Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
12826630737bac4a4fda3a4b10be7117_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12826630737bac4a4fda3a4b10be7117_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
12826630737bac4a4fda3a4b10be7117_JaffaCakes118.html
-
Size
6KB
-
MD5
12826630737bac4a4fda3a4b10be7117
-
SHA1
c6d99f8c8dcf87d95fdfe2d02c201d5db39923f2
-
SHA256
34dc924d3514512d52a4b58751ae9449732a2ffbceb9990ac81158716070d5a3
-
SHA512
844f191abc5bd423af791fefc9ca0bca8675bc5884f6d0959edafe875fe83e09509a8aff4ffc2d727483b3c1788ca048f9dc29f704d5857c10dd2d6fec7ab29e
-
SSDEEP
96:JzLmisNo0SklXEDjSUmqQdezddddddddddddddQ3ddddddddddddddddddddddO3:FLeNoKU3Q88GhLYKgk/h
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0aea29c159eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420983699" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C74E4BA1-0A08-11EF-8C27-FA5112F1BCBF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000dc24b4dbe4099e595ab909aaa083508abec08be44cd71493b59d5ed846e0444c000000000e80000000020000200000000953c2ad165d02131fc113d45f21e0bcced650c132938eec981b9f0c835fa8ea20000000abd1e2075cfb16b30d51ccb4a07b321c9bb14b15ad1431374a441f1efd6f6cca40000000340320a633aeaa9de4637b3fa20b9fb21f1266e19f719cf9e098b674a6cfe0afe67e10d1f4ebc2dce8e5a780938b8e888e8a415da18e142e3e0648cbada0e63e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000112996eb12402b723f5a3c5c5eb7691aa352e5df257828c3c7605419df8ccf74000000000e80000000020000200000006d93c05365c274deebf35b2bc0b91d89ba2d7f4312db4dbfcf8166904a42f4789000000026c158d6593a6c5ff04134cc5d2e679c387659ca515f9de13e6aea1108a53c25916773f99e64b783bada5e385eaca59b0787eee133d411d6d1929e63727721e034e14869a3aacbc344c2725aff2a22c04431fe5de5ea81da4c79fa7fffc572e052d53b76503f17718b76768aa54d465bf6cdc87038351a57b9fef6d7cf60951e96b1abba5bde868c400f656963d3130d40000000ecf34ae80a4f4c70f1132f42f5865fd5eba5e70507724bfed76983d9a45f4646b92ea7991735aa8ab6eabfbef7b907067720595db3b0a7748a504ed908dd2e8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1656 iexplore.exe 1656 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2108 1656 iexplore.exe 28 PID 1656 wrote to memory of 2108 1656 iexplore.exe 28 PID 1656 wrote to memory of 2108 1656 iexplore.exe 28 PID 1656 wrote to memory of 2108 1656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12826630737bac4a4fda3a4b10be7117_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509269c65fd0b7a3113e1441dec47f20b
SHA1f6b978ccc7605d0dfeb48eba3bb4ab0722fc1e05
SHA256f67b1c7fe9fb083dd24d6fc900fec4434b8d717bf5cc4d72b13647649fb14fb8
SHA512ce235e6b22c0176b0e31ba3e7593192570941a72ff43be27dd8c2e7253c14d0f5460b908b954ec1f15e6e7961bfcc9968953fe3bf5d8184f38c4795c9342e82f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcd8bebac4dfae4508d45bd20e6d52cd
SHA17d4ee44194fd51fdd55e7a0e97caf4af3ef4cbc2
SHA25637159cc6f5c1f9172814453f3f65e10eba4ed03227eac1985ef75dc6f2a143c1
SHA51299281eb2a8befe5eefe291e06551c45da4eaa1370f123e52dd44a450f438434c2656a674e4da3f79b78a70837bb659c63f7aaa90a2f297332ae3b75042edcdbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2b7144b00f978334f86c02644365830
SHA15003e68cbb1996d92150a676566a3e09bf604218
SHA2563fa023e96139be1f4c9f09eacce2f205cb4ffb2683c43362863dba293fd901b9
SHA512714efab60fb8b74e912a305742c4ee31d5b0640120468e1629e3feef4c466bcf862323122a06c0c3025cc1ecd82ea66e2d77ada71c16d8dc9ae030407460801d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea3f07e811b1f03c77b671b0c2c4e3d8
SHA192d249e433a01cbca400c412257804556898bcd1
SHA25635338084f9d086a82fd3c9ca7e30dcae3dc7265947239eb2e893c76785390d63
SHA51234662dafd85dede1ec8777e4461e0592d537e26b914a7651981698dd86472f266c73454dfab5463506f5c4a5fcd92c2b552cfc6c45346a694375fd3938a75ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2ff51ba9aec7d7959f7e9722d89843b
SHA1945d72ada22049f788fb0b640475f0e339ae984c
SHA256f1ceb9a4dd93a1efe1b76c1113099271b46ccab12ca36e438b5f59dcadda6301
SHA512ca929058d43c3394cb7807666e22c2346571c7392be3d44c623accf96ebf24d3b2f148dae37da5c27e38b820fb0ea31ad93b63f3243c4b80a5ce05937781e1b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566d76edbf4764aac27cf42108b064fe5
