Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 10:44
Static task
static1
Behavioral task
behavioral1
Sample
10547c0a149fcf0f7d9de3d7683830bd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10547c0a149fcf0f7d9de3d7683830bd_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
10547c0a149fcf0f7d9de3d7683830bd_JaffaCakes118.html
-
Size
21KB
-
MD5
10547c0a149fcf0f7d9de3d7683830bd
-
SHA1
03befc8d4ba0a6766fe3154b20d04e281d7a2340
-
SHA256
983eb7b2d8ef12b9b46cadc9a886fa1f3eacdf669875fdc5ca194ccde80c5c2a
-
SHA512
6517a5e7576a25437e2ab09b835862f9ce8b3b9bd4f1b006f65ca9cb4b3733824b3667359360e6745cb5559b53d293c44a7cefffd34400f71c493f12fd1003f1
-
SSDEEP
384:mUp6JLEjmmNZAGHbMGw1WUEYdms65IYiAFNOKbbXHKumNZQyK6PJA3ZN/F:KFUbMGUW9z9yQOYXHNj/F
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29108B71-093A-11EF-93CC-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420894955" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 iexplore.exe 1632 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10547c0a149fcf0f7d9de3d7683830bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD526808a5bb577d18c39c9b3aa144731b3
SHA1d97c791a791fd9af1df391191fa510980973daab
SHA256bc475c62077d5b9bffd10a845ad8e7576c25cbf5667b11a5d41cc14e55f38aae
SHA5125a3fc4985a88e826ca433eaeb9a9595bcd86b6b025860d6682e53bf4bc4c2ed6fa569ad59ece9b98f60865b598e82a317adb89a18e650c49db5fae16e59dc7c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552106b694f4bf9caafe6fd94a6ebb1f9
SHA1347c3df5608c9ec80d7a6ded785c90b820b9acdd
SHA256ffc52dca3ad41ba640d23d03219e9466ee6cc268a3a02165cb2ddfa0a589eec1
SHA512e9fe83d28c829b400afd4ce8c37062d9ebb527409b82a7acd7bd15a43dd55e8bdde185925f54656d27466d86ffd69de2ae9068c714bdd1543ad1b892fb7b1167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6374ad0b090492a882d956d5b0335b0
SHA171c1ec83e2e47986ea5d5846704d8b774f5358c1
SHA25647138f47c13ff15d28db34ccc6a30df2584dae31ed951947e872af70ee36815f
SHA5122ee2672d31a547eb8528b507f7d6246d77bca3fe567abdfb396a2d5e73573f54a47b231f24a5fc3aaf2bd4a6332b5108b946c1a47d6cea890479e02ce6997902
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51348667c55c7ddf7a90adef45235a85a
SHA1eed4750dacc78fe1b75fc0e71bbc7ecadc66b1f2
SHA25645fe034cefdabe4b00311053c53ac454bc5b20e0a089f5b95f07ea15d567a603
SHA5129afa38fb53ee7f149cee8f62c88c5346e7a861fa74fce3b34fdaa68fc8c1020d410efc5e30407cf985e28ebc721b9c529674b8b7c6b598a7fca2357e1ae850cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba769a91d9a40c3e61b05dfa9243e8a7
SHA1ff236de76f0e7436da1a48d976ef7dc8ddec7429
SHA2561e7c8b659b2bef89da4c40a905b79c34d7a46e24efd19514b906e13c48a9faf9
SHA512a010480df5c87c1b80c79af26a0dcaf890df5113069e4fe8826ab90e22dd97dab1ee761516fe8bce532484fe0e471370edbfbb7261d8a93b74bad388706a2451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5282e299e503301088a28801154a3d84b
SHA1f0a54aadf2e15d0c2affb79344513f9d700f6786
SHA256b45bdfd1b4b44c1429e00cfa2a25aec35e9654b6ca867f0c5a50585dda26468b
SHA51287fa2dbcdedda9436ced6493602bc9a110f27033b86bc2b32781903a65e3a58f0687da89b74d7fdf999cecf703f542fa2d16ea8a9bb8eb5231171e73c3a76818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cf3dd1f14150bc9aabff00326ce048e
SHA1d6745281083463c07906d53fbf8d4b6da90590b1
SHA256a11fd5a25740137b96588a994029b106ea933508f650b849356435977d8bf381
SHA512f39e36441a4181b9b184a7bdc07eb44047780fdf421d1b5325847ecac1fa05d4d46d5267e0ff5b06010cb26f61142aaea3b30c65a7e04865c6bd3766f57dc904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530a7bc43d92d1597db09d38280f02a04
SHA1fc51222e402510dd78935c953e3410103b5be84a
SHA256e87f55bd24d985b8df0810c21a83a09430b3128f33c1538fc043c77104833ea2
SHA51284d215da4e7b6f4eed8eb4dc802c6e7e6a2e9f7e90c86a912a32caa81592e88d609f7ca7c0cfbabb33ccfa5b3e65b81ae7f54d2ae84765f8fe47b547117141d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517dab307a6e88950e7511cab3d3bb266
