Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
14490dc77e7b46b0381371bb53482ce6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14490dc77e7b46b0381371bb53482ce6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14490dc77e7b46b0381371bb53482ce6_JaffaCakes118.html
-
Size
125KB
-
MD5
14490dc77e7b46b0381371bb53482ce6
-
SHA1
cd9639a5ae647aacdb8790f48b83be1729369f8a
-
SHA256
dcf16f5abb308671a0f753805657a97eefafc936ff9d2d0a036351d286e79627
-
SHA512
14dd74375390257062d02702604cc6fb532e4e3e8622d0fe3bae0b8b5948a783b541a8ca4935da6744a97d6f9497c5196ca48a59e0ec5023de1660debe4a6e7f
-
SSDEEP
1536:SkeIyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SLIyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421015128" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907fb0ca5e9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bbe74a5528bc5c01c9cae8df51001c17a6cb7838b56943cda50e0ec30f60a0c5000000000e80000000020000200000004a3564b6c2f626a987383566566cddc708d304a14ff2180d7364645a7acec54090000000eab9baebe0fcb40524c618d1b9cde179436a3090fdc688965539cc8cdcd82eedb9c59426021428f4776c2a2e93d74817dd31146ece2ca714445a9d9e43b75d80fbb2d76477ffa12e25c464ea43a678f181b1a1de9d906b3568058dbc965124b769c4ddb4bf4e75d869566569dbab04abc09febd8d9ec04b3072ba1541dd67711639559f2a97b137273a1834b588bacd44000000045b90539d1232e3f418222ca987b1d5b44c6e7f644ed27b411615837d5a7cd6cdb23182da1f3863978fe2eef72c88c885dbf452dc7346d4b6c3ff6e7d2773032 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F592C4C1-0A51-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000824a1db05e15c4ede4c5af2b673d207a2911e9b50cc7bd1a843b6cf745856ef0000000000e8000000002000020000000f5a7b1f0d00910498a391e2544c6699c538a91ee258540ad3a390b6cc2ea94c52000000015f81208b0dd2e9ad472af7e17f941c2fe4dcd008496289d40257f783444758b40000000d1619b4df9467a88f0ffef976dc645141fd1f303151b6e6aed538d71f7cfdaf8aaae87d4df5894e9c3ed43f07e4b6544b54490d6646ccfd6c7cfe9e32241fd0b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2136 2240 iexplore.exe 28 PID 2240 wrote to memory of 2136 2240 iexplore.exe 28 PID 2240 wrote to memory of 2136 2240 iexplore.exe 28 PID 2240 wrote to memory of 2136 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14490dc77e7b46b0381371bb53482ce6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1a0091bd49d37572e5c97513c7e1777
SHA196aadf47d629924a7225febbf6aa00d2ac0c944b
SHA2560631f6526096fae1c18bff64b65d86e25afb27f484994caeb0b86e66ec46858e
SHA512d19f31eaf992b67333ab15e2cd7cc907a61991595eab96b17ff92b06ba7a2a42802834c4ce523c0794cfba7ac8006e5387101fb89b31ba9cb57030e54b9f9369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5995cb5bd354194ad533577389655d390
SHA1fdd0215794e01a16b5b0825610d9763fdcda6bcc
SHA25675d7dfc45e9a80c9c93f7b8c8daa7e92164ae138016c66dde8d45059d5e81f2b
SHA51208a43864319389740500af4f6b7bc1993ebd37ec5e2a9179757de5cebce2af2d84a0bdfbaadd41964f9b90721e78d697a70fbfc78cc59b2ff7e4b06e59aa0f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bd9e7f92cbb850080562777a9479c9e
SHA19192595cbc660085803e4ecd7f41ffdc910bd9b0
SHA2563192a9c811c43c99ead2a3113e3146383e7a77788de571cb9718f433c3d4c548
SHA5124d3c4807b3848005103cd26a8314e40d817ae0981ca8f9c3ad21a9ecdebaaeb20b29449363b73d30a4632e274cd867198e7100020ed383fef0bb1e03ae5754e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e893f963ae53d9b6523edddf0c0bc33b
SHA1d218db5272b6b35dc1054b9a4170a63de56b14ed
SHA256d901ae01946ab4a852b774347a5f2c434e5b357a784afa1ea8a5f6f8c3b90e9d
SHA5125c7133337066f4b7dfc72c8016689f0a86996074de39fa75775e44bac4ec8783da2f409075f163f61490c7ee1ed7057b32701fef247140b968f9dfc5c9620f08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511a296944fc005d0720fae60f9506644
SHA1cafe60133002d0303d30133db3072b266e3fcbcb
SHA256e3565af6384eb20141c73e3fa03da1381e1fd8f3705294668e4dd84bcb27ee70
SHA512041bf5e9711550d54419e53e31d9d7df2a0213083c647f7d201abc319c652b3c8e751d313bb36e126ff7cdc1b291262b270f43cebd5cbec4fb2ca91547b0ebd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547cf84e26fde3f176d49ba9715efb98e
