Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 10:33
Static task
static1
Behavioral task
behavioral1
Sample
1254acceac0699416849849010e1d8a2_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1254acceac0699416849849010e1d8a2_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1254acceac0699416849849010e1d8a2_JaffaCakes118.html
-
Size
13KB
-
MD5
1254acceac0699416849849010e1d8a2
-
SHA1
58b0c0a919b1f000b9939f3f339fcbe81696dea0
-
SHA256
69e9126bf1234c6575bf81704a6e2d9912066fc4501b84cd8694c828459f869c
-
SHA512
f607f8300ca9430f97f9bb8598707cf114a214c835c414e94c0ba791298dee31994fcccb9fe47c580722f8f9ab19494dddb1c90ad1fabc2a10232bb3336f264e
-
SSDEEP
384:Bw8zqsMB5mpvUx+lXj1iisFADdWOU4zgSZEOme5zbIjcJp:BUZmdUxIpMA3PafCbP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420980693" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002f8a08d7c83b83d8b0a6277de7ba9c2565695565d0bff1f7827b2d3ca27e6b76000000000e8000000002000020000000fff1f08b0cea2bff7f9207d262987388c4e35487f3164875f2ad314145040df820000000c11332818d89306f873b41a6645b8b73bad2726ee641c3493b2a1ab0d123f21a400000001a5b72e8a51d1062bc056526b9a1d994bfbe04bfec6ca31984be8269b469179d10840b5784ebbe96eb389301aba7fa648629b6d3d14b1dce9e6cd218132b5523 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206b139c0e9eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b0fc6bfd502f0b8d686b3b7225dbf06322f11d301c7b7827529906406eb75f42000000000e8000000002000020000000bb7ff53c59c820c6266292bdd7f660fd76277ac482763a467ec7ce12234e700f900000006d262116051c238cbd8278f765f541534ccc0c0bee1cf293fc11be95c4e089c909fe945d5eaf058bef8be1cf1341db7b223df913645d0a367ced549946df84df5415a9a7f140012e3ac4ffc87571c333b094e1a689d8c56c77884b8a7c0fc49ce29d6bddf79bfaf35fc70ea9e094953a8c9a9e90f72088b5a4461ee5751da66a33ef7fe336d9170d82f139bbada9a7f740000000cbc50cd8cc8508bdcdad4e4cb7dc31e295203409ad87daa0b4081ce8ed70b5d759606835577cb05ce79e5ca40539441339d2c2e5d1f670ff4f007f84c9118fa0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7A5C671-0A01-11EF-9A72-56DE4A60B18F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2176 2468 iexplore.exe 28 PID 2468 wrote to memory of 2176 2468 iexplore.exe 28 PID 2468 wrote to memory of 2176 2468 iexplore.exe 28 PID 2468 wrote to memory of 2176 2468 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1254acceac0699416849849010e1d8a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0d162b8e83ab96fc2fc3d4f88a6fd8d
SHA15d1f1f3a6d123d5ee6323b4bcf72bef3685b8ee4
SHA256455453ffaf0ab8e439a5010e3673a3634ab145d55dc0b47ca221521e8874fb07
SHA51211138a1577fa68e2aa20ea58e819b95c1a9d8513287f4dde4dbc943033474c89dd36313f56a1283e891cca7502f01ae5d442c08465e994f8f42671449a228144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576477d08c375be0b711022b3bcb3213a
SHA1983afd77a4c9307cec158a634a411841ffb542c1
SHA25660561debbaf1a98d3b036c4318981b8eef9975ccdb07ca224c1fc5019611333d
