Analysis
-
max time kernel
137s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 18:13
Static task
static1
Behavioral task
behavioral1
Sample
0c7e40e7f235e4a0bf83206172fca62b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c7e40e7f235e4a0bf83206172fca62b_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0c7e40e7f235e4a0bf83206172fca62b_JaffaCakes118.html
-
Size
27KB
-
MD5
0c7e40e7f235e4a0bf83206172fca62b
-
SHA1
be647abc58f4c483c85753f9d6fcb2de6a036520
-
SHA256
6778fd923af28a5527ccf7dfaf79f8eeb8c1df8060d3a49dfe1266399d4c1ebb
-
SHA512
faed7c788e971abf98ca4e86eecc8d276d1b2880fe0f4515e6b45182459a489d55e2fdf46f5e4268cc2089a9a5ae0ce7025f72229e7490f9b69717ba9188cd30
-
SSDEEP
192:uw/sb5nW7a/nQjxn5Q/RnQie8NnunQOkEntrLnQTbnRnQ9eW9am6MZUiQl7MBcq4:qMQ/qrAiU1Sut
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f59b97eead701b4626b63394a94e823246773280d8652b085f3a2a22f55aeda0000000000e80000000020000200000009677bde8f118b71bdf0f93d7b7238e9d5592c401abdd84a9a98860b755202e6d20000000370d6d78f5ab84577235b4846f9054f9568c2dd6e0330c34ee991efac29e65df4000000034c8ac610c8b5003402906020e48945dcf92ef67a64e4ec1929abf5135ace8426dd6c91d44b80ea2f8a1bbd23c0f6f4c50bf33d58274b82f0464a1077288324c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05dc14cf39bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420749060" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77104C21-07E6-11EF-9988-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b8e5ecb650e4efcff5be8fbf17231d2afca3cb1938ceb99be2e53302484edd2a000000000e8000000002000020000000d747262621a8aefd4b5663718ecaa6497efa34fb99aa16cfc8d29fc3529847ff900000001a87484dabac8194d23b3fbcc0ee9c940599a7b1ae0fa1f5080571057f76d8625702375454e315ac628cc4ca27324a8663be117608b9ba18bbbec1716119e887cfe81b92e2ab184f7be577418837f24026391be687cc9899b0b2776724dbcaa8011a00b670fb8326e58027eeec02d0ffc545a50eab442d8f2d0a336e20f83fe14c989521daf1349b7476f39548b1b90d400000003880342838bc1c0fe952b8daa6b305e2f604a94a19209e4776bc298de3285074271fe8be9e50ff2f950253cf06b112140b2f3313ff5c7d0f5566583225de07a2 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3060 2172 iexplore.exe 28 PID 2172 wrote to memory of 3060 2172 iexplore.exe 28 PID 2172 wrote to memory of 3060 2172 iexplore.exe 28 PID 2172 wrote to memory of 3060 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c7e40e7f235e4a0bf83206172fca62b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f52a5a7fcb99568283bd19a4efb88cf
SHA1603fdd3d8a0755010529ade0b165e010e5787e63
SHA256508b53c3757b8e5ce17869e94be26221a85dd8e8652d1b5a560a35b7f9df865b
SHA51296ddc399a24d10a21911b15304e8db83aec6b98b78e1d27e178d53fcf8853140f463500b289da02b1f87b26dcd0128c7f6c4f7cea955586bdec229e80d2e8829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b629992e4a72edbd410182ab03afdfc
SHA12b2c31b57ec32315dc9fb4b9e76abf2dd8bab9e4
SHA25685824dbb67f636129bf32ba87788f4ad3e916c1a6dec87891ac09a4868c31e9b
SHA512400750fc0bffc6af89beb463be8ff463d1d255debc2433b297a365e09cb1c2a6b2836241a327f0ec34ce42059deb85dd5b10f995caff2b341ecbf29c43d91cff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555d9706dbbda019deb802264171ba094
SHA189d6967e5bc7495b9c32b531b8c538521c917e50
SHA256dbe817007973dba2333618b9137ba6232169766b6ef82d7ab72d484cd0ea593e
SHA5124956b58244fdde51cdbf343501b421304ff1b7af67692c11732cd69b0704fed115f98552b49728d6a8e60f193bc948728473787419013532504a57591dee00c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f21d8b63b2db23f740e26ed3927ac40
SHA190df5748c5101075e1c8afb6bfa59dfd4342555e
SHA2566b528f618aaa09c0fb1c1d3a848976ceb3a8b1aa8b79ef78025b290614667a81
SHA512a1375a3c45d8c3702f2b02c394e214fb106380176d0c7befff9749d74943553170667c6d7fe2f7c635c56a3efaff4b5c122bca0bd9dc3111adc6fff68613c4d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9ab7400fa35c6e6648a4d6e5cceb1b7
SHA1770db9e8c20191f820ce7f9093380cd99fe9e329
SHA25665b96b24af337ef3edbb1d3cc67471521e25420bb350ef86a75fd28224584e58
