Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
0b6fd07efc9771fcf08c2c896cf38863_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b6fd07efc9771fcf08c2c896cf38863_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
0b6fd07efc9771fcf08c2c896cf38863_JaffaCakes118.html
-
Size
67KB
-
MD5
0b6fd07efc9771fcf08c2c896cf38863
-
SHA1
3264fec3e98b573263150f21b8598655ece012e9
-
SHA256
9ec67fe5cbec1420f1a66647ca464d271b439cd1954ee8476f79547995965348
-
SHA512
6279e4172d6276a91df70f05a3e6b99f4c8f25972958dfbca41ffe3794e07b6d1ba39875afae87fa93d66fca65fc2d4a5027accc5a6dbb1d0bca63ef06d9f302
-
SSDEEP
768:JiXgcMiR3sI2PDDnX0g6LaoFwdVRoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JxkUUTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9905DB1-079C-11EF-8178-52C7B7C5B073} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02d417ea99bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bca8def2d8648425407a6757b8acee345d3f99592804342319732d0cc1f54a54000000000e80000000020000200000001219422e8b5400a3348aed8aa0dcc5b755ed1c04bdb32618cbb60a404f06da6d9000000021a02222cedab85b1633f4369d8d1db283d81b6091729c1f5b53faf1151c925a891f86a4473fd724ec0034eb10a33b2c22cb8ab8d0b177506c9eca2f0610d840570c285d88b11e456e36b6f84106f1ab61a0d5f6067fb34f0b801233f1769f54ac8596ff9884b6f26d6a783bfcd3734f501af6b49c20348154b56cfe84e7697bbd6230221ed1285c938f896c64493736400000006f6c4c474b58b8ff793b974f3fd866e174cab4d7b82efaeaf0fe7660727f7ff11cac7f76079152caeee53cf88e5c80cc3b4573e47ba869efdcdb666e1fabbc77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001754df4295e2f30fb5b96c2e85a800e60630e0e0c8da8ec617ed59854aec0dad000000000e8000000002000020000000b620848dccad5ee706f222c88ad14b277de1f326abd628fa7efeca3890d5ad59200000003fec60bb949e22a25d8fe730f01de9ffeee6aca3030a92413999661573f8626640000000a87c7f0b85b71922eb3d14aa9514c1b465b1500cec8251c45975a1b5a6882d94f7f793fc5a8cc6799ce92ce66f6924f7dc042300253765a8ed571b73e99b8d69 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420717358" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2784 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2784 iexplore.exe 2784 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28 PID 2784 wrote to memory of 2748 2784 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b6fd07efc9771fcf08c2c896cf38863_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57273b923dc9b96248e0f7aa26164df1c
SHA116a549dc14d084b0ac223fd286151608a52c1475
SHA256f3a55cf4fea818ff3ee6eedd4bed0c0c04a97b808edf1c2af06093508a1bb633
SHA512479d0437899795c1be457ce710e5e65c299e30228b03612ee4f85e37a7966201e0d837c56c293da98ae8a50bf3fd8e066bfc1a394b61f5ea2a31ad103a9e7b57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bc59d4637f73ef2ce8ace4765c646fc
SHA1b5e95de4f5b9ce75bdeb2dba6048eaf84f8d5b40
SHA256e8f3e8ffd564f4d87ca850b3da49ce30d10abcfb2b6f0854308d312843f32c6f
SHA512405fa4eb039c3b9d28a2a52d875b6e9fd8abb00bd3ab1ad36cb7c254bf3d3012f6069fa4fe37f6ba6f92ba4ea5c973db3ada2226b0562f52d6b8dd1b7da7a0de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aef57e970c93afe8b867990b6abe874
SHA1c62f644f6ff7d23ddeadcabab951448307976fff
SHA256d5841fdb4e360a3a360d6375f5b860d34c7123787e5b2215c5b4740280b7eb7a
SHA51206680b8a558fd7eea352af9954d81c6220961ed32d09f847080a82d4e84e5e6d3ae0abb6b1e4cb3b79557f1ef306cb10f539a2454b6cc9d0a0e3db1402d02c38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595bec12345338a3a607a0a1f8088f13c
SHA125465b825c0e46eff2b5626c605da6caeadaf46a
SHA25668e12751ced140db7d846495d3399f8befa142bbdfe58f84749eefb795f6d309
SHA512e926df535b6fc9710077ce58bbb7d5c3d89773dcd8c657da087c6f3ee0e9da8fcfdbc5e128535b30e9de3d030a490630259f5c4906607180f0993031835412ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e644652ed2d5797e422f20c6788cb4fe
SHA12c8bf7f734d6fd8ced20e1cba0364c6ef2d92948
SHA25676bb0883de836835a558f875815012a390b5e1616311e0e48c28a0234e6ab02f
SHA512edb00269233b86086460e3e7d1a0aeb809c6f7ab3582bebc4df5d94d3d719ebe49dada11c2c2939ad58ca5117690456e350e61fb4b9d6d1118d87255b5be7441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb26436bf19420fd79e60985950763ef
SHA1dfa711604fc42656ca827962f59c016f55627a19
SHA2563fbb82ccacc82d910d862f54743697c7b78533b4f93d1b78406104213229c77d
