Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 17:47
Static task
static1
Behavioral task
behavioral1
Sample
13cfcfc69d8003eb23d2225ddd57b0f5_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
13cfcfc69d8003eb23d2225ddd57b0f5_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
13cfcfc69d8003eb23d2225ddd57b0f5_JaffaCakes118.html
-
Size
47KB
-
MD5
13cfcfc69d8003eb23d2225ddd57b0f5
-
SHA1
19f84cf642b87f7877e28a711003262019a9648c
-
SHA256
c12cf8b8d7ccac95f3ac59d4949e96d943cf1ef9f635e4e8676f40a11f469de4
-
SHA512
d55f4bb4ba062563824a449e8f10f87aadc7c1ddf75cc6f9c1c0c7b0b5c8365117fe2ccfa0934ee13e1add785f30de6cccf6393d551f6b9bca86d01dab16d521
-
SSDEEP
768:SJ+xriDCMC+9OCQzQBbUo440EQZsnx/ZjL1Nurl33dZXBHwoHl1N:SJ+xWDCMC+AD2L44Vnx/ZjL1Nurl33dh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003000696b527ec8a5d8848930710ef6546e46dc8ab69d4d52d49b12313ffe9a55000000000e8000000002000020000000a8299a14edd7aaa891889c22b53e9b7e2c7d41012c8e99d051871a453405198620000000e9f10f66e54aab6cd66eac0ca18f46ccf8dfc81fc735f3a1f9b09613bdc2e53e400000001a73b41d40137907e0b0029422b2d4799e4c39b1b6bcc163f074cf3d4748b14e89be3340bf8e18a065c7462fa499a4f32da42f167536a540a762608560ee3463 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c62a614b9eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F4D2E91-0A3E-11EF-B20D-42D1C15895C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421006746" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000c003398ce7986176167ce156b3cd3eef95f1e2602c28fe4ac265a966ccc26d5c000000000e8000000002000020000000508df9040b9936de8e1cb071a21b41f5d870005ea27905832a63c966af7151a990000000f93c847f0f6678be007c722f0126b5d494b465cf5e8321766b79e38fc109fa96dd394f5607f1ab033a2e6e87af699ffa52e41a1dc9de1afc17a94c3c4b239597a55dbc03d1c5f3dd8eed3a67e2c76108289cbe8f2a3433856490e4fca927560d0649362d409d295e687b88dfd1e60545c87232659cdd00d80687054c60baeeb519f9f659df738086834f679704ef6f6d400000005d36646a41bcfb7e6f33a2db2d475e006b5d6584ccf38c836e5e7011ec2762e9fcf7edeef58ca8f0c2d116f6b1c5f1a391ada9eb397b597d37fb8718af941d6b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2984 2220 iexplore.exe 28 PID 2220 wrote to memory of 2984 2220 iexplore.exe 28 PID 2220 wrote to memory of 2984 2220 iexplore.exe 28 PID 2220 wrote to memory of 2984 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13cfcfc69d8003eb23d2225ddd57b0f5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523fd31d060bee90b17e42dd7b501da63
SHA11e3355f98826f7a4908f8fb121c5cc5fa3599637
SHA2565e14125f77bad7df85d7ac3d5e1cbd7ab235b6d3a5329fbf115c6e1ecf83cdd5
SHA512cf7e5dea679bf74e81b1e3daec10ed2adac4aa0246c2fe74ce2537f4832604bae35273e416da7f900f0c9c986eda1e053d907fd0d07d114af76b882858ae0528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d65fd653c4f2580c8923ff24b844ec0d
SHA112af8b98427348058349ae2127bf7ac5abd23e34
SHA256885976c22b6f9bd0156fa690d170746c5a6085e5284bbaa40ee70a73b17770ab
SHA512bbc9c7c664f7df5ff1573af7d383f199dcb1f55e22bbd970153d15a6ae10d788ceba6989a430ebd633963b457b6603421dacbc2d3c3903afc70cc135bccff8aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f967fcbaa01646f8e6a42444ad05028a
SHA1e06ef1261f94e98d2325d31d3470920a413252f9
SHA25602b4de51f817918b3671fef915c0ff263c0636d2cd3d8b1728b5d9a84ab268c6
SHA51206f7bfa7049c41d15019dd266ba3378d7893a5cf41df10e7a034267ed6cab48e5d7302346d9294eaacb76aec1d74889d0b7a6e2f3fec09249de2bff629c03ae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5247b319da6ad4c5c8a009ddf63f0b942
SHA1fc948e781f80d8b884c86ca566293fa08e6007d6
SHA25624bf33384e80ecc7316d9f6cab6ad24ad8accdf8fbf7940520bf90ff0aa72894
SHA51267b02b9fa59eec18f26b4ee0aeee5ece21d815a349383ce4a43dfac00f3a3485bc31da788c2cdec29e570e0ff1d6398a5daf90b81b16147b84959d6e951ae6fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8dd9391a1c81c711866fb6dc7764976
SHA11f9dfbbc0b31ca66fb82ddf30f9e6226db013560
SHA256139d2f483f5d82679f6504270bff93b6939f9449396a0a87571f5e4896232740
SHA51234f94b91c594f832a21e12fc627e093b843130295882908e389e702cfa898a5b2cb3ddfed79056d0566aadcb552e1b779dc86fda2fe2f23b7e52a9e4bc8d77e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1fa25f6f230e3ba8c819b63ee85a495
