Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
09c77da8931417533d3d2f3210115f00_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
09c77da8931417533d3d2f3210115f00_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
09c77da8931417533d3d2f3210115f00_JaffaCakes118.html
-
Size
69KB
-
MD5
09c77da8931417533d3d2f3210115f00
-
SHA1
e62f09e8cd6b998613a120351afb5f65153f3a73
-
SHA256
53e4cb63b0fe053912bddd98550d0fddc6af8eda3418f699730d48dc6811691f
-
SHA512
0b1729304f433dd829135657c42129b168e5af6a9f81903da633931074c541c8f80d7cd6d334bce2cbf27c4ad822e8aab2bf7e29b120e2c178613e78d10c8c74
-
SSDEEP
768:JiPgcMWR3sI2PDDnd0g6siwAoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:JVrTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a279b20b1290a10e2097cc4f0f2576e274376d0ee76ed59f9259fa5be2235be7000000000e80000000020000200000002e67af34edcea33602df061715a7872acb22e1170f7fcb3b3d162992f794e7ba9000000048ea59d334794244d6ee102bfba7ec869c2676562510e0caa0afa01b4c6e3362e39ea3ff64e7416a82ad1e6452182d16994088301975ff82dd60a8b9abe702dbf0f1639a5f311183d6d9e8fb48a373211cd9be56981adbef4eeaecfa87e5682b5e08daa6010e8e9e5c775f23efce5f18c642e14a34f73e3f0e30dc9a77cdb6c3e4ee489db9e9311acb1941c3408209c940000000415761a328155d7d9392ea5fa6261f84a0348ef003184d59dc3b33521cf95887f79222a15071ff806e0b8f63d9546766f415ec98993869ded05c4edeecfa3857 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4006946cfb9ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000052b37c925a97b13c90371e573465e7b205293574e8de7f94d7f471d34cd5c4b8000000000e8000000002000020000000c6c294be7e70eb279ada046be3676dd9dd443fb03c432ac62c6f32b4260d18d220000000dd8492f52d364479ec08a3bb080c1dde96762ad153280908031af5c3d75258ec4000000098fd4267e016ba07a81be9e8673d456b5d9045406d1cdb302d3346ec8ecd036c68f2b21b089a060ce7875c4af845c3d6cf445bb5dc9052b25c08a10628fc3475 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420642597" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97EF2CC1-06EE-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1904 iexplore.exe 1904 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2504 1904 iexplore.exe 28 PID 1904 wrote to memory of 2504 1904 iexplore.exe 28 PID 1904 wrote to memory of 2504 1904 iexplore.exe 28 PID 1904 wrote to memory of 2504 1904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09c77da8931417533d3d2f3210115f00_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cffa214bad52882cc5e46a6b3babaf4
SHA1799be08c931890cb5ec3dad8aa2ea3ca1b79a060
SHA256afea5eea54e7d7368347f08fc187a409dd7ff7f7a4b9a22382d8c237b2167d30
SHA512aa2e3b37512a3ee50099e52169550ae1d312b98990d10a1c20254ca3565035039481fcf2d7d1e27a9f8f2cdb8aed4c29e0668f47b02e85796d22bbc6a49ed021
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59de060c1884e86891a768e41e9d7929c
SHA12f4a6223b1686be90388fe8250dc85bb6da5b7ff
SHA256c53649612ebda4adff82b3fe4c664b887df0317f3ff4f3447425d159ac4349ee
SHA512c794d95c81494ea5a494574f2cc1f8049625481372ec1a73c991e4306e639f3d4917470f1a8d5e8bd1da05b6cbfbd7b93b1492872eebcb6e7e0fbccc243d2a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514faa211af1dfd51450a3e9c0565cc04
SHA181d0db89cf3b65485962bafc3e5169e1bc2efd8e
SHA256ab06f03251dfa8b38ff9c09f27847d3d3cdc298f20056038230a2874a36d3d82
SHA512e301075d4a1502618d631235a42f1a94e71c153502fcd6713b74097b3cff91e4f4711fa5c2a1e483b0ddf21c29b395ba6abd3287b34883db2924341e88a25820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ded010fd26fdcd2f17cf6767ff5df3a
SHA1c32b23e40c3f9d79744c5b15289e768d249927e6
SHA256f3cd89090fb0a462425b39403a96aa60225bdc40b0fc101d372dba27d2234def
SHA512698ff68d9419bbb12170171f0df02a3e650898f4ded37077d745d2a014f8ab688058f55f5a3e9fcf8d53e734731ab8600fafd0c09e814d0a6e949eb9de61836d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f68232cda5a0ba0a64d87d93c1609a12
SHA1ded5f4cebd0629f17ca2bb399f34353429a7bdff
SHA256b7c09c2aeb03c0d9bd47b78fe176acd7ea142209ee371f7e872047da73eaeffd
SHA5121bf71cf45c56aebe80f0ed619361ebfca090a4da8db88e1455669a4316df7fc72727ac8fbcc87275c013259f37b225e9d6885bef8b21e51349d718a9948a61f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a96d12cc3cc3ecdff20e215c8e5e41cd
SHA194fc1980c01caf9f64a819f39ae1d0072a65d778
SHA2562ef23efda0206981d210d0b757a7f5f38de0bf4151225d885a666c383247283d
