Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
064d7a8fdb0de801a8c982f3eb6d67b1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
064d7a8fdb0de801a8c982f3eb6d67b1_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
064d7a8fdb0de801a8c982f3eb6d67b1_JaffaCakes118.html
-
Size
12KB
-
MD5
064d7a8fdb0de801a8c982f3eb6d67b1
-
SHA1
9a1cc25c016e19807a3c424107555ed28c0c6a8d
-
SHA256
b56976db27d77ec289c7b7a15f4416c76cfbd92d221caabebfdf5c7b3d630b9e
-
SHA512
5fb141bb9a9f3cab8c8d2fc75b82da5415473f8aad27c7442c2581bd253fba03fce8a3303ce1ba149537e89ca2f793b3e19fac886683e43714dace6812d817b4
-
SSDEEP
384:Cyi+I3JucIfddhQFAiSb/0hMR2Dor4eIf:Cyi2fzhQFAiSbshMx4eQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CF55741-05B6-11EF-BC57-569FD5A164C1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000666a4602a61e146805f405c38792a6623249c871c5b111aebce250a9245eaf4f000000000e8000000002000020000000061a6b69ee278efde299391a446d01a47b44d6a1ca31e100ce9672b89fe6672190000000d25554d22e9423367794e167a1a9b6f6e7c81c05e99e399d67c91a1c9853ed35c041cd365b198ef2df3c6843d2a5bc7229bb7b29eb546c48114d6868893131ec4fdef696aa6a4ba64a02750e859ce600435f692bf46f79db3db46f2a096ad57ed3a62a4bb60eed9a9c272d3a6bdffafc62b6979ae8bd3b631f534c43e91e3ac2b545f52d9b7dacad768cadb94f46c6b2400000003d936cd4dac47c8f58771e31cc5d3ae6e505cf9afdb5c5bc24ed4281eb90c5a07602559152a3b1f60cebe28d67197d9da999bbc37e4f7fee103a5b311e6e0b77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420508495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000009f846287d4c28dc531b0608d115616422a0b6240f33dff759cfbb6cd7757ba54000000000e80000000020000200000007c3a3f9398217406c4c2143cff3c7f9799f5522946e555f9e1d6d3e57258dec0200000000dfc7f7546591f589d30826d9ea36b82467c879f707537b31c02695a6947170e4000000069d2c9a5d067c9cdb2f0218ea62ef88269356dc44b7a89d9dc43d0ce6168b8654599f08275f5e38f4dde11690507394e0948aa75364465d57a19c22ab33221e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d001d231c399da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\064d7a8fdb0de801a8c982f3eb6d67b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556536f4bb9e0276d8e5bd3340e3f6e13
SHA112ea56a1c052c652fcc3de91dab984c5adf314ef
SHA2568fe7c2449d3ebfcd971ed0be79cf6d2c691ca9f3ec788d3e938e985a66b0902c
SHA512d5134a5f198ac6ea6b2c553d621c5669878a54e57934403daf45b2a4d7fa3ae98002560b72d7114155bb350d20eef5e6bd5ab67b980d923c74cac8763d7c49f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5accb5f111774408466f7bc0e71d00a6b
SHA19a1c7bc2131e2be871d919f4f1fd980810191ac0
SHA25657c0aa60fe4be21fe4a7b2d1da2e4c6832aa57d83382925a182844bd49f5f793
SHA512f3bd082b35d702426f188a603ae37196d990edbcd35ca5b1d550ba8b04a35e9ec7271cb9b1c6d74e665083ff8821acda6ed77dd4a918b13f2d2f0b0d090b4031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d68c63831d007d58e3c58f8c30a3840
SHA14c8e3b7c31f5edf971d8d1c05d156ff951f85327
SHA256c4c62a5ba57bd949c0dfbd135ed5039973423010d35e11dd2261227c133e07a8
SHA5121f149865732781a498a2d15f75095c0484898e8957517c2a343ebee8788182b351c7adf7f0bc42eee89462996589232af0226ba87608001ca7c6d0678cd381c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cf55db1aeddfdbf954078d8481d10a9
SHA137356a7050840db432558dce110f77384e877e02
SHA256173e2609abd33099b4988f98197bc508e2f29507bad262707c2db3261d144cea
SHA512cca5b34502e79c67a17641616743ceebd065c4290650e03da429076669b6c73d63a0b0dd81653ace352822a8b5d53d89385e5b9282c389c9b4b1ac8c703f3160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa9dd8c098505faf9a2756e432ec9733
SHA1bdc6fa56a5d5342f1807d4ef6f06857a1f493790
SHA2564ce3385b5c53a8e65e4fbd80b0f66ae021c316f7bae80666b9a93371d038ae76
SHA512073fb4da7872bc51836d9d07598aed68a8ba90c641aadb5a56a31cea7932bb852088da6923744e8c2b3d9c05172dfaef227a0c66bd5d6e0554dab15761f3709e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a43ed81dbec9d3cf88274fbcda3304b7
SHA1504e5397a37aff99959a9088a87d37fc0a945cac
SHA256311a4c5fa3960c919c211d1d8530ed4bb38d277a2d89b2d09bcc3ab4d3ba4fe1
SHA512339ab889c283a96977313a815528c0158660c8678455ad204bbee07b642026e831c5387c1054bda4e13af61994649f2b379b554fb7cf545980e6206f72f57618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d42a996a186ac758968ee719cc256fab
