Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
068a171e1faea95c7b9215b4e8c400b9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
068a171e1faea95c7b9215b4e8c400b9_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
068a171e1faea95c7b9215b4e8c400b9_JaffaCakes118.html
-
Size
459KB
-
MD5
068a171e1faea95c7b9215b4e8c400b9
-
SHA1
e178ee8e3a1de15e4ec2bc07632dd91911b08f14
-
SHA256
2313c62d6b39d4c805404d00e3d44aae4131af87a74773b18d573bb8c84845cb
-
SHA512
7517b45e6a95c1d524090a9380281b8c342d3e60242037901db7fbe25d8f4cfb1e9e5789a85f3e2dc3a7ce47ee58664d681b392493c10ffc9a71a633fcf76969
-
SSDEEP
6144:BsMYod+X3oI+YZsMYod+X3oI+YhC4sMYod+X3oI+YMsMYod+X3oI+YQ:N5d+X3P5d+X3+G5d+X3g5d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005c93231f6e150541a4ccffc3b12c8143ba1637fb4278c21f1e1089dfa147b022000000000e800000000200002000000048535e81b801acbc14b4de7919719a897354bde2eac9a6a61b8f8a0c58e1e5b39000000026ca946dc24461c71b9de9b3e880300b32facd0314d9eeaf08ef2c5226db32bf10f2175084561d2dc944a0532bc8aa8d5d85afa28ad7d22bfb6237d7b1b6595b24851852372862ae0146f6ce603a005021d53930e917be8f3d9d65fd90a5bf7af628244790cbc70e608ae7168ddabe493c421ff93232a46785aaf8acf19e8abcf312180103642903a9ca5f1e1f587488400000005e833abb67bf72c2c175e4c61529c0316c198c3876b36a743d4a8e371b8f18f6ba61d06a6b7ffe2d719ed8e3554d4e34dbba7cbcd582581139cd6b0009d58854 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006fc998d699da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420516724" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8492C7C1-05C9-11EF-A7EB-E60682B688C9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ba221f06c5bbefebb121ea1ff7a5fb3160040965257ff8f0e19c571466b0d082000000000e8000000002000020000000797fde6f24d5235ffe8410afa0e3e390444474faaf6b6cf9e14bc03b0de6b4f52000000083a425bf11de56f89ad359438bdea6380eaef91be3b27e09982e313043e491ef4000000033e91c751100e60704ae39c119eb6b0221c189294c62cc5cb907855872e34a2fe813d59e43488b7665a3db265fbb3e19e3eef322861d8f981b4e3558665c4e3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1400 iexplore.exe 1400 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2520 1400 iexplore.exe 28 PID 1400 wrote to memory of 2520 1400 iexplore.exe 28 PID 1400 wrote to memory of 2520 1400 iexplore.exe 28 PID 1400 wrote to memory of 2520 1400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\068a171e1faea95c7b9215b4e8c400b9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c6359ec2b18c5aa233e68b9e6b93fc7
SHA1b17f40a1cc0abbb623ead1ac1287702213c47d08
SHA2565b2bc62d74eda1a1d8d8de1a98aef058c020f6451688ae765a797de8308cb598
SHA5120e6c9290aebf8afed16b5c5e86449ddb8ad7f6b142e0a72f8a91ad333df5e1120129755d2201392618d5c0d6e22f9fb51b5659b54f67efb21440907d3b780873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578d5e4de8879940b26b62dcb90149367
SHA1c3afcab616471fe1b5d275bbd416af711e5f3b71
SHA256d6ebfe20ac407a7c64e149e8cca9b56609199aca2d606058cd55f20c09f334cd
SHA5120e0fc1a55e5384329caa31fdbab31443958eb0fb025b2a513abc5a2148e12c6bab809e79d3072df3dc525626d1d061addb0c15d819731d6a8b2d94dd21528203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5426bb61ff968c19b782eea5ca8b98706
SHA140def72c521789a712bb2d1f871ae740e7ef2eb6
SHA25678c6c15921cbfb6f9886a33a36899e323dd8121ac11595e67d4d61e9e04f71f2
SHA5120f214e772d585775b01360a76c21c9593a0af4353904cacee4c7e442df5a43a2e11b48584cfd810a5654324d177434c94ab7cd74f98ddb611ae4018838f4379a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52751405ae860dfa6099eb097c71a20e9
SHA1c52bfef1589e8b83090699cf99a51aef2c0433f7
SHA25645e652d8a820d69b729c8cd6c9280ac440d29b9c20289113def7ec571144b03e
SHA512d2f039319dd925eeb44987c7c818a15784940778a7b988e1505df371be88104a3316ebb8c57f748a19d39efb8dad5c367e8496fa7178994ad70b259e56b6ce6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d542978aa8069f8e3c9df1560fb70af
SHA145f68289cff0f53810d777fcc5d8a98ab124e7d4
SHA2566dde2312921973ada4f788c875e872af88d7879d2284a012df2621ccc0af646b
SHA512b9a9185eaaae6f87c6d19edc1e4457420ff08d4a6aec4a91b622f20bdb16b7532c4ccdc69bc2d9a9e2e2eec63dd589ce10c6878b1bcf8372c0a688754eedf043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cd8f46469e47cd509cda5d1c00f3d27
SHA1f485993cd6dfefb099840352401cfbdc0711eaa0
SHA25692ea5fb824d33612ac083e3eb9adb64a2ef57dd30241e167cbe2a54fb39604fd
