Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
0e013084fe5f9d96a8af460c611ee06d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e013084fe5f9d96a8af460c611ee06d_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0e013084fe5f9d96a8af460c611ee06d_JaffaCakes118.html
-
Size
30KB
-
MD5
0e013084fe5f9d96a8af460c611ee06d
-
SHA1
25b7ca505dad9b6b5cb1f758a65c71207561fdb9
-
SHA256
0f8529099d377184f540005544604dfcac2d8d1ce451336807985b132305bd39
-
SHA512
1768f87acfe2c7a344b5ef61aa2b1ac3b87fdfbefcca96c167bb50c5de78ab368496cf0a9c29531c49595e49beb4d37292ea33eae901ac73f668edf3f2f28cce
-
SSDEEP
192:uW/Jb5nUZnQjxn5Q/nnQieuNnrnQOkEnthRnQTbndnQTMC+Al6K+iibI3serwxwN:rQ/jAuOcca5zARvf1OT
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420800651" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002b9bd9829f70b69c4c4e28ff34eee6c7aff1b6ff30eabab770586a6de8331ccc000000000e8000000002000020000000ee1ef8c7d9023e328447da4e4358167089cc084a5460d6f84ea725b5e2da753390000000351efaa71a8de6e140b955fb76cd5216af32ad89472aab3c7e4bd2253b7103116265ee7dfd3e1990fe14e3d38b4a5aa23b1aa0732a89c04e414c197f19186be875c50657201f337e0e5e510d0248f216baeddf87cc7e45fa33e8fabdd771ea552ca59dcdebbc587cac30a5bb349be3aa5d90d2883625cf218589ea716a4f66b0a85e9537df73c5ecac2b206faafa71df400000003e3cf5bf2e71d20a3c8561967422996c08034687d59a75da079415cab513ff6cdfbb2a338e13f61830444d68b6b79d28bb4addccb495b164cae1bafc2923fd16 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f3bc6b6b9cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000004e049b6d3578c7ad92496abeb855ffbbdad16071db091da6d5d6bdff4bd6da3000000000e800000000200002000000017c017d401384215e6f8f80609051ae01cac991b17179c446693a1262408a92c200000003d31b01ae4d3ab891353c37241b26855545ddbdd72923122d967b666508f0e72400000000ff27dd9515c8754562ece5a49c057d19448cfd2939ebbf6f935dd6155cb3ab19cc001502639cfccd951059b1c9ebe131608c8d267fb1bb53355b41b318b963c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96219511-085E-11EF-BF06-56D57A935C49} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1740 1252 iexplore.exe 28 PID 1252 wrote to memory of 1740 1252 iexplore.exe 28 PID 1252 wrote to memory of 1740 1252 iexplore.exe 28 PID 1252 wrote to memory of 1740 1252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e013084fe5f9d96a8af460c611ee06d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab64fabbbc3da8a8279b4b7cf14218d
SHA1a254e557a788acf21898126b9682b6c132479cfa
SHA256046ec7d3688579c71f0fbe42e9948b5af5aad88d2eecedd40cc9d926ffd1eccc
SHA512102db05adb58f0c67f1867bcfb8707f8e9e0624834c7fb34a76483fb14492f0e8514fdffd58a5e2cb821aa60ce1840a68e787f31a47df23ce3b3aeb3bf2dcbe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539627a2314278a3350480e96227997b1
SHA1db0cfa5541e07491007d41669c055612ff149dda
SHA2568721c01a4f1831393d2bb822e86372a877dfb95ec2d6014b8ff8e133b757310c
SHA512f0b6bc6c7f5d1b64fa6f6e0eb26d85ac58bddae55bd9d3f169b806bc94c624205c1feee8837bdd7106fe02eae76943f22abbc18cfef488c69adef5f3365a6248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9e2e7e8a5cfde6f777012400abf431
SHA189a5642bd98cece0641f34106a6d920f8748fdb2
SHA256f546bf233cca9957432d2fc77acc53d48f5949911bd8bb920fd34f508b2cbfaa
SHA512a8e22d81497d2c6cf6346332ca17264b3910ba2fab1e80b38d6cf0776b873f3bda84db0a35566052de7dffa3fde80e8368d7fb7ea39b448a0f4dc58441c72fb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8b30fc3fd0eb479e5b8212271592136
SHA1ac61c4cf102b0aeaad7cce040661018278c7529c
SHA256763ca73177e830d79912d885f707827c69ac34ecad7214983fd5e9c3002efdf5
SHA512929da5da05f637f330e592f3577f9966bc5e0390002f40d827fb997781d51aa9add4a21827520b21414ec8b9345416203575b707fd891f0fa8f02d8d0b7b2b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527b918b3d1e4db580473fb2ede30b30a
SHA16a99809a479188a9ed01e154cbb3c498e5b288a3
SHA2565e3ea4006d56dd912ceda7104c91669c33be1af02efaa9a53d377e3f018f9c8d
