Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
151148bfc1ef104b3677e6d5a138bd94_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
151148bfc1ef104b3677e6d5a138bd94_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
151148bfc1ef104b3677e6d5a138bd94_JaffaCakes118.html
-
Size
35KB
-
MD5
151148bfc1ef104b3677e6d5a138bd94
-
SHA1
8e79148981fc514277e1a494466bf6c3c10ad954
-
SHA256
d6222bcf288285240db27bfae2f4412dd00ad95455bcd28631579e93fcd447be
-
SHA512
156415d55ddd9eaf9efe1e853a567c2dd10e209e2fa6239b5baba902c36192a61edf7307b439981d88e95085b0f565ba60a4a2404410306bffb1dc0dbfa24e16
-
SSDEEP
192:uWpo6dt7SURaBDxb5nqjSoHUi/CwxxqKWRnQjxn5Q/g1nQiecUNnzUBnQOkEnteg:DQ/tBlOCjbXJqyWWsNkD+wy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000d85e144f1d54ac9b66379d057d5e894f06acd7ef939a294f35516dfa1f94503000000000e80000000020000200000001f8221bf166e977ed7adc14dab2d6a5e7fb8effdf923f5ac5045a09cfb50d674900000008434ea31bba3f76bfe86231ceb2c661ff628e95c5ff2227cf1790ff9517805d2b503a32bb29b9b0f34321c7752223078c3083e71627c9a38dd65c4c9e36e757d065715534000bee634fd3b6c55ca8eae2eeb03c867c017ba083690789f260d9e0ffcac091749d506cae2fa3c6df5cda1d158d184790137b4a0db33960340f0cff1d5acf33c21448ad2d9ea50a7a33291400000007fa690729a4130dd04cc97abbe6a12843a75ddde16ac23fe4b56e107eb53ba701c2584cdaaecf3c9778ecc45a1c80e6c2a44335c2e931f68a577e2333cbaa6c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88FF1271-0A72-11EF-91A4-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e2465e7f9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004d8508baf4052cd85ea865963acfe8cadc11e71b26b4fbe0e93c5807b92e37d0000000000e8000000002000020000000ff11d00a1e3ca3a19caa7cfd25d6f1e8ec955958f3800e440e3576e8eeb2b623200000005d772efc9df98c12127a1bdca0bd88f4cdd66a013c46867c61864d0cbf3d338940000000339f68ba540635b954fc18c9856574ddd57efb07a026fc518762f87276c77cc091f482fe16d4aba85b843b5a0a9ff21a6d082bc06e9bee346d3959efef9e09dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421029122" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 1252 2936 iexplore.exe 28 PID 2936 wrote to memory of 1252 2936 iexplore.exe 28 PID 2936 wrote to memory of 1252 2936 iexplore.exe 28 PID 2936 wrote to memory of 1252 2936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\151148bfc1ef104b3677e6d5a138bd94_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eceb6d4d4e48e8c78e1709e08aa0885e
SHA18f7d7f8d10f6bd1dfaa25f9d6a3b8d656b678e47
SHA256e7ccfbb75a82ac3d3982e040f2e086944f137aa88476d907be2e851737a1a4f5
SHA512e5bafb2caac2763f2a80e328510456c8d00aeb8c056ce394528f96a7b4dae0ea7fffe2083cf6dedea2d91e0c01ddc3543f24156b620550ab9b2357eeb7a71d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eff4cbd32dc6ac2ec6f8073903da576
SHA1607bde5b2330c125f9a928ae3d32280ac15865e9
SHA25613a9c1fa991f66d428d37dc9e0b88be082822ef31de8865f60d82f41e75ced17
SHA5126b10181a00446002a374c91a788d371664e43db3715767487f0cf0edba677b1cd5f499be7d814bfe3bc765e42c56c79ec82f7a90daf36333d285287b874445e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc2b9d7d8e6b257ca1d30573bc043f47
SHA16768cc5a12311ce692a2d7bade530258b4e8ae2e
SHA25687747872500b458bc52bfecdb029ca86bde1033c80830ba6c9760d8aae2dfc55
SHA5127c6b6ebb3ecbc327f4ae55822db085b7844df719b6e750bb0be0039e232d62e4ca89dc1f832a76a653f81f9b2d1787de8710e321f997b56651bba38997fb8a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a771fbed46c8aba386dfac5b1a054a7
SHA1f16c24c8faa9657b22639b4f80352b950b851bdf
SHA256b4f4ea5e4f177b559408ca5c239a6196108e51324681d6868fb98b077a19cbf4
SHA5124a77fd88e1982725da22f6460fea4d31a47ce49a01f8f74473ae29b6c0dfd7f25b64044fe67147ca4a34c49229a80257c2bf6ac30c43a13a873d838039a76d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b77758e53a52da849ebed8b572c2e69
SHA127b8309f551b6c2f3e2db9c83febcca1c1f0ac63
SHA256241c766559528b53e19379839f9950303ee88f3c53ebc69968c9a109e1aa761f
SHA512c87e5a280138996cdba8d53420ab3e231a2e0c006756e127c6b1e663570d6d51b594e3ad1d881f1676dc87e3e24afa4ded2b716854d168dd62035ddd6b56d2c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c360bdb91e281de85c9ec05f64edb874
