Analysis
-
max time kernel
138s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
0ac42e672c35eafbcb910e1181cd9c46_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0ac42e672c35eafbcb910e1181cd9c46_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0ac42e672c35eafbcb910e1181cd9c46_JaffaCakes118.html
-
Size
139KB
-
MD5
0ac42e672c35eafbcb910e1181cd9c46
-
SHA1
050cff37cf77ee806df647851cd1893ca8fb8b62
-
SHA256
9837e4cce07fb2629af3d6b193676c4b85a01dad38477b5b82382dc7bd40e7c2
-
SHA512
cae99ad89ff5b54f0872d622ff56024b5713c6775f33181422a6ca517285476f16754bfc9cc203ccd0c2a42b8c0cb03dccba9e3cf788e86172cdea101fa792a7
-
SSDEEP
1536:S82vflZ/uNlxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S82LuhyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E59AC11-0755-11EF-88AC-F2AB90EC9A26} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420686657" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000428c684bcbd51cf6835cbe37ec31d28dad4541343b5b782e9c39684551488e34000000000e8000000002000020000000d5186cba9e28fc7a60b6631d410a21bedf9c523a0d7d2bef0d76f60b80c9a15a2000000018914f62f066a03594fd831069b53d3c50b90f4074df41b7140a2a4d463735874000000073c356ae1b83d6cecf687f0acaf413c0992d9fe6a11b53005f72945be438dcb457da47959b5cd76196618478c1ef381c41eb85780d35e5a6b2a5a21ac8bc1f28 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0041143629bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000be9a516b1bc30e31f529170560bb0829d78df8b8875fa60325ea3c2ab38a56c0000000000e8000000002000020000000e3ff47d6aec2b4226c9967495aecdeb4e49b246338e84104caf52b86fc76b073900000000bf2c2249311481ee2a0bcc0d6b4b85396c01b90ebb51e3159c24b735d072cfaf32a635c772f0f17eb50af6e633afbeb211f5c75ca5f1457c59e62559e512a7d19d71f9ffad537ed8635dd0b130a694cf40305a54a86e96f3d7267c072b0bc699c22fbac7977007a2f251703b5b608a75dfa513ca6ffb29a9a13099e9ab59342cf38394762414e9ac0f863a0987244674000000077ebf28875527774afb1752be835201c318228f8003bb4c58a410477def6ecbafd066b178f41e021e442ce556e8f07f8685ac916d81e2b352866e93f1038b585 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3048 2248 iexplore.exe 28 PID 2248 wrote to memory of 3048 2248 iexplore.exe 28 PID 2248 wrote to memory of 3048 2248 iexplore.exe 28 PID 2248 wrote to memory of 3048 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ac42e672c35eafbcb910e1181cd9c46_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be77f1d8618655ac775bd874fed89d6b
SHA19cb0e8b249ef6a9e386d321b4599769ec529dd83
SHA2569c33c1edf58e2a5cbced2d30bec53f0db37197e307df9a6f388b27fd2ffcbcb1
SHA512d9d4955a228430ac760cdcc59b368ffefd1db0a1e6e398e3dedd6cade9fcd6b8676b25b19179b4ff843c1b179e0103960f4e454cc23b7cbe6e2a733e66cd4244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5207fd2cc6e3c33044a928e404e9368e2
SHA14fa0f21630b453d70dec748a7f587d2b2bedf640
SHA25671bdc78b0f799ed4af8e29eebecaa3bf2ca404b103ce7bf02a4c573c4fd9b4c4
SHA51229fb241fa20726d9c35220f597819c5eb762eafbdcc1f9fd05c0ff84169e1925357c3c2ff18ea72a804fe2b3e9556e3d5522fb11ccd76e62864a216508dcb52f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551e9c70ccd8e8d28db55fa4defe7387b
SHA15116b3fbdfd12e11190cb040c76c7ce6502f62b2
SHA2566851a30177ebb16d3a258fa9e9abc239efe8cb1cc58279cb2687aed81ea9d5f2
SHA512ae56c67749e7595b256bbbaf66213e8a1fd34681272903d937dce2e167e6ccf2fa7f77376b8b52d922133b828b4f12f473658f22f706cec8015eb4c8e5f69a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b77e9d50844c4fe6c8addf85f3ba728
SHA1dd69a466b688340433d2e769bb04bb6623b8dcbc
SHA256ed0eb1fcc0f74ac95e327df8f0ddd7e24ff1ff20e0411a40564737242b2d7d97
SHA512b81ec0844c9c6a054ec8bfeb46d3b83e5b20010e9affc15d3ff6be7e967ff6c2cb0e57d1cf66a706a8de6e386fa636889f58a6ac152f9bbe61c83bcb39220e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ee6ca2201a0aac9a05413da5bd4f3b