SHA18d80c5e4a32a6c962e6ff508523fae01c1dc674d
SHA256c3a6229f4bfdf72e4f6380223cb53a54472cfeddc554b73626669c0a4f209283
SHA512a3a17ae75f41dc77ca04cebe25e73967e5633832f73b487141df3741b7e93e57d523ef8303c0f08f60dd3c0a1200060da03c9545591afbc6affdd670f6e34946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda053fbf2ab0f70fe85bc62824cf9b9
SHA1234a8b88485d65ba144aca041cebfe539159530e
SHA256eeeb6fe221ec3444dd52faaa5607a90028079e0c84f2faa4767ecfb2663b2e82
SHA512290117e805ccb9474aacee4820bbef647e0c17d00673de95e1e015d159f119b6b7a9f4e720a34facda92fec9a24eeb00161ea715cdc29bcfedd5d3b14ab96bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1ddcbc50987d7f9f4f257fcc0e2961c
SHA158f8e3dbc9894e7e04f2270b14086ceed435eb4c
SHA256bdc9a9e8188121938881f37b4b17a892d5ba02be53b5228bd7becfb5b76d96c6
SHA5123129280fa37e96cb380ce7101385256a42eda0ccbcc2a924540ebecb550069a4b63ff33351e92a6ca16ca6318fbef77d300efe47537f03db4966880a424d59e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59902152bfa6e4cbf10da6fb9929fbccb
SHA10acfdfc2ab8ad8d9983ce873042c6bfb9549e6bb
SHA2561c14c8382b84e6282058e8513207392b200744c9c1493c9a1b59c1947e61bb83
SHA512487eac53f4304ddb759d436d9b625f96823ff66743379a1861329cacf9bf429f8d1f79bfef08e1d0425c7d3609736acf8774249e87d520441092762e00394335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5083db322719e984abefd7aa8503a1698
SHA1846e06f9c11263b40a95b915a593ca526b79623b
SHA2563a2605f61f6e092588cc0807b3f35446e2f1772e23ab1f5397a7f54b33419ef6
SHA512864102094ffbd9f49b289e0da33f519ffb72fcc5a749ac9b0c7334dff4b4405ddaf0349b97d17430684d1897ca239d6c4c98046ae06388acd8dae49b077afc8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55571523fc826c1b6295dc5f08b6dc4b8
SHA1825f9598cf137a1a4bc80d5230fcba765ca40881
SHA2567e87a3085aeb3d7bd4fb67e7440e77aefff15972b7e2352adff772095f725d25
SHA5125cf60e4a4a8e03b6df33e11d032bb919ee2ad9d398babf100d1863972175e7c76632715a95c85793016274abaca46c0b59f18ff42f6868c2b236678751991377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5153aae4f269b72594ad5e1d78167bb0f
SHA1ec411f43817174dab9878e41242f8a273361bd7f
SHA256d9d5189fd99f8074645a876c04c03c28104cb490ad5dc763d11c371bc65cddbc
SHA512a5082d56bc9e4a3734e5bdc2a6b13f8a19d72d53b7b7b0af7d0429609c9d691c8632ce236dd0aa16a2105aeda8be1e587656d4bc862cf60782789e9290a321d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574776d6a63005d319135c938ce257905
SHA1c245f739331469a07d1e3d1f2de9dfd8c745106d
SHA256e9838bcf2f150889244d7502c78725c04cde7d1ad66dbdaf3786d78e51604bb1
SHA51213b6bfda75a4510d3b085a87e266ff8043642a783bc729d0e6c5f24f10536f2d0b4ab8f80455a2276db1e39b6191550d3b1462a58ae63ad6d7b62318ce49806e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5575a8d1ab9b6c564cd102610ef6739f1
SHA19600f2fa42b4cd097f78023906a5348d4eb31199
SHA25643c6bc9c324484c8499727561c1a9584bf1230877e67572389427f23793b7bb6
SHA512de959c14421296a63edf8c6a350aba63a404ec26f3a7817e1ada82dc968febcd311f6b1a2d9de6166a988f5b52b9346328a582dc663c51299524a9e7bdf03221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f3c2cdebaa959be7391ccb88608fd76
SHA190d49c1e0877267e7b07b654605ae440b9296ec1
SHA2566148a6df1be4dcd35ca5b66debe158354da3e196038e19d7a20cbdbc13bcc00f
SHA51235202a45e3a7a9b67e9eedb10c159d3b05a7e48723f26998259d6a46227dd153d1dacdc05e4bbbaa9bec47277222214e0f99bc11bbe5b0a5fe3bf4564b0f4e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e0812d5a2c1e733b4f59b18af59ebbc
SHA1a5e87c2777256437045a8dd9c5bf51d50f7203fd
SHA256b6a9df133350be0d5992573ff019170903cada414c0017f995c4a8a4383e2cae
SHA51265955989663781bae5c1c784704acd1438df88f6039652e419a253363e5a4d85f8f467cc0939ec61d573ad71d80c23d89e728d1b0707ff713f243f51f3630622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56927da3416158e38b4f9ddee360580f7
SHA1bc836e5b707f1fc632d908aa6cfad614c9cdb21b
SHA256051fc2985cf8150e9a390669dbe5e00c43c138bf75b4eba14095e124db353e59
SHA512c018713cc3a213f2cf37afd51e3e87a3095c36c5536c43d9ce3fd1684e8366a87dd5b70de1fec604d938f2a6d7fac2edbfff22305baf8098d4fa1ee0d6215bb3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a