Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
0b92f896e467bc22c7389bcd7ce729b7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0b92f896e467bc22c7389bcd7ce729b7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0b92f896e467bc22c7389bcd7ce729b7_JaffaCakes118.html
-
Size
462KB
-
MD5
0b92f896e467bc22c7389bcd7ce729b7
-
SHA1
cf6e37ac4483d123e2078ebd594a73200a9d0de2
-
SHA256
fb9fadd334f9901e080e9d5548cabc4d985aed84bebcbef82a6c1ad94e9cd478
-
SHA512
d227559824df961ef4a5aed12d27e7d44e40e54654b7645611d0411db1b8f6fb81927522658c7cade53895bb311259f8f060acc99a60151f41d64254da31fdb4
-
SSDEEP
6144:SfsMYod+X3oI+YnFsMYod+X3oI+YEsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3H5d+X3g5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b79c50b39bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007fbc14683c062f84a8c320532a67c41e68b18e90dd4c460383021d24f5d00a01000000000e8000000002000020000000be7221014785eb32d4d49254933aee61924972b917458a03b21bbfc4df2cd67f20000000f48124a968ec0a556895b21938880f5bc4408532c103d69f58b59f43717b84a9400000009cf9579c6f9db571d976c91d3627ab529e74e17a20c8c010cb079dca3dfd13e57d218b24be6c46412af81f49fe8d4fad4c41af0311ca0fdcf64e9b3b6cca1f08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420721570" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{781D81E1-07A6-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000772713cafbdebf21330ddeb8906e383c73ea08e61847760a417b009bd3bf13c4000000000e800000000200002000000051ff67a0ce60eb6271057c6e6311b23651408878328c7b00f41bbeb2d1293883900000007325494f32584b0fe6e170aebef98544015c6418a1f1fa964de0c5d02f6787ca99d02a6e728f4d096cf59cb5a518227d6de8b2653a4be0de9d3cd5560ff0554bebbb53aca4c65fca0c73db9caed6ab409be22e17c49f8fbb7479a7749cb726acc26f0d6248c6325e0c102f610485ecc05ced16279678a511f75db8a14732b2a97dc2160e88d590193aee24d97aaa934340000000dedcbc9ffb55f87d0649379a1750d9455f6cd67097db8523987d43396cea700d1f704549459be789b53068a39c369e8f88f31b031c2e42344143425a9839deb8 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1860 iexplore.exe 1860 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b92f896e467bc22c7389bcd7ce729b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584fc8037f25e512f99a9940d851bc720
SHA17ed3eb06e43e4c5f19ca165b3afb6e8835866947
SHA25698c40ccc43da2e80dc04b047c18bd44190a4c7c10bd1db9f6f79265ee3045f51
SHA512f0b8f6856bf434996a63aa9732df99ba06a9d8f179c6ff140f37bbe965cc7290eade1306c886241fd7fd2353848cf6921cc02b192697e2a5e38761896f76abf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de68f821bf8c5a3492db03cff63ec198
SHA17d2f8c6ed3e50518e950f80f691c56e79b06cd8e
SHA25636fdfe5f334f3f6e2683004bdbaedcc6e0511ff9980734c8316432e747ba1a23
SHA51296af57721be64e75e50439ffa5461ae23656ee50a6f149b16723d035ac8deae0f5cf30496d7da20145bc01df3b5bee12eb0c954b9ce2b04c8d5bc9088c6667de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599181798a138c14897e8e5408e424a85
SHA14244aabce2f6c7bdce9e148cb480e6abd0a42cf4
SHA256c400fdc2ea055ebb77dd612c7e17ebeedea0b54536089af592a76de2609f433c
SHA5125f9327f11d96f44d6d77c7ecfac955a82162f8f5edcc556f6f690a6e479267c9d7c8aa82ed2f775d8d720a2e473c05d9bd14a1c11d153321368d0b79e111cdec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c45871f031b2506d11a172ea7cc8a11
SHA1e401b62fd970de9e26afcc47b03863037de4625a
SHA256c53438a33904a0455fd3e40f82be9cfe8d8ab0fcb4941e4b8d165e528238c14d
SHA512747e3241c55cb882f51435d1bccc51c794256adf13e17eaec7b4570744935537c9c16e504306fa6e25fb4f7ba7d43cc6796bbd1a2a93ae54c4e93596407ece0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd72604172237c0081e4246b10e13be6
SHA1c3e0c81fc8fad97d3966e2c169536bfcd4d47cba
SHA2564c7a7dc63ea0c1cbf52c17b7c58cb29985f732195864b3640b4a4fecfa3c0e4e
SHA5124e814265dc9cd81276b325a4e6f1ae14f564dc6ef700e8211942e1910f61f4a1e438a1fb66f1f8892b40f12bf2aaa3bcd490890ca744f4b0edb5a810f60adbf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518dea5d46d6485e98fe81ca626d067d0
SHA153ccb4879daff016d27c8e7af855fd66e27b079a
SHA256b70a39132e2866eba5260b9be57e81fdf75e4b766c02cf4fef3f8d6091c4f129
SHA512afbc13c476a93fa630890f41135bb30f2bfccb6e2b0600c39563e1240094a30d4623b36bfb9e14e19bae728aeb1b5523245d20a9126c44110a4fcf33ae18ad9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5225973e37a6546b566d42529156ddf00
SHA14b1622ceafde0a70724c9e78b6597def9bf67a85