SHA11abd015e4cc828ea832cb83185b2eb8a630406d1
SHA2561e66220d6051450de180c960ff396aa34ce319b5a7b91a701cb106a7e0e1140f
SHA512d3f2fcc78fa66fb53a35439f736fa9e3ec8633ba4f12adb2abdac85078848017698fe95ce57bdd7baa2e96a032d65f3b217d927203989198cfd370e3c6b5b083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b398496133a063dfad877e29506d6ef4
SHA1a747307409965d31722af76ec41414d2b4dd61a1
SHA256b53f1b4bc7e8a3917d4b84424ed95fa74e95f81577216477b75610f070e90e02
SHA512af4255ae954bcd1c9b9cdbbcf855ba7c2a70530d60ada9d26a4c1cd63cc1bde1a1c67c50a50c28fc66337b9b1befc7635049921e65cab7b58668d2f32d586647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bde95b827a7e19a8081bb9b97e344f59
SHA13986ec87cefe3695e32070e54f6b3464b0a40310
SHA256ab7eb90293febc48567b1591bf807e9cccf52cd7d9985129784afca7c9fc0a2b
SHA5121dbf6a63515292597f3b1a10cf4d138155f653ba50394f6b3fe85c4776e62fae1a61b003c2c58fa9529a5773fbc4c50cd3131349c1f546d3d9c9a389022745c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57be00debfcc52d83a64ace9756da917c
SHA143af20afce3fbc3aed0941defb53bfe819419a81
SHA2562e41251bbb752a96ce6ba58bc85339fc9ed8655d5c3d4c332bd770f859fd3776
SHA512573d0d062d85eb597b783d249b44257ddfaa53422f74152616056df10ab881eae9d6f1b88fe1620910a18d428084445c78963c440ba98fbc550352a4f7ea8fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506f403dca415c07cda7c9f0875532bab
SHA12635edbea151251be7ade42dbf9c99c0d0c30cd8
SHA256bf363de29d87b506a682c75aa7bf64a2c84164ee5c0b69ae54caa55d1e701ea8
SHA5129edff3e2016a397c9a4f7e36d302fbaf187ce2f3ce8b07f792975f2493ea3c876df81305bfcbb1d1632c6fd5afd1825e7e5f46818b335832ae8d5842e6573344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5956247453e343b50a1c52ce915c9cf42
SHA19e0a03b5d2cadcddc6f09d718c2d2f5ea9d0e22e
SHA256420dc232fce0e15212af3cc194b51323a3bf284f7de0d57945c40c0adac8eb52
SHA5120789346bd48c57b77f4299d700b9c7deaac32a358df48449ae3ed2eb035098e12436891c2c285717ddd5727d510330d30640cd62d7fba7353aa877c8cef9504f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a4a11762b9b5d19f15731e763009c6e
SHA1dcafe9a816acda399d0a0bace141b9b3146f343f
SHA25613143c357653a1127b3074d5a83fcc28919ea581cacd5b9eb91418f894337def
SHA512e3094a8e87c69863fa8f9a6aa11c4d314765fd61d2695040682bf525b48ca3d65ada1538d381367951f902fafbafa77bb68b42d7d9eb57343322e05a96c5f8d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5789fa1f340db922609cdabc913111710
SHA1018e2a67fb1d2b888a6381a9afa51932a6f19fc9
SHA256a5aead7e0177386c6e966d1b36e2a31bd2b67daedb42b0442f785bf2d592de64
SHA5128b1d54ef7acba7d0f02bf070091c87c32e20b00e1d9a4ba59daac91d45d2ddd203d47618e825e9ec90f839607dcfceb7328996f06628df99fef500cffa4b3f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543f4e02072388293182716af2975327d
SHA1bf64ce3f1b81ec597fbeb2e5297c3775169bfbec
SHA256ac373c4809badf7a9cfc52583186aa81797b1a0bff3b5dadfa8856d50d1502a6
SHA512e7232208564d9f100b96d09820cd37e281a7861cb9e06a2df531d07ef340f31c790db87e39bec886786ab235c91148e1cebee184c0d932f3d059a94195b46edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5127f92986102f0b927c15e0cadacf1fb
SHA1a4424d1464ba1950a1a1049c0fc68f6620aab677
SHA25637f9d9dd982ad0286cd0c0b666960edb86582dd1f4f703b62ebb42fb01197b3e
SHA51235841eacc963b5144309d58687686f053434d1074d14c3f26ff89d125e32ced40e9261f761415d9fb1ab0b2a3517b4d2f3c373c9b8fc6892a6c45e3971216743
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537576ade3497a4687be99549d8031365
SHA1153166865b2a75434354d94f1847502cc995c72e
SHA256416f78cffb9b506547016812be8ea6722cfc874fcffdc739eeb9aed5e69471b7
SHA5127b4d46c398431bbc969b0067f5a68c40c275b8151e03d03c7fa1760d6140c7f53e5d054f378921cfdd2a53084524a2ae539ba841e3dc8cf1ab367664afdf2018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e436c7ff1b57c00a496c7c962470870a
SHA1200f2eac01a192c86d5c59e3b8ee41328b02c8df
SHA2569c56d1f29a327803cfae9841bf3e12bbf8fa185377d5ebb7fdf7ffceb781193e
SHA51237ed673070de3d7a2475cc90896a9402c30432d772a04aaca53c83bbbe096f0fd0695a3fcef5d1e94142ce79df8fe770870a8ac5dd5b084108565672e2e7540a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a