Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
0d686ae018e5f3c0502c6246148883a1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0d686ae018e5f3c0502c6246148883a1_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0d686ae018e5f3c0502c6246148883a1_JaffaCakes118.html
-
Size
118KB
-
MD5
0d686ae018e5f3c0502c6246148883a1
-
SHA1
36ebcc136c2e02f9af6567f2b0ee7b268949e962
-
SHA256
a1a87da31b48e767311b86ad843049f0e47b1f08566ec1a521ece281e50ad78b
-
SHA512
9473f6d728fb917beb927a03289ad67f1b5448eca09dac051042684827185557229991b8a1ddeea5d2d511571f2a887f080b7115ee0ef9bec3e9ced98368b81a
-
SSDEEP
1536:S0vZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:S0vZyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c32f5e28016564be2d20ee5ef7b4ba0ba6d3c2b4000019b92e035f0bbbf2c27b000000000e80000000020000200000005aef4b4e5522387237c5eebb6dce2f8c3082cdee78ebb5cca1d66ddd10326ba7900000008b197ef3fb3f12ba816d5cd01991359e6a32705aeb73b4da51ae433960ad53db4aeda8bd77d8bcb3cd648097a09126b03b37e7e87d3559e7974886247b7736647b59e325d998a495380166d7a627d54750c35d159077c686a7dd3040d695f48404388cdebff2996cb8de4bfb4d11c6ff33df73d96fd9863c555e30fb46e909959d7b5d6e0022abfdf98c27fa88ef3382400000005877ece15a323c3e2faab46063258586b95240e64279e0366d162bce5671238d69925a8bdc22c6d7e85f39a0dc099b93ae357097c4c53bb1536adab4a4f2d96d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40603ad7439cda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420783651" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b2d64e1470dfdb29533e8537d15f4fabd5b7ac72da4171c94485e4920c1470be000000000e8000000002000020000000084716657d575be1667a034caf863cbe9120f13c7f5d82bab20f0f2b0efe5eb42000000010568e875eb620fe6f9ad9152cba8a4cbfec029127870268ff5d1c32bf43501e40000000171a76763e80ac7008a34ebbf6e6571a530eddd2475a50cdbcd1335e84658b8ecedbfaebbd0878a2f64f7bff12d5c8bc489cf4366061339d6c8df93e74a943b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02AA08C1-0837-11EF-86DB-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2016 iexplore.exe 2016 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2872 2016 iexplore.exe 28 PID 2016 wrote to memory of 2872 2016 iexplore.exe 28 PID 2016 wrote to memory of 2872 2016 iexplore.exe 28 PID 2016 wrote to memory of 2872 2016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d686ae018e5f3c0502c6246148883a1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55574565c41315d0f016c9080b77495ab
SHA1c616dbb1a61caccadd6af0caf8649610d2a76928
SHA25676fd78538d570785bdaf2ed1cbecc6d68864b8f59c9ede56182d0a1b57a30f97
SHA512b417a25d7d9af60a607ad0f8f2fbf0f13dca73baf67d2e6ec4fc5d77b42a7a24375de4ea0de186b8e9b6c80499ec5cbe3955db85674b8b708171b44def06dbc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54239a03d12bd4ecc59705e3e5a7b5523
SHA1993489cd113d3a47c7aa2d75dc11c6bdf1384a52
SHA256dd255c75b9b01167fc0cb698ff39b18bac67a4661752ff35070becb107242761
SHA512326a7c7f092d34891f4001b738a2ef158b4b689a46b0443b27bb781c949f8991f793ed0f1d531608c15d50c9b65ac23423c5bde7b2fbdda1e0e9aaa29dd20d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b03bff549cf6b02cb4b6eeb600e9657
SHA18732eeb8c121c26ac44d77e66eeebfe4ea555516
SHA2565fca7a6252982b7d54de964308e4da95ab2698e8e087eb6f602c62afb50e9523
SHA512e126e002c17b8468acb1a96936239e55e8bafd227171df6c6c3a13c21a4458125dc936c3e9a8a0d2ebf73c7d3d3839cd6910f68a02ef0cd31e5c8bbd2b0dfd5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa43be215ac02c4d79830d08b5b562d7
SHA1f64ac05ebe2e0baddc60e3437e6e25fb61e39c11
SHA2567a3d3fc2e682fe73c065732acd559a58a8971d2ca67e676d82e7594477c60646
SHA5126b6a1d1eb5494ec789839a6429f15ad46e303b5fc904659204f88f7386f6a3d55494ef19c9bbe292aa902cc7ce427222853b34950c8b776ae1a79ab589429450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588301418532a5784680a86256d0f2c81