SHA195563ff1bdc75e383743e8ab56e6ac3a114e19f2
SHA25607b2a1e390bf3e22015dd3f3665c54df189a79c14070334d50f66126f7ef0924
SHA512ade226348361e7316b3fde253571b0163b292136c533dc3a6015959e24686b1d8761e43db5b60dc94ec07f9ea6b292e8afee704b1ce86dd459c10c6d1eda23d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5973c9c0833250703962dd472052a864c
SHA1854eeb1018cb241c3c29ea936dd829cf13ec7693
SHA2568b8c5ce0ac645221e73a602717b079b804c66d605f1d3b0df4deb4e6c71628ae
SHA5128f66f08c95a1dd060700d55ca7616b9619069cd145784a0b248ae146707d9748417d0eb2feac47f77d6df569a1325064157c92f7b260ebf7d1e5e2d198cd5134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0baf10cd4f66ccb305148045652540c
SHA12d6e35a9934b2bf02da01d4b7abfef11973a2b47
SHA256b569197d6e02d01e74a38517d179f43ca70db1f71caa2cadc7a3dfd3a107ddeb
SHA512f6f8a759b3b627f28352b43deaad7c2b133e2fafb658481799729a6dca9778bdff626616db70551805e2d7a4d63e4b6ef939e381e684c74ab7f17a764ffe0e71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d520b4e961d6d3cc3b53c8e8d6c76cf
SHA112476ae4df352313992a5cbe64428d0a5c046e06
SHA256b20ede398983346241768f404d751128aa6315030eb5b49241c88a3edb4648f9
SHA51249e51693fdb4f16a2fed7620b8f4abf401816104c2e602a1692df5e1a09b7f9e379542f925d04e04bbf177598608aacfb7ac8a4313d8b3301b0ade9884c7946a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d2581d9bd33afa102812dde622035c
SHA1dc71f74bac5a88aca999d138e34dd29b3b6e8f13
SHA2566f8f034247b25f6e04947dcffc22666580f44a1866c19f1be744e03818fa1026
SHA512fad500a2696520e2e362d348471bcf9fd7bd62cfe062eb9b6178bd179db36a17cb8d44600651dcf3e1c34011daf70d9a2ddcedb6ed41066c15bb3171e8904bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8da735cc1659f639fdaaddbf329c6a4
SHA12a380c5cc4ed9c04c26aaa73b0c714f4d99b6724
SHA256792d166599ed4b2e322fc2bbfac0af0bdf17064402dc60bdcc8de5f26e36bc5b
SHA5128684f3da20bd320b3a3bc8bdd018c87e1f3d9591ad5f9e99a7fd8d1a389d035eb883579131124ccab17528a0aced45db7d91a4e29665bc10e562cc6567ef997a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a996f98f7a25d713cd45b5da09eebc3
SHA161102d4a67e4c017a03750488d188a7f6866762d
SHA2564d9d64f8a91b75cc84ceef767f4b66ec8f5d81022616ce187331fbfbf14faeee
SHA5127f86f4f3aa41e0966f4d675f1c869e581926d8bc6ccf67fb99ca1740ba4f0f6bf7ad4d5609dc36a544c8ea84f9d527ea480dc7cd35ce2e7d124178d5ddba05e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fac476f863eb6e3371b67ee2a25ba65
SHA14f83f03e3993dd9b8bf143c29ee3eaec9fc9b124
SHA25676fc0eb3c1d088de3141b75a8aa69510763dba16df9ed3196db1bcc5fc5a9d9c
SHA512dbf667d84a3739dc296c406f60eccaf5072b892ded7177765c6874743148e1b6d131f9ac7720d0e3871729e599c4418b8e84a54168e0930bb3ae49e0822c49dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8370f36adda62ce3affe86096168a69
SHA10b1c100dffd9f7a548445f6b854b557a5e67c481
SHA256b831ef6c3e9ad10e5baa9a659987404445b716c0fee04d4c3535e679c7fdb034
SHA512354e0430cd3aa1642fd97f4ef8de449a2005c8558eaab730c10039c3fc25708b03ecb209727c812b4c5ee52c78698136631644f1a8d6eb0c368a0be149b95165
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542f76b2a47465936c566a7d19956985a
SHA1aa347795c1c54c5e607b27a605a57f6c0ffd614e
SHA2565f5363006241ada73f98710eb1cef301fb1eee5a6574eb5fb477827fbffced0b
SHA51299fea804a047e197cfd922627023822e84a82ae1880cad1336b9d9b113845b620af5dbf6e028ac9f3186a3abdefc8b242336cd0d09602f419d6e6a880c944621
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eae0ea6f2406c11ebdc595b568064ca
SHA1ad4f9306ad58844bbf1ab8537f390c678f23e1d3
SHA256402ddf3804beaf8f5ff98dff98712afaf3006c9f1ff204142040367f6d31a4aa
SHA512e2dc60f9f2ea9875450e109e9e2ab07b35d12adfbc935865c6814e058bd3c8869bb7192b5f02642fb01a9577dea4f7ff929257c25048bd1b6e86ec07c51750d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f209059b8d364ba7dc04dc69791e482
SHA1faf46154762b9e09c10820d357e34e0189a1dbd6
SHA256a290450aaff51b58372d782bb2dffcdf83852fd7b9a7ed34baa2309f0ca1e2b2
SHA512a96991a58ec566dbc01025af4a7a4306a11454f497850a8a4261868f259235aaeb47e90facab41d61cbca3827964c9538fb1ed1757f018215245c7ea2f5a0b21
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a