SHA1d97b5fb2f0c2844f2c44ebe5debd88d9ef8dde38
SHA25660d50218caa82c0ae8ee243027141e0ab256a4074f1dcfb7fb68d366bcfc7922
SHA51216ec48bb4ba7e816cdaee1f7bdff112b437d398eae1a5ce150b2a0942d5fa54ca8f0fa927373a4c0fcf1dbad65349616c9fc2f3d5c8252d503ed991b03f2d9b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc0026492d914bb737cb2fed67c20386
SHA121b799c553aee054a20e264420523c99af6743b5
SHA25651dfdacd833c67c2f36cbc58d87da0b962d4b3f1ac509bb485e11234bc2474a3
SHA5122e8859299376a938ffae3da16661ed2ae9aeff00c223a5f8c370bb5987b8e455b7e706ed6c201e67e11a25bee3ac672e3db1b5be7981e9d37f3e4fb6fc3b861e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5173d24ed943b944b4b05671937b035d7
SHA16e7e4686537d8655a83047a342a20e85d0298461
SHA256fecca92382541adb99246a5718a981431c449b6b6e718201eb14f24c04a759c3
SHA51263c0b38ae72802a1d7d35b59cd6cedcc2fca01335e475b39ca8e5bd817f988009be7643a33f7726c620c8953174c081f1299fa65577ab9281c038a4b976748fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f2e4c1ee7fcdef4e8b08f321753fb29
SHA1af9af925e8654e0c571712cb0bae675c04a6b10a
SHA25624f5ff727f4cd5f779e2deebd90fdd146b68c4c14bb218f5f08c14e9ce1a376f
SHA5120f047c9aa6ee74216a2d35525bc76412c9674663fe1f04c952880044d870477e68ae12ecc383092aae40b916f81d58ded163157aac4b06fba1f23704f35c8562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b212d355665b91613c55e04b5a8fe3a1
SHA12da1002c325b95e3a57a353890f70d72bc9faaa9
SHA256f2aa45530dd3e8f25cd2a9e682b909f9672a823b899d5f232e726d6255311909
SHA512e10b98b558604da3d3095820dba0071f47cb2a18799d7190439e70c5604eccafccb94b23d502617772f1e9af052ff0502f566d0654546fee2c517ee035660b1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52211c41908365c10ad45b96742113307
SHA1a1c17abe5738b0fb36fdc9a1cc46a2918f51508a
SHA2565927711a2a1a73e47ae443f4dc380c4d819633f3af7534643dee3bffbbe66748
SHA5120b5d44eb080cb62044a0aa67f1b759f75521373dab1a1f018d860453165ed4367e1100563b718a15f340948bb742905dbc58474ceec5a206096642a02c68072b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e93f946f8d9344d07571051be716bd06
SHA10969c4eae771a35985ff8a19e4517691d64144c9
SHA256f1e69d83906742f37ac3062d153456bd38bcbc9a50f0a0dc6c95024dbeb201c3
SHA5120d1031e2bd05f1dcd0a0aa7c1389a704dbf2ce4959bd118b976addd01f559daf4664ff54e6bfa1fb1b46585bdc899ba684cf497c410f2a36f55de51a5386e0bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583fb6e03b9c6acaddb86c07d4b6ed455
SHA130054172f595a7b862c24c39bdbfa9cbe38f8555
SHA2563263df8182612cefcf9f0bc1e5d3180b4de043bf104a05c26d40b145b11d61df
SHA512ebebe4e220ec3e938c0bb57b2473b15e96fadf1ac27c8f3a9cbf8e766386c7ed072173a2d4e11d5878ba81a62ecc4883fe773176d70b591323ccc061c7433553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568a1e154a1386f4f9ef9f6e2c3184afb
SHA19e75a08933a6d845428cd099332e89f2224ccd1a
SHA2569154e90909aa3fa6eb908d37d1831a5f485a88a326397b0626e18b0ae3a1348d
SHA512aae299ba149b631cfb2cd55f8b5c9b6b4d54def24a3317343f141bc86f160d790743e9865205d613fe0e346db90d22990992a025f5e13526f02f56e3285078d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50789d7584ef43d2dc5336acfd8c2339b
SHA13e543c5caf0f2d669f0760e8db08ab1e6b0a4089
SHA256ccab5ff2150a6f5a7f2e4f56077e96207520031b179f024ef04c4f7ad959dfe9
SHA51224b0576f0180ab8f65c2a5a233be58947fcbabe74a6c1816615be2ad746c6011d5595460fe1850b18b5acc96d8bdc37c979bf0ecf57a1cd813274783ed83901a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d62975828b67d2a9ed19505d0247cd79
SHA1f240db9a15312ea141d0bdf0f58301ec7d691635
SHA25606f73b61e478d62dc4cf86e2b107ce7a0266d41a98eaa8f4b3b702b090667d93
SHA512ed4351cd1fa1cb1da3447764b89297606fe4da5e054bca3cc3c0777b1c551a5663745a86385a6cc2a46fb37d2d4781fedb139241c6f602467c7a33a9ca1b00d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a3974d460c8600159dbe7dbe574b17e
SHA1fd7dbb63164ad210746548eb2b8c461803c8cd06
SHA256b9d977e62c5c332a960fd18831110f1d759138794426b6c7c9a5fa6dd8677a06
SHA512535c73ac81c6db2c258c92b16d4baebeb3d09202636c332e2b04b247603fd6208b78b07798dca26b7ad0b50149ad024d4b1a6d2c2d13c5967c38deab20d93e52
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a