SHA5128212b084e522bc18d2941ffc935c943bfacaee21e11b7c50b8da1e783f5dcfcb04982cf0918f954c79e6eebf989c105d57c63be02000fb6312e2136b381ef81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5793704185734fa1e6d76006a0c8c48ab
SHA1bf8ef168593bbdb2dce2113e9cfc4ba9ec7bed00
SHA25643d162d08e9b7ceaf9ae5910993ce2b49c176cfd4f4a7acf1a701908f14d8e8f
SHA5125d6624fc00070b3e86b770204574f38057dc02412e9c22238e17eb691475785d6bf5e144ace6e53dd23aa75df2ffea630de1ca40ac127e3c493b3dbe94abd5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566a3eea1c5219c700f5d95264e1b484a
SHA15f8b71cc74fcb5a11379509a3e96dd02a569abf3
SHA2568b7bb32f4ead8705c761bd340cf10b21d2d5b5d34fdfa06d7e2567668865f9bb
SHA512327e7592a670c3066b2fef7a6e58b4df69397c70c67a340f881870b07e5888a244c819303efe9c7d2d5b7a12d8b42a6ffd3440db1cfe48fca06454c1bec647c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c1b3eb32eff83b0970c91ace6f9dae1
SHA1b53b05a3c6174dd6ca2007bc39dfcc2363e09f9c
SHA256b1bfbc0c1b1197b7a6004bcf46f022485991f0ab60bc46d1a7a096ed82c753f2
SHA512bcd87005424f30263b4a116ae28a047058d46ea07f555824f50462db4f8619ea6f9a435ab861f1b874ab41ce2283243daf9e6a92c323ba09712b3889058e7518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ab67119d2915b76deb42bf4dd0d5f40
SHA1e2f2fdc11a1208ff3c5ec0cceff575af4ef7c2cd
SHA25673d1b94946b3cb538c4977452b90498391f6531acf84295e69be97e6d3e088e7
SHA512b89212aae3477a04a79f665005a034529de42a5ae8beae6045d66cc13c28b70e8a1b714eef4db2c15c547842b0ef9e950d7c5444d3c28304001b576cf802e0cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58effba71712ecb715490a1690a602d3c
SHA13d8374725a83ba1a292342b58ca50a702ef35c19
SHA2566e883e223340c8ac903c9483c99d954b778ae43533a5ce576ed28af2f797e3d6
SHA5120eb2211bfb46a9e0c3154aef8aa0b0bfd65981f0e85ea23f0783c64ee642baab1a0b7cec5464a9cb1b69915e9c8518a4e6a887b5e3add5c8dc2b810a8abfe648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a743414d0b7ca00d0dbcb581fb820bc
SHA1c4cc6253af2922e597ec345f3086bffa9d96bb77
SHA256df5d6bc503b028477e3054e591cee1a9732fcf41eecd8c834dc48653a084e29e
SHA5129ee3d13b2f1a418c694635d5c9d80465e5bf76fa73cbee14972f1f4e22ccd65c2ee7182ac0143eab58ade6348a5c44ffd087fa332163ca7090f1434a6aa63723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7e10cd07752991d6ba17525decc9d5f
SHA14af086795bcd43e719d830f7bab7e80def2bcac2
SHA2566d22bb1d54b5d17bd4c5544354976e281de3451cb226879c18b7c29584a706ec
SHA512e8084c5e1ba6cca38865e1aa754be41538ebf33ccfd711c8c8d0a4bbe9f986cec9d7cb4cff70b6ce06dfe94411a23bea363b198c4c10683391ca779f71dbe7ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fac5dc51c62f617282e0c726648a1987
SHA1c98dbb7f5b234b291278c5d1a0883ec32b3a2b89
SHA2568d0344a64a4794ab3c7710cb90dace5df2167c48bd58565bfeb339be20d41c17
SHA5120e0c461df1de8aa2bf907a8a139f20bcce9618be6c7254cadd779908ac271dae3fca8adfb83c5935f5c3897e71bffec4a0700172befd73739657f0a219fa8c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8a491479d0a352888c85d219837717f
SHA1173c6ee6f935231232a14200bfa42d0f83e220ed
SHA25642e691f5a7e13bfe47941a3d04b0395d8feef6eea751e5b5feb35075d59f6c7a
SHA512bda1cdc4a5ecb064e1ae2da08a73006b48b15d73d5bf1817c249f0bdce1d091c4a297e533b69fa9dc6cabb12578628159669242663b371ca7b0e9311374a1022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ef9f73578cd84af327cbeba4cd15903
SHA1d19e2c98deec7710e43bb959c8cb929daf5b8efb
SHA256367e16b7670470cf1f18c6fe09fe65aabad10bb05758fd908060dfc59d527349
SHA512eac5a08626b91079442f3a421718f69a59127a0bb08ab8fc9f317c02d8153b130fa1fdeeb936ad9c0bb73bb15a83fe4a5c7ca7db23ee96e87cbe980b45a08235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5314268d32c42e74e66f0fe648cab7f25
SHA1aa2066ac1b7f80bb0ea2e5aafb4119a773415442
SHA256ef8afe9eddc6aa60c3f8f7360c8ca61240f17565e652f67c5b46d8d3e4e3c350
SHA51274c35ccd6e7d3a874bfe65331256f1f103fed550ddd1a3203c77905772005876fd79200c571e5774ea3b9ce9c082224af72b23401c5d5933282f26a9cf0f8602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5492214b7f7c8da967db9849145d1acad
SHA1fb8c6a6c87cf9a98e38d618fcfec358c69e9c24e
SHA2567e41bc58ed48848112a9d49732d2c3816a9dfcf16998397b81cbeafaf3a89c72
SHA512a0462febd976108cdf31eea9ed61dd0530caa2c682fc5111fe553303e1039354fac3e88b8263badef2318cfa7d0d105f0e016b5739c7f0c80ddb7f6de148c03c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a