SHA25643ef8e8cdf07d590f7ff14a7d7f6306cbffe58e9686331fda3c158e613126d4f
SHA51267126f5ea6fe731d93c10147620ec3d18160b4fcbf30b3d2b7af73bd5d8bdd792543dcf4886767e8555a6da822db6778b07072859d726c5b3f9abfaff6632bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578c6f1ca0dc46af1730d381b6aded956
SHA135ae597cba9464c1cbccbf06bc9c93daeb066f97
SHA256497d8a544d1f4d620910daf1800bcefd4212faa77b0ca8293d43c3b337f3a404
SHA51234aa61e7a19366656d475a8258108c2af3b3212ba38ae2588a61b81d8c42af53d101c82debf135233e5facd3b486311604eb0570d337a532f317d778d063e399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503a0c64bd1d3f502d2316a968697a59a
SHA1c56285c213d4f8476b9eed97885e2ffd2ec6e1eb
SHA2560bc4a1b35d2ba59722fe2283e8df247163f95964ada220f452d508102481d594
SHA512aac778aa66693ae689630fd829795a10d836bbea1c2fbb7e07cf725c6f865ce0e57f47a072bb5655a344406e75d4767e0347d7fa542b78e4efbb5db9ac2dd0b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb458ddf7c71f60e266ca4d5c0569e15
SHA1c2fe849f48da8b1ba3cd0d367f9e55c972d99257
SHA25621bfe49cf1a0b4f2fdd671988a54f82f2e76095708c61c8acd6e795bcba71c95
SHA51272341288d9a47a37b58f8c60abdecbcece147feb18b8c0c3ada0dfa913773bcb489edc31aa23029a6229faab74ff22b60e3aaa1c93d8a9d459dfe9ebc091a910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5926e05ab2af65c7e1d9f91747067a979
SHA1d230019b7c82c7cf993272c54f1cb913fe9f4dad
SHA2561daa61f4d360d5dea211f67ab619e89bc9d53b9a5c398b6ccdd810a058b062af
SHA51215bb0e8acd16cea1a0efd0f5ae172c5a0b9e00b1085c831b8c060be1d9f14169af8fc7d299ada51af97ced23ff54a2ea725b4be60a547ec418e977ed0f0756bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cbc4cb1d434463aedda36c4473d86a6
SHA161976ace7ad3409a75f985dafc136dbeef38054b
SHA2566b29fd26ebd7658ce047cd0780372ad47a59500fe0c95bd0c03f62f2d85875d7
SHA512e73b0c89aceaabc79ece520355f456c425426f92c60d3309f576d511c3b708e7923da8bf4670fcea64c0b68faf406c835393025e8f9df2dee430826af6723f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f69e998675a4ccbec8e6dbebfc5c9d
SHA10bca1e57ecea69d0260ef31bc908c1109dce6c48
SHA2567b72e0ad4799720858f5ea948da8364936deffb0402202c39297c59e21a865bc
SHA5127a7b868cda644dcf470925c1ed12e3d4610348f835d0590298a480fb843e2af27c2e407a2dbbbfdee58865d983b0cf2345c6e42f8d4d3882ea729d394b4be162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5445d1cc6a77059f14bf5101f32c13503
SHA11d4e23102bceb8a6ac4e90a05c3315d3da29756f
SHA2560d9b288490993027344a1d4e5d40aa3e2b441b851ed200b6bcca068b931cdbf7
SHA512987523e21e43b65f8f1307c9db79693da0b96308a2296c0104af934de082f0dd51336b8661aff8b2e8193308541979bd262d836acaed21120b3ae531b760212c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f8ba96aa31ca11be17f192a394db935
SHA1fe68dd9fd35b020244ae111298eafcdd1c95491d
SHA256898a2b467e897d9d55ec4b2e31a545b71a5071f2366218cc62ce1cfc93acca74
SHA51251f884230b8ffd373cf6a5e1dffa9188fedba4bd1eb724bef9a5b28ed0092b6912012829318acb3df38c0179e55a1cc239437ab716f313a57042a4b8184db375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585370d340122512656aaca6d0e7f7a08
SHA192c3d63bfbe616bc401287291a1ee001f9b42986
SHA25660e9df1396aa5f0c5d448795620bd1a0e7fd6e51f5e17487cc6920d84f6bb64f
SHA51225d0ce79126a3f3d017aa8dda6d1ce5088e68f73234d418e1b494ad7b53891bdabf84bc8119cb1845759484bb16fd6c86a32f9119d4e713a8ae31c4a0ad7173b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5899b4ed75d932328c8b8c8fcb274e70c
SHA1fb5500dd6059e8e5779cdec4e514cee80a79c09e
SHA25619175b20c07e57dd3e3b40aac0fd8316aa8e55281a640f2bfd482d6cedd2e3f0
SHA512452fff6c6666c1363483b843b49666f17dea46ba04692d68bb96bb8c095b7ca6375f2b00e58a8853a67af5b3b59950ac8a6b6215024e5faa3cebc02569f22b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fc3f04135b0c5f6a0a36cb936bccca6
SHA14a64abc6480ceb0d983f77f4201017d0e8e8f858
SHA256ebbc8a1f965bd3bccdb2377c513ba69839f96ad690eb4717c5b113c4511c7d25
SHA51297e41e80ffa13528633b29f8e0701eec9004963115f2b3b9f75a79a21ac49ee9c46a1f577bc59547c9c0d91aa449f24b97913fb8ec111fb61ea48acf0d2a6f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53499371aa31c612d2a0afe393b62f4ff
SHA1d3cc77bfd7a6d6d3999acfc6df40ffeb65a4be4c
SHA256fc6b5f225b72ca1ee60fdb838b52fcfd44fd615f9491e652127d1c384bb419c4
SHA512c309b15f23d250c29bd68a90e70ab97a52046ba54044cff1fcca3672fee5a1fc8ec1c4376e155e60a1b4b911f46e43820198075b3a7cab7a8404862e60a07d29
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a