Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 23:29
Static task
static1
Behavioral task
behavioral1
Sample
14f60c37f229cbec8724046df5b9a0d8_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
14f60c37f229cbec8724046df5b9a0d8_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14f60c37f229cbec8724046df5b9a0d8_JaffaCakes118.html
-
Size
35KB
-
MD5
14f60c37f229cbec8724046df5b9a0d8
-
SHA1
b67a0823dccba065541d3759130b16b2201bdf8b
-
SHA256
d92431a4af70e8467cefd80a3ec55063ca68cadbbd0344040356c11ca8aab2f1
-
SHA512
010ac44919f4d831c528dad71bfb9de7886f4704afc358985aee4f410fad5c87acfae59c9d3507216628fc38968870c905cf2a7baa9f3cee45908c15f4b2a281
-
SSDEEP
768:S5UZ5Bb8vgkU0Lgg4OVZBdhFJr04JMJsBJ8Vj5wywvWsi:Sy+40LUM/dhFJr0o85J
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{259F8BA1-0A6E-11EF-910D-CE7E212FECBD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50154d397b9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002862fdb07c8c64bb55d2f19322184eb00000000020000000000106600000001000020000000d5e6e4a965c3d23dab644af1e870206afbe97c1d7afe58841dd2dc438a76eb73000000000e8000000002000020000000c5eadd8a8777f9c77ef16e3b5aabb043dd76b08c3a2b7c6bdac2a03774a52b9f2000000047b6c5a41668e44b72327a136f9b253eed4b91e0a6d0653eab09c18977ba85e440000000ef66bf96d615e3c6ca1460ebbc7ecff899e8d839aee3aa87f06f7b0008dc55549773f8d6194a1baa3aff86c5c632247387c104f7e1899dfb8d294142ef1226d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002862fdb07c8c64bb55d2f19322184eb000000000200000000001066000000010000200000005de3294b2ba484bef34abba2fff985765a5bdf90f1612abf6b2de2c44e2565d6000000000e8000000002000020000000e3ece4dc3fbf8a02ea69d73300ffb7e25fd7f95f60b57aabb61780bff0d649ea900000001b85b49bad904f4f93dbfa6e2658cf876f05c8a6889b795990004a30794ea2a33930836cdf2143273bfe4d6317571b2ce49c720245303ec1cd7d1788effff6ca8e4ff30e61fe06cc9cc8e67c3bb7ff61f931c5c4098651b5e40b6d6fe39f31e4619dfaf0e57197ba6d71abe6ef1066a8eeaa067c4dab7e89b7f75543e9c719672574b575b77478e7fbf2d4aa1fcb6c7b4000000094c6def771142ce5f5b9087ea95f3909fd6fa8e9131f444022a13f50f021ed8365d50082b90120d7e43081b904410bb60c0260aa006604ea10665bcb0d3a5868 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421027235" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2372 2232 iexplore.exe 28 PID 2232 wrote to memory of 2372 2232 iexplore.exe 28 PID 2232 wrote to memory of 2372 2232 iexplore.exe 28 PID 2232 wrote to memory of 2372 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14f60c37f229cbec8724046df5b9a0d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD58f0d7bc973e8d2a612a64521289f3769
SHA150fbb6687aade50bceb07821ab38756e8296c42c
SHA256948e659a6dda0047cbdb7afb700c06a4829a8ea51ba6ddc22084ec52e12bd546
SHA512b62e93a24bc4634522d59cd801bc2ac8f3c3567148dd3029377a6af527c120d7b85c9f05517d4a42a0339093f9f25149edc4b73503486c34f21d37d64aecd7a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e51b93c0c7bbeaef682e2c88236ec4f7
SHA174e841e95fe52c8d57d1be75ec677cb56aca8725
SHA256e31fe68077552ab9968f0423a267afb3c42828a8895b09a1d6e35eb1a024a23c
SHA512fd0a00f94ceccdafee5a35ab3e407858e7438f1a6fc95dc3178cca96537b50e5880ee1e98381557cdca43486d06e80e9205da84ed6f903c0e1f5307c6287d45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54544dc355e1647fecd4fe117a156129e
SHA1c7f2ec08e1739f1832f881068ea1658d58a794b3
SHA2562dbc1bd1a003f4be6df7ef71bd26ac9ca61982bd193e584625af5d5e078e0c5f
SHA51276edfdaf4c4420a2a1f36b0e775d7f4fb5427d0f374704dafafa5cc741fce1997b124be1ae9a2e8339aff622124690a2e1b7faad434c0e2fbd9006959c375c92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e511495ecbc2e5171cee873a9745b5c6
SHA1eabd33d16e13acf457e0cf6cb5e99fcb75247b51
