Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
0f17062bdb297b416e42f30878a23cd7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f17062bdb297b416e42f30878a23cd7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f17062bdb297b416e42f30878a23cd7_JaffaCakes118.html
-
Size
140KB
-
MD5
0f17062bdb297b416e42f30878a23cd7
-
SHA1
9209a4a246402ec8b17497e3ed9b00bb6d92a62e
-
SHA256
4ef8eeff4d89e3fd6705f6e659410dc3921715067c9e2a5d53040612d7ede286
-
SHA512
ace9ea076f16bfe8c73ebe93495baa4b142d3be4fcb321378052fdd4c18a50dede9dfc9d0665cc80a48e03128f595f79d91522f41ffa6cba5e06e0ea0a6b2844
-
SSDEEP
1536:SdPUulwk0Z0kLVNyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SdBGLbyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08c2808e59cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000dac45ef5536c0714052aa5cc3e2e6f0a66b9577cfbdf44ca8d3a674483f39a4000000000e80000000020000200000005af4304aac085ed876be25638dbc3915a291c35b1a2e63d98899e00ae661c3cb2000000029cd3214c41cf382b10a315df8d41e9336eac952898b220032df573b4785ec43400000003faa2340452a0609b3e906dd864ac438d042b2318107cbb72d36e29c4f25e6808fc817f216e8c9870730c11377db401ee9711a0a45d3f5177f060b3fdaa1f497 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000007a59da5005811670a8641c2d815078d0782efdccb0c39ba9905473f8fef5d7c3000000000e80000000020000200000002947a4081591222637f85382e2c570f763dba8475383ae656763b6316e2d409e90000000a46a2a8cffdb299f20b5703240d4ede669d2bb9aaf52664af60c38d8e4747c25b83504ade25263a6f3cfc45f537982c6db7e4b899407416840a33490adec67cd918b401790e3dc8dcba95e22c53fcc87830365f60759cb0fd496f546472bd980a9add5f2ebba1587713b8aacfb85691bd88bc9e9ceabb87b4aec1f5726052acf4ab2c438e263e7802c8a015320a3436b40000000bdd1d56765e2ccc2564b2797edecba9bf9e4e93211dc98b3a6932fa658af18ae78fc0bd6dcd7aa77d2a5ecce6f2eb7a4bc2f452bf4eb733b1e61b732e9741610 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3349CF01-08D8-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420852885" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1500 iexplore.exe 1500 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f17062bdb297b416e42f30878a23cd7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdc30793db95517982c956338bc3e180
SHA1da8443a941e0e216b5c3b22dac11e1f2cf3bb833
SHA25638f113431d945f8bdac0f1205fb9cb4fb27b778d25547a73bc73409d0e9004f7
SHA5122a0682a9f2e614ecbe58c77ada2392d8d7d5aed75b3b441852e6721178bafc4d9dc2fbbe244387bbbe5dc1c2991fb2f17159328689f000b4129334434a48f7ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57eff82c54f86d010b9d3bbcb2c3ccd2e
SHA1e42e404ef776d9fd1693b849c710a0e479f0e37a
SHA256e8f5785f36d141fcbd5404de6dd640af552cd7e8825608b14e0c275a6875f065
SHA51247300c52f76a0eca79cd7425c9d3d005e36823519021bb5e951400f0fee6e100bad099009a2084324f61164322ecb31c4db8e9bf6581196b7ceb3c4ea0abf115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ade3a11cb8eaad51367c58508929e36
SHA1ed4fac27b99bbcb9f06917c8f05d6f1d4353b874
SHA256dace7910db9d5225ea871d9b5af1978c06e361ba8acec5db23fa28e8e8c3c46e
SHA512fa341b8d32af007e48716c76f3964d97809e890156c35226b748cddf8a3367f46dad45985327dce8b593332c88c84aee9e2abbad7f4961d930b6888d6ed33375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599c80e86af53c880bf5e6fe5c6e03913
SHA11c0d952ef90940042049acf0a8ffe430e5262421
SHA2562fb55d781c3e6e6919585a961b5402a56448a45d2b68ee4a79db554c9f218f72
SHA5129909299ed4b4efd82143579c3fbdb648173ec7f862e80052c2d3eda4d8fc5bd7b13a1996956ceca4f50875dafb13372d40f74b74eef6ab8fd0061fea2e6cd832
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c250b09a456babff80fb6f63a95f340
SHA115767d657add06cf170cf75c2ec716876237b70d
SHA2564678447ef5f30d474dcd56df082b0b105ed29105a97107ecd449d8a27d1e2d2e
SHA512f0a8e70f6911ec66cce757181ad521e09a465bc64949499b1bd7d787b8b0de7de1a9b1789fe2d38fcf393748515992a4b7768dbb4dc0be2a6c83d0fda348c3c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c2b880118c6f7d55c2b831fd19edc6
