Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 07:47
Static task
static1
Behavioral task
behavioral1
Sample
0deb07e12083f7a2ae36fc51db6d687f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0deb07e12083f7a2ae36fc51db6d687f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0deb07e12083f7a2ae36fc51db6d687f_JaffaCakes118.html
-
Size
69KB
-
MD5
0deb07e12083f7a2ae36fc51db6d687f
-
SHA1
8b560e481bf8a0a6ba81692fb806edad1e1ae3e4
-
SHA256
3fd8319a3f5c8ae2dfb4e163641a0f2305a1e11dfb34dcc26ea4e71374b0ed1d
-
SHA512
4ffc824f2e7bb8afdd78327986d1d8c871d833dbb64062eebcbc0ac330069e8b0332c5e8f7778f38b100b8ba519115726f118ac2cb6f6e520d6e1b89e41dbb60
-
SSDEEP
768:JiugcMWR3sI2PDDnd0g6sqoHXGDDeoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQS:JywwUPTvNen0tbrga90hcJNnspv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420797909" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e44769498b37a7c77ba23245dda37017b8f82e28a33e28c10454b4e011e4392c000000000e8000000002000020000000b5432be8567133fbb0a47b1b6de7788eae55f02da882dd323bd8895916f9a6e390000000a15237896ed4f13a86b62811f6f4cd3fb640c46ee4772464b787309a8eb98cb783755e471bc1b5caeda84109e5dc36e392106abab063a3994e6f606366bb07e00cccc3cd9343f36e7ae53b54ff1afe66a1f14c8190c45f54aa951920071d5eee1f0e1b8629efff67394fa1457c2113f16b5a2ab966ee8121dd5d700b6ec76f76279a9b888f39348f90857f71a08d7b27400000003abc6076f1cdf09a6f15991e2817c28d3cd6656721635d86283e2f2c3115afa69d9c00128c2d8f21a6482dec4041921f60fc85e30554e13f1ab7743bb7e77741 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3521E9F1-0858-11EF-822E-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9051e609659cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000047586b5916686691d9db2fb4e3b55762fb410d6fb88db245296d133a1dc7ef5e000000000e800000000200002000000077eb44301748378a4a25a04fe027936d9f931941fe0cf2d781dd7787e312f4f720000000abe0b1cf5240fdbf7a2852559e29be922d9ed8763846cb0a664baf53ab4f04d7400000008e17bfecc9a00b038a1d6b0075e93d69f782c17571794a093af9e481bbadc493892e4b4a413f83248a63ef998443788350b6af1bc01f923c2ca9646bd453b76e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1676 iexplore.exe 1676 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2324 1676 iexplore.exe 28 PID 1676 wrote to memory of 2324 1676 iexplore.exe 28 PID 1676 wrote to memory of 2324 1676 iexplore.exe 28 PID 1676 wrote to memory of 2324 1676 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0deb07e12083f7a2ae36fc51db6d687f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571927bfb575929fe3d67c63c629b2252
SHA108e0e49377d636b79a50b79905efad46d37a64a1
SHA25631e8eb2e122c431367cc434600d1563d0300702414c30c3e2a0a398faae4b2af
SHA512301bb6860c613014aefc54c504e70c19f053af5d5308e5a75f7327399ac3ad727de0a1c5562b803df7df97a1c19ac1e216ed9919704a0da020e19b5ff2db2a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5863efebb67ebcd7d8c2595a6158a87be
SHA1b0623ac6ac09cd035f5594945209be36880fb248
SHA2565f980291da716d7e354e937c434324582a374ff3a4782ae0263742d2c8bda785
SHA512393eab31a87a64787af9a26a43d9d6edb4f977c48c5e07953546d5d9321cb560c37e6d931d84388e62f7811b99890f40b6a5c59b9838c365596cad09c7788548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5728b86ff578350d4e2f6d3c949045c13
SHA1dca91e724284e9cf4f1dcaf5f7eafa48148e7859
SHA25667b27abe190a9b240a153a6a14f216b2567ef86c4ecb163f95aa5864cf262552
SHA512a63421c09e0e7224da521f62bdfd2078801eb2a09cef5b22778c12c844b0d44f78924241cefbc82af5b66964ba930b22071ff5ee104d7b4e43f2ace79bc54fb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa93f6125336ea0e367498a5f78b0c66
SHA1ac7ce859ed58311b43220951632d64bbbcd68686
SHA256c620e7a8c8b18c0727bbc94f0c333b839fd554e73711269af007f26ebccf9b1a
SHA5126580f60e3973c66ac0d5fab57700f91e59e0444a634723a3e4082405ca7f27de7cf9377dfc2291a25646097ca896e7261d9f0676e1f01bfeb13995435a9cd254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52399d49068a6e12c5b8ebb319034983c
SHA194574f193bd81375556cbf6e52b69e6a39291c76
SHA25650cefad409f9c95bed7eff78ea83513cfdf79d357f345b75d3e9ea428297d6d6
SHA512b09af3bccf72444574bdc5604bf476c45ffab0f4e77363ef40eccd815f49074d69842d9349f6bd26b730538196a5cdbc9aa231582920c82d8d23657dae6f01ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576fad0acb48b60395db09180eb9cd622
SHA14727d376fa025a51e1ac97ca92e37cc8bb6d9f8e