SHA162567be5168adc08355d7d063f10b7d1c4f8841a
SHA256c97be71a60fd1ab5972dfd0d6d42aab230ff562111f7d7cb30b24882733904ae
SHA512456b1f726a8ab76486b88b5fb574441b5ca5eab44fbb7bbb899dac0e3699166f163ddba6d85b06637c197def29f3455a84d8c8bcbdffd6ad5a3b85d83899062c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4d49d8ff9865de48d8c45b7d9f3e4d9
SHA17bbe3e755b281a9dfeb094f2d343eee72e317315
SHA25662cc06fc4de2bdcbcb0ce6463caac72ef0eb62b430675e26a9d231f2961352fc
SHA5126d0c50234497631cbc03d3115d91b3c566d7e3814a8f512ea1dc588a777e82cb8c8a6f24fd86038d10c377949885d206018ae99d1b9d98901bc8b31b5f3c7c01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5453463675fd68deb7969d960575be0b4
SHA18c38570062b87a1afb49629fc97e2931b7c7f1d1
SHA2562958f8c0676ceb7de4f8fbbfff6a7fb362467933e4258afd8843bc607bfd8554
SHA512199955cc27e70c2724e8dd1b3fadd753c53e206e231fc3cd22f9dfd881bed3894c1e15ee38f6b6f1eff705381525f87fd985a9f2794c0f00598aea80f262bf28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd6bb6992de81d4d2e475a4b0d65a6aa
SHA16a0b4df0c814f287bc2936be370920b6f580498d
SHA256f3c2e86e614f68559e2aa33d4ed3a466f2ff2efb2f7d0df8fa4cae11492bea52
SHA512ae7659439a8a49e1651437fc27a64ac7e0a14f572174f92691e3f2c1f9ba487d262e5dfddf6cc3c749191002c1da42ec8d4c4adad027daff21d67dcae01f0722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5881ad8f488fcddcc6ed5c28248350c92
SHA11b1c754dbc86632a7bccf1640ff2ec2c13f2831c
SHA256fe2c06d01c48bfb6f66c10c91aab7266b53cdd69599cf7e1a12a13b568d8a63f
SHA51202b31605ad4c17941a0c20effba43233a4f96e33c4326123266acc580aad1baa6dce53edfdafac5d0de61a3ca0a56ee66de14e369b3b9a2861184dee5960e6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5a4381d31d2df3919f814d72090e53b
SHA1b918163c1b5b9d75408909bce256cb5122a8e949
SHA2567dbbec22f825f703b74ca93c600a950567f2d78653fb14bff63da71208ae8b4e
SHA51201e5dccbd7fd884cb65ded4c5e332b1df0d446e9727dd2626b520ffb2e896d73291cba64e12e14ae5ab9ea137db1c3043d1e29cfaa58f0a0f089739d279b05f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec30338b860edcae58debed7489ea6ae
SHA182330301b7c998c2445b4f6580725adbe644d11f
SHA25627fce31b4f7f51779bdeb23ed194b46e873734018e4e6b7b1eb60cc68e6f09a3
SHA51245aeccb00822c92d4d7ece900994475eb93f7bc34059f91554e8b067deba9073537fb977f574535480d6a08b9da1f1997dc974ac7b8d8eb8bc5401ca435251c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c9c175f1033c7380f84c836d7183305
SHA12d2be043e4405a3c51b409824c956f68aef48a0d
SHA25635527334dd71f5392bcf0d37c52f23f4e40d2492d4faf68c8cc4b8bdfcf32b1d
SHA51286bca337cbe039087ff8f0f760fb5c977149d4af4a497eeef91e315522d3e090c83a62db832a1b9132baff0776fc1d6ae983ca09d4fbb85b2a7fd23a8177f430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e8b8992c774b771e22c909f474f925f
SHA1c1e5fb2988c863604ef4c0fe26e8b78d3668757b
SHA25600b08e1cc854a63de3a28c65693c14d8d2a0fe2d0ecbe012f643999f1e42df9c
SHA51250bd3c2ddeb1079c64a83afa9c5044e05ab1d5ee4abda93eaa974574965e881dc389e6e6eba6013422ab32380b85a99b907fa78efe313cd527a296fe325917e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a7c8db232a2cbf0d9e60335d09e939bb
SHA1ee79510a18acfde6f74cb4e59a6ecd3c33753749
SHA25698ba41adf624104380f3aeeb9a4fea428b59711a4f3043b51f90e87f926088ad
SHA51239d6d309e57bd764c7e0120cc9f7ee056ac82fed7d1db04f6f6f3378f06cdc7a0136dcfe84fb3e5a031bc803d9557c623c6e018144b92d2a7ea0145349514068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD50bd6a6766835aafd956a4bd441358ad2
SHA155fff222b0b86f600ea91704056757bfa5b1eba2
SHA2566fdd5975b8904c86784dc3539c8a217eb1242a9c08de23dbe152208ad302f211
SHA5125bb53853d2e9c280696c4ff167b3e1cf60c1026c950fd9c547ba53e898b1970ddffd13d50f85cdf403fbf25a617367d9b6298c4527f0af53e95854a58539aaac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a