Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
0c5716f5f2dd498878eee1302f1ec5cd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c5716f5f2dd498878eee1302f1ec5cd_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0c5716f5f2dd498878eee1302f1ec5cd_JaffaCakes118.html
-
Size
4KB
-
MD5
0c5716f5f2dd498878eee1302f1ec5cd
-
SHA1
30d14002dd039a41633993b976cf104e8dd71bf6
-
SHA256
6ca799c1b2dea7b5fa11fa17f82d82e48cf31079e70cd8eff2f398449ca72b50
-
SHA512
697f4349021effc678a3006c2748788b15717ec8dcc4494975aa30de0d8c40ff923f8104d22066b5adc1b3737026ebb3d52715e64d854919f072d1aa7b834e02
-
SSDEEP
96:yt6jdH7eYb7U2JvwdzwAVe0lVhC8uQAi2VO99NCKMR:RjdHHb75vwdzwMe0l/C8u3icO99IDR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0edd027e99bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000040ce1ffd67e8446032279db1b6272eb9d35d1c831c14a726bfac05c704d8275e000000000e8000000002000020000000c6097cab21d1cecb96195cac59a58dab6439f7c68a44f5dec3c1d6424ddbdb0e20000000e9854e256f20719cdfd005de87140993bea4b5104a2c63f0067b897f464a5876400000008621c2e27abb7504fff6aed15ddabe3fa5e0d6b31023ae67ec80f58b6d7bc8041603c5d91829ea88ec4fad7348c39ff82cfbcc0ce3d48e4e3b86cfe10c394928 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420744701" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{534038A1-07DC-11EF-8178-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000082cc0978ced9926b2c9d4fa711805d5534ac706bae838ab2e371d4e46898a378000000000e8000000002000020000000dc9ce310d37fef9cddf8ef8a8b712f30539614b4dea1758e5de01031a7129e9c9000000041a03d930f3ae3c2014ebf9924bc71bd67a2230cac74a83c82da92b1d10005168d954f1532180c7d22a4e42f9419016c3cb5b24a665eaa7419f91b26fe8df4a0968cb873bd2b6331c56e41dc481563fdf417052e85474031fc86982c1e85304dad50ff9ca45ac2d6c42b10001fd8ecd139ad58172db925ea4ccc7485d6c4d78c05a72d2b98d61139a07cba5875b0789740000000e26c9f535c67747b85d8e660db906bd79aece6fe6deda8771503d05148bd311e571af28b54e6542980e1fd90ae690895e1c680056658815f7cc49ef004242c75 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 3068 1968 iexplore.exe 28 PID 1968 wrote to memory of 3068 1968 iexplore.exe 28 PID 1968 wrote to memory of 3068 1968 iexplore.exe 28 PID 1968 wrote to memory of 3068 1968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c5716f5f2dd498878eee1302f1ec5cd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52817da3dd2da154b113f094323318955
SHA12d4119b29447e13ccffc6b01cf8035011eeff0a3
SHA256e80fcd45da6e6471753280f7a7791ab56b5cf09269d1da7a1c8bfaaa80410701
SHA51249db1c47a74550ad094a8db7b9641c6725fdd65bda1eb2de8700837a0cb7114b8aca7712545c2af2816b684f7ef7a7704a8cc8c61585d1aa6fc3215442d5124f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fed18750fd827dbea7b01a40ae2ab1c3
SHA1b5b3f4004b253a94d0d91b23223ec5b7ad73001c
SHA25664f71d16cba7fdfd61edc0c8e11dc3adc1166d7e282547ec1b5b526150c17e83
SHA51283622d114064703ee3d943b1d883c78bde3ae18fac0a9133adced5b548e2fcd7fb9827a33de4fb1ba4093e13135978c929f84cd783f3640224d489e192ff61d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511d62a2c755f30239f665dc4610125fb
SHA1fa81f413e56b9e0c9c88bb2ce9db40ba3288c4c1
SHA2564f93f5eab8a808e9937e88ce7393dfb7211035098e1d94f16cde587af7377f74
SHA512c9bbb06740cac0a37c1867ba24f9a5e805b2945c126c6d2bfac828cef4f023de5d09d228e819b2a28fd07185c1229fb87f21031bd05d1ad24f9d3da6bb020124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571a00417dce2724bb0d30187d5776765
SHA1dc3d32bcc676bb5a29950e3f42e567f2ee01d166
SHA256b6ef78267705576d2503f950e128edbe5a5da3b5abac95405a49f06a2aaab099
SHA5123769e78f99437d0ca72f99a2a1bbd8f5c36f2854d9dd70d8bb8385aedd04e3e4dbee9c9299360a95acfe62c0e1e46a5834107d164e71d3368d118e2cb269d319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fce69d3c213670e06e4e11e8bac277a5
SHA13d0001e0b9734818f0961e021dd6c42ec7d826bf
SHA2569fced48208717cc6355e32686cce88a9724ee719801663f39edb3935085f20fd
SHA5127c4318742a2ba6cbaf72edc1b0a15a98be1495024084ec0ac12db83036f64cc50dea5b2380b4df13bed3164954632298caedf0f3c9864ff548a3d9c3128ed664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519ec9097468c9148c1136d1eb4ad8edf
SHA11fe4b7f43870171f2cf8c7d3cb2d76fa5a2b1883
SHA256e8425f161811b3d6d07c7852cf9ec0f239f124f081ce9b0b77644016097ff1dd
