Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 10:16
Static task
static1
Behavioral task
behavioral1
Sample
1244e17f4e7866d104b50e21903d1fc8_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1244e17f4e7866d104b50e21903d1fc8_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1244e17f4e7866d104b50e21903d1fc8_JaffaCakes118.html
-
Size
32KB
-
MD5
1244e17f4e7866d104b50e21903d1fc8
-
SHA1
013a11405279e2d79c0e3b2d93aa4027e3275e7f
-
SHA256
c41d923b4f4a81298b3431be557ce437814eaaba58ee846b0cd216a3eb3620a6
-
SHA512
3bff5cb57fe4d261f9a07fac6e39c98e5225e8dc7e43e87af5246e809b3681f851bcb1df4fa470c39507d37ba41e3ac20c887059fc108e8f0ee03510730ced4e
-
SSDEEP
192:uwTjfTRHtb5nwinQjxn5Q/EnQie/NnSnQOkEntsGnQTbnNnQmIox3+CnMccl/087:TfTRHYQ/x9xqP/05cm+F
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E294481-09FF-11EF-A339-D22A4FF6EED8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420979654" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08443330c9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008d2f37be1a07674d334e68b5c1a0d76f2cf648a73f0b487b9d28acca19de0b7c000000000e8000000002000020000000226854fa4a597bafb97496850daa8668cf1c8cc08f87cf794eef20d4062188db900000001892c2dd31a90c8d8ead00c8824ed46e078e46f9109cab1dd829ea28205add4f493966115d0738d39085e2622c0f7b00de70d77387c3ff23a66ef1031f4f8dc75de03d032c398063a46995fd3b84f2df548177dd8d8831322bdb43dd97c4e3a8efc496d2bddc76d40d13b7669ea909c8f4a2858312dfe16a963d0fa7893bebd1626bf938b3a1a3d5d67fac496154079b400000003c7a0e323da390e7bc8981ceba5118e1c2687f378bddeffb836257b520290f66ded05e9993f0f67d28fe325310e19da14f2c2df988c01c9c32e73cf00b419982 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004056f7d925cb01d2cdff3c3a27c8a409cb8b7a72f1bb4e7407e7dc079d0f7cd1000000000e80000000020000200000002659f22da3ad1f7462204a6cdc50bcfaa046cf8ea6eb259e363e4ba581ac392020000000472d097953d13109e5bec2d6b6a9af1271eb883b701febf9c71e43a3f332b734400000006216f46c2d47a1261edc7e8efba05b3638c237dd4966810f88720792008b8d935c761f6005a6d90afa508866ca984b86664f23a0c22e7e8e2abd5bba3bd8fb1e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 3024 2080 iexplore.exe 28 PID 2080 wrote to memory of 3024 2080 iexplore.exe 28 PID 2080 wrote to memory of 3024 2080 iexplore.exe 28 PID 2080 wrote to memory of 3024 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1244e17f4e7866d104b50e21903d1fc8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c81af44274e892e65e1eb34586e81209
SHA12da2b886cf01ed9c4a417261a608c4faf04c50be
SHA2566e333bdb411e55eb2c22e6e35c4beb96140c6279e2efd3d424eea4f56be5ab65
SHA51254e9e20e10910532155a26d74a8a4449d166bd3737a1fb1930b0e3052c4637409e617c9945da0bad59d38ba812b874de3ada3a4b874a0ae2dcb454885f1fd59e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5372ed22fd633a2c8cc2520298b93d34e
SHA1c2a443724308a92d85a608973da184036c6fc2d5
SHA256f817594f6f9ed3af0d76abffc21533d6c9fc2ed5700896cf2e4720a3a402e369
SHA5129e7f7e6f4afaf1cceabbf7f0e143283a2e667d12b99843aa625fcd7cf5075ff985b7b431bdbe89c3982b6a1585b81a7ac7b4b58c30873069d80732b9a26504f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559717ea55e9918f099c4f683cd7a3bfe
SHA17447ccbbbdd960c66cfee8230643d6be45f24029
SHA256b96036690a1177723e0af832fd201676bc4668f1d7ade728165d7dc68a5ce321
SHA5129fa3dafea281f69998155a35ec867ad4ab5d49d6e37b5ad910ec03a64cc177bc7de1f2dcc78ef480d9dbbd573f88f3c1a32ea7f160d71b4e0c1ce67bdab5b688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544aafa9a8086bf90653ed9634a086f30
SHA12165ff0738220f932cd422c2792335e1b1f5087a
SHA2560673d1a4c2e7af65da395b364fbf1cfb755ea67174e95e8d0da29ba1f870ba17
SHA512917d247a299cffa8a6ff9003641a166fb19fcdf09b3c4abc69d372995d0e8064d427c20d3b2bf01fde0d16f9a085669ec4ed31d0bd7ac97c611520bb28887a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f69e313788ef8a1289a2107dded79a6
SHA1f763b99bbfa8719f4e5e3739000fc996bc00976c
SHA25604f840042816beb86ba678bbe179819644ee15d32bbdbdb8c42910146d48c9ff
