Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
12af4b4a4e6c17c1a39622497617c7dc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12af4b4a4e6c17c1a39622497617c7dc_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
12af4b4a4e6c17c1a39622497617c7dc_JaffaCakes118.html
-
Size
18KB
-
MD5
12af4b4a4e6c17c1a39622497617c7dc
-
SHA1
1eac76c782289bca9886d03ff34d80573953b7a3
-
SHA256
555569bbdbb72c3f0d1f84e1d728a41dc0b3b75c9abe3154cabb5299c8396229
-
SHA512
e3c16bfca4886738602dd73d5b1ec99ec58edf675f194a749c1239fcd57ea09ad34e1aa2d50455674e66d0d2c948533b00d0977cbe7ffffc5a15536088c4a530
-
SSDEEP
192:32ehCaWv7fwcuR70tlSryvT+OUsmDNGyYPgl+z:32e4VvvwYTvT+syNGySglM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420986622" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007466e4d718882f4e8fe629075937059ba1a9289c118f596757f6b061b8660787000000000e800000000200002000000071bf2515d7a35df6ec254ba4f3f7f0a05f9faae065cbca3f321dd9e80164bd3c90000000264ac9cad602fe1b5fa297db2215bdfacefc7aeb8c6c33c3eb742919ee3517e51f9f67fb454d71940363eabb95790dfdae536aacc9fdba7b9af99618937246b63697394729ee0c7b18db3d9e0c39905343b0de9cc8d2449ac8fedc64c4ef2eeb39bcfc783478886513ae8c41ba228ee6df0af7dc4a03b96e322c5a64c60a6b1d8f00163dffc5a00ab4a61d352a177ba840000000dbc896fff371209e9f10f95323dd7c22dc154e8581d03984995bbbe5ad6ee4881141483fb045dad732e579b51d3652f128588ff39b11a4940bc2c3639682568b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96D79A11-0A0F-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d242e51b72640babee203f7a39a627567828f5b547c81ad8183f9ac5b148cc8f000000000e80000000020000200000000bb91601b6b411b1517dce0467c8dd12f28b0e55caeeacdf3d7bb4409a2234f1200000005ad8f821f94bba5015c8d93ad390f95730a186421d02040fbadd5cfe9aefc71f40000000e86c96d68dc8b89c855a7975c1ba7f57f1e6ccc2aa6a71c2bdfcdbd198ae092521146b18d738ad0e02d7a63d666842bb5efa073b587d99364ce8d46b3d1ba42a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b4156e1c9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2480 2088 iexplore.exe 28 PID 2088 wrote to memory of 2480 2088 iexplore.exe 28 PID 2088 wrote to memory of 2480 2088 iexplore.exe 28 PID 2088 wrote to memory of 2480 2088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12af4b4a4e6c17c1a39622497617c7dc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fd2140857c56f528ef74c52c5f6a74b
SHA1c13ae1e0ff4443b28f42cfdc3be66ad5fabae4d5
SHA256a6add3eacbde768299a278485eb439601de4ffaec273fceca5a49a8333efceb5
SHA512c7e3b90ef8e2ff6a336027e5585fcb5d16072f6566f6916ad6566dc62dcee593c2897ff770b9777186ad1110ee4883ec818dd10f13d88f12c09d3f49f6965edd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bfca2c76116310d28d0e39bc52f1206
SHA19942fea7626627b62894403ad71cff9eb423f3e8
SHA2566833613e398bbb9240b0a88f1a49d1a5779e163239cf6a506adb7ac1e4aa5f72
SHA512de2285ec86aae8f48b6c2dd500cf20930abaa18884bd786954a3b3f8e93891f15f782a3c70da6277a4741b7b4db129a6303c0dc6f089532ba7f15c02457a47b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ed2bd2a9a809269dae1a2d1f75ef7f0
SHA1b52f4aed328d8cb47003b0e60efb24d038b59f85
SHA25651c21b7d214993fa22276ee0484d8769b58056532eb430f66fb85f8c5ccc5500
SHA512be255aa9d5b01678ac90654b933b03203a13ed71d845b5a67975007eb5d4babed7d3743bc468d837af20da48c4ef936586462b8f3f8d3c3e32039317ca5fa289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b09723cea05b745d833b5d9431c1c62
SHA111580dcfbf83fb8b24265a295b85b44d9491951f
SHA256854c197fdef2256fb4fc00e3e1e325451f5d4c83a03b966379be1d6e8d2eda1c
SHA512d41dbdd5e4e914f588946d45072b308f5efa2e226d79de99a43e364a12809e87b578ad9b2ee7bad621f8513f33a376839c8855b5bde287371ef7c3ecb7302cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5205d8045d6ac898e5de3143d771f3a6f
SHA1b8cf44d00e13577759f7489f9f2027bd2bb5ab36
SHA256231839453a882d72f17ddd42b56c6dbb8af1d92ea3216cf274240b8291ea6f0e
SHA5126cb1d1a7e8530d6a2819b2f83ea63ec36b185b6a6064fe065a8fa17a7c14d08d339be7ff285d294dad5db2f5e796fb41d0e4265cb32d4edda28e74036198968d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cec0138aa3fc36234bd13e4bcf3e0268
