Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
0c97816ae8ce2420e94c39f87e317425_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c97816ae8ce2420e94c39f87e317425_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0c97816ae8ce2420e94c39f87e317425_JaffaCakes118.html
-
Size
460KB
-
MD5
0c97816ae8ce2420e94c39f87e317425
-
SHA1
0e74b869cd8a5ae259a203b148e3c0cc55e79b3a
-
SHA256
2d646e31438e95a9ca360fb4615bd2e3b2b6132b4997cbfd1450691edd7e3948
-
SHA512
6b3650c23a7824ce9a9c181edd0d7a5264869ff155274ecc3739114924f3862b4e405ac827ae90a72099df43f6ac7c24b7fc6334836d2917f8f22d15fc03551f
-
SSDEEP
6144:SisMYod+X3oI+YGsMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3+5d+X3n5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000047f132b6fe0bc824af8a7dba337e2eba2787ac3f561198ce9387690b5db1bf86000000000e8000000002000020000000b62d04cf58e050c49c5995f3d31b79e71a06da11f7f334000bca3d2a725c75d5200000007a8b3b19154bf5f86671154ad42be4488304d2ffef8cd09c4e0048d87d7cf96c400000003b64af00bd90ffce515aa0331ee81074a16390693ef57a51e91ee662154b3da5e6a8a43ceb803169f3e5666312dfe634c4c46926ba334676495771b100691b9c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E25F56F1-07EC-11EF-BB79-CEAF39A3A1A9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e22e980b5378867bf47f2d6d520565da078e9e2b74d883799f1ad04046c0c882000000000e800000000200002000000094dc478e0d204f2dde253c0dd73dece274100330d6ca5eda23003a1551c7d7e690000000532f53e8d8ddd6b584ef8a31fc404b31cebef6f03f58fd034ca9d5154a8f4989d847f42f3d0db8dff6d334ab33f85d047cc4e30a14193c1c6aa60d0f272909d5a0d64b3d06ca91cf2596aac47db63f82cd6af585e83ec3641c93ffc93fff695a9f0503c5147b090bb880f4c3cbdd32e04133602e0b225e5f16b53eb264402b838bc54b4b959c79f42d5f6838340dc3d740000000060e609b39473384e9fa7f04d25576faba3499861abce11eef87ddb360d7e28424d3a63700b1880d329f1694933af49ffa962edb3c5f9bc0eca927bd4f0a9fab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420751813" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0abebbaf99bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2860 2164 iexplore.exe 28 PID 2164 wrote to memory of 2860 2164 iexplore.exe 28 PID 2164 wrote to memory of 2860 2164 iexplore.exe 28 PID 2164 wrote to memory of 2860 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c97816ae8ce2420e94c39f87e317425_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4658bc307c018b8e0fff1d26fc29e99
SHA142733b83e91bac6d236bc5920406696f661ce537
SHA2569aacd1b5b3ef1c61c1eac2699610dbf888e8b5c8e75fd846fb2d686963d2d1bf
SHA512d165767c02bb21bb7acb5656ecf02add3acf1b05b097b5929b51bdb9b845f910769f5a855263654350166e796235a18d69164c52b3c66bdaf06bbe3161803491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562385374c70a6e0a828f478de3c4a689
SHA1d0d7c5cb4452de43927a648507aeb82d7d5b4023
SHA2569ce3eaf72034b3846d3ffb8f6ca7cfaa80e8d58b57284086144581d84bfc1b41
SHA51287b9308e3a71071c66185eeffd2323a20ec112ed7310c1c44fbe7c8ddb15e08527c149f8e5c74f463d6784a316a0b971701d227bc31d2e29a1202ad84adfa21a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4c22678871d26cf18e605c99d702e07
SHA16419fadd54e8612da3ace8c5e160648a065c2df6
SHA256c86cddfc0e42d6c59f0e0b76e1301fd04720af2d3fd9658a5e0fbf63d001bf38
SHA5126b5ac0f24c219b18c9f0f0ebce844bbb38fd4667ee15b0064e51e92d63722ff5c7d8f78cd35182be7cb9a0f286a34a1716ab404604e28e30f68523d0ee0403ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510a0f970183ca48010f39e88d42202a7
SHA11a7dbe70fab2f5e454e09b7a500e591385098508
SHA256c784f0de2b58139c7463dca08585b1cc437398cc3ec30d940a4b24ad72771650
SHA512d71bb1e43b4a18e2374bfe2d244a75bf50af9b81911a9ce388cad917120ff576594dd5dab50025d203f24cb4824ee00c244aadd0e0937d1d75afd31793609d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac1183b5c92293f6dc309fa43324eb6a
SHA106ea88b22b37d3f6c9c2371bbd0be894dad6577f
SHA256578ee48a83c958319034c67ae7d91569bbdf8cf98991ea377f7f8bdbb63e550e
SHA512ef9dfb6caffb3aaa4337a154c7f2061f0d9c9e3f8f36fc0068ea1b2511657a709d33ee4607bdcfa47c092f39695e26ea523ddf91156e9f2d29a1fb14227ca862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d430304f27886178864a4fec99df0843
SHA13defe86becb7d380f915b0afcd8e76923ea04b7d
SHA25624fe8cba45a3db49d02cfd15f0af74a47ed0d2e882ed03928389f73f68f0e09a
