Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
133d377f98d732389ce31acc31493b82_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
133d377f98d732389ce31acc31493b82_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
133d377f98d732389ce31acc31493b82_JaffaCakes118.html
-
Size
90KB
-
MD5
133d377f98d732389ce31acc31493b82
-
SHA1
eab3c6825259b6215e6fe9ce5e96de59bde41f16
-
SHA256
1e1b18ee8a05afd2b9034dc5c64f92830b942de8cf5e9f175562b1e6a90a55b4
-
SHA512
119f1c03a05515de2a0fd4280e745f34dc470281a4a6ca36b90531065568c98b96edcd015dd2c50eb6beed21c6d682c635ae5d6004bc71c4df98e7484ec8fab3
-
SSDEEP
768:nq0hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhX:nqy
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EE23701-0A27-11EF-A692-6A83D32C515E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420996868" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2520 2092 iexplore.exe 28 PID 2092 wrote to memory of 2520 2092 iexplore.exe 28 PID 2092 wrote to memory of 2520 2092 iexplore.exe 28 PID 2092 wrote to memory of 2520 2092 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\133d377f98d732389ce31acc31493b82_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5fdd87e291c26eaad85bbf90a129925f2
SHA11ee803e2be854fe7c11e4ae5ba004ca9a15ca12f
SHA256ae9ae85502d4aef8a359598e86afdcaf91b440f7ff0e856422335a545c4de1e3
SHA512c34cd11d492f35b465aefdb26a8f1c1f71aeddf559578bd1e8ee77ffed504675fbd8386ccc954562dd69e7ff43f230325ac9b3c1bd1d03d418d809a4f5ad75e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5329c72e4a9c75459bcceb5de600a8569
SHA167d51a4502f5f800722983678d95e8a9f897b5df
SHA2560866c8d8e0761bbc322c78bfeb7c49033b821fd7cd316128ca4c86be3847f75d
SHA512a2bc77182ee50d0e260e623dc87c96ddacdda7ead4be36702eb9fd4ac449cdb507ae3ce606ecaefe6d02131b3f455418b8bbe70dde1a2a7100eaa2893de54cb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549142310c55edd2c4dda0f73a7f29d94
SHA143c35a241d275917507d446722811c16d20aa522
SHA25699f172ea9aa9175b155f8f803e7a3e9a5e1384266a6ab3f954270bb677693d8b
SHA51230cbfd6341797f75754e7975c1d8fe1fcae0b3e8fb57a97906a4b343acc749fa02b117cf2f793f02581dd83cbc2b7809ec9f7068fd453af52ac34a2e30de5c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569e1f12058d065cf85ce77170c245f41
SHA18a1a2735bcaa97dbcee1f6dfc1d8bcce8f9b61d6
SHA2565d894f33c7fe4e2e71d02cbb1b65b42019b734554a36a368a6a1854dae8539ef
SHA5125aa75b20e9a3f4d2173ae7f43afe4847ec86a372264bd61f26fc9a0ce0652333a3fc5a862503c5e11e8c8933fa58fc5bfa1a97135d8cbdbba0a5bd6d2d6189cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5769906c7074bd78cd1d9402a86b05c36
SHA1c07b86154bb3124024b337315f80c7f009f625d9
SHA256860fa20ba4bf888445aad6e33f37eb09673c654590136d765446e4928a324649
SHA512143b07d2230beef227119b294a91764731f22e64c173a3f6cdfd5b26d7f4f608172d29083f9201b445f1c9641c8be443f78b78b1b98b5befb3fcda18c33688f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554f15684d750ffcd7da639f451e18217
SHA19c0e60efc7e8702c1bd5eefe6b1fec42cb6af2da
SHA256d5ec48a59dc2cf26977525370272a84e958ebbca401d17e10f301b1a2999825d
SHA512e97a5d6094b0499648fa117a694cabd810ce66484c67825518c22530654407ed441e07d059488a49fffaacaa47253f398a62fe3d449de17d16e4d65a4f76870a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508bbf1acf344014a2b99ceb151de4323
SHA1d283b0592d6152f9103a84fafbc3c3a6c9e3562c
SHA2567c86dc88161919e268c3942295c1a2de908398f5910527a5779c1bd04b180b4f
SHA512f9d16162fd7c5d834db9024ebea02d004a0b8af56086dca598ea9943cdae174f7cfa7b6740bb5ac29efbf299e22372f1cbb3456ace3b9955617520764eb67834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb206d7de7643a1713c32ed619e86ea3