SHA153259d8407d2ce3fd1777d20d7f22a3e08150b44
SHA2565d182193587a4af5fd747b268d5787245dd81b2a5ecac30680c81232a166b655
SHA5122e5ee553f6a78588879e7faf192ec9fb4958577cabeac15cd2527bf4b42d4b790b6be22295f9770bdeed2dc5598282a893439e5f81167691bc51de41a60cd107
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59376004de43948de052a1e6c7a69f74a
SHA1fb01f15a2623b6375c467a4e2e21772daf3b9218
SHA25649ccdcc6340a83de224e88adea9587b6c33ce63ce3b0460035d1686ca65c4c5d
SHA512708930992e6464804c6cc466728c72c714cd802bc8884049e770780db3f0a86e6ee40036c700b51d4a52a79fdcb28aec083cc519d921a02249b475a86f97e228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bad92cee913c4becc1fa9e5a2eb424c
SHA156d2d33a3afdab59f54eab031555b9382f5098f2
SHA256c52e9f9dd8d011c9c7c82fdcc6eaf28b3c38086c102238f986a85eefb9073c0b
SHA5125b9ddeb9d173b1afe8c89ecee4ae7f4e65cdd68bf6ba647de14f7055c4f221ccc80054dcdf9f0dd85e9f48639dda97d848cc7c34eb31f32eb95394c0008dc52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9491752d12b2bea78fa9b6425111815
SHA11b8a46dc4a6a880858e967f7fff3ca617d4c582f
SHA256dbae5eeb7f637f822907ceb68dd776a6ba87afbea6c876d56082cf6f1d1ba1b2
SHA512437fd0dd9c7c6236a5d324a34dad61431121857b1e46d870e0bbdf42256fea253f49b3e86e7c8ead3bb43d35a8320e1fc4959b6ccf9f025e5593a3e04fbc34c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51695d4a674f83883f286407b4bd5d574
SHA1b17c36f5d6abe8808c80bff65972f057a62fc362
SHA25657f652a39ffe25666767a0220a72d2519b89427e795a8a4ed72c01a91ed45534
SHA512ba2393b6a185c1ee7e672e25da88428202a079fa762097ec3db1b800d687ce1c227afe7861fd3a9f239dd5d623ef30df70b80b2e7e89d94d9fbb642d0293436c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e80ffafcef39f7e31559302dc2980c8e
SHA1a63dfc6de186bd58157cb781c96891ef70899fcb
SHA25609fe8bd8f8ca9dc50a0f9a24b674e8efeb5c859dbc38fd79c0866c8c5c584e11
SHA51201f44ceb5ec338f977653c2c314aa1b599b68bd32f665c91c0a07e93f7361da42839aa48657ea90552d3a7db5d93f7950a0123917266b6dc2519fbb24f43e697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e583e12db37429a68288baae7a26830c
SHA1bedc11ba258b38b1ca6a77e97161b26371231d59
SHA256c7c011110ccee189cfe9e91ae2c61ea9cdba2393936ce2fdf0e77beb22e8fa4c
SHA51285e31ccb540198d05bc5ceff161eb575c98984a11171ff83e3c38eb0e7418abac50d12abbaee507519f6ee49b5dab546538bf5c54b4cbe79b1e1f296bc4762c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d3f0a7cd3c4fa255ade748a737be35
SHA10db0c74f176fbed061e93d4c74f3e3592ca5fd3b
SHA256ff2078e69cf1958bce174ea3c019d9c35c6cbc9eb5a221218d144c4aa5522089
SHA51211eb579f462dee339612fd2ddeb0ddcc932ce2ac6d5a2a5b6997c20e2f58ee29338135f11ecd6f42cc221cf4f8a3c730fde2363da15a67d4736d69d7e1508053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539c0b0936ca3eec4912fc4ac448e353b
SHA1a9e6baa719b85e59f440ad545f63757e82505108
SHA256175ad011651574057635bde4e62d036fe25d7effa9955a4d8e7b4ad72d967e8b
SHA512666f011d3af1d6eed2288f87fd4d30b9ad1aeb79c8e1e603dc8fb689e9ca2b78987ecef79747648cb9b17d99831039546f77cf737334edfe544b6bc3b64ec140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b9f2d47d646415556fd8157c6312b71
SHA1fee00493ca3f8212a5ab5e8b41e53e2f782b4bd7
SHA2565ea33d2e3c9de1e5e5589a34c740fc70c1b5af4ce80429ea736c6837163de683
SHA5128980f7cceff1253d6e25e4a62325524941d6cea73e77969265129d0d4110ac834058e1cc5eb344d59605a3cee4279ce3af9d96dc6794258fe8006ad6d269f744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a7077bab2387b21115ce8693b13be2d
SHA1c90b7e51eba07f937cd6e62579cab27f4783e20e
SHA25673814472715ece118ef5b71c9519fd6ac3438972a666274cc63bb40bafb56e48
SHA5122b853d27c935321c249f85e52ba7123b09646875e10716404531ff35b039f90f78394f9867796acb22b0ecec681ae31808d4287dc19dc8595317305adb62d2e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c66b69760eda1221a0db4ca58717334
SHA15a992cb507289f4a06cf7abaf4b94e543d50b840
SHA256049c9f36c148cf2037386205af16641395e740a12f701f849103bb8f4245d162
SHA5124665b0603a52f37a2eae4ca26d19fb2e1154d0c8fa5962ce79df1c9593dc13c754fe9a218645c315f7a574ae8b843c68a26ef9314dbe6c26b4bbfc97a2013511
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a