Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 12:30
Static task
static1
Behavioral task
behavioral1
Sample
07abd375b5d77a69f670fc76f3a4aa79_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
07abd375b5d77a69f670fc76f3a4aa79_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
07abd375b5d77a69f670fc76f3a4aa79_JaffaCakes118.html
-
Size
38KB
-
MD5
07abd375b5d77a69f670fc76f3a4aa79
-
SHA1
fc90603d983cbc94ad7083320d790708fbd0fb1a
-
SHA256
9c1d48c8dd65190b13c7cd69ff537d5c639a2ca339998be9e8bb231c97140bc6
-
SHA512
523c139eb035bf914fd12d2086c7f14b8dc0591c559377e09cfb2830253f072a0cf02181c5e697a8e52c5d81d2f9b2e83ade33076e10054dcd8a6270b0ff99de
-
SSDEEP
768:SFf7jI1C8CaCPCCCKCgCoCWC3CtCrCgCJCRCGCnCTCcaBvDsLpYgZp:SFf7jI1d/C9lBxLCAs5WitKsivDsLpYg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000592c965449ef08c6293dc307e78f30ae6b1346a2283d6ba7f39d7d29c754de82000000000e80000000020000200000002b50bf624f1f907673b3ff97dac668a99ae3c4f37fef0a7ecc31b9e8e5652b8a20000000f0211ff6c959d164cc78e122a57319a01eb4786b284983d7577a48ee1e39d0ba40000000a60429cbc7b55c32d966cbfb29676bbe38af355940222d9438529b7da61dbc512db4868b0c7c28b38dba022aa04067b92c813321bc62b8ce607d274a02c54039 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420555698" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44B47081-0624-11EF-8CD1-FA3492730900} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000051de65a726056e5e7c29d2f8f4e616e96e45dbf14759385cd7494f873d04d5e7000000000e80000000020000200000004509f1ab545cbff70d12b5fec08f9590ebff3de9301c91dea53d3d0597c929899000000090851014006b2aa32d938d479e5b25220ef64a50bf243fe1eb1025859690ec62d25aa4747f62c84e36c8ed55c00eda9ef9536735bdabee9b483200a23c780b16694d7033f1fdbf13c09a06c7f12cdd90c9466d44866c8ac5a77b542c09a6276b2aa33fc31dd31c250f5e03f0ef8933274e20f35fd08f36fdecf68c9678d630a7b302f2c536b2d2be13095abf49ea735b40000000fc66e406274afd2a1b7a0575af3f512af70ea60ce599d23808da2b879f6bd0745cf24fe7df9ddfeda48cb2d552913aafa4655b18218c2adad41616fdce339db9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3019c819319ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1728 2208 iexplore.exe 28 PID 2208 wrote to memory of 1728 2208 iexplore.exe 28 PID 2208 wrote to memory of 1728 2208 iexplore.exe 28 PID 2208 wrote to memory of 1728 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07abd375b5d77a69f670fc76f3a4aa79_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c1cb4413362a23f8f90281d98d6e48c
SHA1c419ee5d48da2471ab0c0286cb32f9423c9678ef
SHA2566e6188a9544069587032c0162d8863b0cfb6b64e4dbda3cee378a123c6fc7a6c
SHA512b0aef9a879642fc673d1b29ff6f9d1db4b9de7e6bc138d8c09523135a4b2f47e75cc4c8d705f53cd2ae91292126d4526be9a4ece12d061e22501129a650006df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590cb6530910372a98863263904dd51a9
SHA1928b1165605dcd1fce34a2cfc7528e8eec401dc1
SHA256b60a5695db27c50102efb9f874ee21cd193dd039e4a082d43fe1c00708ff13dc
SHA512ce98e2451a5a5010f350baa1d7578b5f1f4c53749b3acdb550eb38664ecf549ee765d3a87764dd871c871e9cc05e199e5bcf0ac596b43874ce7f9db9e03a1aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59389dbff58ca42bcbff3feb1b8b22e04
SHA1ac69a6864de0dd3c035cedf5ec3d0c2957149429
SHA256c83a2654bd074d715e0889cfbc9b288c1028865898153b9e82c19872c5eaadfe
SHA51276fb11bbee8257225be21f34af9c33dbe8d8b11dc731e1ff58337a24defbd1553be9eaa282ed9c849ab0b3061daf68c0de144baaa1debfa258596a44f553993a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a53b7a041dffa2f215024321eaf0cbd8
SHA1a90a5d26c4eb96713efd76fcb1b23a9910a996df
SHA256587fe3d5a46f5b8849f725e7aa037a5c407a326365eb0930b9d5276f352e34c5
SHA51203b8f94c2e04513cccb8437571acbc31b8650f586126fe383acb8ce3229215dee23a57291d76d7a9dddf8630a824e611c8e10c9af257400655430c244963c44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5543e6992468957a6b8871cc7401e3
SHA13f976c87be2118f60173f16aa69fb8b6d62d82a8
SHA25686c9b287b48eeed93a122f281aa1b9163c6d06fbb530dd733612cd0cb17749f2
SHA51248de1abcdd7d2c70e430ebfff3d99ffeb963ae563c17d0adbfd009641347163428ce64b85ec460cbb2198b0b211562afdb48cbb22a0fcff0379ce1a458910ae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e084409916fdfa1fd55ab0de06a49a5c
SHA1bf740cd8d14929a29f5a47a702cf38da0005c893
SHA256bac44da5cf99a6bd17483612a724ba134ad7a75d4284417d2d6a2c7458f00a9a
