Analysis
-
max time kernel
136s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 08:18
Static task
static1
Behavioral task
behavioral1
Sample
02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html
-
Size
348KB
-
MD5
02d03a4f335d3ad6fe802a236d39db8a
-
SHA1
54412278ae1e5dfbdac9b0492f89498d45826230
-
SHA256
14b3966e7745224b4e1af720283f3a1bdbae700f7f3383c41c91ccc6fa59d65e
-
SHA512
7cbf02ad807cb6407c6a775aa2be3bb821654424d56886d506cb8e5e5a3c8e12c2b674f24f7ea0154702682968f4a41266410802da55458fee3e5950809b01f5
-
SSDEEP
6144:ysMYod+X3oI+Yn86/U9jFijsMYod+X3oI+Yn86/U9jFiI:w5d+X3R8mU9jFm5d+X3R8mU9jFd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ab463a8b48b1aa9d47e8aa475ca5e52cef794f59b069628385cea7bbcad8b5f9000000000e8000000002000020000000935c624e59188736e87804ebcd986540189c9c888babdc9e2d2d3434e61639d0200000002e102e7773031f58302e848f002c6a3de18f68f69f452045767ddf07746bbb3c40000000baf466a287988a18caf491132fe58bb8ce85b5a48cb661db2d6603fd63792f062eb67d21bed6d29a509ed4bc2c509bb9488910697677b1c410d8bfe071c15b40 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B646CE31-046E-11EF-A296-4A24C526E2E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420367770" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1095aac97b98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cc8d0aac94405b002607cafd0a1027bc6c75f253804fbb605ce82ccf5fe022fa000000000e80000000020000200000006c74b45675accfde86d12faf1d1916f81df8b5e742cb46b5a105490603165a4090000000b602b239f3d62a4fbfbba191e51310655bc0e1f424084984a64452d14ca446a74984afd83801f4f5c373f6d0ed8bd0f163cccfdd47a5a7f481aeff7362d6f57fadde5f68f38a1a72ceca91a3fecd6dbeb634802668b04d76e92ecc87d50bfe78b978036b2952a1a830cc1c44c2a78f4e9dddae7d5a89cb74e2a6501c88b32d0ce0922dac4353b23970d13d8df0b62cb3400000006f19aedcb78c38343b02425420144339c13da20718c00740f14096c384b97883915a743466237534f7c1189510a13887a2e0c13c4c4301a44a42947acea3ab24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02d03a4f335d3ad6fe802a236d39db8a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a427abd55e8efb56c92e782466e845dc
SHA16717cbfbee1c9e7db383e67de6a963480a45451b
SHA256c923fb1f7f7a31c14c95580151713c0e663ee8b8bdac777c81a0b4b04832006b
SHA5128660667de743efa61b683189044f167806abe93d4b9dc3ecdd7865d6ad4ec84eafde3fbcddf79ff7248b9f302a5f35308ae858f2fcb36cf0a3fe3435d07b320d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a9a48d81e4c9e4a6452aeb9805cbf3
SHA1df14585b94e26cc813553a69e4dc75d3355bd7b4
SHA256769d79bf22131874217d0301eba187e021c864207bebed14acea86ae4ea16090
SHA5127ed42b86185f8a54ec06ba2dce9b708907a50467b111b4c5b4862271da3b8e3937ec50ed2ac7debeb57d94ca5ccadbaf90e53c8fcee2a28bd35067b40001f3c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b9bc16358e2f47f79362a601a598eab
SHA1a9a7738c864b37a923a68aa45a0b9f909ccd3fca
SHA25689c50a1f3d021d01e42bb1b45ef4b021961a815fe797b4d1c8025733c706cc5d
SHA512a20a3ada2677dbb0244114aa914fcc60c5bd7dec573bb8a76f6982814b231560cfbcab03b709f39bec054177c174f7757d51eacf802baa746471a2307115b7f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576e6f0f3ee356ba4420d3b8655a41b7d
SHA12ce058af105f5ac4649682addc744e37088d7c11
SHA256fc30bd006a0da23d6b0e15a6be70f14badab972be10bab47687fd436e7b1133e
SHA512a2ea03c05469f0cca4a129cd85328ecdddca987c10afd39120ec0ec3497b64a4b912869dcebfe2c6784afed6c412776b1dfa4720756b74e9e1c9839b53903801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5330d32c698f54be7c1805987f6dc8177
SHA1dd425b39f85ca098b6ef265f440a4ae0e4b1eacb
SHA2562ae1ee0d33a6669f14eb783d397a422693f81ab241c788a3f426504f54610a60
SHA5124ba0475182efc625bf10a94d46af0efb90489ac8d626efaaef3722a7b29ae85111f6e14ed27569733a595b61cfbba65f2117bf550a113c9486f8a557f3373464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ece44d7ed61dafaf6ff2125844ecd57
SHA13e17bf679384f9b9b2c59551c6734c5552397129
SHA256b40cfa3deeeaa6f45888016b1fd206af7e562198a7c96697fdcca68fed1e1e98
SHA5122819fffaeaac0ba4683041e1be765ca5a1e3481be7cd0c28079c496fc0665308c78929615efdbb6e39716128e16b70af569796ddd1c1dcc96f73031f9eb9c811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539412899bc0165410673e3244cb888f7
