Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
14e6dd8f45fa9cf934cd565263c700c8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14e6dd8f45fa9cf934cd565263c700c8_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14e6dd8f45fa9cf934cd565263c700c8_JaffaCakes118.html
-
Size
6KB
-
MD5
14e6dd8f45fa9cf934cd565263c700c8
-
SHA1
cec9c5a122abf868f92d2f0efeaec1671c4a872a
-
SHA256
959368f6c23191519dd6b0eafa3240f432fc0928e6a1d6458763f9a11e053d4d
-
SHA512
ffc367af864754de1b0e734dfc5a4f3cdd0fce886dc15bab25a96fa712f43b64155f25f6b1d6ff0c689947e0fc9d8969c397844a8928f5dd1ef4c1d0d549e92e
-
SSDEEP
96:qhM3sHfbaaBhdtxlxinAEQjpLdtVGYyWhWJxTsP:qhM32zaatGANd/GYyWo2
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ca2078789eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421026156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A387E791-0A6B-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000693ccf6ca7505824f1a93df1f5ec89ee5baf4404526e1596c4ec7e638870b406000000000e8000000002000020000000dae3122c7c372aed1a855cf61c5ced7ff4e8b7a816f29e5fe0783bc83e607da4200000003d79c295e99bfc250ade1b17ce4e5d2f704bd1b0ed8239e419a8ff783e5f49f6400000002e613f920f60fc5376e3436a6783334d3ce5c7f2fa4f8b8a2210acbef4ba6f3c981872c4debe1d4cf805c013fcabb5acda8818dc8372eee5a9da6e4efeb8fdb6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d003ddc7af21ba82454fabfc92c87da6198aeb61f11f4efd7114cec8a3e83305000000000e8000000002000020000000f590f985e2c7b94addaa986b89c29a9f9532e52e065205b04fec213175d0f0ac9000000096cf7a18d35f0d5b8bcaea3cbf2786cde55b46f6a64db68e6d4712e06e50b3b2ab066b21df92f2fa0daa026bf03e8bc6385388a1ae2d388b781d54062f2bbc6b3d86d3aec7746b06c1c1c63be0bb7864f232d6dffb9e18989d72070f39e128fcc60bed3a3f7911be9bfbb6b92645e181de2f0bd0eb593ce6308122b436a7401a41d861438c9248608253bc7d48f6660740000000a8e18a83d0108a3c519a9c4689ed699997b836f13a16159e8c0679b9cfc3890e0ab1bb62bbc3db347ce030a3a40d1ab313549aee8eccfd69cb323a1f5018d039 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2304 iexplore.exe 2304 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2180 2304 iexplore.exe 28 PID 2304 wrote to memory of 2180 2304 iexplore.exe 28 PID 2304 wrote to memory of 2180 2304 iexplore.exe 28 PID 2304 wrote to memory of 2180 2304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14e6dd8f45fa9cf934cd565263c700c8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ffaa5e11f407c7d4dfaa5360639fc5f
SHA1b27ce20d9daa018c3928c652f8678e7ca1a47cc2
SHA256e4adee2c58ec9deeeb1ddf0cbe4d9a5dbda49a14f7d1c89ceeec24e30a313eee
SHA512ccaca38c9105155e8138fde761990a2e6db61437a228f932a09c33b992bd90ef8cf6bd826e81fb1d833af514fffb5a4273818c87f01088cf6b0c5b2da65e70f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fdd5f1a27884dad30abc26f1410a588
SHA1cbe12d226b5d587e1c86318a1d1bb547841bd604
SHA2565218d11cc09d05b732873f6b3f05b75ae1f25655ce573e54b6b62a0de5028354
SHA51218ee09488512d05b03000671a5e2916158581796a99c6abb52b1343b0f47db70cd2109597e42d72a2cfb3a614bd86322238371524d3ab01b001e19bb54773be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aea6dcf7a3649ed866512875cbc219f1
SHA1ec4dd76e983178b911f642fb8cac5127853a7283
SHA2562b2a1ebc72d0baee6308c7a1cf6575a0b52d8819eae30288042c18b7f23dffe6
SHA512bbfcfd1ea7938ece2805b780572bb3c7496f3075a6b6a4e94dacce1706775fade646c9c4a942e8eb8cb4475f05f042be45450718b0ee41f7fb9d271ae4ac46cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6dbcb74123ec0d5abe0b72c98fcd66f
SHA19eff291aae4bc36e66a178b6eef965a8e6086732
SHA2564e1f756bc0bda8c80cd0aaa6f6dafea5015c9223e75a33e48df51e335e0a04f7
SHA512b04b5e4624abc30763a577a065496063030477308d1202342e6bafd43a369e4040b678d17ed79ba5c0a0c28e08ab295be994905dc777c3eda283dae9ba4fbfaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb7c0fdc6d66bbc98f3f35c5be5e54cc
SHA14cd9d88d78361cc55a9116cbb74c9ab1c0a17c57
SHA2560f55d45b8e9dcbf77a12f438477d7df65ce669ac06301640aab53665e0b7fcab
SHA5129e531b041724d0dcc319721166808aa0ca1bd6020c8f6a410ee0575ab19abff272576e7e8197ce24b594ed1523d0b24a5108888034a87cfcd4df3429583c19b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9e47a171ae9d69c1e9b4eade9f91447