SHA512ad8e8bb02138ce734619ce65ee090d6f29748cb588d76ad03f6eea9128b3516b675434b161bdc65d63d4d386fceb46e74e3a466a7661c2ab193e33dcefcdb950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ef23aba4cc9ce2807ed09b81f6e85c0
SHA1f9e6fe79842023dca8cc9769f51d8f8e5de5dbfd
SHA256571da7c28aaaa4d138ed64537e9f34ad7c7372a4017861f55715e9b20a6706af
SHA512f1e448471fb5dcf9d46c94010df54f8c05b0a83f99bc9490470a9c375e7c9b7eecd4294dcf4e2c97008d577d4646de960b91cdfafb154fb92308e4a00b08e82d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59517b85138d8ad110fe8adf10f3ed39a
SHA196ad4888aef202be4666948a1c289bfe55c74fa5
SHA25695a516b92f61fba39c5bfba55e62bd08d7d0b20e11ad047902ce5eb7150a69fd
SHA512caaa952f39cdfb53e62e52bb8610cf6c564b4736e33e6079b4c1fe913cd2021dfd3672af18a7db33e320e2a50d38518d4b0a2a719b3a993c545fb7da143da4de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5132ce3cb7516e5bf961b04f1fe198d9d
SHA13d593bc968dd9a2bdba9adfe5bfdbb9aae19a49d
SHA256814945a6daadb1961ef10bb580f49a2282c899aa14aaab2ba6460f0b807cd701
SHA512796f948dddc36969d61add3d6ca713429336a4b43e8466d56ce41f7392ced7469c098d6639dd36ffb2306bc595b84f26d75d87fa866dec1a5332e9389d697207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d930ad8ed5f2b4ca1d44dd53a3962e20
SHA1a2e40ae6d40fd201eba36e03c6612a217ec4ffef
SHA256d05d7941a9659405772023bf9248645e15a2e62979c5f02accc8d4f2571e48bf
SHA512f3664efadae33fea102af6e55a5281fe31fed7752120988c7dfa052e7bef117f537ab1bad961335dc0f452ff3bac84ca439ffeb9820c054c50894e08c8f9176b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c96bd25e597ecf6a1024a47edafd2d7
SHA1453f6d45daa92cce6e537abe84dbca3665f31f67
SHA2567e82691a9c70d8c892eb17a28c296d5ca6ed1a651fb2dd851a9099b0faa65869
SHA5123ef4f5726e27e66c6fbab8da3b1e9e2ded7a46f7875bdaeae4412bb7918ac63c2df82381e416a5318ee01b91117fe80f0a458f1d4c40d6dd00d6c53f0d8b6def
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaf7b1ce1ed515ba9ecd03d0b9d2bd66
SHA1b7fbe6b9a7e0ba7758693eb54cc3b6dc8973af45
SHA2562b16de125a67d305accdba4411f5b4788d9c465cfef606551a9027a7704a65ad
SHA51213b37921d3b03d78c1b369af3d8b03cbefba0b53ea3721fd6eb98dbcead6a210c63a4a98bc1caa891ad5467e095d64607693eeafde66806d229cb3efaf0751f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5149a46bf8992a5e808b2eefc76775871
SHA1f618c3206c631bfc89a756e41743959fabd8b04b
SHA2561e5c8977aea60e00b44c31e7eeffcd58c4915b00a0bc5a412272506930667f0b
SHA51245da646c2531980114af0540d73a60dc4f3bce6cabd2bbc6e41cbbc49a8a2946e62ba45e66f785a8a527a6517a604d597f1fe72ba4ebe1e5340c3e330f0ac5a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54138bf4201332ab51f8d36e6a8df0fdd
SHA14a317b090ad573942268f9c7e97a0bb883adbccc
SHA25669eea099e1f4c42967c2354b8b133d971df81e557d62ddb7815809e0671a1500
SHA512cd6432e91439c4d7f29564381652bee0dd62247f83bbef0000e7700f8abd1e804444ccbac501835bfe3e6a155806edff8138bd3976f72de61700c60256b017ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d1605d58ac1fa1a3978619c4cfdbe20
SHA1ee568a4ad57f75f1d524b6679d704958c8696ed4
SHA256fb18561e0802ae30100267e62b30ee2f0eecf63fce72dffe7260c2376b2016ae
SHA512713c9bb7f5e91085a95a067377b331f0685ae02ee88c9025713762256cd960fd8c21dd40b0a8e573217a7d6da175e2c5596724152eb15273b496799187f602d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe80279bba5c8bd38022bdc6ee38a477
SHA17565ab79213da17a7da1433a5656deda1c475224
SHA256893f242f6294dfb797c6dec89c9ee6d64d5358a2c2bc06d4db124d5c80f623fa
SHA5122bfc4c120ac1b8b34de9e9a65ce72a46f7aa6f19e547c145f205b7d965475e906e84f074451733f2732cb617e7d5a9fa79ec130946f79262bc8a44296a2cbd1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8b094d3277b6519d9ebf3cb47cc100e
SHA1319eb295d0d7628ae0d2fabf32781aa17e3d3d2d
SHA256fcc62f0d1e05101e4c77a6552f29a2ef7e4d7843149159219cf9712b376a6fea
SHA512dddcbcb50da0985c8bb4c4f7c2268421cc2ab816bb055710944659bfc2f2b87c3d6d1b5f4954c244545705f2fee067d92ad961f8888d3a2b4f586baf7e78b53d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b0557478a5d832ff1d7a93b32f7a7d6
SHA1d0035d3f8339733f5d665228191db41dd9c2e4d6
SHA25692bbc5d4cb6a8effa86829f5d63dc3a4757b5a30e20921a3ab2aa8282f68ec36
SHA512852411a553aefc45c0c0bc23c37d86502f730a29c212733b52c0a4eb939d46a73e5b440c2de14362a274bb2b1cdd66b5d935870cfb3851872fc39d8b1e23636d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a