Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
0d3539268669b84c5f02bc4517969da5_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0d3539268669b84c5f02bc4517969da5_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0d3539268669b84c5f02bc4517969da5_JaffaCakes118.html
-
Size
21KB
-
MD5
0d3539268669b84c5f02bc4517969da5
-
SHA1
b99acd82dcb1173465448971bd79ec01070a6465
-
SHA256
1a7773137dfec24df10c08697f57b45ff0ffa2720035a3acb38b25bf9277bc2b
-
SHA512
2fbfb0cee79504d03fb87b71d1759e19249760a1454ee6212135719251db0d0de4aee0b175d7a641fdcb756eba9754814a7a2a3104597bc76b60cc3bb0c706fc
-
SSDEEP
384:zi7KcRAa5r9DIiXbWVBD8c03Rxh/iXcmEfP4ycbp5pzVcrMDJZTO4um:zi4a5r9DFygc03t6cmGP4yGLJZTO4V
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000497d8313eb078148cf024ff92809758e73fb0beef8af7fefe2368b37d7eba2d1000000000e8000000002000020000000fd1a5a4dd3eb0b7fdf98027b60fee17b49bc0de2d7ae01d4a37db76d97004d3890000000c4bdca4a1570e2b5523f866a9e8e82c8f43cb44ad3ab1ce469c67d534439d786bba23ada8f5c3abf008c7ba361aef29b8eccc9ab7be9de76484ce3616f0e32012a4e72f88b8fd30c194d164d173c4b7bb9b989b415ebd6e190c435b324c1d45bfee84ca63eeb1905b9646f9cf80cbf01d03b0cd98c506c4cbfd1d5c767218d0a023fd644115b17fdde55dd2ccb12daa140000000a2c9b8c720129c8fa91135deccbfa366d410a49281d9903dd0bd5c6442aac7f810d473a8fd46c82a765749245bff1f3ba076c95c24c95c309ecd5d9d88fa2b42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420778128" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26C0FFF1-082A-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001a6e710e2030a30d217a43aab8a5bfc83b72e70fe3752a4cc9b24e6dd5047396000000000e8000000002000020000000617b53f7f9d97459a70154fc4949473768ed601f6197d12fbdf3e5d24dde79b720000000420234030f4c243505d388d65c48f2862c569f63e7bc1be5c1c379cf9358995d40000000525305e586acfcb6e5024695ddec2560279d867d8513e0a315f3f74fbe39848c4671191edcdd43278b1bd403b2181fa4fb3d1076092c523681ac7a356fd74756 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02c5cfb369cda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28 PID 2440 wrote to memory of 1676 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d3539268669b84c5f02bc4517969da5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4ef53c54220b923f039aaee72526839
SHA105771f6099c05c21bef45ccf9d74f85d3575c442
SHA2560289d65cc2eaf5e40696f9d3ab93533721b82c413363faacd45e11d4b017e12c
SHA5123207f7402252e345bb904aa0ecc4bd2f624928baf4f602af4c2206607b24808461b09e1421cb56afbd20ea8ec84f70254e2a31aa4afa9c55d0232cf8ccd46ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a67fc49d3061f4cf6c49e8eb65534c8
SHA1c170787f578f280449e9a7f3578ee6a0997b6655
SHA2566deb99c3c4f9194a978c0e45a7214474be4c5369ef0c0e95bc992a04298a0386
SHA51226227d4349f53517dc3cd74c46674b9f58872210ffe757be732db10ca950025438d062814c344fce09402f3ebcf09e45108729ada3e38b316e7654ee1b58c294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592f86aa8d6a9a00b054f80a14fac5e6b
SHA11dbe8d08433408ba04dcc918e36265a1c892a7c8
SHA2569a5cb0f66bee5dd0ed77e8480bb1d57c6efc7c27476d729cd39d9c69e0083317
SHA5122214516129dc53f7eed14d0f87d33a9d843c64c6161323a8d05a603b9fb5a1b4d51a8c144d41d0c3c781818c7dce535c46913eeef7c290432ef3099ce8f6a152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588cd876845759f382b764a431d929255
SHA1ee1cc5d89f03aa1236aba2c36d77c5948462ba46
SHA256fe978185c106599d1974ae3fb8177583cb1e4e6a644f88b15f80e43600dbd30c
SHA5121f46cfaf07fd181539fd88c1b7d1b982b30372e4ae720dd97554db054aecbd4618f7e1d3c023a06b4e512652d18ac530a616579cb58d28bd75eb426b1e72faf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5430455ca70bf71e709613dacaff5ad70
SHA191ee1774794794991613e4064ccbc420815d5a55
SHA256cda012745d4c266161e4823896407fa9718de0a1464f7b55b83a87b3ce0e1077
SHA51218c9a6936349057ca021bec47196349b70d6e84232bf27472d37d0bb7cf495768ddeca49fd90bbff14871be89812e5a0dce6f1a520859157d748899c91f24438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8e7d40d7c53484120c23a84486bd491
SHA175aa92123eec18e1c1e08281143710fe2cc0dfa1
SHA2567c2fc82222e1063886eb31e920e9deb676b4dca6de99220627eecd439ef76733