SHA19a353989232ae3c1b01ab9319d008bc10fb6baa1
SHA256947aa60e37a23f7f0d6b45ae576ae1df0f0cf03b2b4f0e0b396b5c3f7929c4c0
SHA512a08962767be7f99b67e2bc93be4fc3a710c1ac8cf47ddd9ce533c7d13289eacab4ddfb9589994ef03413460bf7e99b157239df4df14cd03c410786a838ebec5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a519652517b564f0f6a4dfaaebb455
SHA1c218abd37d14e56e7dd9ceb5e6e61f2d8acb0c95
SHA2561f57963b6ae37277409763ca960bf7650cf93943fdb8af2a6044bd08204b4930
SHA51214c1ff5bcd91da17ec446dfb3a334c63a3d64a4348e1f6822c338f0667100347bd447bc5a7e9b1ff2f6b1d9d4267a5ba40cca6f625464d9a02f45410895eacad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b6bd7d624b83b831005b7c3db47706d
SHA157a966089673e4e6483d435eb813b0844b9a60ce
SHA256d04650f4fabc63b518d5ada9c1cce20ef29ac3d2bdb8e2204133bc7a059383ee
SHA51250f6185f4cd4c09369871a33d1902ec46538ea32ca8118866bdd4c53cd9bfb96f8f4ab016f39b70ff02f3f66502739a5bf133118cf51eb76045776b7bf06d5ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cd9d2c1ac20cf64ed89bda71cd64497
SHA1a0c6155ea4a301edbe86c8f43e8a09836c4f3f24
SHA25628bd72fe9227586fad145de0959a898d9aa9f20cac4ec463d9315e384ae7ab5d
SHA512d45176698875a842c0f03291c011e77effddefdf5e9b767e67a5484a28532316681a2502b3ee488700a5380189de7ac4398cc9f79b0a1543b36c1d8c475ea3c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5705dc5a55669c5b8d22d362545c92942
SHA16fcfba19b037aa8304ac56504897cd6bbd8a9385
SHA2569e1be14086993c83c40fdf15b5a5d37d7ff2086e88b1570c207cdb45f673388c
SHA5129435d5f845d4eccf17f5a54622539b000f1f9ec4dcb0f874ce69a12b7c50ae32fada73d330a48ec75101f1d8298a147962e59b79346cf92fff0a6eb3bb1439fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7beeb9516342eb1ba01f2e18233985c
SHA18469c86dc2b94a6754fd280a92a15511e1d1431b
SHA256039ad69f19d2ed18c667a495785be3158972919b1204cc21629009049d253ed7
SHA5126d98fb26ef64d38efa0694e9c1c83af1cbd64ef7fb321ae060aed6f1bc96f651b9273c42c151570670a5b5b18fe0c267b6eed5fec1a230114095cc9d0e08ad08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca2c632cce6192983d37c3ecb72c21c
SHA144c18da4cefe4261bc185fc27e6c27489a7ff568
SHA256b115b217d111a112969dbf4c48f552b748ffa25442792deecbdfef0d3302fe8f
SHA512595f2e8df24ee1c43d3b467d9149f702729a1dbc8da0c95ac676b3c9f77f68a3de5ec859d8cd648369cc468b458c2874feddd94cbda9e0e7e997ee2692b533e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52227d8323a88c80e5080166d89aa702e
SHA1ea6ce0504e4e6466e652f57ce39b417aa65e4de5
SHA2562b2c307c57f6f1fd7c0e3beaa3abb27e243dff4c1481c4f9d1509ca4beb1ce52
SHA5122d6f1a46ce586d78609a70c763a5ad4a8d0e264858aa69f9b51e5686ff9301b01d87278d61a2d551f87fef4e48299ee827a7ad6f8d95426be5fc7ccea02a851f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db5e875f2a2b2cd7bfa84ce4fc7616ce
SHA18f9389b01d5cc16a1d825684c07ef4938c502d6b
SHA256694ad7141985277360a0a4521fec0af7b56325e571b8029156ab4eb087ac0899
SHA512737bc948b367583c08aa39c778a33ed0e677291a0d0bdaac4b2d87c27b83d7b1f0cd6ed16b20b6bec07a8ab34a6287c7388e7f52d8155c121edbce6f4a89a4a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e18ce83901c9d7f7bd5b23ae517a061
SHA159c99d4147ea022f860d7387253dbd693c31bec7
SHA25663186e4833e64fb97dcbf5ddafa949cf839f5e7666c07581ae84f867afe96930
SHA5122231a460c038c1ae5ba883b10435d476c63b75b7dda2b88d8c928587ab334608310d40b95c2a4ab7d100e366620022bb00ceea1ad37061f25bc87e83b2315e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5529e871e0b94e9b850cc7c8e1ceee99d
SHA18cc6899c6de6ecd764668fa33ad6c360e09ab9bb
SHA2563425a6646d682bdf142ce8d5586c9399524f16a0593c4c0af83c27e7a629882c
SHA51236672d6f0e9c489f7ff186619ee1246c8971960bf2a29cbba530b717c521300cabc6cdfe17f707b675b470663910c307fff4cb869986a6dc182335a1261989e1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\ads[1].htm
Filesize114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a