Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 07:32
Static task
static1
Behavioral task
behavioral1
Sample
16a10defc1126a4bc33023c47aec2801_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16a10defc1126a4bc33023c47aec2801_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
16a10defc1126a4bc33023c47aec2801_JaffaCakes118.html
-
Size
145KB
-
MD5
16a10defc1126a4bc33023c47aec2801
-
SHA1
84612416485e6218329e046240fd9ff5e03c569b
-
SHA256
ef9c9a7f764008fbade80d344a732cfd8292d5e3ae5b2bdd8911e64687d62873
-
SHA512
d186b1b441a96d969a64bd1cc3c1e9b150cfe3e991eeb7d1fa2ed581563a9fbae3428aa794a07aaccc05c194c0ac86c2224e007fbfa17b1371e12c35b0d6fcb4
-
SSDEEP
3072:S/ObGpyHgpx7dyfkMY+BES09JXAnyrZalI+YQ:S/OUyHgpx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421056244" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B08D1D71-0AB1-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 856 iexplore.exe 856 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 856 wrote to memory of 2352 856 iexplore.exe 28 PID 856 wrote to memory of 2352 856 iexplore.exe 28 PID 856 wrote to memory of 2352 856 iexplore.exe 28 PID 856 wrote to memory of 2352 856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16a10defc1126a4bc33023c47aec2801_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2ee77b9d2af131691360829cb0898a8
SHA1027bc611ca74ffab26e4f9459b92cb2a06eb5caf
SHA25637440792123b40d3f329eeb2bcfe74538851e1f86078fc6a9137c15126ca8106
SHA51272d0e8bdb8d28073f5013a054e8a128c071f4e5583fcdf68cccac9b392adac9c437682232c17eabae8b2a5f172cd21b1337560d8e10369f857ec4dac9fca90ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8acecf2af93c865c76db15c08902b0f
SHA13e83d5af00fb2ac785b718b87cc00cc9857519e9
SHA256ed64f2ccd32e257e9ef4298910651d87e697e94137cef1571c7d21fa67bf1e9a
SHA512bc62c8e861a7cb431071d2e64d097015faddace0226ab9759b3b2ac6bf937d392ff94ab79ab1bf6ef7e07515be5a21b2d24d1003e3c48945ee43907b082e419d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51700956fb065aacad17b0acfbbe9eaf1
SHA18d4393b67ef05167c402542531ab00bcadd576a7
SHA2568074b97505d21d3934157e76dfa8049f9b15ccfd912cf9cca5f56fca7aa7b4fa
SHA512e4ef6b558b583740f88e3c44439468b7df2f6c60484fcbc23a5198e2c2e6e3548d58758fe8e55ac98838155f3dbbfb7674675e6df60712828f06305f0cde8816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae93cfe4f637bbe2ebdd5f4e2f86b471
SHA1944d9b45c83eb1b90b89d4bf91c43738e9d57669
SHA2564036c1a614bda79ebaec43347155983ade7e99c64f3f34f0d52d5d2128e0a639
SHA512dd08e80de605b5c577e34bf569b07304dc54fb86ebb610a923ace8e969af94e60fe022f3f6ae52ff79b140c5bbf1d5f241c4d248294ac73419b3028c24fc25d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6f38867591e39be0536934602a0db70
SHA1752bb3f75d1dc2fd5e91a33d3dc814ae8edad7d4
SHA2561cfafeb8e8c58499d92dc350cf56158b5d6f9d710af13d85940881ac9ca56a1e
SHA5123a02e307c45ef9fda29a62a4094f1a2d64e61c7e116d6d9e90e816dbdc70e3e0766ba92288745b25a18c045aab4b6f580d401335b08879378465f5530ccda44b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b888d18cf9823d549a811c97823406c5