SHA1deb57bc79886b1992565559277ff282167b5d62a
SHA256ba047d89c556ac786159e9276aa21b5ccdee4b452953b37c89d1782360107017
SHA512b07f7e6c7d0b5ed57f4f97b085a29739a688a63df16689ac0a94a36ba925adecbafd7e8f4a956a1bd2e6cf39a421d9e20ca17e4e34423b895dfedae5bb39c6ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5251515fde9ed56f3daed68cab5b71827
SHA1a073c70a7c8238fb158cb433f0481d771f3ec45f
SHA256f06ec51681f9822260d7a7a7ebfecd63168b07ea035056dbc7e037ccec6e246e
SHA5129e01597d27d429cd3e50f058c919fd617771460a93d3f842c454b2346d3cf77fe3dfe81a4801b9aa66eb69c264918b26f406a0523ca120ebab038f1c973ad02e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585534dd17b76e22f97b34bc1fe56c080
SHA119605919ff3db38fe25c9f086eb2144c491055b1
SHA256a424f71da4ca753a5fb09a73477d431e3b144839380ccf2850631f4456c0751a
SHA5123a866ae41bb75d2eb22e18782c9bd7d5390334c5dbbfc8ca191c0b16011019e70c63fb788be34237657b9077d37502a4da7f53423c986c980e3363241a08e682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51be0cf9421b1d39e5699aabcca7abef9
SHA1b6ebf95526d49da3b50cbb2fc292fa30196cd7ff
SHA256d826ed83e257f51b1ff5a754fb091ae19fb5029ec5960946f0329d01cabf14dc
SHA51261e4d5603c1dfe525aeffe374694b5163a1ed99e0bdc5f2dc76d9e607e56d8c6aae0f916d43358a5de8eab569413ba4156d28f9c166a1d0e6c96dbf4b389a1a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1568d87a2f14d7d0f27fa87e0550f57
SHA1a2ea644d44dfe2a1c580b0445f73214149dd1997
SHA256353c523415ce250c854c9e317b4ed7fdb2fd53d9c23eeaf66c56433ec0593a58
SHA5126162756bccd21af59798b8255f3a127726557a89faa7a8db80f0e53ffd3aec714a863db65d2e901a79675fb7112c1c745c886b5036adc9c59205cf14b3a0c8a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5669cd464e748d276c6dff49cb551baa1
SHA122c46885f99fbb19b64ce9d1864c03ca4ad45095
SHA2566a2a7c77c6dc18a52711157ad6b1fecf1cd10c23c85acb1a226979997b47ec66
SHA5129d4d70c049dd58aef68a8704b408cbea777a1129a08e58aed214f907f5f5a8916ded2b250e566aac99c137490524a3cdbfdde78a66755b356fe8161ec518c5d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5038bddd844efcddf2cf2c2c5e5bee7d2
SHA1375fe29d783cddb8aeb808f535200a775fbf6cbb
SHA256609be937f8d100708cda817a754374af3f5bb2155290e5eb3c4f64955a808901
SHA512a95d5adde394def35d6c7f3049a37edc84b63bbb8dcee44241fa82264a84bfbffa36ebfe3bb41b264476032f81c4a1a073582ec0c1780fae0b635c624c0121a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc2f43073ff7feda317a6b3f065d6adb
SHA15cb3d8a48266a35aa7a95ab54abc3cf277ed3a3a
SHA25605308f51866033c5da3188a850972285750dde1c839b5a223b103e6d37ba600c
SHA5122d2cee03abd17dd8481ebc345a0dc6df4eb000e34cea1fbc7e43f6fc2c3047647d88a78af79b016277c48a8fdfa1093b8dd0237b3a7211d01a6633d89f71505d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e81455c30ce9eda5113c66a18a6ff00
SHA1c45794763b14596860c9eeeb4dc9ac04814f0c68
SHA2569c679b8feb461675976cecc0078126d003c580abe02b70bd2be01885c1ecb657
SHA512f9f6d5917804b0c5abc04917578fbf67cdc540f0c1e771d4316fea7edf97163829c86244ab5b2ac01f03eab34b8896849f128bc5561be9cd773a09d2e6249411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a553e49f5722b0a58eb605bf00951697
SHA1021340f5f80bb4763ea944674791c9f50478637f
SHA256df1a801e643fe041ba53f71432dcd5f9f50e9e4570ce2e79cbf40b174f8b24cc
SHA512a88d51d0feffa1f5efd7168313da4152196b0d59d8746bda3a369e144ecd90e501d9f723b6e83382a27ccdcfa60b79de6c72688355c693fdadedb3e9773fb763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5588dd348339cb0e3ab137f0bff7b8002
SHA1cd2e2586c65cd167d4fd706029ff85163d952c67
SHA256bd09a5f21b96abc59f7797a29df0515949ed8c3717c7ffcfa1435459f5afc5a9
SHA512797625e9d20dca3db26a02ea48ac8a09a7bdd4cb55de7580aaf1f8c658dc9dc14eedea0fd2f3927ef84d0f0fce4de52d3b33f4ad49415816329198651bbb78c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bb8702493464e5260a090c7a1e99b82
SHA1b926ade02e68f72e4b548baff102a2a93aa685c8
SHA256053a4c1eb5821a70407d5227ae902180502eae1d8bce6ac437858aa29bb65d78
SHA512d8c8d0ff22a36dbd467b6b3104e62c85bb34e1404260d18648685665a4e12dcc8df112256875c7425e66c844d70a15b0ae8f8b2dac5b591a01eedb4955e2f086
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a