Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
14e75ad7eb1570f17e41531a0c83f2f7_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
14e75ad7eb1570f17e41531a0c83f2f7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14e75ad7eb1570f17e41531a0c83f2f7_JaffaCakes118.html
-
Size
27KB
-
MD5
14e75ad7eb1570f17e41531a0c83f2f7
-
SHA1
eaec8f6bb02567e972b4cd8f2b90e03e569bc1bc
-
SHA256
4498e185538feee95ecb3db23a5bd3a5074a0d3cac2805038f66070d6d1b9be0
-
SHA512
c876ef149c843f0fe4becb54f3b0877952a51baa7a3067bfca8e6aabb091bd10a8ce070fb2a3edfa429169443b4ea56ceac8e2369713d4c0173e6149ffe36393
-
SSDEEP
768:I+Xah3AM40Zow5Fg4cfMouTcCoZTO+HlOWQ3WjEVTyint4h9kvcmXyizHt34:I+Xah3AM40Zow5Fg4cfMouTclTO+HERy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000065d40acf126ff45ed3fc1d43bad6f9d365dda57e743d7ea2e81ba764cc62c675000000000e800000000200002000000088ac1c20b40720a8e135d9fbf923a6bd1338c0a71cbb51229d93ed75afc726b720000000cfb76ac0de4c817f80fb34105853e44cd228762967b8388d05742c6dec776179400000000b73f7e58c226e7bb4f44773247ca9b9e3a616b14e86f89f6e8cab0863838a1196c4b84d598cbd7cf1cb32a4d901974a9a6c1e81d6441c684bea7e64288bd893 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f12c850b5f17177a4ea7e004791154e5aaab49ee6defe2204eda92e0270c6e08000000000e8000000002000020000000c543e92c4548605c2a224dbdc26dec07d1cc47f936555fb315fec0b127d214ef9000000023393051d2ffe4727e3ca7183cd9eed46947e39ac18764304bd01873f5278f2a3b1f4ca6d2ca3e28214fb1584e7264a8b251366510cd8522025709cbdafb6ed2e605b1695ce5bc7d558a0dc90069bdb677f97b376ba2b9baa39d4e5ceaee2c6f119761879b22d78f91da66ab55c3ba7c27a3d5bfa91194ea54380b0234d05d2e6419c9fc2558a479dbee19b56d1e684540000000e8c09eb1b76c4b81c47e01af9a0071f25e6c9dbff78f7a397ac2c81b2a376f968f31f70858139519aed8d50ce6fd94252b3f85e1216a40db13e5b8586c3a0f19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e158b0789eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8635A01-0A6B-11EF-A4DC-6EC9990C2B7A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421026192" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 3044 1888 iexplore.exe 28 PID 1888 wrote to memory of 3044 1888 iexplore.exe 28 PID 1888 wrote to memory of 3044 1888 iexplore.exe 28 PID 1888 wrote to memory of 3044 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14e75ad7eb1570f17e41531a0c83f2f7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD528f696c79f5cd58fc0bdda0d1337ff8f
SHA176b5e13e579366c9a69fdb966b6eaec6ff7aeb81
SHA256a96219728e4fd76ebbc4abf0a1ad2ee8e43a9fbdebfffd27d70dd6f61f8fecf9
SHA5124d5328a11e1e19318b9663fa41a7544d3fc2f90c0f5aeb17b3cc8a31edf32e402e757a74eaed5222c8848a54f51582e101cfb3a4936db8cdffb62a3ba53e7c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d28a8b99e09427d351452dfdfce84372
SHA1fc54b3893bd2b395525b103ed5e08254af6a07f7
SHA2568b3dda72f2803df0c4aabedba4d3077d6df0e929a9090a35d2a8613fec81ff62
SHA5126b7d2821a46af2f1f74b5f61ae036dc99e42092767847e10928643e7424b292938602c319750bdbc6379e6350d4c6b9bf16178a5e21580802e5398da16077bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fbf0037717fdafecc66000f52628069
SHA1ac2738032eee89e953c224d6e0cc9a8d39554b5f
SHA256a9f50fcec2ab73dddf4a716dc48e7abfa77e2a9404216c1d6d1fa7e29dbd6c7f
SHA51245087bd119884d0de17c984d4eb515c29c9e242e2e55742cc0ae7b0d1a5acf856f161fd90f5702ff04a43556d46478cbabf8c9834343551dbe8ca3bad6012e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df67ed04079f1be62710600f882c8b6
SHA1fd9b5638ddd4727af99c5b7eea7a2ecf80fb9b87
SHA256bb5329839b8196ab609cf851bfaea6bb4c497adcde147a730dce69246ce44c80
SHA512e48d3e218c49fdcd2d7ac42446af116f8b04b925af44ef3cf4489e11d6077b2f15e3350084aee573530121b764e48f905eec40129d54afc324180b64dc9cf71c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aea9ddffd748e86c59f3e97fa73edb35
SHA1934ac09526b3600cb531c8981237b6e94784ca7f
SHA2569de4260479aa6874474a3fb2921a120b8f8f1e55cab025f1f097d4cb45d6a951
SHA5124b06c33e1965352652883f15946f8ecaba19f5c6394b6a037b6defac08ffbd03469489f4d7937c19805c10dc5539ccbdfee302e8e551d182712983e76448d0ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f7f303651ff46c8f8e66ad7b3ce7c2d