SHA2567b5b7067ef045e61031c4398dcdc8740e5c7c9851a321a49d9b0923afa7adc58
SHA512c6608e09d7b42dd85031e2dd66d901966810aa8dd498cf31a1fb2cc459d30ced276c24640c362e3aa41e7bf52c23e75221e5f516e4eabd0db4aeffb6997069b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542e8ef9df875d2c6d550c5d18c276b74
SHA14363c9a0fd965e7182c49fd6fb107d364dfb884b
SHA2569c98ea71a1143f766a796c0b8d437529c4d225ac15cbfa5de9bde55aca30ec1e
SHA5129c1d10cdb4f3a8234ae6b730b21d4458abe436da9fcf3d7d5d19a423e81d9ef1c051059666c0077fec69efa8f2715ab39ce6c3be0eb7e29b01493fe7cc9de960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598b2ba55c3353596896ac9df16904d9c
SHA1a72277d20dd42f6bae786edd48e4ba9d050663bc
SHA2562e8f6add17620f2445f73579ef928f7063bd80f92fe763ce7bdc803b164dfae3
SHA51275b0a872a42b153212a3dd9a8cac6b66c0e6cd784111ebdf3d6d66b6f14c81b4022b9606e23a2b51cbe47ecd5a57714e0da42d0b5366a4d0e4bcf12f91eb0ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be42b9b57468eca7851db5ec4264c416
SHA1c7d77d51885a9397aaa26c9ccc3863f5d8bb9331
SHA256b501881fd55b5edbee433fa0688a8cbaa1098a9cd7630918d495282dda3d5d4d
SHA512a3a57d8da808937a5a35374fa4337de803e1e252ac100da07b41789c4258a50306ce3a5bf0efe140fdbfcb07ddcb2dd93362cb08db2c102379b7390635f9f8ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5902da4026f608891a6d576d3df19f9ee
SHA17d09d8ca281f19389ce81ff4f0c70369d3731a11
SHA256e0243c89cabbc21ade3a9657127e496543afda8784bd7fa2f42659570a8f9f83
SHA512937de69beeeabf341b533c9f50e83db4413f57a8e130b56f5728e694f6ad4ace768047f24fa8771eb1f3eb89eb8e7bd7fd302bd0c6f23b2e5aa5e31fe440fbc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5436d36fbffacdf63ec51b96decd60234
SHA1502c480614d5f574d19e164259c2bfea335a1327
SHA2565ab613655e9c83df97001003fb408d726932b37f515287982cdd33dd0153f4bf
SHA512087670a1c8f368e3ced778e5ec9dac20a35b0b6db21bc7d30ffef6528a8beafd2bdd88ecfcaf4adab850d37a182ecd707e1158458ef1dbbd3fc3ee2227cff91c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0acf5be5c105a94a174eb5c00548a72
SHA129f0262d75b3a43f57758092b1b632ed984d397f
SHA25644a21a2351432a446af690fcf25ca21c314bc63330e94e12eedc57097a964d71
SHA51219fd08d4f9667586b9c6854d5033111349edab5e570347e9b5496927e52917398bf2c09fe73c3f85e52995c63617d58d388ce4de32cbc422abe61e0440bc5008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b53b3c2af0b5e02d896bf0f8a4d167ab
SHA14df37fdeeb0d045542130f2b866ff421a1b55d6d
SHA256aad130c3ea9237ca87a39eb490bfdf4bf7f9e7f4e96e164fd645b92ae709f696
SHA5127e53cbea02a0e666c6413aaad6b9c14186214adedd4804437ca450acf9a58877664bdc48ef59baf545fd2c953057bfd9147530a767e0492b3ee65cb4cbacfa0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d44ca241bfcc749e27be22822416a91
SHA1fc99192649c88608f89c3cc8eb96d2da667b260c
SHA256e679fb0e7dfdc423e7e53c1eec5a4d0016676506046ac86bb1f68fd122322dc2
SHA512b912e2e3b269a5c8845b9cfb4b372aa7c081a3658fc7425487e92185d707ba3c4c8770827ad5a4fbfbac16fba59b136964de63c027531d61976dbd46e3e8e6af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5368968785b0a5bf96374362d9d06eb
SHA1e3bf273bd426f8891e1e9ad6f26fbaadce077560
SHA256af281f3c1c7e809e6370d810502c39a09bd60bb1f4f16577c688c339550e8208
SHA5123aee4f379e62171b491e1553e2097f4773918303037fc1768d442fe11a8802218266a71f44680223584fb46c88b79a31570e14652782e2be5cec50a66dbd0111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD568ce767e8237e9b0168bd9e1552f6af8
SHA179a42313416e6c77b7c899f02288989cd8b32678
SHA2561705f15c7a39b3819900b08fba795a1af8f04d6fa472fbefff583f012afa49bc
SHA512fe23ea8c3ee56dd1fc4c3eccf41f2d493c6def79eee7f355e673bbdb4164e83498eccc95df4886b21ece0d240716e339354f83417980664687b8688e78f98ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a