SHA5122b262051edf59fe6cf20cbe00853201ebafd8c76cdbad45cc83271ff4715290999cad987d5af2c94b79a8b6d8e185234c8176edd1d4c4a7786835e9fa66f0267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c57d5a6be498d66f5adf618504dd0175
SHA12fc206b54a2bf380ee943c4c69d89c7633ca95e0
SHA256aec457bf23772bcd5a777ba3f169677c2bd3c93b1b47deef2a787ad558603ef2
SHA512cb35babe3a36671d8acfd87085ea2bc3033e4b8b0aed5d1fe3ac49a5e9a2e00779eefb8736d6bda371087686513e5494be6e677c16edfafa75bbe596a34be1c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a27150a63c4f807894caf3f6d7a2d15
SHA1dbc719b824cea97745afb366c7d77fcb6718169f
SHA2568fef6ae22089a1f9d72bd17e614fa251f89f7b5e2bdbdabd25443d0541b39489
SHA512cb36caa1cb799fa8b6f2ac130006096ceef75fb88fd255b3aada5ef429a5185195acc1f229e4896573a964d02e4b6bc3a6953f2bd1c797b7fb9a7a0fede83950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adc947b4612231377b84b860784a4235
SHA15f4a94ea9e5cd44196a5d96bd2b3614f4f4e3b09
SHA256f2f1ee826477dc841fb26411a21c07cc2ada9eb3fdbbbd7d793c1df06119993b
SHA512b42bf4b4c22c663cb576be848eb7f22b2fbf1c9957c1ffe09a9f80653f72f666c6331b2fc8d8ff2b972c5dd028dcdef2b9a97f352989932325707add827d9f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f043127448b1d449baa50a5d77182b5a
SHA1ab5eeb7c6e269b54f8ace9c2c90469488a6380a7
SHA25605c3f64188e79ff8a8fec2d8147db3f8d27d6a082682417a5a70370f75124a3b
SHA512497b9140c80b32b742f26271d2058124453e604d7320dbba02bafdd77afcac5abe9f2d4d99da59dd19de5e16f8f61ee88e946d06539bcc93faeca747e308698e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9b5802d8e11bc28cb095922db3641f8
SHA1de03c9c4c7025bbe3b96e97ef5d017591e45dfa8
SHA256914b01f24efc735c6816e7eb71b0ce898c26f5ae52034df033ef828a9d05134e
SHA5125e614adfacb35d6dd4a248590b6c98711cb44b93b00a1c70080f4e1100f97929bcc58b5e7769c6f91682a07b3e1ad5ce4fe67a9f46904b4a0ee4836297751844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea2c1df065fd9ca5af594740b32614f
SHA1320b65b8eec713cbf61d74abcff952089d04a543
SHA2566061414ec6aa34b5c3d5d0d3df016428db04a20c3fd1168e00de73de545664e2
SHA5120c14637fafe9342cb44aed7edd1585c9b40abed6011cb680da2943ba1b8a15e9fcd647427058952c61a4dd2884ff53cd334ea1e20e8c383ddac9bf2b95c23f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523d32eae777edaa8e90d07986795ebf4
SHA1181ee323374f926898a697ff6eaf02451644c7f7
SHA25621bd9f3122e45013177e33c93612d20b781e9233652bda17322a7228350c5733
SHA5120dfa738a3924c66064ac3a927e58f191e65a0f24e276c31bf81cc4ee30af6cc62a0edc33a620db9dc767f53c06e7132e8e09c73cf37bebb474366753b9c18fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d805c55ea20b89b48a25ee7e335ecfef
SHA17e401ecd87d24ebc23e1cd49f2cb12ac56cb3bb9
SHA256aa68df81a2c817616ca2f1a6319491f8fc3563374474f2c84854efd98aa1d517
SHA5127dfd76ae57432c09cfb41ac9daedd21cea6b2a851f0f12d76698936b099eb93a61eed9c201f0bf5353a0aa5a54596130c4033e4a584e51958df61cc88749ef44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b12ea1ffe4d98022663636033a8504bb
SHA15db27b53a16f041ce8bf9deec3e8eaba45891b14
SHA2564fd6e39c8f6b788436a9d0f19939d0dd0fe2e6398602f306d0aaf563c97dc0ca
SHA51289a73e31e38ce28d42c2266ce8a3c16eb62d2521a4d9318e6af9abbeb0642c99aff2d745a07a6020247c2ca6c979987de488fa8f4c0fe73ce3e7ca00585eae94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54436dff94d6116fecb2a02ecceb51cf8
SHA1e0318ce5712fc0a78ecb65b34da38d88b684b9da
SHA256a9a2a2208cc7d748e64a907f464d4619720801d6d18cc874c94b002b4b79efa2
SHA5121c124f98bc4370786d9b630da30646be93d202b5b499bc040666f9140b7f8499b4bdaf424a4357be059e94c48ec00f770d809fc2fb801294cf92f70aa8471b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597a7277bf1a02ce1e23f77d2c1e68cdb
SHA1d7d1d77d995ab669651785a41b58690359627de7
SHA2562b191941d377651f8b4f0da1680c87773200e2bfc7139dbf10c1465bba363d6a
SHA5125bbf4646e958760a74285cb0874f7d508cd40e731112f651128f7c514c06cf7de05efd6ed44cd7fa85afd24b663301f77fff753a9cba96ce5ea43cc3d7de88ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a