SHA512d5b92b723fc33cb2329c5eb2513d3bc4faf568097361bc3299f14b6c3063fcf7eecebae3e5a1a7d2f506f86f069cd6ebfc4efd9944aacbba6b17ed1f01d4a58c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f198abcb810ce20e042c01b97d69e508
SHA1e3d8aecfe3f4a61b1e4d7e17fb685bc7452eb644
SHA256899070e224ee6e3f73e6711cbb9f97f7cc6d4cea4a9981fcdf8a61815cf1fef7
SHA5126c2082ad370056087c5f69be531bf7aafc13784b0bb132b4080eaec53187c8a5a9ccf2bb3e9577b6c5e36d979db15ecd6350d5f84a972fa9ef1da48b45290009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d81f200fe6d886096c213eb82fc93c1e
SHA197c603894920cfd6e5ee100b331620739c34ca12
SHA256ec293704e814bfbf6d633618b8a8b6932c111584a9d750988914c36bb6658c3e
SHA51274be876ce0f81a7d34b129645787a1f585e3885359b68989d056009e82b2055d714b52568c0651cf6523998499e6fd9b22c093c882438f569458af224b245e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac5f7f84504b7a94c1d1c32942e3c5d
SHA18aab80674a4819658f10ba0fb58b769e2b1e2a8a
SHA256ec712060fe664f0fc9d421f8fc5d7d56638de1674665aa33dae8255f6f097556
SHA5122bf996518aaa9bec32b541ceff50129eccb50bc058b4276334d08794c274fdcb97abec7e149559627dadf03157fced5fdcb23e775e79ea0f6524b836309cb73e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536d00c41954892c05ea7958b252be790
SHA146df45b63435ccbb323f2b2bcd64d0b6c14dde02
SHA2565ab8690ac314bf07f02365d20c9cb3bcc9f39895b310f175d4aa815008c8b633
SHA512ecdca1d11e0776b01b03264f8765a1fe6f53702a54f8c7e954514ab400e145f122886911f309e9b14599f2d8281d6ec5cf6b3d20d8f3efa8766db716e4657f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fb00fe904a031be540bb2c7a0aad5c1
SHA1c7a0787dc9876db72230ae84d783b2b7279153c2
SHA2562518feb8e7d9ce5068b80169e387092e9670f50139c42ed652333eee7ad26571
SHA5120b34a5381ac6750de17d6a388021fb50a6cd0a3ad68af7384d9d8eaddb00e34a782bb1786c6ccda80e7a84eda92b1078ddc625106f2246e40d6a313a384b02b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b2409ca13869ee5ba5ef4a1b140cd24
SHA16bea88fc2a2d158ec0ed3c763213c1d24aab0de2
SHA2563bd66f9919fe52c85f3f55cf7ca2644852d4376aceda67346e119475a64375fe
SHA51247984a16d46398ed154e7156aa1fbf85cb59c6d637f00b4dab6c63cd1e512fbec852fae3182ea7cbd510ae2d3a023d3fbd004184fcfbf549f4fb86b887d84472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518440a6e8bc6f2e306fe15574757eac3
SHA18928a3de2cb8e2bb38e0315a37706622d02239f4
SHA2567442176b43188de5e79fdcfa26159568e47bf880ec88969abd1f39ff92611ed4
SHA5125257c0935c80a731f1ba874c56ba306e3ece3df2d0d1854535cd1468dcb9c03668df0c2680dee4e02187e0999c70caceb6467aced746671a01b2c4c0b6323347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f437f4663d351d06f55352d8c0e43f6d
SHA1932b2ee9f6978f853ac8b5b8b8e6b7d5d534b74a
SHA256119be998a5d2b7fe459853ed421e47a0313841c6ff450c3582453d120f07ac50
SHA512dd353592deca87d31750ec6cf5f11fce437545c7be440d575c2e05900f74c6d7120d1f6d8ddcb66dec64b128acea05d76407bf146b97cf30ca4861e79cc7907c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569014fb00ea4a53df9a525708e74eab2
SHA188a317450760636e4bc85b0659d0152817ee5297
SHA256488e4d6024b3cfcd2b34f2e8e110bdc6e9c4c8425bedcb575f393faea6827afd
SHA5126e59dc989974b18163fb9cb86424b96a77869d66802ccf1f6d2b87597b3ec41b91ecf196c4c8446149a72b36acbca9b3e78eeb58f4d9f9d51d2d77cbc46fa100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710c7b4d70d9adae7044f992a4465e8a
SHA141bde0e26af94b4154069d280b66b520684b83d6
SHA256ee76c62b24c1e1e4c90b61cd3c8fdb1ccc182e7e7a064874f1df28ac53a658cf
SHA51296785a153a6776da983b253446dfc4d372b753c433d9f14e50ae090612b762b3e1fa538770558fde5bdafb99675acb29004aa76c544992430bde6a3bc2d96854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54630c218d70292094b489baef2554434
SHA1a88fcb75a68eeba39f5cbd5f6e57d4f6e16a4b86
SHA256d17bedfd96786419b6070595ea9ab9b5d1a8a5d5404b7cddde79159cc1bfd92d
SHA512bd0d7e33bd1b1c5963329b11ad04feba779f9335b5c800d685967dd5706da8822ceada2439308c266a53c2079e1c3ea7d17fd3df5075c6c901ef15b44b85c728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5433dd1e0add0d06eabf56bf901f6a7e6
SHA17f920b8ca3fc80496be100481082cfa35ab9ea92
SHA256e754b4f7b091ca0ff87e2d95cdb28d7119565ed4966459364a6303312cdabd83
SHA51224fcefee0d3980ea3307bcc9bf68f402f79f2cd209cd68a2c6cad331f5c2a9cb9e783f535d39201c511a89cc7a177a7f3f6a02e6df7e4ee7b348764140a97ada
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a