SHA5129f4c57f06076a0e56e92e3aacb6dc363b3dd1a367862b0fd604462fa1fc70265c613bb57a79bc6b15b941985ccdf8887ddd3ffde909be116a2b801dd74fe9af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a35cdd86a9aa7889a80975dddd01906c
SHA1b7ff87ce2750321e595466ec82be59c7a03391bc
SHA256867705614d1406ebf3fcff3e876b87c60f874a5f711684d96ce0fc31ba6a9d31
SHA51240b6523a76a76933de3a7b51669f558129123e92d218bbffcc2c39c5ca2f9819c381c1248f6ebedf44f5d1e9a1d3a3d36e84694df76b0e055c14ad9b9e3f0abb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb4e2b148fb3da85504521e1e3521c0
SHA1d2581e1be5def4c5d6c5bb6ecfdb11bd23ffee53
SHA2563fb66c9fe1c2936c116669baa529d919ec5cab8d0ff246a8d40e3356c913e3e3
SHA512fe1b63033661a003dc2c49531026c56d1212422ad2d41d621a6c8078c41d8be83ddb8a3131d66bc6ab00ceee0ff3d041f24bd8606167d5a6bb8397420a06185f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd36a14ac76f54873cb259de47c1eb1d
SHA153f5d09bb51cacabe32da11696cca2469a1a8697
SHA2564c9e7c4d756efea531696ea4189c3b3e09dc7f2476201a7ce5738b5f1bbe2eb1
SHA51248d71b600201bf27ea19d7f8f45ba0edf1140670ac2e8b65bd0ba221d828429e45f781823870217aa30a7ccbd49f0f3ac3e28e98f622940a3e4d2799c1535e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5229092936e6856565da143eed5ce84d2
SHA12b6270a35630acdfd06da9ed498f57753b011397
SHA256420a513afe8c7d6ebf56470ba0e834c1193ff55e75de0916fe79e713ac42596e
SHA51256c5fc013bf66e9e21ef9930b9f599406cabf7efc37dcd508634ce4b6fa684ae5826e825492657076380b69aae236ef6b6f9b082d785006b36e8fa7907bde40c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c634985b26e3d06fd867f2b70e61008c
SHA1c068b6da00fb86b2f292b93ce49949ad7ab32458
SHA2563c1425e181bb22c86a28975cd5b6b39ef65f57abcc5a3409169e0b967c74cd57
SHA5129d8e8aeb7299a1e7b1974eacccd71acacdf4bbf366663f9fb61aba13bf24908d4b1dd0024a7bcf84297ee672feb5e420af4ee209be32487c15172b6eb8803dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad2a9289cbbac6594ca6a0f0805b3470
SHA1493ddd0c8ded0f06b7cd4d9c3a447fdc9abb74a5
SHA2563a2043813c3c7ff5d98aa589db5eaf4593e19eb962a63d30519b9c07eebdd3f0
SHA5124d1c3ce28381860b669c283b2a835596e029bddc427578558b42f622d35ff6a0dd97b2d3d4b30d8cca6e640f83eec9ac51474242ae7bd5e7e4a331128e5174f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a603f86b6a8e3aef727811340488d32
SHA1b51a248cf3d91adb0aa845fab3ff8ef38d7913db
SHA256dbcb7c90a4e23706f7304d387a1c8a7c1078082de6eeb4a471dcc68a1872fa8e
SHA512c31c27b226c0f290294974a875b5d9a6ad05e8d94a85723dc23b53e8d533aceca737ec62430ef2d4ae314aca911091fdb4571dc23c768c7f2d5f21c1f0f9865c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4b9d6608f32f7bb80169c1cd8abe171
SHA1f5819db63bbe3a2743bdbfa1c6cdba3dae54d486
SHA2561645c5aa13bc5eaba50253d3ace1f72ca85bf5c97aca539d22e28f2e46196255
SHA512428e0995ce60144a0cfb0c079b81033f463f2858df43291490933cad1f4ab6b2782611a0429bd63ed376b1f6dd206b54e7d74d88785b31b06e4f06243977ee7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533f09c0ed975c2b5cf227303e412cceb
SHA144b480b28e24497dee8e3b07708ffe947b2aa0a2
SHA256068fb06a9c69f16c11a22a923bfd4c552316536f2fce071853753ed018fdfce0
SHA512a8b1af32927755e16c4d2d564c877b39636fb8e4c3acac7ea61f38468025fd1b149a7fc18ebc40b3c6e81f72907a831945c7d1685ee5dfd28319be27c021e418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a7b5879e69ab5be12f69f74f33f0997
SHA1cf83541ebeedd1157f22aba39e342fcb76708532
SHA256e2dcc5118299337b7021eb0849e5586f80930bf2706bc099252ead8b54a9eb06
SHA51201f682648da2c487bf92eab754a96aaa5070daa517b305c19181c8afa49a37c9bd571c5ae690fb358fb935d1bc6401133f6868cb75f507da45daffa366799b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a38059c1de99e8f6d5d71453f7d6fb1a
SHA1e266506312717e08fa37d9a123d3c57d7baec869
SHA2567446f1de6ebb73b33bc8e37a86247e10d41b1e587ed13fa0a8283f3b7e05f3a4
SHA512472d699e0a6b20c847b86d519c4dec3b48559a6c40a2739036428a08163bb6a9fddf15ccadeb85d8bf75fa59ed02d049f9ebec153df14594553a56b0b91f6ed4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a