SHA1d3f56ec5a32b9b327559081a4897aed6ba7c2fed
SHA2562df96e078471cb081e5c1c7ebc77fedb470e988260a8570430d89a8ea95b44c5
SHA5129363fe6c88cd5919ebfe32440769ade24ff36c5d016265381024998482550c0e2ec91b26fe6fb63b76ebbabb00391e2a566a80d76c76c88c602b95a84caa63be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d3271b57aaa6a6338607e28685db0a0
SHA19174228e800bfea4589b910972eee90adf097410
SHA256b04b61d7a2c1b1d769c98c860c0517c7e88bf789337514a458e5d6afb7c59ab0
SHA51210d4aab844f1195caf0bd9700bb47b77da3c2f8bd22d5c1b219c3b70788cd3103cbaf5640e4225034c904249720bd3ccdb76eb19e5ea39fdfad4487e0d7db6b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab9c2f9a12cdc6d24a689ef175190319
SHA1c2bb3bcaf1278f9f6fe289dc9ea4a964a4018720
SHA256c9a96f16792257804f53d6934eaf5c4bef22171d805364c60ad5aab2bd4b89e2
SHA512616541a1729b119c5d061e6f05197453834a28aed5e839b26a0aad07ee02c578f5c60739099ca6e1576547e0b83ff927da8b1ea76266739de75ed00cc2433e28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0aa796c89814500fb6c3244c22f301e
SHA13297295246cbbd397b630963b8852e3289e0fb8d
SHA2569b169029e410e1fb060a8dfa9d726812e1b518bfeffc0ae0db6a772d4c3ac150
SHA512f0a9d3021384387c36c1874bd66b4f9a701db01519bbb96fe6df248a2dfb1ff69ac4b1f7c71425a8013aeb3c48408c9b1360b97e97b26ea496311009fbb2c747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6768ff6fa5d80662432cee8a4e43e9d
SHA16729607f88c263895024ef834b52bac3e9546e87
SHA2569de7557469388f6035a3314cbe13cc801db27131f254bc94778ba417f810f171
SHA51217beefd3839c510563932eccf3cdb04cf045d6948bcf899572a636cf5aa07f03fd254fc5063acd8fcc119b08b6eded98c22914b3e031a0258dd127f3d5a18558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5551b04cc6df0ab0901ff386393a8291a
SHA199a8581089eb67ff05593bead7e802e56d83e2e8
SHA256455a271d304bc9cab827f63dde4aefbc00e0b29c58cc7fa99adba5b710da3dde
SHA51211c739fdb88abea4be8b9bf5483b25aca51c1af89d180b51e8c89ca28699d4f08a05a0d6e31668967c4b322c5f4f2226a26d871623d1e1ef57e59ce4aed688b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55991f2d500a7d9feb6e611b3daf5b2b0
SHA1a91d13fc3a829f137a821b98f3a1876704ab5c34
SHA256fe9ecc5f1008c92e75698551fff3e6e3f71127883dc8ee6e1b1a72a2dea7ff47
SHA51240faf798492e9bfb52337fce2a8a31303a846a456fa17b1b3c7f67f62bfbf4ce7b4ad2843ed9b8132d906e60e443084c98b6893d5bb3aaff08f7168a7a8a85e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\dnserrordiagoff[1]
Filesize1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm
Filesize41KB
MD5e2815ffbf75cf1720e45c1d522c79f95
SHA1de817c1aed662033db9aa5ffa65a41830c698754
SHA256256c40933e27795baa8d3966ff73541966dba3ca96fbbd455b3e377982d9b07c
SHA512322257be8aa1468633be08c8e617d4c61688bab4c6cb49bfca8f33ce63127d946a5f22c5b945568ead3724be233de505ef1caf4a8338a5afe0c560f741828379
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\snitch[1]
Filesize11B
MD532682312d17c7cbf18e73594f5570319
SHA160e22121bdd0bc71cdb2bae2a3aa577006b2eae9
SHA256e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
SHA51268337debb9cd659cece621af582ae2bc4b56b9cf06b26c45f4d9eb8beb91d3f36bead287218b5aa2bb4853a1cf1a12017ca57318d7e12f489884fdc6b261dfc1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize6KB
MD5d3beac8ced9d5defcd9471f25763461b
SHA12296647bb3b06fbaf4ba9bca5e56ae2a42582748
SHA256d936d5c570e290d2ae121b4d3a24706bb6f557fad1fb8ea661a0d5043db940e0
SHA51296b16678b62cc0442fb4f86ec0e06f2ca71766714cefe387b0a85e51241669da4ec9740580a37a37f59ad1f9bc88a8a69050d5a488045a72187196164298e68b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\errorPageStrings[1]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\httpErrorPagesScripts[2]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a