Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
0f8e935707b7ae8af153c9fc2fed5102_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f8e935707b7ae8af153c9fc2fed5102_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f8e935707b7ae8af153c9fc2fed5102_JaffaCakes118.html
-
Size
460KB
-
MD5
0f8e935707b7ae8af153c9fc2fed5102
-
SHA1
284146906a5caf77bc4f87b7a9d7e090918af585
-
SHA256
106c757635918798d5af27a358a7fa2d2fdc484593694b959cfd9dd0bb1acef1
-
SHA512
15704012d9c3f6ad788a40bad4e85ff54e6c32ece4fb0b11d98771e3492fdb80a7e04ab52272c976e9849ed704bf708c0ae2f19255a013ee35b4e157518d7cd3
-
SSDEEP
6144:S8sMYod+X3oI+YssMYod+X3oI+YosMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3I5d+X3E5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000039e5e8fe42be4ebbaa7eeb435685270152d14aaf5d0d54e7ba224deb77d5b926000000000e80000000020000200000002b95eb784d0309dbe35c61e3cab18468763f08aba0c5364b43c60c3f8b0c6ea7900000004acc133a02b5fa76bbfee3ed97754a13b12b234d08d3a736ccf49dd5c3cb7cdc5a6d4093c16fc45f8880ea54af16d1d1f962aa508bd348fecfdf943bf859fcb897d48a32d57dfcc5601eba6956dca6e7a9cf61992d6911840a3e760cabb8d2c4d5b0d82cfae4f1d76d9effd3c44c12744caece9d433eb1761a6803225de1cc36addc5c211163a7adaa88039a26f4b5e7400000008d21078c13520b1c0ac541fd01988b2c74562a2238491458369928f00c590cae5002dbd3218f134953ab90e523216bfa689d7dff079338b0c5381a8f011a6958 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420868417" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c036c737099dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c32ae1b1c62e629a7cbf999b2652942424f36d42fa98a488aa857bb54dfcb5a6000000000e800000000200002000000009e78482e468d52ae250c3405bd5abd850225cb38fa43d5039d47aa5f521ad6420000000fe14cca25a0d8b950bd6dd690f478c830bc1c1b760516c1163d5a4ace898671f40000000d5d4abb0bb89f8e2f31ddac7440a847ebac0d589104352feea44fa1a29c9f18f79b0ddbabd40492ae930c2bb52aff1173b60d7bf7408f2a051cbe26e6ba219f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F2C9201-08FC-11EF-93CC-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 360 iexplore.exe 360 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 360 wrote to memory of 1680 360 iexplore.exe 28 PID 360 wrote to memory of 1680 360 iexplore.exe 28 PID 360 wrote to memory of 1680 360 iexplore.exe 28 PID 360 wrote to memory of 1680 360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f8e935707b7ae8af153c9fc2fed5102_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527f07f6daff058bd84901b0751b071fb
SHA103b8b1ed2a135c8972cdc329ce587a411598a780
SHA256f3baf457be46be4116ab5a091e7f43bf749266ccad5f52c7bd9eecd8e091eff0
SHA512aee27c010de1a567be4976ec059ff4f3fbe7408da50bfd6cdc6caa9ef726b9348e0c660659c5c0496a02d588d78c18f6a3c88a601cfa1297775fd78a0a65101f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d69454799cfea1498b6eef625b31a69
SHA150dc80a8e0d1b893b014e81b18302064f017dd84
SHA2561b59fe0f2d4ae25f6f297ffaee6ad645584e3d0b2680b5cce60f32303bd47adb
SHA51290f78ab16ca6ed826698a2c81f91668729d634545f9fdb2f6d48f9b041427f3bdff4bc57fc38c22e5537f7c76ec7f403af8e6143cbcbb85128111e12c1da9871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509666a85ba8b7bbb6c19adeeec766add
SHA1ce525c2336ba35f0b7f1238afad052b5b3404e65
SHA256c9cf0133f502760cc3da92f6d97dd98adaec43fc30d39f8b584e645653d3c47a
SHA512d08ebedeba66b9f2418bb2d63a085a480dd3029c11d7108d53404185e8aaaab85309002ca71de67facb66a635cad042c073d1723fffcac4ef4b072d4d52a373a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dd75b039872086e2da334a5344bd2f9
SHA1819b2db10527a4fac84ef96ede1bda789fdf1eca
SHA2564c7de093ea09b768048d9990c6f2d0dbd3f9d90f0b598779ad400c72de00c27e
SHA51287c2a1f1d1cd5e20ff0af2e44dbd80eb7c7533bc0a7a71378e0476c6c40ddfb7894eded8ab6d669a0ce640688805efa009e84d227ba95bec6b3a71f263fbe914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e02e1abea48fb8489e8526d488a491c7
SHA18bd8cd2734b35cf322d5e08df4b0783830375977
SHA256c16de585d4680554d97d51e2c2478f328a1883e7487e28c04911e592ebf7411e
SHA512888f148db2ed84b5e63d443d417b31971300b6b9ccbf9c6fbbd10aef79d04a3e099422ec59fbc18aaa4fd8320bfbab414824c127b263bad470e10ed1910045ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d912dea96658d02bfd74f48f8e94324
SHA1a92bcf37c1011b1083b42f98b6b7a474b0c4c978
SHA256b86a4d5f364a33e931b82906c5a667f32ef3c18a6a2ce51baced1500184df6fc