SHA194c9035b3e510dbe5ec19a617f5edbc023213d91
SHA256d1edd36c34da7348324c08e51604f4402229db987b1271f61047ac471a11ebc6
SHA5128883f5bc06cd1af5ad56d6e0f231f8261bc707e45f91d23bdb0362a1f7fc7e5e1d2b37c9778e76cb6ae9ca11a702ca2ca6b24d7757d7376e027abac369ad7f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599d851c9a1537e78747ee20e19c82e03
SHA173130979a6e7eacbc6e790c507efca55618d8703
SHA256c1a6ae5d44f87a9133d7c45c3d206726140c83b55b36b4e585a09898e504ee32
SHA5125565050a67da7c0363bde4c8f6495ff5977c569e97da19c2529c6eca6d905108e64058ba523ad314824aa5f5e639474daf7a6cdb3477d128e1593ab8eb6113b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51860c5218f1fb36c3ef12d9b1a2f3685
SHA1fcc33acc951aeedde61b6819528daf96babba0ad
SHA256b71c67c5a8c0c603624e77184b2418bf5e6258bb192c4f025e8904694d5c5e50
SHA51228f43364f1f0dda441cef5dd2285ebb1b7d0f3f109580d9ded97dc290a20914ee818c0c2505c34135793d54e704ce914557358369c8f9d4a2cd119eda010beb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536bb2cd4c370b7411abfaaaad660478e
SHA1cb137d32a402c453d5c674c65357bcce047193e8
SHA256deb33fa495282deb12652e703e109370d7705e76dedb4a5c7fb14d70ba157cec
SHA5126795f31e16f2c76803d16979ab7e3179b985f3d9b60c1735652f66bc3e1bb3a879437aa7c49156edc4f722ea40cd1667166265621cfb22558205f10df0c4936e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50735526567e7889cf572ae701988af78
SHA150114445fe7ea6998f1ed67a4158cbd12fd0787c
SHA25614b5840e753e0a9f5be54b703c968ad6c2836be98ebf6fb78dbef9ac50d3aad6
SHA512072350c29daf3e3cb48de454cba23ecd68857b06430ebc0eb86fbff83fcc030b6c64f92352058d0d977434e2b6056208547dbf4087d06549f42d0359045fb19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a53576c6df6454a2b5b2e22e69af848
SHA1fc47135051c8dcf09f92368ce7b0264856a9ee52
SHA256ced46dff1f8cf32a30809ec04a051f9e49063106fee709f8731053b5f37c0335
SHA5129d9f3551f465e2d24672f15cd3d6910b94f1e278551d00b6bd6082fab75fea02bdd5fb308b4456fbfb862e14d85dc6be92b2fc36c3786b6e54b982a00403e724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d12ac0b10565bfaab888d54e78a2381
SHA1449cfdb47f084a0a6fa1e41d39bdfc6247531271
SHA256bf7651c55c55a931084e1613d08335a010d7e71a9728d22c3d8e8cfa7bb705ce
SHA5129919e4c91d858e009289a34362d30790b899ee73ce0ad6c624246fe1d42853b06ce4e5f7b66c5f9b1e1ddb2dcce6c1ddea5d26321419a7ed4b1780f40c06f253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e444854c2bb13e46f59835562a7590dc
SHA1a45a2ddc10da236fd4145240faf7dac58f8a6cff
SHA2561b79c7cbc4e4371c6fe60442d42edcf30185269cb41fbe5967f4e2dbb5c65c13
SHA512d4ccba6d110726af3b37055cc2f8b071d8a3cadaa428ad6926fbb2758e13f7989eb4b211f7f9c325ec42573ac8a5bfbeb01e7a0ebd1d1320dc3be6246751c251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d6709eacc4ef8c55933dafd7f8461b
SHA113860d21b937ac19650b47b381e16c0723707c48
SHA256f80f9db308c3ae59b79322472a6dcbd0b6ee55024580131a6143a1424fb3babc
SHA5126298bc9ad79f444f4b3d066d3665f9642ee21704c550404dcdef2d4571a81f09da4c4cba31e8b3016cad10ff9bb995994dd4e517b8d19f4c160e455b44576eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dfd1144c470ec023dbe58f7464069e1
SHA14d8114bdaffd85a0636b416c40d0e348956eb198
SHA256d53bfd363073fdc7e9bd9a44fd26bc21a590f1d4bc11bb542bd574354cf7b336
SHA51229a14302d619c88cf188ceb57e6f4dd98867a6d79c5468e17b312d09b8b2c052af92db4ee624fcbc4f3b9e0d369db8b74ea41c1647f57fb36a71b9cee6a382ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5994795cfb721e57c44917cb6a022d300
SHA1969e864f2d63d5c6c1014048d6682d426af79b69
SHA2565b112dc7c10daa6a90f27f292164c97bd6c0ee6503ce2faeb991871dc87caba8
SHA5127fe096c86d6870be31254c80fd7dce1d2f85d4bfd16ba6070b0f4936a8ce4a596411677b7450d421917088c7bea919f67d4c0b28a68499c85c978d97d3fbbc77
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a