Analysis
-
max time kernel
136s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
11579b95f612afe3f42f3007aa84bd2d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
11579b95f612afe3f42f3007aa84bd2d_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
11579b95f612afe3f42f3007aa84bd2d_JaffaCakes118.html
-
Size
1.1MB
-
MD5
11579b95f612afe3f42f3007aa84bd2d
-
SHA1
b6b2a694a8bacb7898a78566892949d115e267d9
-
SHA256
e1aaf4a60dbc6cfeb0bec5f2af968388956e06e8e39eb4dcdc5f7f5cf740343b
-
SHA512
a6bb2d70f07f6aa4c7141547e2389294c42636503259c18f1af6f707588cdc174fee0126515a2eb58379b0ef0117e47027c7e5d92177d3df2ff99d3924797977
-
SSDEEP
12288:95d+X3ZrscWy9dHe5d+X3ZrscWy9dHt5d+X3ZrscWy9dH55d+X3ZrscWy9dHX:B+1jg+1jN+1jp+1jL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A255BA71-09C4-11EF-A596-F62ADD16694A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420954429" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000323affe1c2502314dbdf930e7d40c2e41dcef9486927d49b09bcaf8dadbd27db000000000e8000000002000020000000c20cbac2c0b5908ade95a1fdd30c0d667e390e6a34424c2900b7e687cb5f3c0120000000f16b55a26ba94f5997bb69ccbc6c3325874ff11fab9666a8e0bb41d84386cdc940000000cbcabad2ffc0787bbbc8ebc87975cdb8a78f92ecba5ebc85c9fadab92da3f4209d4650e3980d3b6e251ec87cd60f4b4a34638a21ebdacfc70b4fdb66b45a8139 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30adf8b5d19dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000096a84f8f8a51b9f6a3d0e7f8acd831086cf31326664208cf80b7db7fc98343e000000000e8000000002000020000000f9be95e38895a14612252954088ad0761acc94e52fd91592eeb5589cd307cd5a90000000764e969b3aa21a66a001c4b9a84aa488ca8c1c81cd7081127a9c3c8d8efb8449b17a6e9b3f6683d013b911c81d75eb6b349a0ba0aa5f014b08e8e5bdc8069795fab3173b6a42a43aa724d9657d9eaece7845ecd2e7cad1cdc5642ab6d564164b95c8d102f12159a365ecf3598ec94fc02d2d6554e4457c2a0a604326c852acd1bebd85425db5215db55cd0af6b2a033e4000000046572fb2b48196be486b352cbdfe833e318e9b2dd03c4ac02cc172a97faa79e34ad269d4f2ea563dfa3be9fe613a3006249619a645f182e100eb979a5fb60f85 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2636 2980 iexplore.exe 28 PID 2980 wrote to memory of 2636 2980 iexplore.exe 28 PID 2980 wrote to memory of 2636 2980 iexplore.exe 28 PID 2980 wrote to memory of 2636 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11579b95f612afe3f42f3007aa84bd2d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5effc6ed539a0636fc505e568104cd5b4
SHA1ec11fde5ef75888d27205fbcca00b80459c984c8
SHA256e2274125eb8236fbeed59966943f74b4feccc1218e76737be0fddae654cf0046
SHA5129b79038337e297704b7bd54407679f546d58fd36d46724201e07d6b36638d6fec9abc9cec25e582e3dc034975d88130f905d39593faf747c5793f508f75f5edd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55508416e6cd6e7107a37a224d665deea
SHA1d690fd674adb0d59a127ea854414940f42394e12
SHA256cbe28a480b64affb1b29d22d2785e226f362541fc97eb47c553abb88d7105e44
SHA512901589881dac4f00b2902bb77d5a9394155e08511e9bc393b3205b9b6882ffb13297b2070ffdc42321f66a2b07d69d84d617a3655cde691dd8ccc4d3beef2396
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5875c551a2110087d048805efbc9ee0ac
SHA127917c6b79a2218f4987a6b43a7d8f96023ab70e
SHA256072334db22f72f23317fcd90f46c60b94b090dbb4243c632612a9383be39685f
SHA512ebf61078a301fa3c2f5502574d5dd81d46caad483531ec7a68a20c0b5ed4971a4650e16472bee4a60f1dde7c61d829eb956efc272c2eba201d4ecf2a27ae46ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543a369b28d68fc1f09fc68e4a563a26e
SHA1d8fc4ecb35e34c9bd920a09d1e6450ecfa1f527f
SHA25678cc7482d2fcd66851ac36074cc94ebe1b61c4225cc0a90d81f439d744809195
SHA5125fa2ee4680721b9d43e9be67aba6a6b664a596025292806ad32a7a4a3ce7445a742f915979293b6b399c52fe349f552d31775de51ef9e9d801cd8df61e2e4731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5929b04054886802ccb4bffc6a6b44515
SHA1c09fc15b18de7aeb86c7b985f86d7dd967799757
SHA256470a37a8ed5cac90a7f1fa511774214133e6304906c0667f26c5379703ee7248
SHA512df0937108d8dc75255c1f624d306e1ff0073c3a442f02dfb067ec87b5473d854645c3572b86b66dcb4af225cd0f2d64397ecf34bd4122cd7602f002d499ebc60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bdf784b981ca12120cf1b0720220e5c