SHA256be869fa05968a7d8d8c2fb56f947fa24f817d320706491d498e5f61be588c9ea
SHA51275ed752314a811221c355bbd42a6b62c98b309e5e90287b2bc230c976f1c01423ab6a1e93daaa115c86792dcfdd6a7ab27e1c8ec7d23575224374d59e87dbb9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a90727cef70feea6a6b49ca4865452de
SHA1f6fc67b68345af2fa28bf25efc3cf7716adedac8
SHA256895c37b4b493ff6a8e5ef7ce7e0b89318f9e230649bc4ffea3406842e761256d
SHA512fe5e4e0af8d3f6d8bab3d966651fac3a3b97cb6cb1c70ae17c822d0ec697a9578233da3c39491c921e71c8dc52209a2f0642cb5092db7fbb5c74c67d89dbf75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca2adbf1e43ff1e0da7e1739974219b4
SHA1b8f7dd5684dc3ae1d488eb7787ff2aa527eb7c3a
SHA25657627654724906f6ca6282cf6e9881dd6513aeb7183647f124845f28ce844685
SHA5126f115aaaab6208d31af691b3d9198991470e0bb0c43cba2d104a86b23f1360873d1e749ff916f206e20c5d30bd4c2b4190b6dbbbed99286d453048119cf903c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d996e4382d8ad27c3791c7b5e9bc0e81
SHA16d3ba65055b7d3e5175a717114647e79c28843c5
SHA2564eb85e40ad2a5de6d0b0ac680cc49b5ef7932bd20d4ab11adc2a53faf394f9fe
SHA51248cdcb47fe34abf5106599dcd15af057a7e8be703bf49a3266d232e9191793f9744e2cb8a06838da99c54686f02eebeb2233347a8353920b2d98b427acd1847c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597dd0c6d55f93cb0a40f3efd3375d85e
SHA12e870b04944c885c838c3553c7e88e21d397f893
SHA2565809c0cffd9872ee954ecc84295d9b23be4354effc2aafdde312eb0ca4785873
SHA512e2d79d065165344e8ac844aad9375b1160486b8235d847258385012e0fe2295664c9068b2f3f532ee9b0e66647def5d49109471568008da73cc89918293a9c96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bf63bb09dacbec6a4c4a0aa3362c69e
SHA164446083879075379c3f73e53278930d9724b2aa
SHA256762cf193b583b7a0a8c859fe33c84adac23da7de6c946d76639694ea0a124d4d
SHA512ec932e28835bec7dc0d7f8716411bb549ff819492bba61e6684261648702940fef90e40c5bac6735448967722796f9075a05ea857e29133e9404d3cadedd3f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0b9d3658a6062e65ee5f62009ae560b
SHA18779402975e7c8121e1df7be46be9c05291e93a2
SHA25636d883f8713fb0f93a92e570a32e045befc533cc6d1180f5063d6d9637b88b56
SHA512995313c8d6069d3cede1983d1425b1a87884350ab9de47bcfb272eb3e887f917e66381975abf6e32deaf3944703554e04b1b7ed0596166eadfc663b3594cea33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555b50f69d8ab347e6835e08fa2f5d50e
SHA1506ab1495c9294df60a85d63dec604b91ab7aa1b
SHA256929637e10065560c606ac8b9fa1c964770d632770fecaeaa90537326ab1e1d4c
SHA512e0a82c802da61ff336746aa7996eb93307d2b4a03a736b957187517c87300490ed43fcd64e3bf16159ca1667118c42b87a5688313570b5977ec41991990edaac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6ada389006d5665eccbdb1dc1fc5cc4
SHA1bc8cdf1616b34aefe79b55819ce6c5cd04995754
SHA2563736bd19a8652b713655f404cfeebe73d49bb20e789c0a6359fb64eb6d3d4f10
SHA512705fcba02f33db9ffadf190c1f680306fd7417f97090603df09e17125b0f17d303d432bc47b31e9283593748346eff0f3eb21a6bf259ae6ac9d71ec0ab41db54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54366eeb0b80d98dcd09bead4e3df97f2
SHA19364f354898ab68803861eaacbbb88d0e038ea7b
SHA256fad0ac0a1debebbc84ee6e5dcca88432468383f0d062f71cae63af9ba8d1a3e4
SHA5123970604251d5d756db1481ff0ac6fb1d62a2ff4744a974e0aee188b8904a418549a5d050fd5f75316169f116996178879566fb80c3b1108b9781a5a939ddb97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9539280463505fbfc20001f5e00dd32
SHA19ebf6c51b52115fcc37b010cf7c8ba2163715ffb
SHA2566209300be076814eb3d563f815ba6bb6a749b593ae86b27874f7bfc68863d801
SHA5123a995c201104aed6b8abe4332c851aaf4165f95d0d57d264080b4035615817b3ca7856608e53d392fd8f0d7398ae864e29b6d7788edd85a0a5196589bc69a343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beae360c623145c9743ac051875e7462
SHA131442d0eaf9505917c5f02ddcd3891ebafc590f8
SHA2560d6b5c790ee16ad94e5817137bcfa1f058651cb67c0e8fe1db9de8d73dab9798
SHA51221277ae1c310cf87d621ec544fbefbcc4de822847b0d58959bcef153a4c8a6e549626ef8c3e90a071e360d9e62de360ec151140e83c46389ce946a994ea6ef84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ebae68ecbd9e176d44d0c08781ede30
SHA16ada71d903e50d2e2fad4fb181b32611033899f8
SHA2565cf3b7a618cc8e35e7dbe2481446412e933d143dd42fefb9a6b15d4524b38b00
SHA512914e5247f3cb76a3e2a3e3351212d87b37663ce4de4a6c10041eea315de279bcdffb1b36dd37763ee5681dae33b1b30ad88ee585c83714c04f3e67895f8d7061
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a