SHA5124010ad89f28c5e3fc34254a65244b4b35d13497a9f86f724e82d82222317f732d303d77b65136e956958f95a7fa43de7c9fcfcd1e1b145b81a11da08134c7814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c6ccbf809d863fe271837e16d85fc85
SHA1ea2d5496d7898a93488995e09d451a82cfc06ab7
SHA256e077999e8f163185d08db1dc357392d5aa63cddc873157e76c6cb912ad6d7007
SHA512a66c77750cff902a602ae96b780180906b643e0563431b805d52bfd4c682bf112fa8758bcee7da5558e46d59418f2aa1210ca98aecb914d80e790c887eca2721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e8e39ee574cbeabd4667f8ff0f69d78
SHA1118503c761ec9594e2713efa82b77fabf8d5cf8b
SHA2560dd95e513627d0f11498dbee04a2a786d71eba8c747012388b3a9f7fee6f0a74
SHA51289b1bc7e3b3e69ff67e599c3282425a64912a18611957a9a4d6db767aa3d7f88bf416fd7c939d0082827b2f047e8847e0713bb42f627625dcc9c541f2b93effe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f28a4b645aca2cac8d605d723c8389fe
SHA169c2e364f824c16356b91fbcfc6c48d4fc657816
SHA256150ef329755b1d0d59b321c8e55490f5a6c7c9feb6d5246f4b4fdbe64cfa774b
SHA5128203af2cfcc06e59ad98db6fde771c5b2d20faf3f0da5ecde15a50208dd602f6c28103e9856f5e1969f517cb92b47d274cd9d23656a62c06084f681a0939c234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58473ca242f35fe8fe89cae5c42d1ec87
SHA19d66132bba79b357f71ea0e265169db5c244171a
SHA256558854d0992d440c4611853e4d8de7b5f8ab31c3b38ce52f6ae02a9ad66fdfdd
SHA5123c6b36b5c6eb0b7220b74fda5b96ea0d35d6600c02b06f94579ea0765ba46d0ec19e7ac9ed4543f3e02db8abc868685eee0652aad5cf31e6dc64046c79ae061f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531a20f5f4ac2c65df78e37f7904cc8b8
SHA13d13f1c3c9a3398f10124c2cdaf30b03bae68ae6
SHA256edd2bfa7ce5764257db55275d3d0d8c1889e017b966d76290b60f3785660a62e
SHA5120d730aeb70d0f5ac4266cad0d182d441caa73c32a97a3d24ec4f7158a6a966d391105716ffde723cb6e46f6303f4c8b87d507e2eda2c3e8e3b9731ac353e1f82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bf1004c821d041771c573d9db57728e
SHA174bfd1339a1a5e30479157e67a451bf1430d234b
SHA256c2743521dcaf944ec6b25c5c3df5cef8b3dce27d917368c4257486ad8372eaec
SHA512e8f5f4507409c232cf50b50bcaae4d4a66ff4e96776ac1265d3a0738db20f4d304c720197ad3309bccbb1fbac621e807ce6496565e0758b2ec71d9ec427c0b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e01a81e55a30e77d7a8c9c10195aace
SHA168478172b36913cc9d45f3172a071a9899907433
SHA2566998df62049d9c7bfb0b8a615f179ad1b79dba2efc79ab9852f0b0f0e9d7d3df
SHA51204f5374766e2f06040f2b81941b572d7b2761dfac653d22e3c374c30f1c8e7b99492d5baee46b7c2b40b63f294744c71cc3ef04c14ae3396d6bd90a335154d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3d17811af951b0b572167dc187aea76
SHA1554253e65acee231da7443e3ddd94b615a6e9bcd
SHA256170ca370fac2c183a04bb4ea5f38352d027a5581cbccd0fdf824562403e2e8c7
SHA5123e98ff158b06af330636e6fe428ade3e84ef8e796b5268aed0f92f168f7bc91574b1310c9b69ea49ea84bebcc71e41adae7b74242ab756cba1161448ad3485cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddf962dac5ee8f8ce224ae242d233ee2
SHA1f989f784b82f56666ed37eefe68ac87ac9e9cc55
SHA2563cab6e4ac6b266d698da0617b8fc13d2503f66540a2927eec4e60b4a38580cff
SHA51205682518fe5d05a1ac63f9d961703816399165dc7c960c641fb4c7e175b87085a16af6146143325217f37caf1abd645ba98ffd448230e9372e7495f6723ef079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5531b5513f2fa0809e43012a02965a617
SHA1f320ad312e58080ea8f4d45d7d479c95b70a0446
SHA25664c5cdc259e30e7b478fa6d1e9ca7ed151d4bec841fa5dbb53f9c3c07d3b3cd9
SHA51253d0ab2ff6c4edf22d9705422de0a91480059e118d36a131547ccb50d2969bfd59c3f399b983d2543522afa333c1a2020f541aca7ad8c48ab70e5cadf02ae93a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524536ab207924d3202a16b4ed1716151
SHA144ed2c17963ea9e3b0f1965b0099710815080dbc
SHA25671fa3cad6712202f695c1362e14f106a4390fbf18d2d94c48ff395a251f1e6fd
SHA51246d67abd89d8ed291e042ee8921d3d0523fecbd1e981d0ccbb7ba0585b56d17d044d4f0b08a17aef2f739eb2a7ffcd55104f7b0f2e168cacf2f575be5da42d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5354917b1af3d0798ac1bbb749a920770
SHA1a266f9581c4cb7f044504caccf045258673f804f
SHA2568efd7eef5ec732f08f3b2527287e87e193cb4dc6a7a783896bb929dd180c42c4
SHA51236c08903a70a96e1dceaefdef58562b3e76974ffd30b161559b134f32d1b17b0b8356a3e62ac6f601993e8fe2deeb235b2589006da85fb0bad8c195756b5e982
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a