Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
0c729f13c316f489fa6de4aa00c6c8c3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0c729f13c316f489fa6de4aa00c6c8c3_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0c729f13c316f489fa6de4aa00c6c8c3_JaffaCakes118.html
-
Size
29KB
-
MD5
0c729f13c316f489fa6de4aa00c6c8c3
-
SHA1
905a1681039065499a827dd76a663015a73f3512
-
SHA256
12fde2b817ac134328a3f395c3e568b810902f384ddced92e446200e70279eb4
-
SHA512
5fd3de9fb6c0267137a9050d8a18e9b84366c7214f0323545dc9025ee53c0f2c1ef9e5e42510c83cd9a0e6591e587dd06b52c45121e1cdaa46ee999dd77a6adf
-
SSDEEP
192:uWLKb5ndZnQjxn5Q/wnQieDNnGnQOkEntkunQTbnRnQ/7YEMC1GRASGKTYvkkkkn:NQ/gJ4DtLqv8m
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000da43a10ff6e6be9e201638b10dbd30b1b191a21c37a5bc0086791f14db610290000000000e8000000002000020000000223e4440bfd04e045f55b3fd26cbd1c59a3ec52de0f3295b3d7fec2a3a4a0b2e90000000e151b31e561fc05334db2b84752c8eb1d6279b501db5dc63c4a7d3415a6ca4614eb0c6a565db1a6fcb26d5b8a1fd0b78a57b1b939ff327beeaed836623834a72514a8ca0661b875bb34c547bd6820feb060efae242e49998812dd0bfb491ee4d68320b55dc01bba5ea09c76fe501e46bf5663149a1ba1c7c52b27475d962abf446b2352467705c20307010974dbdfbd74000000022141617b11087e23d6de9f854ae3053cf7d67a0cb6c4fd8b6d53a6d187cc314b33c96571abd6d8a830e5d729179d728f3abdd995d78dc833b5a896aef8a6d05 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420747736" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{627AD351-07E3-11EF-9ED8-52FE85537310} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ffabf9858f0b19473222a4c073f27b861327ec51115a7b22f5fd5024ca1f411c000000000e800000000200002000000079ed6cc2709ccd3710cf478916a8c783228708ea4945677b18bc0f0ccc30d98620000000e9180501e5dba3d5ff8c21873617001d17e6131916f1233c158b36e1523e0f5c400000004c801fdcf30d28639c9e4b050386b7c5be01aad98081548734993135b31f0ea7fdf2ccce25ad6c958dd94d3b2fb98ea27f9a0c319ad7b210d256dc2f1de54662 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a1a839f09bda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1976 2368 iexplore.exe 28 PID 2368 wrote to memory of 1976 2368 iexplore.exe 28 PID 2368 wrote to memory of 1976 2368 iexplore.exe 28 PID 2368 wrote to memory of 1976 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c729f13c316f489fa6de4aa00c6c8c3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e27b6f774d5f24d7ec02f97a66640dde
SHA11bf76aee0cd42b6af88de3480ad7fb2fdb3e3db1
SHA256802587cadc47988981692c7867546632e34dd9cd21be09e405c4937c40d2946b
SHA512d06955ae71ff339b389277ddedc1c78f581a5622a255fccd2f79fe61eebe6f85f20d8c97366874e3e61468864eeca0bc5bc2a350c7046c507f33dbd280d18c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dfc470ca7e9899816a9656bfdc3da19
SHA168c0d9ce8cca17d87d59747753f6f512e2fbbb70
SHA256f1106bd3b9d389ecb20fa68177ac13edfb9ed2d954691ac118d3295c3af0e2f5
SHA5127e4feee1254825067d95a85e071af5ace59e629def3bd7190b14fc317ddedfcb52c64ba085d4f75ebe72c1ec66cb875dc4732155caff9cc579e2bbc5ecf21736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56593c6c3f9e2b0f7cd98f44c0f3e691e
SHA1d56434f88cffe434b6999e4d79ca6ecb65f94514
SHA25694de04e58d4959e9c470ca21de98bc0f496d048332473716eae8f90e748e6c3a
SHA5123911a3dd70684292478237be97dcfbe39a66c66f3989019febd16a93bbd7f4a64de15c2cdb443b61548b983fa4cf57754f12a01463768f51f1a06630145e3bf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fb6c3c2e9481200cd26cc9aafd51ec
SHA17faa546fa3a3be92810b1e2cc99a36d9a775cd87
SHA256cc67506898927d69cb378cf95534a353a613f586d1d3c8742887b9fc5c0bd2fd
SHA512ad521335c2d790355de66165653c214c884ca0ecbb0e894851dbcb0fd21ee9cae5066d3d3c6bf3affdc9fb7dc23190785f06ebf5a37b68258adc613cc8a1ee76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d9b7b07015a45fb6a4c4e29ee8c2223
SHA125a0540024c43d396e42b928c54088678dae9933
SHA256ed356de2e6a585883f15c74d76d838bce76dd59ced22219b22da97e3dcece7e6
