Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
14408937023fcc87b3ad50a3888c69c0_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14408937023fcc87b3ad50a3888c69c0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
14408937023fcc87b3ad50a3888c69c0_JaffaCakes118.html
-
Size
67KB
-
MD5
14408937023fcc87b3ad50a3888c69c0
-
SHA1
d226ba6cfc102b88636e2c7da936a2cb30405fa3
-
SHA256
8c455202edc49af5195a57c7463db52eb21e8c4000ea64b11c9ffb0289afc84e
-
SHA512
69b2ffd64ff2aaab385c1c4e84b5630289d01ddaac86d9e65ef2a5beca2c859d59bd8d26d210fed4eca75e53de95c06a03adaf7736ee9b3ca7161488c9b0f484
-
SSDEEP
768:JipgcMsSZ8tN99OIsVfkcwoTyfQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IjkKy:JbWITePec0tbrga6cuNnzIjv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05f12575d9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82600131-0A50-11EF-8F92-565622222C98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421014504" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009e55999507c7011ed0d2251222a1ad0c46dabb0ecdb640fd618fe152b330e50c000000000e8000000002000020000000a8c0aaa79f97ed1079d32ecc4a1580ad13d93dd5014cb88f64483d1a4f2110fd90000000b1d60e387eb57c70b7716c2c4b99ee4aad1d616bd2accd881249311987113793c40335468c1caafe1d187549db0cc97123ddf9b6b1f30527918f51ea4cfc74f72f1fda0af7853cca9cc7db68bbb282166d4b9edc06573029465ed1304d3f855134580441c2403410b1169ccd44c1c71b8d878fa4c9ee3dc7dff075e702a5bf519caf0b7d9fcee3826445794ce8c5baef400000001a89c1c45ffa588e6800b43c368de2302c5d133537589020cca7c36595ee7b996179050b0028e2ab07eaabe6e5075d928cf3042229b2888f864ff5b6aa6a6ded iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ee7116abc9a193e1d12c177e21ff361b3a06ca87437b98076e0bc1ac41a41f4d000000000e8000000002000020000000c1172fb12663589d1b99d7b1170f7e983d64d6a030f234547f8c4e202c197eb22000000088c098e678f3718ecec95c06eadb572d0070b8b948b8c5781c0dbcb55fee60964000000044c89a013ae4d20e7a6bb951e264e098f160cf6b752e07518ccaa21605c26f21ff9f083a5db005afc3e4d7cb19dec9ee49a5ccb9b51ccea3057f133f812c3a08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2492 2872 iexplore.exe 28 PID 2872 wrote to memory of 2492 2872 iexplore.exe 28 PID 2872 wrote to memory of 2492 2872 iexplore.exe 28 PID 2872 wrote to memory of 2492 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14408937023fcc87b3ad50a3888c69c0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544f2f6f1e185218952c938dc66b00093
SHA10835261cdb13dbcb8b75c1ff3b033d1f106e96f9
SHA25622d5fee3a87e8cd1f4e8333db98d1ce02cce91c90ddd5d0cf4c8fbe8d3aebf88
SHA5128d2edc186580bad5d5431e894ac9b188d1f4e620e1ea17ef9abe085f6b6dacedce9601e7c0e10efdb7ca30544c8f9d3fe2b03f417921aa71b355bfe527caf753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584449aef8764a74622be9ee39780306c
SHA19e12801f80ff073b974a7e168888971ef782adc9
SHA2565793f413ce2ef93c09d2995921d264d0f71013079f199d6b210e00699fd8eb20
SHA51215eee1028dc3bef54ff6a9f6f2bd073145d35bbc0f59b2e6da818f8bf420c4fc47a65ab6463b2099f30de31ea83c95eae7c95e3549c2d7500f4670659757d15e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c852c21eec9d74c5b45645aaead406f5
SHA1769b6f824ee89faebc63f5857e1b52ed110a82d6
SHA2561a52d396f4cc732f22eccde37a0d00b2077e957fa98d94acd5820d095b04b7cd
SHA51221836f7c92febe6d56e3c43ec03bf365d46e9204a87604398f4ad67b9221813db1dccb2b86b7825e4983c96e1db77b8bf521caf8bfd9278ebfc76adce9e73464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814ba43dddc9ff5791af4b6ef09966b5
SHA1a14c356287920313baf126a6228f6985ea87194d
SHA2567c4f0ce5d78f7d11c65e24483aff751c2405103f860d094fb870b519ba25dfec
SHA51232a5941c7364f6b1b6de6fd1cec1b22d48ac8bcb823e93874d67cb8311acc192de75cccbe5431932fbafdc3e66ab8d90129d742d597a4b10bccbaf63bea888c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586f2dfca3625a708257321af0fe77771
SHA1cd69c083a1fd4705acd41e869f8eb8c056936299
SHA2565faecf0be0c7b30af2aa8daa8eac9ce80b46d8c25bfa60d9e8a7859587e69796
SHA512297e0c44693b79e739fdc8daf64d549487129fb26c850bc4084ecd9c2fdb67f095fb5647469f67f95a8f8ea11bbbc53becb3b059b0c34abc1e88f73e9aaa863e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574d29dbd5e0a27d897377566d70237c6
SHA174552ba62bbe6ec6f2c1e73b0dac00cf5945c525
SHA256b0d67af59e378e4f1355d8948f7c9c42c95da41f2798e66ec6dbd137a502f6ba
