Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
162e91c734f16db8fe0cd315a38a3b2f_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
162e91c734f16db8fe0cd315a38a3b2f_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
162e91c734f16db8fe0cd315a38a3b2f_JaffaCakes118.html
-
Size
65KB
-
MD5
162e91c734f16db8fe0cd315a38a3b2f
-
SHA1
bc7f6714c7a6884de47e0ba7afb2ecb79ec8df04
-
SHA256
1b30697af190133e462715bde769993cd429299449b102f426725c5b83b3adb0
-
SHA512
24c325446b7de863f5558a5dfd2401c7cfa36738e7223da7481844afc1d59b0fa03a784d2acfc8bf849a3174a014497e6ee57c501fbf9678c2a64c05303c24c3
-
SSDEEP
768:JiDgcMaeSXDDLx99u7lLfMHlGzx4oT2ICZkoTnMdtbBnfBgN8/0OgcRWQFVGss/d:JrAuLT8ec0tbrgaUc9NnjUl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EB04251-0AA0-11EF-9FEE-EA42E82B8F01} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0244d23ad9eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b884fcbc7c20d6cf1f77281ab827615855cbcbb1b2bad668549808bb208c4d12000000000e8000000002000020000000b4eaedbd7350ca2b4e1b1053b8bd63379d85a96bddb4ff383eaa9e07523cc8e79000000050a58e6e3b992bd79da4993f241b33d5167e49c412f2ca54f9eee6d8c4e91d5db580cadeec39957393221c8e5abf3d3689c313d44dd0f3fee4c4f128fa82215c9b9f27a4585fef3a6b188ea4b3f7bb43f37a752bba1da293ea3aba68b5a762aa4d0c433ff64cc74eff356de44b4d5d548d4a0b28c367f0439784a075676b69ffde9baa6b22c41b0dc71c9e6a3a4c8688400000006fe5f87e416f425a8a869e39bd7e8d318ca33857e71818367e886708f3344961066cae5d72d65c257f2c971ada33793140497d5838fdbc418a7aeeebf5c253ae iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421048778" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000af4b3aa5f57e4281caf7898e5bf20a142d85c3a0d53eef5515990ac5f1b404dd000000000e800000000200002000000046a5d33422fb560e420be81bcb74a025457e5c793a2b8bec2a52b583b4173d602000000046b5d4476e441f7c4c9e5e992d2e15d6eae625985c849a5ba101013b1a41772e40000000d4ab14265575b4803c2bfb06f06fc635bb487c5d937e101449ad4c5313f3b200a0c5440b29dec81a12013c29c0654ff2a46618ba6005d99057261f900b221cab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2484 2848 iexplore.exe 28 PID 2848 wrote to memory of 2484 2848 iexplore.exe 28 PID 2848 wrote to memory of 2484 2848 iexplore.exe 28 PID 2848 wrote to memory of 2484 2848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\162e91c734f16db8fe0cd315a38a3b2f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b4c580c0fab75ac88a0e5b2a43cc2da
SHA162aefba21d18603a961ff70e9974cf5d42df91cb
SHA256371ef7aaf9e3d519fbfb366cd80a328a1b736d20189b8939576c4e148fa79c55
SHA512f748cf53f21f7ae2f89346182ebae5acfd903504885a4defc864e5d6e2db11854ce2c48ce12727f547e1f9d4a6e874257ec2d3982e3aeefbae8f907f1a93e43d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d87a4f3bbf4673b3151669acd587783
SHA17e67dff067fbcfb0981d2ce791c142ce42020665
SHA2562731998ab00bc74faa596e5df0d606d58566449531ec7da23508ba568d5a7ac9
SHA51240a1c31d3871526b06964758a20dd6989dadf7152fe89999df97057e7e86bf64990d6867a0373eba7907fc1fb6c4e9cf611296f316e0e95d4d338b8263a5dff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568064af25f7d0df4d2e213b728e776f0
SHA155a444ab4e2cab09b883d06b7c174ad5bd1408b1
SHA25635462c7378bd645e7fdbfb65de68040f8ca7a55ff182bcb7ea8e0b690231586f
SHA512e2aafd870e2e39609d788e8b0b414a24b427bc1d2c13efeb84ab04676d8af3a005afac15d50d711a840144b037700e48520ca346a67840ccc5dceca6ac8d61d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a901be60793ea923599eb92a57fc978a
SHA1bd810574b0462cbcce999ede5429ad830c96f583
SHA256c530f389fe8d77f04c0613ec00e06d9b238069efd48feebbfde82f65d88ea58f
SHA512adae4c861d7bec05ae6c5f9e7c4405e74b618c81bb3d10e17a8b93a59fcb578331eb8bcb74ddd1b9d4087ccfc31c451e77aa07f9580d8e305f724ccd99b20222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533880c9d7577d12441236c5cf94b1ece
SHA11624900bf42746b907d0cb547ade411a53c30a12
SHA2560a1f95a27f956ea0f046d44fadaf8b00511f0b892b80ae4a842058b7ae48ff8d
SHA51264144c44455435fc58807af284cb397bc7ef766a770fee0cdab30acac5603e01a7e5183edcd217abfadd7bebc3c56afc53093d87dd487602443ac5f99d8bbea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae0d35db4d62a8376269f2d9bc887799
SHA1d5ef0d5bbfe05a5d389127157812e09e4dcd0149
SHA25645ebd44d6f9642cd7c38eb30e0fc40d95a2f7ae1f12da33392f5b862171235ca