SHA5124a2b72fee440615b1b5349ca75251c704d4dca7e3eb0906d7710304fdb9220bd9985a9cb8d126ea13cb63c94bf7215097680aa603ac736c02fec8e452e064124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee861ca6dfb394817beadd4c46414c6
SHA16ea03713c92ca5c0fb38c2e60c75812c89c88e02
SHA256595d20bc9305a518d234f6eab7386f34d06b0a4c40416bd227ff1f129b915eb7
SHA512017db1f61b872aee812c4ab1f184667efba5f4fb13dc126cffb8207768e322532969742c036ceac59376b3167dbc5b79b3c0167cbb4abd6eb9437ea08e75c2d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55de583f572c2154a19319e25eb8ecce1
SHA1f603004a22b59e83a899de6d2fe8aa0a7b0baa4b
SHA2560f49623aea5723906b9f2768b477928c61b0af0a7f22328711b286dc165fe3b4
SHA51225f7424baff84a94cff9c9852bcf93bc238876875a4a61a4927cbbefb3cd991f1e8a043d13822d293b09c3d4fe037b33cf4e74ed4231bc7c5d854e9df192329d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d762fa3e705d509bab7f434355feaf2
SHA1e880c68f93db07e08509d93c0ff5643cb92cc1b0
SHA256669c33775cdbf57c8a88ea74e518de173de44139cdd17878a4924a8004c773b6
SHA5129bf17e5f8baa27b3df910ab58edcbf42a368136f6f57700e4fb8a149c5033c7955d167b6e549cfde3eee7324e0aaae8db3b43acd7f831678a1a237c4186aaa0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f87fa0121fff3d3e2be24bcec011c903
SHA153e96be9dd976a1e4851723b506f8a0c83c63694
SHA2562f4d73c4e5cffcf224c43250e551e9fdf59d71e8604327e7243468e3f4fcddc4
SHA512d80bb6351b9b83912eb6b9f8aee0bab3b4627a93fc981040340cd150b6a38c564edd6a44364403acb87bad576c9421b6b16dece64616424604e717ac7103054b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5595782624bfd462cdc492f431904aef1
SHA13a407b8c381e1607ee2905132c78a0fc761c6c3b
SHA25624b2e40152de9c94d0231b3829bc70b2e41ea32926b0ea67db859e6dc23f8199
SHA5120d254843d8523ff55f12209f0d35250a27c7b653eeb831b0b6d2cd98ab3541ad7bea308e33e16def8aaabfb72273883009a021b47abaefcc2eb92fa5cb50f4a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e13a28d969666afe9d9aa5224b7e9612
SHA1fde12765638456b24385bedfc703781f386cabcd
SHA256162c0720bab0b2202db0948dd4e8becbca874fcae39077406613ed4d572c8de8
SHA512fa46a98aac8741dc40f5ca5719165357567a79a1c0b6f774a25313d742d1754841e43da961d4d28f815ea81acaced30c39db8115377e083157feb5822cdda77d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2b14c93adb10f0784f691ef1c653ffa
SHA1c195d712cbcb896a1e42e5c50a1478dd050c2fe4
SHA25643fd076799b3013fece5cabc229d88d2a3eed45d008284a2e5bfb836daa716f5
SHA512c085d0faf57ed30e0024feb85164feb45898c37e649fd283e8c874769330834acf29a7c372927d0d57a24ba5ffafb74972272b94a93b6bcf5bf3355921697bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5780385abf28949371a4c281dbcb24a0b
SHA16743dffbe27b912097d006da44f77b8ae1eb77be
SHA256111eb0a4419eaea96165f91cf048d927341423a040342c511167ee4a28066292
SHA5125998677c4854ee68fd3be9198ac376f69f52bb74497c2d6113015520bf2e6c54cea5eace1d0f597c6deb1eb41e6bb479868330b8366c13738eb27cabc92a4424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86fa1f759caefb456038ae3852f7dc3
SHA1bf7dfca423293bad523916669c097eb1ac1fc5db
SHA25616996adaa6aac73e48b4b46ef16c15dad0e5cbe9d1d296d1233cc2610eebf2b4
SHA5121103d8ef91cb3a091bcf03c0e96fbb4ac7beea01cac0662882ef4fa38ce842fc7baf2bef5dbaf27afcb7c3e8c393cbd380dc78dd0bba837bec1e06dd87a30f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58eab94fe89ed539acb81ab295a32e41b
SHA1da33e9555c902e79a969ca28ee502894030e3e8c
SHA2566b30a728244e12b4550ec30225c036c789ad54168324464a3d2d0f709c445947
SHA51215fc24490db15fd0f834883061a4cfa18ec0b5382fb2b5b5ef3fb6cec5327ad98b4c719be179f5d3fe247e395993b06abe130707612e1099ec9e8d253e278389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577b57afd28ba5021f9b477b9e52ca0be
SHA1bbbfd7f9b09a0fb0eb6e84faaab1977e7df62c0b
SHA25689875bf134a3d469d1bf7e94c45b1972e7b7d88df22870b04360d6cafe238620
SHA512bf7cc306b35bce25c7406d80b60468162d963f4c84b0b83d12ac848cd4bb17f51b9c13d4eeea31cba7a02c3e570dda4eb435ac8a6d404319d17f6921a01d9015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b5c66283f217188d1412e139f95c7d6
SHA16e09c7b6aa205dd08b18b60259de1f4f93d18126
SHA256fe98a3e12e5b2c164339847b006f45a17d6fe079a77037ecb2c50d0c44d4f5d0
SHA5124e0c8ec02b44423d662e9612e05292113732cbc5b815c051293261bca2e1cb4685d7139fb326c0e120e6298f7d04f16589aad6d7b5f321c07442d01edf703ae8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a