SHA5129ab8f2c6144796d8a234a21b67ea25b5f4da06f444be3b5b6c9d34f65a2998619776a7750618d3095d74a0b6b2f97d0f2b30c950e378548cd118fe283ef44dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b9f0f9155070cfc96ecc61f40616417
SHA12316876ee16998194be44f5a03d75512caa58fa7
SHA2560f1f0ccfcec36c50b474b899866511db64523fd94fa154a869c2fea95e093c37
SHA512a72e9b5e8d01b0fdd1bb6c5b789c07ba626740f1311882c722ce956f7ba5d68358d92bf9f7627dc125c2e11aaae19522d5ca0c268c5eb37ce460fa8bd98d7679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5924c20f2968a3c5f3d28dc8eadea36e1
SHA1f13ca401a5520f313e751ed7baca55a4f2784722
SHA2563a9ec56d79ff65af68423ee7201c2bfce6bd9dcc3761391a1aec266696e2722b
SHA512352772c93505491d812d22149911a1b1972cf17428454c825ab75a2d8815028f2f6d1adc02611d2f6d3dc728c687614ea1deadcacaa8dda6d193ce0eda2cf047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5653ea29f24ee407fcce5e250ce7b3e07
SHA110f4b242499d0bc731359c17083a91f898beab34
SHA2561c002d749744e1a811bb84da06708cdb6b1bad930ab5700617ded54d95043e21
SHA51258912c6834cfbf3df023e9f5d26299b8fd1c93c91a1a0dbd18d2ef2c8df1c4ed93c973859e63ae29466e161e092fc4519025b4c545b32ac3d9700d214753aee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50030d92864a521839739bd0ce0ad5ca9
SHA128d2fdbcfcb71a2e0b0008d2d98c922dd0c52ce8
SHA256e1c745e58954d2472acc6b418ce925b8898639ec7485c300851a549e4402a941
SHA512b4e87c7163db5e0d997686583dde374366de74c906a71c886613eb9a5de6f7220746fe7c3fc1bfde450047a529f4ead3c6385c8383860e5bcb713abad5142124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d67444c2be302a6ec1642a6ef2b4c613
SHA10576bb4564687968763cbf9e4d16d0069813d7be
SHA25654d403dcf0a4d8a31b19a02fc57fd79a3536a406a970442537e4da54907fdbea
SHA51222cb45379c9c873027418e1251a6961d7d60f70363f34b9f4948a97c04e96ddddbbe29b2ea6ee68238a806709bf0023b5e2efcbe2fe40ed29baf4fc1319a1cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ff86208c9ab17142e4ac66cc809bfef
SHA1b4e0324d93c549a951b9bf1ce628e4d665bf8bb8
SHA256275665d928235c42e240de904c9e2c08b955505ed77f9b6d706b4a684637029c
SHA5120fdb1460612c0527b56fb2b0ec7760fa1b506fadc4b0834643db08d4359e375d125f5a27e97bec516b3e10b84a73275b239d69abb41d7883592531bb22a705ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9b184fe8c9364037c4ce6928592a807
SHA11739c833a696e0fcdf6bee646c6ca6019d5d79a0
SHA25606c6ac67465c3e29b598f5f4e44c58e3e51f5299dfcc61559f2226a86a3f34ed
SHA512547671fa4164ae802763c939fd14e0c5e01c48f56c55d6d2554113e8f7e33b433aa3a6aa4c6446673f54a474099ff7cdf0d4e158d2dcf3f6cfb1de652888eefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5f121bf49cef4929be985990af6311c
SHA17715ac528251fedcc11c04e7a1d5fb887a5ad902
SHA256632f633f921af672ce2798d2894897f0aa069a9d375481a59e0268b00514c80a
SHA512a401cc9c760a46f7cef19a77d027819906540916f40274d42e4c00b034e3e60510c4af7c03a8a6929ca0b04bd98e17bc6c352ed32b46112e47356c6e5aa77d6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f33aefd62bf5f08c038cfa7e21272fb0
SHA1facae4143dd655843a2ccc0a72009bbf67f83c6c
SHA2566719995df3645060ce8c68cfc5fc514c6b986fa7caac2c6d9b403ed64753d6ca
SHA51218922e55c82127c7be79c7fd1b7a2dff12103fe65eacd5a80f93653a172fadf7cad78421ea22c79ef9cac3f50e32e35604844de4ae96ef7a0b0c2287dc345702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aefb6476a27261c9f1a9e370c522276
SHA1362156088da07290d0fb117d1d739fb5f59e55ff
SHA25633c906ffd6a15616c474e6c18d98f4f789632fad7d1655daaa760d4e06bf01b5
SHA512a4ec28af1117a84485227f7597279e554f03f2ee6de527c19574fcf950974860e46b22cc0aca5cae170b4ea1a7dd7eafe7dfabe38225617418f5a6779d51bff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5185669cdfaa6480a9e49ef40409e178c
SHA1bd7875ac6dcfd88c6d1139ba3a84a2ca11feb837
SHA2562fd8a9cd5d4ff55765550b79e816d1fb839a8257dec5518cf8d3ef03ea643619
SHA512bc00a688360397871ff2e52f06b13e39d512831b87ec463c7378e3736be417415f8f7d3787ac5e1b0eb9a2ea2fe521b264fa315d9823933271335f34051ad251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e9f75c627b1068562babc03de1f0209
SHA1e6e937f0236efb81329ae31bbf16e8063227ce94
SHA256d2bf646d681a54f9e3564c0dedb5891948ea756576f1956f11352d5ca268d166
SHA512857745c0b4f29f0cc0f9be92d0662a95234f3fd8390cb6f35d1a172f559ce6032fade3560137f12312980736a4918a0983ddb2651d2c7475ea9bc96654da639c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a