Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:31
Static task
static1
Behavioral task
behavioral1
Sample
03c5cfdd7569dfbe80c4d974d83aad98_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03c5cfdd7569dfbe80c4d974d83aad98_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03c5cfdd7569dfbe80c4d974d83aad98_JaffaCakes118.html
-
Size
460KB
-
MD5
03c5cfdd7569dfbe80c4d974d83aad98
-
SHA1
7533b244f848ef25ad549502e90bda4c76fd5a38
-
SHA256
ee797e8f2213c98ccf9a2bc5a5adbcbfce65105d66699b6486c50b38cdf8d80f
-
SHA512
1abf2b7fde7edc161ba748fe1cdb6bbcd465ef94507f6738ed4c6ab473d04c014dc36ce2547fa88606e6de581a3d4915fc546f3b8a12feeb6003ed8520998b9b
-
SSDEEP
6144:SBsMYod+X3oI+YmQpQZsMYod+X3oI+Y0sMYod+X3oI+YLsMYod+X3oI+YQ:y5d+X365d+X3U5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f86faa693395c2d4f0664f4ba808fb160341002c5f0954bc1b94cd865382b648000000000e80000000020000200000007a5bd8f1e11b77015ef7708030dff55a1af46934c6f0001781317feaa34f637f90000000f3efde5e8ab5d3264b58de3cfda860a609be861100aa79468642e7f09306da30f43a344bab696e026be8439a19bbd43450ef8fc7a169729ce4274f67fb1053cd52b0a66b271ec636d7b0793fd185a91ceb5b4c946d6dffdf7f78de9d5d774ddae21448ea1b7ab9c371dcf8b35632d5eb095baf01ca71f2f0bbe2047e1bb6948a2ca4305dea913fb4ea2aaff5538c001a40000000676534654f9ebec571070bbe40e881b5a5ae8c79975ee5e8369ff06cd434dccb0a70b645b68e37be03c61bcb70bca37eefb37bc2d9babda1baeafbc10f24c428 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420418967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E847BC61-04E5-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008bcec0f298da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006fc4cc55f74c51118b0781254381bfdaf4d505628a0405a0bd33e10921cbf4ec000000000e800000000200002000000009c25050e4919e67ace2326325e99e3fb2153d6833c30dbb8f2d13373679332d20000000f51c792d53fdec2b18a7bb0c14740d1b9d7cf0a08fa75e8ee45da6ad78981129400000009cf6ba0ada722d2fd31cd34196ae39c7f3cc9aa26f1d015c781bf5e5a775d05b5b0a97a9ad788057bc2e6a0eacb5dc8bb4db7d9896e98769369498e6e3300551 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2296 iexplore.exe 2296 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2296 wrote to memory of 3008 2296 iexplore.exe IEXPLORE.EXE PID 2296 wrote to memory of 3008 2296 iexplore.exe IEXPLORE.EXE PID 2296 wrote to memory of 3008 2296 iexplore.exe IEXPLORE.EXE PID 2296 wrote to memory of 3008 2296 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03c5cfdd7569dfbe80c4d974d83aad98_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5212afe2d6335c81b0f348c5bbcb6cc20
SHA1106f98386a0c06c3659ec66b0c296739530ce4cf
SHA256b8a9e15c7bbbdb83d0961fcdc233d9f0b882cd5dc64c528fd15abc71a1f287ef
SHA512627d3473e15e6bb540602981bf048bba58f789e0af68ddd2bf77c72c69b2da4b6a6b504512873f2d01fbed6a2bcfda017a3fea4d9a64e834231a5332bbec45fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3d432a36eff71637556c25de6609639
SHA15a14d1a39db8ff79d6d4a84d0b81a7580c6741e3
SHA25691cb16d8298df8a2cca8c035a5063a90b8a867a980a6307e24ef0c3def5165ff
SHA512d28f208c8020108f308e2414dd5dc4a368b1a52fca1975e0c3a22c11177d3ada6c15443588e05ed393403895d277938e7fbe955470b40dabf484aa156910667d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591f04cc49f031b6836f7c43a7cdb7443
SHA1f2fb5d8bfa734b2512f29b8a5e199739a13740bf
SHA256c9fe9527361786c1cf7ba3c4ddc0344a8e58a6d5299676d90197cf770719f3c7
SHA512e731475b9f10be970bddcf33cd98acbd0b45c5c7c642dd5fb28851d7a6b272f3930879347cf17cc7ed949226b4c8641abd77d8408cb3f25a74726f8c2fbe5ce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53852dec1a0c11472a005cbd390630abb
SHA1bfdc7586e948ecf0b42cd957dd92f20be1ac00fa
SHA2561b2e9aad088ae05032ac13a3dc30fb80a55014e9fe25561b5a1872957fbdedd3
SHA512743ad5d4f1289d9eb94b33450be6e68d86c8f7673eb5ce4fd7fcacca5658bc40226adfe0fccdbf00513b18e8ab1817c5073252faeec50a7606a3ba38103e764f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f8a5c615e80a9eb1aff6224a3483b20
SHA11bf9e70472a00efd0c0495a13ac35dbbbd1dafde