SHA512be18d51af327da91d22f6094bea9da49df281d63b32ce700cc1c594f456a19c3e24df19326f8a62be93bcf573fb6cda8cac9d9951cf0deb60728e31cee7c0b83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e86b41062ab84bd142ab0211f89062c
SHA10eafd5916a1947e82504fa708b5a5a80532c9d4b
SHA256062ed22e8650736d6b5cb8fea016fd80940aecbad899bc5ec4a24f994dd534f7
SHA512c66a03033723412eee4c728d06e116d578b73f20e90fed6914155b1d0b9a013a025c45845653069ebe7d73cc2614d5a27d5890df9219a5509ce1f827079085a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56224797fea114e623a9b5bee13d657f6
SHA15925315569cf622bc716ecec349d5b9a77acfda1
SHA256f95d98f7a3433117fa2a33bf1f0b1b50a70c94a8a0627749b89b11ccb7a8c735
SHA512d3bfb31502a796913f23c6cd9d58dd79faf1ff086902d3150b18ca4078613eb96e22f205833fc0242fa1989cdeb76226362f529503b46efe4638a48aedc66a90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5626086c347d2bea24f16892b463a6cd7
SHA13d225a25d93121b86c7a19f955289aa02e98c70b
SHA2566ba217703519cbee71cc8e064e6bcd75693ebdec46e03605ac7c33c58020cb65
SHA5129858ed81420235dbf5895d47743bac5365619d8875183e4246d38255d5668ab760033847d2172893ed424fdda068f286d748c139048eb1009ddcabe7fa8c171b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b6662248165c2bc7a237cee75666e3c
SHA1c032612e7f50ddb9892ecbfaed1817b1eb83d00a
SHA256b9290bcc4dbc66caf33c569048837697e75d15ff92496dac5ae3a8aecd699841
SHA51209a613a26d1f45e2dbfd2dcaafa2241cdf68dd7d54de6763510692f478c2e122f2a1e42584e24fe36ea336de962afa4b118c14ab2f51eb55567750eebca3d374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5541385769ab7cb709b29f6870e475194
SHA11f506c21548db5953350bbcb0722ad44bb650b9e
SHA2561fbea240919b24dd8cd7d543f42f3eaebb4688542a9883454f0ae662ee37e347
SHA51224dcbc16d1eb8b3b903d326eecd1cfa1cc74318a94c36ad44a67caf484825d906a6f31625b6b71894120b2ec3f2a9630a0bb85739d4e1096a061633588834404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aed34ca696b8525dc21f81ba5738834a
SHA1315fd25e522b3291c300188bf952c0409f5a8a82
SHA2567f89e1a4ab281895095d7302a2816f5a4e7fc6527e033cec1db467f4018913ee
SHA512b7e910f856526c1ee295bbe87773bb23d98284db89bc722705164d2546443583093b716f89280fef869ee14cc4fb473ae3824c4a212efdb7f2a43e71b4975b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df44dd9acd62c1c56bf7275ee675aef7
SHA13af4db00cda018f8ff34c25e64e448c10140a07d
SHA256de1dfd97d5b6a1844ab6cf824445f38cb6735f5eec4a61ef538d22fa724c9884
SHA512a56d9ca1f9bed41caff298502fe078120536af0e7adcc800a35685c0d950750c022d6dacefefbecd5884018b55b8963136ce12ec821a792d685f7446d58f0fd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594c13121ec0f093b47c00842d947f0ac
SHA1443e5ffba1a6088a184ab096ae90bbeed863b896
SHA256774fb767970f11f1d4337a83636ed620724132eb6eb779c9f1c3c49e3d023931
SHA512a2dfc06f965b3575e20cd6bfd547ca1d17b45d0b408e2f9188f5ff139409497529034d9c3fe44f0fd3e3dca4632e48491f15253342e32025ae7a5d4221c0366b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e46aaffcc47029707daf2452085ff04
SHA19fa56b499e1cc13ac9fe577f0ce20cb273b90e22
SHA256eb665042e966556be17aab91fe3f577c645e2a4c7ad31d400b4b6407568acb79
SHA512a156925fa99135934697d54aa745f50081eb7d2c9e0ffb0f8055d317575d03a1db35de8d75503a6655393f0bde58c711ea1dbdcfbb5701119f34326c243bad3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5717de238704ba254c0071078c230ba40
SHA103ae9924feeb41856a6be4e6784d1d49c33cee57
SHA256b97049be85ccbc1eaa5d7be23a1a066c3eabce66635fff191f3ec93e9f867684
SHA512ed96e5ca7e8b7586fd97b5516f3ff71f4ebf8bad9045163efc8daf68a1aefcdddbd888759427fb22743f122c80cd6c7a30781b36dc90d9432e4cb03825dec494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2c75642a1ab611a7cbc8ad6bb2072f3
SHA14cf6eaf846600624eb202c82738d03f64ef9a676
SHA256bef15e949781bb72997b0fe8adc2fef8f893c1dfbfc07bdc9339b0b66e35a7a0
SHA5128a73060a1c1c89a54ab9c2627626224b1aeec63855c04dcda71f3575e7d89042aea10e63fada2b93360dd1bee63d722409355141f723d8cc42f86a49432019e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595086072557787f7ecb5bec193d12324
SHA14b60262090047c0074222f5994cba3db27c8d22c
SHA2561fc598ad800cd2229fd29f67ce4c479e7f586330f9a171829858d2892c665a76
SHA512b0d3a6f0943c91bfc06338f118184e3fe494ca82834f5e533cbabb81e2a1d82cfa38afe211b7bb60dc50b3733ef27b7ee4c6fa407cc4a305ee2e4e2b2decbee9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a