Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
13a920dccd4c8694c1bd4e34b256c645_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13a920dccd4c8694c1bd4e34b256c645_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
13a920dccd4c8694c1bd4e34b256c645_JaffaCakes118.html
-
Size
460KB
-
MD5
13a920dccd4c8694c1bd4e34b256c645
-
SHA1
84987bf65ca4740dd521e114914fa7d33d4bb226
-
SHA256
ea7f010c13ef67f5ae675648887613328785cc512e571dfec6a61f82b78ca0fd
-
SHA512
38cc809d261ba8d15160b13d86c7cdf5c1f56a5ec0367eca7339a6a8fda5eead5595228ef58a152a6809fa5e9403917062e92bbe84966aa372167bd29a5c868c
-
SSDEEP
6144:SMsMYod+X3oI+YMsMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:R5d+X3I5d+X365d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002a14190a3f3b9b609439b3244e654d00a19c662b56a4097c365f76f469e856c5000000000e80000000020000200000005531c1178aa0ab0e8994283aacb999da9d82174c1a123b05847be0a1adaf45bb900000002e533883d99fa1a350d2bd72886fc3ae177e371646c2121fcda57768f8bad3b6d430ea5f72207f2c79a8a8fea3a769581296f5c273dc3e1be08928e54763baf8f8ef434b7e778c4ebfda01e4352bc170dc4f4de90e0246ebb62f3bffa556d7a1abff88f9760951276cff021287a4c4957ec2b2a6e1201205d067144f61736fd6be9b1ab31c8c67023e9039ec8a61b2cb40000000ae409cce779e6e1f5707bd63cee3209ab6664e5e8f34c5068a45d7d09a9e961bdcd74284de8fd8ef354246c24d73f4e54bcaa92412646a2dfce5b524c1c9f499 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421003938" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E80A0301-0A37-11EF-815A-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f087c0449eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004b33becb246bfb26eeacdae8ea487b96e80aa6dbdc83f735238da489bd5eeae6000000000e8000000002000020000000aaa44ad73c7b863f4088ce8ba0fb47e6aa4dee1c8a8a5f80cec3572e95958559200000008d3cd571726979f0f78747928af0a0d89cfb5c61a431ff5560f0fa236b2cf349400000004978548f0fd92337a1ef610761c8590d8b1a73a94d2a23abdf263a8c1fcfe94b72ae089736677662c8f72ad4f6939b5e52c861a34ee536a33d040d44d7ae0759 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28 PID 2244 wrote to memory of 1384 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13a920dccd4c8694c1bd4e34b256c645_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55870d5e70b1d46ccf85dc6c9ddf10a20
SHA1823664bff1911ea9b3c7c65d9de7577379194831
SHA2569a507579f0b57c143ec5a06a3d8211c659dd44ef932f244c23d973d63dd6bca5
SHA512989db18b7520cafecbc3d18226626b4950342ab483a038667c35adec0b22920bb8e78baee4652fc929828ad81de59835516784a5f2f4ecb170251bbc50a8e6a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583ed4ae8f1f7311c7013aecc6933525f
SHA1e732da20a5de4f89e0fbc751949e52abe7f07c48
SHA2564d0fabca301fe3772871e71cdea4141165061f82f83189c19cafbaf6fae7fc23
SHA5127fa50d3becdf7f76a10b7ddb127283ab9eae4d48f1336dc29c965e650c2da560f3473ec41620e57750021f16753da7c2f73aa1966f5ac3b95579d7dae4c3ca6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7ce23871f5ea09815afd3d6fd678cd8
SHA1c24639c6e1cef1c27f3bb4c2c4bccbc3ad72f5da
SHA25679f646f9a0c74c1a82f74ba2f376004e64ce76714976be10c9c0d36127def9d0
SHA51239f8b42bc6100032c2e40a3fbf6f7c49ee59de6a6a555740c41fdc0921368ad61d457395214ba3c19c2a8d0af136dfa840d477ab58b23742a501a9b8a78ec4aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a2635d38285797090c97561c1fadf51
SHA131a9fedcf5d08247ba2e125e5d1dd8943b9c3db6
SHA25689a43cd6ccdaff0e0fa26a0d382ecd1b899727d74bd3942a97ea94108295cd84
SHA5126fe3326cb49e9b8a9cb1b7b12d52e5dce1cc64c2222411943860965170b0748a077b52e24e96cd4d6520aa9f7e881ca093f39a9eac35bd390eea81b35074aabf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c51b2dcf31ea9e7a331519394e179e1
SHA10713c86ea25492873603ebe0f5a6ddedbf5f8b34
SHA256f9219afaf62aee383d5f1168228fb94b7d9447e2edcb635f69fd276fa94ef8ba
SHA5121b2bd05307e80fa07eb334a86634c5cd88f74340f241ec38b0ddeaea4ce4d1332a511ac261ec50638875bf720cad1003befdd75ff03c3f807dc736b60166205b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177593fe84cda93678393336a9ee00e6
SHA180bf229f26f97ee8693140359331d6237fd86e37
SHA2566c3b092194725df53a64dd8fa123dd78ff4329f877474b6733c5726bc8e32224