SHA512aad169a8dfd216ee1b575f0496bb4876fb4036f8f281d783e11da71ee77c10cf4c93ea9ea0496a17eb93559c01327c76f08b26d413752f16dd98effcb478db85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b7cd4e42652849f0b80a22661ceceed
SHA14a1569eafa43f79378687bc12d58781e9ed28b74
SHA256d1b67ec17b88df5bf1f975fb2a418f77989a3338e461504947befb271e9c8552
SHA512fa073eed7b1196a4be880fc01238527fe61af3c7cbdbce0c4b5f4a087c5fa8e175dd4cc35cd3cb2eb9f45dca17f437cd60890597f248aed61df03a36b32e2ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac811cbdb4b9a5f42ed55e5589e5b04a
SHA11b8c1a661730939970dccfde79b51b68a40e5deb
SHA2562af3c31dff2c04e5752e4fd61f93311759a2b466f93c11d942522895529eead8
SHA512bf2cc88ad0cbb3f9e5fd963033f53e65adb25c4dcc20df5b9ea3f44375f081d781775586a788eac83a721fd51d656b90029098ec3d6f7bd19e90ebbcf8f979cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5187e79155f55c86775696df535313295
SHA138090e77df490cda1045c0f446fde9b909d325f8
SHA256c3da2daa60de87f12b0392d50c6f0eae833f415b037edb9eca4c2835ae031c96
SHA5128b2a111208575f8784f8d810baf22ebe565224c7cccd3bf004434d4508b34ec8b9745b62272f5f67f9b971b0aab870de08827dde58e348710e6280f2a3d7517b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5240cc0ea6b731ba594f763674227c7e8
SHA11d9cb9ca1f3d7472ff4364e380d40bfd4fa996a5
SHA256d9bfabb3e437f80a744b08f59f2351394004bc0afba294b79ac58fbb48a8539b
SHA5125889bb028b84938dbc7d243194efcc0e70dff0c27f8fff72b36e6f243bc1248b39bcdca7e865a77fed06194eeb7c03c5c0444dad5351a2237ac3eece28727a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57815676786203fa898069bc3fa742d07
SHA1f26528b9f7264e047e39cb6c5857aadb4bb457a6
SHA25678eab7bff48f89e3db7f88649d5a90b9205286c6b2a8c8c0b6024b77a683e908
SHA5123fcdec2ecf3985a3cbe6c38ad0f80449c6e85c26a2c3ad8071d6ee960362f3b397f1dfb8aba7f3d36083a22ed134a037bdf27be1a3ed664da2cd1a5dcaf59157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630fdfa7bada0a22ca025e08d47784dc
SHA16fdc090574f61779919f0b3e12e53b67d2a199d0
SHA256668fa5bec764c045e15020700e181e6d217305bb315d2cbeeee5d798df75bd2f
SHA512caaaa6de2eacc18ef4c07960972fe00ae4747d910b896742211ba77bebde9fc0bbb1f935b64610adc4afb1e8845a10e41631ed2b1118dd64b6ef37373d3c5f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9ea322121940e71a8e65d008ef2594
SHA15788c5ef359603af0f183b2e44a0144088743a3f
SHA25687bb75c6c3c8162cdad234f731350ed30f854739910c4f21f2ace921e578bcaf
SHA512801efc150c5b629dd376b089307058ad3b7a5cf59e9b75c117c41b0bb1f4faa95a9701e16c69eb6880db3acd2ff0bd3597d9cfb0ebb9545f1ff5b249b7ea55d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5876c232a559a3d77ee412728e7f40660
SHA16f57012b7920cbbb8459fb3ce88bd251f088a154
SHA256acf856cdd1a9c083f4e011c86fa4459473980bb466e5d3e18bb2628d3f141b55
SHA512f8126e453d8b428b3a323cc4f819990f5827221ba80b43d0a3276d878184376938339fb0315652bb96e12ab6d71e1e4661379e8bd0210153e526d411a228f404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590baa008787f011c3c62757565c712bc
SHA17d6fe65cfd61183a320dcd338412ecee29aa5139