SHA105ca761ae886b66f5f3232920ae1e790fa9a06a5
SHA2561db90077f91ea5666419881a615209936b5e575d4b3ff9887d910a262ed54fb6
SHA512a013c7be80e0c7e4fd98c65bf5eec96e45393a2a22a954691166bb87d0f2b9fca9309df94078f90c8862fa85e7ec0e5102a83053e58c9bd23f942cac31121aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5129140f6b5be6c66ca3b2d44864cde25
SHA1cd31926851e81ae16311dcfb07addcfeaa82deff
SHA2566fe83ad9589e5344b5f4ea08ba0a91353fcb14da2e3a0d91c12f6544172fafe5
SHA5123d30e0fbba72c9439f0bead69f65d25f0e43c75652da304a4521bbe2a851696dc53e6c852697776dc0e7d9a781e14fd4fb6d6a5529cbd48cdd89269058664692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59affaae684164e919c985086d5844a28
SHA1006a57ec4d525961a54d5767773b65cc72bf8e18
SHA2560cd56cba3386b86a15efdf0f883da4ac899381350b52aa21670a30fd8e878525
SHA5122759d9081977ab000e240635c5c7f3c1b0e3106b98854037cba1577b08b4502ed9cc6c4d11b0e9ed57edcf77101d23e0ff788f18237b776f61b5e289b39d4894
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfed8ed69cbd0662967c852748d196f8
SHA18b788376ecf83db6cddc54cc19d1736ada6c4492
SHA256d748001025ee00ec5ab6f66075a8acb75eab9cd5675039bac41d7f9f9d4365d9
SHA5120e785ec070dd424dd895d68b82a5f9fcd68505f0f368145326717af657d82441e5006bf16fa8fbebf9cc50243b8e83119432724f39c6752cd41f1c1a28136be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5852dad9fbbf6816ee41390e82c502db9
SHA103364512bb3dee61cd3a082a806fc71dd5688188
SHA25642ba46db4cc9ad33fd732f88a059272b027bc1c6c92468ac86aaca2ec5c783ff
SHA51201efc4d9c036051c264f3401c1a1a564577bb190cd305da9a94e2b38de3afe7ac52fb10884d44836ce868b5beceab95e1e38d4c60c73edf3e9843fa6817f2f88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5815c4cfb3256df30be95554064d3bdcd
SHA19518a0eee23d72b6ee45d9c0d6016513d3887e47
SHA25619fb877ecca19cd506136f0636281c134d365a03a0eca5d07a4c129970ffddca
SHA51259422176dac16ec7d131f3c1756ae051a440bf6a5ac9fce72e767182cd4c5f03b2ddd115391e45d871bdfe637fb6af64156225aef3b1aa8072aded61597362c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599bdb36bd1b8a33efb95cb7de3876fdf
SHA17fbcec26c776d8cf957b3c769b440a18961b7315
SHA256da37939149d49acb55451e5d5c1eed44872ceb952468de99bc43dad7889b2ffd
SHA512868339c4efd14e1db97b887e8611923adbc615fb2b6660cf00da282ac410fe090b69f94d7986c3f2b39ee12b3fb5a424efc2234bbf902ae42acbe44a163b9cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794aafc7ababc6cbc30be12afddba326
SHA17cc76588f5a5b2c3c6a75be4f291373772e1d2bf
SHA2566674e84fbd0338c247bf5682c2324f5ed9db0182057c06aa8fda3ed39a361243
SHA51274db245cfcd5809294159bc61b0958d414164847f471be086f53d2c337e9c4e973f2ae2936a1f2f1f7a92e1016cdb5d3fc6e028e766767da3d885438224d5851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4986c1c1ecf8cb1624d7bc0fab5cc97
SHA1fddeeb822b5d826d3c0a2c7158b6eeebfea6a747
SHA256d77be80429850b3b13af54bc4eb434ecd82330917e5795ee2f0ee9f03526e5b3
SHA512dd33104e064b48bc034d50ade76061ff26646205f1c0df8b43a53a0385f6f9c748710431c928466ba6452618992c51a039278947bc3d5d8b889394d9d0180b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d55ebcd49f7b7bd5cdd2f8b557f1a8fc
SHA199ecb6d2b0dd884a4c7e54ea2b8321789a430cac
SHA256be6fc6cd5be3abda2912dcdd1a7cd2094df9c3e0ad88c1b93ee517116a5680bc
SHA512ab69508ea74b99737ca760d772d0eeb38f7238d48ffdb0cc8702593877b011afbc70b473e582f85d8708de0ab65b9fb21d9915f6105bc92b6d0fd6d77704030d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cff38ce31c11ce9fb37afcfaba0ea762
SHA1a434f784446cb2877a15bed40a5d1f38d35b04fc
SHA25698d73f1c08798ed4d5c1a1055019bb2c3095d75339d77dce6d1e9954533cf8bb
SHA5120e875813209c3d4fb2316d4c505c3f9dc667a6fd59ef75008d3cf3515625627ec96725c2aca8de0c11707fd017e4dfe42bd4e32a74e4a7463adabedefd6cc1a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54964c82b343476394588541691cd084c
SHA1895b6b59dc69a931f7d34bee7e3f6586d8af6162
SHA256fc14db46694120ee8b9ebeeffad841ef79fe76f518326f2ddde34bc0926c2eee
SHA51258036b047bfc1e89a586cf8cb41167d0cfd7c70dcec87cf8b18d8889e74c6e09e63d7f1a9b5acfb8af7cef24fbd47404496f286f36a2b621cfee3d14d65fc6cc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a