SHA5125de228a4cb0d24798cbe649307c7cc263af1c99e3239f9df6bbc1874d52ea34093058ac7286b4b58d2bd8835c624441cece20743b4f40716fd732b89582d3031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b9668b61f778314c9ced61d0a795ff2
SHA150a69408407b0d15a17767bd06d915cb4db3c148
SHA25691fde7fb0df630ddbe17d5a9e20d74e6ad4b652bab8d79812c41e4b4817d8c05
SHA5129d571e6aaab00d451e2e7af9f150385c8ea6ec9aeda2fa16cc2aaa805c616e5820e15ddaa582007bc561031a8fb2b096a74492debd77bf530803c807ccacadd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7d60806ccc4c9152af5ed11250558eb
SHA1421bca20e6106eba01a798b0742c712236937915
SHA256825aef39cd1c95fc06c1f902c2bcfe899ba9a3a9ea3ac76adea6f66f0ec80e9b
SHA5128090c22a3aee80b612c2859985c524ebf620e8a275cf291e42211663c9336bed7f57f2ed927d60535fc6f3aff84dee826f39e8b765ba3002c7bf705259307d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592a7edab8f17ab2540994acc73e57591
SHA19eafd47eed206937720222c1035217807dabf9a5
SHA2565f472e540d0f5b9cc175e5f7e15d4e16d2431224c59c5745f53686d97d31e77f
SHA5124b9cd4d02fe8947168c869e63786b62dbbd184bfc9ddcd4811f2bfd2e6ad834e7aa8f2362f3d77a380776e177f86caa62d2d406a1d3d3dd0bcd3a3b2820ebd91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5590e29bd400aa312bf723aae1a040eac
SHA143fd914a562ec92d9b6315c6f884148d359de74b
SHA25693d1b09619ca32e15258ac73552cd9ea0ad109a4b82abb3ccc29f43fdad0e058
SHA51209a9445d97fd693b42e8fe5e4ff4c55a5868c02bb5282b18ff14e18222b62c9c0a2719c3e3d568721faacf22b836637342129ecacc25efd6660604a60d3832d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6525d7b2034b58cdf293df27d814e15
SHA145a4c46d40c470e1087b8751d12722134756befa
SHA2563dae6d1a6ed5fd8c5a1fb33851f4a1167e1b9abc15f4ebf099bd2ecbf96fe5eb
SHA512853d269ae9833176f391f67c9dd7c42c8a4e43a330a202a382918d39cad0d4d598088506b4aa2db1005d81dac9c01c01d85e6b24e7ef7e0827a1c888ab10b2af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f604ec3223503504e7807b4796f19640
SHA17a9936e307b13a70818dab4b0d26ceca17629631
SHA256c4d1449924728c5ac6e726aa6f86bef91f55a0a68d90be81ed68a756a27f0f3e
SHA51224df4933e3a510a5f9d95460088c20bd5959f563ac5a5aee874ae7660f3dc59b36b4d607ce7fb6b14205495dfb560a806dd6275e89e63cccc879fde9b0fd8585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca1afe9be6dc71df04c562a3676d6294
SHA14bf044c62bb6f41c843fa29a1174ab02777f091b
SHA2562e6334f1a45be8e26d6219d9bae11fc669227a317934bab8f1c161dfb1636102
SHA5126ecffbac7bf2f3b4e4c76a9d81bafa66beaf3a1d6f40814c03d7c633abf367755f1d01829d3f5c9a356dd3c97de0f6d32879bc5d505b9eba14b6c024b1135757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e87ba3461ee3366a65edc8fdd30521aa
SHA175b30bdeaa2f0e91b125c8d5a3d26ed72e6f01ff
SHA2560b3fff936b205b4336f7942d55a64fd91d3c27c5d1a819de3a15f401960c7100
SHA512b074a597b7d12adec36a30faa20d228b75692523360e189b9d2468c0f04ff1103504e006e8844a17a44d8d9d9dac0e96f326f7be9d42bd91ea7f9be47868c6bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d224f22b89e03882a158bd15418712ce
SHA1eaed4931af4a876b78e408a8ff90cd8820401628
SHA256b910fb55fd98fad141d91a04c0a7bcb2833fe435379eebf0265a9df76c72ff3f
SHA5129a36b722b43ff14e639e21dc63bfe53a1bf3dc1cc8248bd1012e04735de8923906afac58fe35637416bf0a0afb9c77ef60d535e5a6b9b90e501964863049d4c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58243d10185ed280477cbb361af109fbb
SHA192183b194c41c61c3f082bc00ffc12fa086c9d7e
SHA2568be5b895c76e13cc7b56e06bd7dca22b5f52202a5c7b2b34720b67224e02c032
SHA5129f0dfb3a3535a29c312f8864ad79131c8c30a8e0e98ad56fcc96dff3044b9cd77de70e9ff4dd2adb78f27b752a277b848f0b4d8d5996c33f83cf1f436fa0a1ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5197c975ab5004d7f27fa34e060d24f27
SHA1e7c27ae740cd7ce7570f7edfd3ed9d9b03e3def2
SHA256df4c41b396fa3ec6ca7b93bb4e1323d06309597cc06597b0a7d7407d84340821
SHA512962d694ebf325cdac627055967d635231ef6528d5b325e1213f07c89d42d0847a256f5f63994b81f991af225f6014ad3e95c4ab3acd80ceb6dbe1b1d67d0e1d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1d4aa3b9d996120fc1676dddb9b90ff
SHA10ee359fc85e3039eed73d79bf0186f72983f30e3
SHA2569462d7a82f6460abb0b9e3ff9b2241b6bf7bd592993574772f530f6bce50ef00
SHA5122442a92921f01ecfd1b1e1116126a0ca4a4f1cc85e149577c764c8435e160bdf1db3dc1c9f0175630a2e04ca4f3cd4e101a1a6e8efdd5e8177fb506b24350633
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a