SHA512f7e01afc6512ac82855215ce1846e0f8aae306bd0cc1ae526e86d1c6476d7927d32669e7586a5d9fb169d5994593ce2aab38d0ba0ea12ec3599a9960e74aff6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cd1b5fba95f8edf0031ce52776244ba
SHA1273ff54d5e2575cc0924fb0f3ff36f5ab571f998
SHA256f8abac7d3c1e782975d5c4e7b53d61577f75db6514ba53cd664f501e3eb69316
SHA512c094c5e63156dead41bcf4ffaa09d7a361ad43017f923a1aa6b85bd3a86c44c89d1a76e1f2594b0d0f3c0666abd6216a3ed5b3146b1b155b2c1e3e723b8337aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef40b905b7f0f49d6aa50a071e10b59b
SHA13667042209a3c140485b271b2c90906a882cd133
SHA256f156c4d8649197f2bc9875dab56dc5bb25c4e6e25a9e20dd1a73149386ce44cf
SHA51222c64172f21cc3976753d52fff4575dbd8ce476dd486d31f5b375c9cb4709e2e1d634343a7a8034f2e831431af4b32b1c65afac1c80d8e308e21cd541292012d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516419b4a96992ba74ed559458cd3ec94
SHA1ed4bc9824de457269ccf1352ee2369f92c9476fb
SHA256c54e201362d01e8a18c1e378f63e5458c2b615784f5e469ab91451035aaec58a
SHA512b0dd6a2cf899e4148368dd827790725372146e1bbf2a87d22a17397613b056ce4162a21a2cb94b005e77e0998617a1e962a52d01897e778eb525432db55578f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e51a60ccc294bae76b6759e36ab0b11f
SHA13eab063e68a26bb3b763147dd83372c799c0e194
SHA256637e95c9b621e5a2f5e498aadfc53ea83da090324d1d69efa678e352f74fc13b
SHA51221fac64e25667ad5b2bbc4f111428f9baebf282de23e74c46aabd5edc36dbf790ebdd231b36877440d0549d0462621fa00851cf5da46b5a04cdfc3a89f3c3e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503efe02654180b712171c424b22a3882
SHA188c49292cb706b43e1a39e4cf4da17958c868e26
SHA2568c7d674f2a40f4eedd224a02bd0ff7aad3b642b3ab9bcb62683c89a31ce46209
SHA512ee82430503ccacec08923e3aeed2a2ec50c41d793596c2917de0e34a356eee607aabef7f97cf26f5b136c4cf4e021df3d6ec9bc4d69384b43146e56aae2f2592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d1cec7aa97bf9885b59e32346b2d208
SHA1c233b31feb47603dfc2abe6841c62066f342c3f9
SHA256da38bf0e6ed12c63e005034a6488b944e14542ed83786dc4f94622e67ac24032
SHA512c19aad6674caa5e4d5f585b3759b265d821d7c3867fccf723b043714d28f6c6875d9efc1705053e75bab02746ec55434b376b7723269e9bf5966ba9b596229e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6fad7ad8475165c1418c5a872160942
SHA18d927e90c4cd0e2a98e1c1d662a20582f67bb985
SHA2562771181406c9d5909f9f4eb55d0afefc9a9155f6cacbcc71c14b2bcd50f60d2b
SHA512db9a376eb5447fefc2df40cd83d47fd5cfeb1e7c9a294a479ef21d85eecc80df8d63bd84e3f0b732343c3b74693e02c7c905d4a1c156ab6a1ead4bdd6f0e5dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b24cef078b884a32c2896f4ad50504
SHA10df8a44140379e507abf4a8b30ac7e3f23c88f78
SHA2562163778229871858fa96403d50b703c3383dcc2eb4181255a13d81c0b45e5689
SHA512a55abc9f0860f5385eb2a8a5382ad2bb8015a438c018a042412b36f41384cd8bb30c5e3a18ab9898aa3e24cdc6dce77de0ed5086edd9ca73cce80212297bb5fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e93b85c1c97f33dd69f97d3e7340a5af
SHA165d2cb87bf3a81493b62a66d4c9ce4b0ce2572e3
SHA256df17337a0a9064f1502b8ec9c7dfd277ed783d72d0a77f038a6bce83cddc63bc
SHA512ced1cb5f6e3910032e8e8692f8a8aaafa3654ef2a5dc53f7737d0c53b417d526b85fd4da4934c4275c4a41042b72ca8f0b8e6048edec9595709679ca9eb77db8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5881a2e83b36f728d321597084b020bdd
SHA1e2c0b5d84b1a2d5441bf74ea79434a9a1336e352
SHA2562031c3351d82afc4721ce46fb2c357c603355e7ffb9d400e0f9af7f0894f2f96
SHA5126ee96a94619543f0d9cf468efabe2f6314bc80e0081689af6abc6cb76f9fecb79d82fc7d59870e41bcf77432dd9cfe981a727b36f6e90433f72eaa0ecde5debc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cf673ac9f22c8df7cbcba31ee2312fe
SHA1669b6d4fd083fa76efda870e2a6858e4f726a39b
SHA256efd416a5e76b1eabe2aa786053f1b9dfc09e57ef20190aaa5b5cc3d8544d9cf4
SHA51219a1bf2ec103e575d76182f65cdbc9532bed9ed0a184272f544d09b41683a4f3f8364964fbdca80498eedd6b54bcef9f4c28402f482d7fb8a51d31770c10dda2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a