SHA5121cb9a9c962a6a5db63ce2691c0d456d09a9a88fa8f9c696e3e59c6cdde438a4b03a88798a608125113ad55972791a57671adb90769da01a8999006c3b118a279
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc90e0529c003117e327d054734825d6
SHA1dcdb98b4df9a936adbb9f0f111cd824b4783e1b1
SHA256de4dc3ad23785606a2107038d7bca77caf519ae9fe5cb7dc9373118000a9f7ca
SHA5123226f91cb96f7211f64c6f041580bf1805025c6c7d7ed3ce9f3f8d6e2e1f1b119ed5a8f0a340c95e6a0fe72fd4f88629a0a83dda3c499bbaf87b945de001d79e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c60599ef34c35ea79c4b384f00f4cdbe
SHA16e9e10a224d186b7c5a8069aeda8139306de1921
SHA25689a051ce8e8631ef7c1df7fe881d687c2fce7978fb05f667c94e10b2124bab6c
SHA512606521f08dd04436fb99f1a434e1c55e6d279c19becd2d1ac4614de43c22ade318ecaa6cdcedb2662d34ea6573535d27dbfa40d5ebfceee8fb9d479c33a1ab76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500064fcba40e644a7c92848fea5bedcf
SHA11c7ce4fedf6b69358574bad56b06fa8c92356fe5
SHA2561c8b8d19d864aa097eadaf0df3b99f2e73f0bb02d8bd99c4eeca82a634dd34a8
SHA512db7d71cd7cd5dc6237bad36903e1dc956f37531dea55cc06f14ce481c8a7fb5a452decc5a61ed0cb5c7c95f001a29f4ede19ad4fedfbc6f0db911709e79df8ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca4edac9ebb3e70c8ff51b45aa7b9f53
SHA135342d50197aab3b7d3b2e04c812ed88f00149ae
SHA2561e5399b30a2395682faa8913d8315348dcc7d8f4ab9513fca9f53e8e4d00a47d
SHA512cf2146fc8107d0342dcd0832820e224274e569b90e78cebd1b17435681408f5ba79a3e67504f61c490b5c54496cbc5031c2c6c34b4b105f5615b114873214d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b38b475d210147033cf805cf8a91d43c
SHA14fc0e386fb9673926a9245e60fff18f90ef839f5
SHA2565e3e550156c0d782797392621736e61596fa81449030f315836b3cadaabca3d0
SHA51212d1fb75bf3e73196259d723d3189b37bc9616fb4b9f5c321ed98d8f630242eac57bebd495728d6466e6132dc73b8349f759b8683a6f7adeaf37c13c45642451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52da79005870f6646fe752a5e04c471cb
SHA1f80971e015b969f538555376fb658e4a5eb6414d
SHA2565203f58425f540dfd869bfb89df09c9a3bc667f1fcead906deb1a5aaeeb99d86
SHA512decbb3ce20d54bf81e0433bb735a7aae04972b554395773fddeffb1c0420642143a1c3d7d426973c97da3ebfb8d335c648ff041928af0e975c21d346f162f91d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee2b458ed602e77816970c3e093cffcb
SHA13091f1acdb44a14ad8d0473912cf60978090e657
SHA25659bcad7acaf6fc4a0356ffdceb79e7df570935c2c57b29dbb11487a2014456b2
SHA512b6620155f9cea7304f9e07ca95a0402cb8491eeb8d3d734c048ac81db32b4d82be16c2a6be5ae00b7b5488eee46018547b30583bd23c159a20855be7fcf5a728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566a5de67013fc0f43b5ee99d00dd4a13
SHA19a4b0a5aa5d7facf1569120a3916e565e18155d5
SHA256cef42d6d945609a7753072bce7a3f93f08df74ab63e38c3803809eae5bbd3509
SHA512331dab3300b0fa3a1cd94aa943e905c06b565ce978dd6197458056395962c0d2deaf28bdcd533b611837fcab3a1cf7c585c4baf7c8decba808a6c49d38e99898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541f27d9ad3dc8a9f57114821e7aaba8c
SHA1ff104cddb33e06655b61f1a6ac822dc468332a65
SHA256fe390cb535cfbe8809799d4ab15c53246ecd0a0b064ed1035a33817a486481cd
SHA51215f0f9f532aa1bdc0c924a635d2a52b7243c7a15e2c9d121c62bc6299905b0460bd16f13bfe2805b2b24f483de260cd2c2c97489e09c996593a357446806b854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e059cf56d7275ee84c82be812d2cd0b
SHA10e48fd64dfed37fd8849044ca5bc3c5ff8153dae
SHA256fa60bf1729c692043a3066266ec35f05a1e0fa7dc8bfb95ef467da95a65a7832
SHA51213da720340e66e0789b596ba28927ffee71eb79de52f3b72f15dcc91aef81e156070626f0bf345c3918f4e5cb505bb69bec81f7293997041bc1006cd6aa7be96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566de3ad536fa0db15f4c9c9a5f781064
SHA16e51cbafc9836b50a4cb1bfd52a35a5162763183
SHA2560ad4fd6733f3d1716339bce233d045ac6421a09cf8bae200a34bd6f680ecc8b4
SHA5129089d136d1b93e5e9000cb810ac97d238a5e1f01982f84e33a6a29351183a67e71ede3bbcdd3fbdae679da4b19425617309debfdc3b943853a6d69473522bec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bddd4de040910128fc5283e711b5fc48
SHA1ae1758c4b568d4e08854310f2433b5a197d3ce7d
SHA25657e3cb06d513ff1c06ea688c3c5c7dbcc1edeffa04d72224745cb2ae82db651a
SHA512073a043b37662c79dbdbc495dd06c6ca8e3ab7ead658bbf39ae694bef8a0fa599d9d9da49fdb6b49d349de73f9d55d693225d4e3096e29fedd7fafac7c5c443a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a