SHA1d3614a5fcfb8b63464c45d7ae72d554ecc82e47b
SHA256ad7a4d0309e2c431020bc77810432cb516c00a87b35a3393a3268b7a09f23fab
SHA51290f85699f525776756c3e5d215758fa811687ad4b2406e433cce88cede7d9bbdb0209afa18af18ad5307545a3c3cf13a574df1919f97fe7492549bbea54392f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b84606d435ce48e029dbd4afff10053
SHA17a614f206b17e16434be76fe3181c3bc89094187
SHA2563ce9dfeb7964398d2a23c5137db6d73bb00af7ab7e47d4e02e7a68e9e3a43730
SHA512bf06a7d4e903948c002477eed764a5727bdbf4e3dd0662614a139a8d82e6018169ed88822919085fc32622a55e68f1e546fe6348171ab81f5e9681e92788a782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2a0534309ded834d63e126f3a248a79
SHA1bb7b9796f58f915919a3571ae611259973cdffa5
SHA256dbb88221904e382965420495c995cb0cf21a060f4283b40eb216c6b58216a7fc
SHA51230ce378a4c322b20cda00d49a184c61cf729bd934d47623af9ad096e6145f6303f4f39c0a27fa8f167573c879fa8fc2bb554fff2ae583cf28f01693a168a31cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0fb8ec4c46f9518535167a6e0987814
SHA1d89ef294edea031b65f030270cbeab27564900d8
SHA25631d2c2a17c60056bcef722e70ac3ab66a25b364b958d88580028237ae25fd278
SHA51238a27a77412a9bb4bd34d7246109421ffc37995c8b68e0f06ac86885c231792935939a68bbd94eb072ee4a0355e58194ff9abe2cef81febc0772dbc61f4273da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d5585b61b9e16574ecc16ee4771f94a
SHA125545c921c130b41b9fc62124ab9e7139688a81d
SHA2561171798dcf07279323fa00dfc309af64384082df0a006450c27936e6b5b21ff8
SHA512dab8c857178211e33afa62369ec9229387a9e80d40e0d2e59a6ebdc56e81117b7752341848cc2b5b855ed25d0956c020249f5c4166ab3ebe550e136bf92bcaf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5859b440c93db645f52d3058d8e03e1f7
SHA135f5e4fbc48da13940cdb27dae633a51f9c3fd77
SHA256fc8389402d873ee6797e1ff037a823da318084903640d24b59f760a5b1ada895
SHA51296f42636fb81ba8ad006cf7aced644db82ad1508e518c3f4ee472412a488ef96bdf8a964b6e9ba5355a26ae14d8aa73d86b9cd332b6ca29872269bb279d56e8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf62c49c796817b31c8cf67f09a17b8
SHA1ae3a3b419f243b442689094165071843ebbda8e5
SHA256aae20db450bb87ef6a3a77b85f992efa4402f15fedd9809ba1c6d3f09a2a2e88
SHA51237f1841da63d6e977f5e191854ff85c36863eddb17df70b83d3887e668574e6bc483169a399766447b3aca73dab7131045c445615e09e77011af9e6aee62ee1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc03a2582f81e6c78dfcae19d399d381
SHA1ab22e5384859207123d4b9228a55655558b57e76
SHA2560716d528fd5c78e138f63347141077b023e314a079cae0e9265833e597f4eba0
SHA512394bb1a42bebb0ddea2f434d73e413b7c1d93a9c62a7a2baa1d82a151acfb8cfb0b8846b25cd172ac50d8ea665246dfbd764ad8fe83710ee05cf6f187a8c5a90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5950909da8689c038cbd8431f1029f385
SHA1ebe0d01985b549410739072ed3929fd0d03db3ab
SHA25663549b90fc2cd57f3c41d4da1aaf70de71a4d52a70e6cb0bc86e6db7e4fac175
SHA512bcd5e9f8407ad6ee7e1e3bd6b58127ee2cfa4dbc59fdaf697928dc83e7eab20bcafe899b1f0a9bb38cc889906878bfd124fb9a6dc89bf801c031ecbea48d59ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525b117897522f2cbefc5e1a4909a0f22
SHA120c6591c82c77c23e2e2ff3e973a0a90e06d67c1
SHA2563c5b624bca267cd8faea0d59b80aac2917a8b221116a21e394a4e05de9e5269f
SHA5123ab4c2c73219e2da43cf0d30b516c00669e812e6b27361a2383ef780b9a5d9423057682975a8cfc16ee868111904c13b9c7d5c8670d0a1e788e51b1ab4252278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5a2641573cddc37a3ea2c0a98a30aa5
SHA1441f9fcedd7a881fb606156326526d12cf00bfbc
SHA256b1ec62b7518a4f96b5304570dd2a5f83f0d4d624cf65133bf892a2fde4897da8
SHA512a19ad925058a9339ce0e8b5067b6dfddb190f798bb8655b86349e5f5168ce7dce229d29986c0bcaa68f4e80fa0aa2b23285a0c2ba76aa4fb26e7f7957bb5cbee
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a