SHA51234646b4d200892cfb2e9573df04708b65a29b4db92adbf6893a51919ba0aadfa37aa5a146299a3ccf3ba6dfb275530031e74bd6962369900d645f7afa3137f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e906a5f4d36376d8b24518eb35eacd6f
SHA10036571595391eb6a52147277ac885db07b90630
SHA256615bec88a2ed6c296ae9126319b991c59fbe1b133e5ec42b89d83c2f55ffb198
SHA5127bedf43a9c6891873c278eaa1eff7577cd8cf0c97b0e2ac17bcb566b1226cb73854c99a935b79c1d618dec8cf86d1442a28a80b6b4a32b65ae40eda09cf29ea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57315a03af87237e61463ccdecb4ae670
SHA17d136a472125ce73b6d1cd4ad3d718f7ef0a820f
SHA256fa98465aa4f18e8fcdb63b85abb085be535308c1f9a5a1cf84f347d14daa543c
SHA5126fc86cb529234bc73f4c9a4da42e5813ba6a8891c04a2fb03b2557d445082cd041079b91c00be338097a0322b452bc9cf6fdbbd09558047f927942e7fd16c465
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52691033f65b66496ec8413850863ac57
SHA19d5dce8fdf9e17289bc075d6ecc767d6239daf8e
SHA25680113f1f8ee07f76aa3a74840c2eabdbe33e8978c4e921d43964104c22d8740b
SHA512cc545657355ad51cff66781623d77527a0e0ba13a79f7f0d0386b264c3c8078696bd47088b6ee670d9bc88de3e49453685dd0954af4d7fa42cf2585eb4bfcf38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd43a43f2730e94270ef587c37f8b15
SHA10c740ccc8a61926caa3373e5e9f3542aa48ee03c
SHA25635ced76740a3a14abbf7f2d0802642e8f01a4ec1be20c0226f7a354b2959793e
SHA512b1b6ee4e9f97a2c57dd26cd549a5c9d2f700feeaa391614c362fd31cffbfa376257e9881baf132a7e6d7567e13e08dfde5b4093e72dba512c1c7e5ce9454ae89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543c6c65ea926ca8bbbb52eab7e8e80e1
SHA1a033389c088205eed7d294dca91650d4086ea7dd
SHA256399ecd4c01ff05d6a5cf3496fc273393bdba8302caaa9ee2e5f53cee53d8f3b1
SHA5120367db0c37353bb65f4313db260ab327c2ea13edab64d68023906676a3ff137156ac103f6fa3d871ddcc73af3add4f8e78fd394b5bfa28aac216a94e0efa1bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dcdb5b8ba52de27d3171a794e45daf4
SHA1a494629cda9235f47c06ef999783c7b647208f0a
SHA25606995c75995a03e5e539b722c6c8fb97dd9103d77c5ca8e21ddfa0a2c9f7e391
SHA5129c7c5286e8840eab5209322320e85ef6de291b4c7dfad29b035417d8cbe70a169607796c26009b5f22d76ff3b96f6f8d886aea2b1e2b6b11ce58cba52c6d554f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6eb7ce1d8b2b8b86dc70ff9a6bc4f5e
SHA1f2901240a8ecf11b657404bc702b85c7f9318d45
SHA256fd326c6cbe109117f522d2b036c5c9ceadcfa4a987d3ea0f00ce53cddb7ff89d
SHA5125060c2c4c0ac4041902d4cc8a24f6ac863577139e7de66451e7e8b0ab1243753aef405aec278a31b716120988419cf87fa8b73f17e2b7bc118d68c2671f5acc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523022a31a0e82aa73dbcc6d6a308951b
SHA1b84b8b1b97cf9d2ea7e88301443d2f966cf6dd4f
SHA2569834dd20bcfd3dd8ea8857fac4495405ef24cedbb801cb15abd8efab47eab659
SHA512a9aef8012d66f842ee43a919424f54c1ca40d23274ea5df6363fed953f68e849263f904cc1bb42f9207f53a711fdebb41c0e942faae9db4b01fee162353547c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf7fe0e982b789bba9ffc07748cd98c
SHA1225272896f45ff926aefecee274319f80bb5b32c
SHA25686363687b1b25d2e9a4c516c42878142b910d112d07753909596d0e393955fff
SHA512d92fe7efeace098377dc6dd4748664fa9af0a5039d42baaa17060f70ca5bd35f618b718c7c70cdddcea83b72caed361de9a2ea73cf0d757a1107d39ec9c80b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d526a2c78932ef067837fbdef8aebe
SHA11093f8dc8c289b24881bb3c30c15a453e793fc93
SHA2563d75da9b02809b1f067e4c188156789bc5f3167ab351d4fa761944b7ff321006
SHA512ce1a59fc6a9102b90e9e3764713e880c00703c244d4129dcdf5c3ef519747cea0d6fd9ce3ef3a0018c880cfce36f94e3f67fa7dfb0fc13d95f8ed36a462860dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e3399159193c879d0ea573bd8dccb59
SHA1ab54382d088562c695ef050ef2523fab9f40d4ed
SHA256ef951259dfc0d4245f3ad2ef02d6ae0ab44d8975d9a9a749771f443a594e4a5e
SHA5129458ae287da71d846c3a28349e9708b11b4ea992e6bafcf26cfb813a9c518c5579d4c000c74a54dfdc712f3210e599725d115969b1336b4095564ff988b7029a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a59f4a1051361f315512a7baf0560f3
SHA17870b344b13e3a93d2bd31927f590d9abadaca2e
SHA2569bf607a8282abbdee04f37756a14c68c6744b7a7856bf4a7e6e38ea23aac90d9
SHA5125522b194a398f48315f1d98aae09258757d664dfb68c813157c776955a08802850471d0af949fe239d3f0fbecf585b8943fd3ffc03251dfbf979007ec576d1bb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a