SHA51238ff2dd43475ed173c5c06d04ae9b8d436d93f54fe990ded10b8480105e9669d5ff4c2a83b8911a9cb88c9860a1863f4c68bb5d3b3f54a90a49479109c793cf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8e5db27b7f30a72d16e81398e448a8c
SHA18230bf312d2e1d6e1542497fddcfa8ecc5f4f3aa
SHA25667dfb970104198587ad6bcb92c9a21bb1bd5222b88129bf6a13721eaede37d1f
SHA512f78dfe8a69ee20dc771d7bb5d201273531524b516f87ca03da4bdd93f9fee143ee718aba18e46d63f393cc3c364d1b2d70c4d0231ad8f8c9d46bd1ab7aac51f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7ddf5ad1fb5e40289a27e2d6ca83294
SHA14181ba52873822094cc037e6cc34043c4d9f1715
SHA25697af8c5bab923138887e3acd1a9fc42cad19b0298f342175a1c2136a0dd12d3f
SHA51293673783bb90a1ce56a3f5f613fb364c0a91641e222bb01ff644c3affa9682c3482b6106cc05137ab6269c9995df1880c34b30ec5ec372e40914c2f5ec26228f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f9df3066826eeab5b92b0cbdb9a249e
SHA14e9bac3a10b3499243306bd166293391ea775ac2
SHA25618c5f341a7d5e61ed3b14ca2a187e16938a56f9cb4360d7862c4568ed1885f34
SHA512cb8697f53750cde9b54a480507ea31b5fc87df27b827eddc98df9b6460ccc6d33d6f406554af5e5e96bc7ec386ac3b3e100d636fdc7190d2b25f78df9691d29e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaea352483aada804e66ad4b3d735b0f
SHA13ce8b2000d80ff59f073111c124a99f510fa1de9
SHA25631c6220236ca8f5143824d525bfb4d0f51133bd9018abda3416c71d40714f507
SHA5122b1930ed6045e2d42dde228825f8e7741e62c611fb6c8980f39ef9f16e6d5be809fc14285f05d5213db4bd51237b222c0b06565907c1802309153f52dc5ef9e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5de85dc302d448df27ef215e183060e
SHA1563b9b9be86fe2ebaaa9c300f8dbd015b03e0ce1
SHA256041d0c62f22b60e2b90b525680fce43a12ce4612d2c69ff627efe419c4225f5d
SHA5128a561ef6258ca2db88a8edbb87e061fec6f776b33273b679c1101be30b6a4b5bdd522c15883a9da6cce53215456107d389e470f1091a32a2a6c2023119cb955f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54565f9da6d06237eda45c31b7d83a0a4
SHA14a4f9b6a5f29617071f7c58e7083b78126172d02
SHA2568b63477cf32b21816d93ad94d22c9380b8c9c7bfa3f0926b3c46766383e59846
SHA51211e4064720df6423ea91631513a244659accd4925a3a1b1e4a3d58442cb9f10212905f66f4a843236ec807c0cf3a48207aaff82508dd4aaf788291f72b2e280f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4d294865ddd08ec309c049f4ed5c52b
SHA14156fd8433927bf592676f702cf4139f57e7eb1c
SHA256accc0c649d863f02a4dbee21906bb583a2218cf11b167104f731a1c1a503afdf
SHA5128b85acb9031a994a1cc5e97d9d8eac2e142fff6bfb4438d33f3667e2d2d42a1d09f4919308a1c1a3859ed35f083a6d3081928b5360f5a59081ec5f9b7d68921c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a62cda298c7b578323e6dc1dd585ede2
SHA12391079b59d74c74cff268a4e103354f8a00640e
SHA2566dd1a7c87527e77d347c11b52c0ac50fb849e0723b80c17629359d41561ecaac
SHA512653af3c448b8f11c904e554294e8cdceb9a5a3e4fd9f7a6b8fa67d4cf3a3c9f77e0405024bd60153b665ffabd1ed62f4766d0dd2a9a23e43d05c7e0293f6b668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5591b2c33b7d8116f7b87fc6c58136997
SHA1f598171abcda0190d0351229984e54aa0d8cf4ac
SHA25657079493cf5cd211f92205b4bf11fc512bb4d6f4d1f82bc60733d5aad1298e6d
SHA512247249d5c41df870a92f49efc9165f0c02f7e2f503a3d17757e56feed436e5c9422c2c059dd081800b0b4a1589c17aea35664040d5e10f5e0b88d07b1c5ff8cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6534868bf6f66553ea9cf7727bd6176
SHA19f164a01400dad5d62542efa68d528994dfc46f3
SHA256197a69af9891505080c2722f511d5c8875aaea7017187964c92e77f75fdb7a11
SHA5126d9b34f2a2b558ba54b20633ff0c38ffd039246c674c4364f774cb953432d6f9a34487b364f1772cc029f37bdd912376c17098106a4ce82e63d381477a1e324c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca5a387dfe4ba9b894108d559e0d2c8f
SHA1cec7512d89e3dfd84ed3dc7f4b0270e330b35665
SHA256bfe238dde9cfeff51877d830359125c534743f9922c4a14546ae40755b661bae
SHA5129bb8314bf48916846e27dad0bd85df355df04aa00a1374c0db87f7a37783a985c7c4510f44a55be0da7bb0bc59b5c9db32525f96637596819ba73c1d754fa6f5
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a