SHA123d89bb99815ca85c9924425a20c94ba33ca41c1
SHA256f880cbe1d8827c1190ef37ba2500168623d11c57621a1e12edb8c27d1ab8a064
SHA512fb7780a7a190638fcc9675420cdba430b7bfc9ea3aa705a1876936c90479a1a4f57e219ddbe4503d0383e63c79bdfa24e748d0ef2202f319b45fdb7779255309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce29c5ddf09e67e85f602a633b51e208
SHA15e3dfa680732900b2886f2ef8d98ac2881264e1e
SHA2565bfd4a46c1c19bfc02a04e92cb50d89df16b1f3666d0471227c1e7f02a939deb
SHA512041d958ed84de40e73b5a4a2af937db719b9f3f69cb97b246a375d6a2e040bde73b0928b5854a2e1cb8825033119224a678e800a4479094fc5ae43bf3dbd55a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb48b3f12d4e1ef609710689219b686c
SHA18d16934fad9bec8d9338c1b2b397429d7cfca423
SHA2563b37a1bf18aa814b5c8ec699ba566aff3863ba153f810524dce0c06efdef0bdb
SHA5122f010ca88b64adffe8edfd6d54a84d9e3fd649ad40cbcf01be5774dbaf9da968bc356d16fb703313b7dac9921d9f4d24ddce1debab9e567fe7308e7031cff371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0862f28b6df6826231a6a0ef2a55544
SHA1aa10432fb7e6bcf3cd0f0b1d12462eed94a22ebd
SHA256629e452174c314f4cee1200727e3193515360abd908b63d117aff1ddeaca7650
SHA5129888e3d6efe8d7a7bba1742bc575f1f31320835df57e2bb84f80682b383dfc61066bc5e23006d2c1c02b71c8f9a507c712b20f2e4b737bc6049e7344cae00c90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f8d5ea911b6ef134ba13e6a9e63ac53
SHA1c6fd4db2e9780b972234438f8053f7edf219b538
SHA256f9f69ace2c93ef5016a85f13acc9f1d8197354202ae946d4a6a74c7f418e1fed
SHA5129cfdc04782da183b63e8ed6518e5e0056de0c2de8c01542b7e47c6d95af03748aac9912844f8f7c999d5f8e4864b3f3467061e329aac45f4ae9c9aa6e1030113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590018554d3178521ea25bf7cf26cc8da
SHA1cbbf04cb043b2280865ee812b91f3ba05d8581d8
SHA256b4fd97583c37929e4181535e77c307957163de91d0d378534ee359f5d7010e44
SHA512ec7a6e0e096ceb2a686c7b7d8eb19f1e98e32a8459a14334cca0374980e1c36db789b85e9038727b7ffa7ccdaa6037dedac3ed2eee23e011f6fb3f9ffdb504fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb8cae312ffd3163da907029f80412e4
SHA1ede66efc8c181a7e27e168cc869d9f5653ede213
SHA256a4e4ba9dd312e31d7a37db4787bf9bd7abd0b1523e2f2ae5096fe9936a2156bf
SHA5123f2693ac57d1df042651d4d493051e26940a27303308fc0aae56a1cc1e89e3beb8dab997e11d61f91616e81357605573d2ec388cd26dc0acbe6e1f4a4e4c6352
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500574d522102e7d9f37be87fc7699088
SHA18a1b356d0cfe354567e8576a9dc7e3fc048e5ab9
SHA2563859280667dc6a330b25106aa0e56bf483b7cc27d0a53230ee9837bfdb6b724e
SHA51214c891fc23e1d57c231017ddeaef3aaf03ae29031a252a7418b573941c11f642f3854b8feaa36b59b90a8a375799620af5bf911efda7c91b4e596b4a4acf42c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f4196c2d95dfc67ba3b2a0f80b5f161
SHA15e4cb0cb6b83acff2f1be8ca9a31371bba5ac83f
SHA256f8aabf57b9985a0dbcdd331a1f7b3877f34cd01bf15241baf7d76a6205a0eb75
SHA5120337b2bbd2e12acbf24a2094147b35d737e30a0c61a992b29dbabe721e75d6db4070ffe3bbeba3c441130682fb708819c6e7af858a11f7386c982390c3407b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4b6ae6104046a46b5d11d472f40dee9
SHA128f3dce13a6442c9586c79159bec5cc06db8ae18
SHA25628a34390429b1ebd6c8ef66b35248b091030d88807b4750f10e9f0b8ef677bdd
SHA5129cbd7e0fb2b5bb8135fabc9780452c561cd51ad0819eef80b905bfafcc939e621fc444e935ced17e2b10077034973ea2ddf78223d91b008138abe04960a1fe8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce21e077df8aa566019e9782eb693d8b
SHA11499c6487d352d47b2bc1ec4c4b0475a1314180e
SHA25660058acef7c42f165418832847070885617cee1b119612d45b85c6c37a5b122b
SHA512b586f2c732dea283cd127a14e4caf8038e86d928e907db610c403d9a5b8a47c119d3a080f87778aaf3acdc16281c934d127b16a6d65aa495e956c952aba88b1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5c06357948207d76217ceac483e6beb64
SHA13252aacb89ea7157ef07fe02e19fcc9de5e18e54
SHA2562034e7fb4497f4c84e9d8a9b1b2c5eed53c8dcd73931361fa3119f6c7ccf068f
SHA51200e5d35eeb0fa4e5e5930c1881f9b3d84acdb5abd9ece2db2cd23003bfbf02ecc535950f0ce8da968629b42c343bd8c798a50927f31e0ec7ead14a6cb0cfdcd9
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a