SHA2564b78cfb6bd3bcf42da1503d27d6633f6a1fa496fbdb535f1b947fe87b1869626
SHA512b369c1d3be5010e7ca660c1368e8ed63f72140932d073ca568b58887505632e131db320d3d23ab53ece7a7f867da5929b3a6f2b09ab50ffb217b35fa89de4750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56886915223d3f1ccc9681dd59c8bd248
SHA1a3a1165b7e02ddadffc82021d2c0f8e24fb18ea4
SHA2564940cc6539b1d71098eee4fd0ad9ffeab3f0277b53580eab192f4393bd80d3de
SHA512fb23b1e7d5eb56748a0b80c27b2c2e0e3de51f830b0c44fb9605fbaa66ea19d41e1559f352b177df1f8282f11e0d5d029053a1bc8eec53b7d6350b3a2f790e1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c133bec6f55e3313e596c3f83a911c2
SHA1856ccd22d5ed3e4860b5f26c57fc55ed9748b8f4
SHA2569323f5391ed350f2c3e1cffbf059ed176a4356dd302e2d82df140abebfa11f4d
SHA5128a1ff5560caffe6cf26ba8e73c8bebc4fe51b0d61beb36e8b87472509b51586a8fc7e49566b1f0448c33a6b678d5d99ee4d70cb0a1ff47b4a5ecc167e46568ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8aa8aa2ce0ea808e9ff8a0c2219cb9c
SHA1dcd7b5af613fcca0e7df2271995c140c87b75569
SHA2568e7a9d696e74ef5392e073465b97c7c60ff2a60629ce296471a680291967f5bc
SHA512e30c9501f7c27c55e3a5fbf15edd75a838656aa5aea5bc3d553df720fa52261e73f2518f152b717de86534e8d6ebd1b5cc24f9349523d33d767e41813ab0645b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599fe9584763d00b7593c546d6cca6ab2
SHA1c199756b415f17f5049f077a6a853f8a91e4a64f
SHA25620478080fbc66757fff37073d94cfaf853081b147e44418a3424dada8c719c3d
SHA512d89fb591e8b5a02d893b931b06d5eef8e453f5e7e0b4b6afd05ea830938fec76f242a101cd05e248e6b404f934102fdbb2cd70a7675aeb45bb53ada9a564aaef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519f33253c2f6c8cef2643b261dfc5700
SHA16e01b97ab4e307093a3e38769b8e6c573b44bfc4
SHA256e058139c8e8342f0d4df56436f42cee0922c26dd940dac43a35ffaf94f981d48
SHA512c4e7ed49b902ce6bac421fb87dc0aaf425ae9f1f18a5cefdebc2d4d344bca2940e93d4d118576af1334628d6e577bc452749ff7ab460f3990c3318637c725724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcde355c602e735005b252718a7c046f
SHA1df3748cddef2421d5a2a259f78ee1c9ad27d53de
SHA2563b5522da9ade5af087b4e086db1d6f825cc005e1dd1b56fce3d60207b34a2f0c
SHA5122b88b3e46848205beb8d6416576a00311bec66b72d1c5c68182aa93ba1c02894fad824b9f99a7f518a46527489f1047ac63d66be08e89a11c05710386ca0f36e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529aaa7ab26a22843ed5b0795a5effc30
SHA19bc0508f2883a50d5ed44c97e35e93a21d581f4f
SHA2565015e84da4045e6636c56244e11f45358efe32ff32a80a8a58d907e0be53eba3
SHA512400d7001a000c80aa14a7bbbf69cea10696b6087046a97a7e8ab54b130f9d585f8a5c97586bf2c425e1cf2ecb6b1329799f1e9aacb088b2d02c85d76f2171497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a6ff3c56beba56f87ef7d1e84293c53
SHA1396c09d28a677162f95283614e3baf305e0cada7
SHA256507d50d7fcb564152d29fc498494d126be0ba5325178c84447124c7df4916647
SHA512fad6366d05111c01156cc1d84dbd64765910cde854e95101840fa9ac28e410530ff965f4340ef4d4da2b9b5c198f7bae184c535baa803478e53a8f3833817295
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a