SHA1e98e719a393cb4426a589bc78f6fb4151de71f1c
SHA256d2cd7a26e0f642b593301ffa46118e0c805cca1d4842b16be45671692ab0c26e
SHA51275c1683b2be6d070f9f94af06542ccf840a8bde21e3f36a194cd27b84b34e2ba997b6eb5d86e52edc8ad4ce803a86ac86b2d088a52c53bbc6456e8810ef1e971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0a555ff8bc8f5832474db286b11c23d
SHA11a9260974a2adb31a6dbff32e737c53da2b32105
SHA256405fa1dc763862a6e8a2331f8f0075d82c07d1ef7947524593e497605df3a948
SHA5123c9730d26748fea152ef28ad1ce1082bd74fae55ee722dc5d76c08fd262862309b5e2e18e5afb4ced774bae09cf9d1606c537be5535410d9fef54208f766d0a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1e750e906cb98764b1231544235c1e5
SHA1f1efe35cfcca7e9622b2928b8fa4c8b724296003
SHA256acd2debdf06b5be98df9eccbd47c9ee16465a00bd945b706cf0dfe9d0771c78d
SHA512571cd63190e9077bdd06dba6f9e9771c6219e7a33f54e6c97826eadbcb611f4f6d0da50f32e49455ddb92cf50ecc9deb3ffda7e216a0c1ed8ee60eed178c36a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca606402b5a86cd00c59550729d79e7e
SHA1716570b692edc8eaad43215a6fbc56e3d470fec9
SHA256945c7e3c474997bb1c287bf26c2fbc53073842c7705b87fc47f0ece03f1f3aad
SHA51278e13fff97d15efb33b263f0cbbf61f1c9b50c2e47a50a94538e5a0253f4950884152604c4edb00bab63653dd0cd296267b5328037fe7c5e7e0d994327c20788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551d26bf63b71d8a249ea688edc83952f
SHA180935c165b4ca6d854e2a1d0d4feddc3a8d69dd6
SHA256ed56d06d4c06dfeb96ff0699cb73f812e7334047d2c7aa41b31efcd9a610b69d
SHA512db7c3931d038227d7cf95c945d9543eb1637798c4c1068c8df8922adb8bb8dff6dfd82ce8b2b33b7a5f1cec1630921f9c1f098bd33fcba65fcc2d91b3639cb2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d4626ebeda8b2d1c68503869f3a40cd
SHA19364c69cff81458ee58d690f420fc1909060851f
SHA2565a06c157f44ce1da0d785bc18e421b17616bfb7f982c715418cd3fabc6347f0a
SHA5126920fa251aec655f19b1a791eae47c63a25243ba4fb8ef473af7da8764dab4aa58f2e3c6648e2fe3047cde7ac50adde999131d00a3e71db8a719836f7f76c3a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52da3130dae0397ed5a52caf6c4f1404e
SHA1ea14b3667bf19039b2ffc7c2c2f90beaf787e4d5
SHA256232da56a74d24791181212568f996b39c8b8ed076049c8eac87fa6c92a63f8cd
SHA51281d178dbbbc597c503390726538377200ee3a749eb992d3b5c8fbe16e80717539529136d5c5f0745657197df934a177348236efde1f81c39b6239a446f132400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c025a6d9c8335e21eafbd0a25b3c6d3
SHA166e3802414dc093f69ab66f5bff5fd8b9ef03913
SHA256b7a2eb83be0671264cf259d41e889bf27918e78976daad5ede57488b95deaa2b
SHA512afa0601b3ad430b9226481eef9d8ab2748f6d44083b0484118eca81799cedae4cbb9a09477ae044478a9f7dd8798f10e14f87caa8675ed6195ea5fe34334922a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a996c83d2265d174bb57eff29878bed2
SHA1072098417af41d9e6697efbe381186c630cadaec
SHA256e1cb382ffff163a1b28fdaa322179e089d9b7fd340334172acef833388ba8378
SHA51214522bcb2f402ad0bfb9fcfe2c6749ee7166329dd41a5fd1b90eed3f5255bbfee395194c7ff87ad0ceb9d580055a68976297f698a2f8e7f5f6900db6adc0f48e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1b2eb235b674323248e1e0561ac4bb7
SHA1cc67f1db5fe5f67d00211a64ad3036eaea73417e
SHA25682a04c668670cc115bb7d61c03218dfd6bfb4ba50b6edda45581051683c97438
SHA5121b7d728f4f396c4efb530f19442e8c9e1b025275d6264888e16ff887185666afceeb7c4576185f48cd024d6e2db6571c87f73b43bd1bf8cedd797efcd62397cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df7defaa0317ac5705c1a56c0918923
SHA1c44e7cab97d2ca023421ca13518d5d20b7217b01
SHA25690c663af522da109268a2e04589e5628a272da4922356c9714d11317dddfc1a4
SHA512825a8d5ed3c0dc755ef3c8172664aa29034476a203a888cb6f3ba9b108f9331ace741fca8d16687bd1eab7463f00574ad913462b018e8602608bc2972cc09e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc0b2f0c7c4f6d0c8cf8d7f27eea550c
SHA1939903429c12e1fc80113d152fceda87b3ba898a
SHA256e2d78bd5b37cd4559bec23e111737968257dedf28270671a68f3b6b503b0e328
SHA512ee9d20d0d6fce8fbcf60b0213920b9c3596a6a49fa222567c44f016a36a12c052139815e0cbf249452220abdab43e014c4abee34af866117c3a6bbd5ae3ecef7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a