SHA512d144939b5a4a1e9075b7c2bf5d518df26daae284e58b38201b5f9e49109382a4ccd1cc4df7ffeec4e519ec70100d23d6a02b293a731552e75b2a185d10202c3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0852763ccc55e9f9f83f0a05739e9bc
SHA122cd61ce2a6424a6929e6a093fca594f69049657
SHA256e4cad510bdff777da1d517e6de35a402dea865b19252e0b62fc5068ed8bfa368
SHA5126428d1edfd634bc67b9abaae08d63ce704acca3802169d4747f494176c0adb41777d070f1d561d248df4100f12fa3009f281e0dcb756c2045b07c016e3604573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aa2d5da1506ed0f8c869a7f733aed84
SHA1e73f481ef2c191709d6ac5173a743107b310af93
SHA25673b1e29bfaba52fe7e348a0e802125fd0ff9b568c3466850e3ccedb3d31d2cd3
SHA512e188309aaff9d887d4336da4cf01e52caefc1b3581078769c9c2c6f9cb55ecc87883b4117a1d8c25969d588e0f4971cab0ce8aa68be445d1c074ff42001667f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c00622eedbbc10611111cc4c638c826
SHA1af28488ab8cc9639e9b520cd049117f7059829b4
SHA25649e788596312130729362ca75a1bfc458c15c1ce44cb02f0e7559a367396dfe8
SHA5120763e8e8adbb78ed84d11eaddf770886728e580b642c93e8fd36c0de884df2cc5829c783ef343ae71ae95421ba4117647500edb49512e136ead02dc8248e4129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6a07a43374ae327fdb35faf37c7f158
SHA1f0786f80d31d0438f6b8762ec6aae46cb20a8c81
SHA256b7e3157b9fe2b3ebda12d754dce071727ab01916972844011e45e1355a0588c7
SHA512ffbedb611c8ef6adf37f01aba14d17a6620239d66aa50544dc7ee587b0982101766b320ca8ac2866f92889b19ab5f02a807fd1434fc1e605ee1e54309d2b5b92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a92ba33cffb9fa599dfc2be93928a3b0
SHA1d57dbb071664cd585fd5be93b31a70d7708d033a
SHA25687cec29d42c0266e6ba35574b0c67e591f2f1995577d4cc398e01561939b7d58
SHA5122fd71f89ddfb2954c54de53f1c979a237b06cd4605cf55edbbd1a2da10d48ba36b354512165d5be5c8f3c9ccdb1e15a28a4250672f56bbe681016409deecc8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d741ad9f7f96c5916df550984ca237be
SHA15c2bd12001309b18f78fa19c534b63bacff277dd
SHA256c4123f8a4d97e8c968cbde72f58c9647530cd551a8a49b17f6f3c17cac02db9d
SHA5126bcdcbe776c4a7e9ab3565f7a281a6420248b07064cd9357fa7f2141b049f2207020881d3e3b1dafccf00baa50d8c0127f846a78fcff81e45f76080592167cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573531b4bf014f59f309173bed0023993
SHA13a713946f96e2ef220506da8c7a3fada381d1369
SHA256dead5899951d7cffd3105cc42057a26d4b4ef06fcfd831d31dd65f571b745361
SHA5128876a1b1fb18c0e2ca1c4d2ca91eed9662790ec3fa2551414dd2055e1d10d7a3208049272e744288e4c372fbe6a892982e17855de21ce4c0af15402551f335a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b5af98851bb7848f6e73247504d9e61
SHA1487212d0f4275a38255ed39735415acb4bab76bb
SHA256f27f558bf16d001789f0475be4f0b1932c542739e5a5b7fcec13cf865c6ddbb9
SHA512c61fa416657c2064b7fc225e327bc22910c444f40bfd397a8f2b544179a1de752fa9d8e6da79f5ce5cba374d7d4475ad69010746be789e2ad35c6ee5a9c5acb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d2768866b973fe5398c9aba4d1b6d8
SHA1679b50bdb3f98030fe93e88805a510b0e132d84c
SHA256f7e58a3a5fdd578cf4a19ae10fd8819d5d10f106036581e150fe7efd32b96734
SHA5129fc73d641fa933624cb6cd8fd88a703af585b9cbe0c8e90cec212f7dc90d680703bb21271390979419c772ada3f740ea962d20e246b9d487173a38ccae91095e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c75c15a0ee4e5b1276deb1e8a5dc9de
SHA1ca6822ae86e75258cc6ae26d862571fdf8aec543
SHA25620baedb4a30bc1e17bbaa7999859590c0fd6772342f61f1e17bb716fc3063375
SHA512eb38a529905f0d1f5ac11719caa812e50023aeac756f2ec6530d1123676627f789efda2a4a7f33c39108e8b2c16ca38569a8e5347d2c53d19a9f6ce01f73942c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3e751615afac2607f5100489e540480
SHA1255474d67d90b054016333f317ea6f4d986f506a
SHA25693b0bbc6eb1ec2f5bd2d891271ffe606cde5bf81e49c7c42e9700eb3e67e34e4
SHA512c177bb845e3057a5fe4d933ba91811b58522ae0cb69bc6e297b4b77439f21744bb88689b33f947e2195b58d2f177296e34eb053709066399ecb5cfc53054c890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d226d461e8aec7b41d3f5742cc05171f
SHA16861b0ea6cc835522b05d672019bad53345ea797
SHA256e2a86a641399a0df4bc037da248e5248728fcbcab609183ec29a5bcf5cf63560
SHA5129681c7000530b20d78a776a41850a00dc562a5fa2da006b533d74ea3140a805fda43ca138e4f53bcaca59f10516e65aa41355fcd8255344891fa25e5b5d771b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a