SHA2568f454b3a58ebb7a6431f65a8d3299fec5070a657f70de6c1d7cced37d9e7dce9
SHA5128cbc319f8bee595b670cf611f6584989b08f1ee646bdcea0fc2d2558a84aeb0731e60c810a409ff4894bcbbfb6f2a9458fa382043578b123248a3f4265564dfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c6f073d071ad13c458d9953526709fb
SHA13fd98f4b08cada610452f0aa5c346565dba6f1e4
SHA256aa39ce0fef5e125f3a28c04f4946f9df748f1f33b870bf4abaadbd50ea14dcfc
SHA5120235c3b0b78ba739821dcfe4fe653324d88d3db2c226411aabe378f8348feb94cc889392a52c66a3fbd2c7966c8eefb5d3329b5754737cabb639c43c9e6db6ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7692c14ecb6fe7b843c7080218853e7
SHA1a4a15fb435b8ed28669c74b01445e320beede62f
SHA2565541af9b89d83d1a29a8f5082d66eaf2e93f8203aa620cb1c2bcbeb3e07793db
SHA5129e8e27f2436226ac877a68c66938b597ebc72e312aaf3ea6fda139c0c52b4fe3f65652332377e28ba13e2ce2838740d8423da341e65c4ce8ff0e0943a8f02c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58380332e2d1797aa4b4100d1f923fae5
SHA1fb960ba0c57916485b328e6dcf08d9d3bf79bcf2
SHA2562c75571c47adf8bc080db6d9c952227f89777b6e550feb2cf5081e4b94d075eb
SHA5126f13fbc5490ae6765a3a989f2dd84513bb8e370bc27da48f4ef11cfbcd8eff9d2a7aad9967eae2887313cb6651a700492d748a22bc4f556665510fcf759bb52a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dfa14746678f5321e1225ed6df83428
SHA12dda087167983f076850dfdc7309665c2fc5b9da
SHA25675b26bcbd75abcbfe14304df94b3ea5624e9ad75ff1a8631f1c2e0462f2caaa5
SHA51282e5734c8202f6d8632d4ff527ad76953685ef677435d2eefb1db5a64ddab47745a1b6c44b4b3c550c99ff59fa0cc0e98802566a74ffa95c92787e4d585b45e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5908a9ad2d204e63f082a2c2ea0184b9f
SHA11163968dfaed361e958e95684f793b26606d3695
SHA2569458531634656c8e337b609d1f3702f8b1443b4249bed0715946117de08897f3
SHA512fbd29abb982a99f535740e6563c16a11e75c673752d7298e13eab6c23caeffead48d5dfa63fb29952065f6ca0fc2e56618814e63731057707be9833ff2341ec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539102f7f2ee380620c3b4b956f45d120
SHA15c778791555a2c3f7cbff12a066634be41eb6ee3
SHA256055dbb137e4cb53db239ecfe6b7927b4fb840c1ccb9166a590a84ed2a535fc5b
SHA512366d4e51e054e5c7cd976ede8453d0452a70de8972f77b2c3eca136d76e3d8e161a7385ac884319b7b3a98fee6f93967715edfdc2f8f1931c1486b2ac15b42de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d00095be470100ca63579e8cbf10a425
SHA16b8b7b38ea477fdc573992824a47580cf8bb80c1
SHA2569edeab606730eb460f14d046fc98e799d96073d00e45dfb8bffd28712b1079f8
SHA51201590f6d201d8b09a605338bea43de574e4c3580131a557b12c65035c4b867f44324b9ed619f9878827977d11f74777f857d15781d4b5b82e82162d125054298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b394386385b9e8b6786bed098a03133
SHA14bb8213cc23c3ad127300286b818535b1ace5402
SHA25670458cb64e3127de88d20452b69a5fdd8b7b1b0ddeedef180e54343cec1dadb7
SHA512c0005d2645c69530e550e88f1d876051abc65ce54b9211eb348be595ac510473a56a739106a216cfbb0f4a13e166fe8f6e32043c5cd2d89eb6d509eac852bbc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac2f2f6dcd8561cfd49049b8addbb346
SHA1e02cfd6b42ff3a2de4ca71a08a812d5d3292ff63
SHA2564e75fd2311ac154223451499f1309da4c4412b8b916d856b3c5146581b4b9c7d
SHA5122f6377c40177bb3e2c02abce6b22689f24764d516a498ece6c02e643dfc262779ee96977edce4501667a751a7d848a7aa4d8fe9bbcf46d87c3ac42d11acc7bb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5216f0076c9dab7f3a37d9fc7c0a7f3bb
SHA1a214071b1f703310eee697d259efd031f71fc0f5
SHA256c4f6c460868a76a50817936f25ff518bed667cb8aedfd1782c393afb11181448
SHA512eace044ad15c0f18bdbcb6e59b2169491053c03de4d7e719492826e7397ee90a1a5fedcbc54f2728db5126f798e1a3422c0cc3ca66a9fb6b1f8a9e9b261eb663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dc353dd6f60355e33d75572c9cda656
SHA102e4041197ac4376183eddf3c55bd0bc002d99e2
SHA2563182e972459cdcedad11ddc89b9c62b07631484a26436e9d6f4a17178b97486f
SHA512861f44bbb26c8963c6cb0554d93bb2c9b9876cba90b0b917b9c7032ef5d564e6bd5d2c1b6ac16c308781adbd238310d14b451f3bc6d9afaaa6e4299c897bff51
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a