SHA12ae0d3506e7a35fca642853b92b42ea7a2e666c2
SHA25605f64e5925c479134330f25a8dd331907733e7a75c354e308a7c47a881336290
SHA51223e6b8550b1539a252f1bc1405cab185335a4b3ae4f2ff93b090ee358acc3fb99360a5c342842c8ff2139879f0e26b51af3783db893f57b78cc46bf01d1f184c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539a04bb77f0b901dad39872ef9913683
SHA1078897296770eefaef177cff328f0b36052d40e4
SHA2564dd6ae9a76ba9117c1c24c7ee408653cae10ae97c5302f47f1c5edf698eccc3e
SHA512c2e0d76da79ca6f0fb11ff18ed2a9f3241ac1026cf9eb76597449d39d0a15c6aef955923e300a7e09abef28368999214285f4a77f5002356a556490a1e7736bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df4fd622d42c005a34cee4748bec222
SHA1ba0836f07eecf1bffdb6c9663fdd868c8207eab6
SHA2568c919f33fb907eb4d9ec7437eddab3de6642511a5f1e22cebd6ff9c80a9beb08
SHA51216e26ed9fe0700e460c39cc79cb78008fdad432b9d26768559381ea0601a950a6b1aad791b4cfb9963c6e36afebace90934350b3b45bb7febf2a4f6e5c1463cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bf54d1e6a9282aca39aa23cad95f3c1
SHA1bf0a5814423f55a0b5e9bf3cdc4ac13d58a69768
SHA25636285cf4ae928444a8109979f9d7914aee1b3e2e37203a5a3215e66c70f0684f
SHA512222a2f03a9c3805fc07c8964f3157606233001db5aec45bb56533e470bd88fb6570a6d8a45c9fff2e3dfb0fe99c8f93724e188ad2a5c6f5aebac9f0ef0c4a618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe125f486a7b377041748d47537bd247
SHA1e3b579e7bc86c18cf6fb3d750d552ca5d3233e31
SHA25609d805fd7565738b48d2a95d3d9f57b3709fb7cdf91f6926b34b73feb4951709
SHA51276a00990e37ed06db20bc04d357c7c463f80b57323d9a08eb52c4aaa3c78f01a4a06bda0bf2b1a03e9c1a7be9a1928d17b8501e29cdb7048dd12ef2de8bf86f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59056c4f9993f8dadb239518dbd9626f7
SHA18a99ac091abfbbe94abd5cab77cf34d8870da112
SHA256ec98735b4f6767bfcff7aa946b815d64e5ff5d7d7647a741a4ffe69c7e042833
SHA512ccc37e4ab12cb50649ea10b91c051e6dbc47cd263bfb81c8660fbec38a71fc02e656a290801e61c913b9e86b22b3360c63222b48716578ac1259c360b67de1eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536e025e817d3d9212fee36c6dec036db
SHA17c3065bfeaa92ecbae9992414cdb069a6c72bcfd
SHA25670fe0768c8fae3428955f1e96c6703340082e2d7ffd4bcbdb835e70caaa48205
SHA512f9bf0bbd4ed20347e11064f337bfcd8a041014c95edc0e5839fd14b4875243767efce5ac09db896412be3a680233da8fffaed7bf5cc68828999e5d31ee429b20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fa0482e870f2a13f3f1399d6c4ad978
SHA19f70c4993cbb55ae2d2d73b5afbd2044311ec552
SHA256f86caa825147961aad97d946370024473f6f7651aab7d4bb6ace8a0ba4acf6b1
SHA512a131ac034c53b7226b7819791ae3263217812c657bcd2af2a3017c9b7451eb40aa0ee9da40b017938afa287965da7d299800834b225d3bc87b98f05151f78e6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5017c692aafe672a9b2705a3c84796031
SHA18f077428502d399006d59d33b42d89881722e1bc
SHA256767092262aa3b7f72a71c7335b3a2b60672b6d462b0db136522ae9b903b4a464
SHA5127f1acabbf5b5b6856018447773dfd1f799da808cbae8764557e9261b24e981e1c0f4a9ebbe0c606e749c57de6e6384f10e964a39d5a7c375c0428d51c657156d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5250ba6213e221ba086a4e7f59fabf620
SHA11a1f2ad661528662f7a15d0ca61e63b32bd9516d
SHA256bcbc33d20963a0a1a5dcd17bee6acdd921b0e5012dd773cfa837a6d68635201e
SHA512b1f37c00401a5685eeda54ccad63c776cd5f69c69e508d8b096051f71fbff180050ef4f95311e4fa664a8fd6da65472b2086b5655fc578eec551ee75dbcad6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5825432ab1c24172edb07bc8cc1384d88
SHA175fa91d8aa7a76eb47233564ff8cee682bb31738
SHA2568af326d8bd91f71cd9957c1721549299c84125772168a98469a73a06347aa32f
SHA51249d8d5aca90aa8ef43056fe7ca2cd96b984f98aa8d2eafb224819227f1e0c70b0cb534297d61220dbb5830732b100367fa41de438b69facb2203b76c27fda244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5062e33e6755e2166fcb3dbd34180c9a8
SHA1fda4ba4e190b96704c0c8fedd959e117451a0796
SHA2567b4e6d427e8778c2b3ff3f5e29dc0084c1333048c88561f02ece12337097968e
SHA51250b2d228d91105758d7a78b2e485537c89ba618791f0f91ce9a3bcd708d64ec4f6986913f2497e797d811612ed44f8745659d19b211267dedd3682adb6c2a73a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a