SHA1821d0f807d8b82193b6261c36b826c4d330c1d82
SHA256554aa5b2e930309fdaee7ba562de74b783d30dc5ae6d66604786e78abd037b68
SHA51213797e73e516352c548b33e5fcb0d3ef1925ea39db3159f00a1d451000882a932abd3706173d4a168ed1edb19e7e3eb146a19a78922e35f18df5998911ae1fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58927fddced4741e04f0ca8151417a678
SHA12182902925833643633be3509e70ccbd4041ac39
SHA2569ff88df4bfdec3a9039378b6b333e49a7724014471a50f32a1f549b94a8f880d
SHA512e9fa2006a3534b298816f777676faa1f0e96665ebce0609d1b13d9ffd027072361e76be54583785587c2c5112c8c58f7b977675c978f0570f923c9b50e97b4e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c81515540c3ff4aa57aa1561b1fed3b9
SHA18e7e641f66bbed95fb6b48b2c02293c1735fa5d2
SHA25624f198f4b8aa5303ad38135a2d4d9c8b7c42b8a2bcd87716d561e138c4eeddeb
SHA5127bd9f630aa4b1b3014fe12d3d4be068dd005fbf3ac6821cf91e48ae9cb9ba3bc6f03d1906e8ca6f5e265dbe8b7074fb8af6e0da20dfbb090688fa0279e204917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a4ebfcc78491f6fb9ef67e85949a26
SHA1365b599fb715c54ccb02d6e69ecaa57ec8b54fd6
SHA2561ed9412cb79a37c9e72456976199b531528f4bd9d9cfb216acf66a7a690c64fd
SHA512b54315d7551276543d2ae79f52c4ea7a45cb6deedfd4955201cd6abd94f1a8288063c2da54d7ae7e5dbecf71bcef6381837b0fb3b87715a1f27ee8f915ece4e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564e0f532b27f09f4d6bcf2154700aedf
SHA1e7a634f97baf2be187dffe963016daa834c3f4e8
SHA2563aa21b8350f9122dccdf69e6c143fd918a0c209122e50fcb19496c574c2a8ab5
SHA5120eb80d1b9d6eeb15cc18b4bae22cd14201cad948c04f19863af87d7ff752df6169b034b13e63abafc26f7e4c12955142f4050092a4625556e44c5bf688cd6dd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532b4a82e17cb2d9852f17f17a9c97173
SHA17e79ae35fb5be04a10f0aae4d2190964055690f5
SHA25697e12c0d594db8eabae2deab00408df9d1939c19501c6e0527a4b65232b5b484
SHA512c7e48650f76687860bdf276265c9a608043f15778588306fbb16f3ed9b3a8ba8afd5b7dea06aa3a9be3ed1d99406f06a97c726e89b522766ccb83f0c65821389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f6ae53498a114f12a07f498a8c87c5b
SHA1ddb63c2276cb199efe3037b79ddb7e3cba6a1361
SHA256c3c22c5feb27a74d4d12e4b7eaae5a480a7256b1ed8e4893bcaff5918f2c960d
SHA5127b47d9a59f13ad95597cd8aedcceaf729ce189ec5f9769775adb536aa7c825045deb04a1fc321658b2fd5f5fa9a5f1dddc5470ca74278a4d7d4dae2c66209053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506ddb2bbaa9aabc9a94e974cc1768793
SHA19d7af68f47c62bd17f2127e21c23ec5b1775e681
SHA2561697a74cd18d3a3c687fbf20472c7343b07259d504dbba6e986a1ce3130c946a
SHA5123622e54276b01da0ca48df2123186c2329cd1e08cd0dd37d2fd157cdd6b32c5e4fe17b7c7aad169a1786cb286a903bed19fc1e7e1da6bbe1c2e34cc5fe0b5e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2cc9da2da880c254a977a917586a45a
SHA12f09bb5c815d861db76c303b128eda641b51b479
SHA25652a005722d6a55ea4fde19f170cf2b6310fb103dcbc7159820ab4839d6ef5a92
SHA5129ff5df6d7334959e6aa16d44a48a37b179e9f56d0fc2daa2d6030f8aa85fb5ea232bc208847a7a2f243d2c057a58ab8e04ed3e5ab77fe08007e73e486fb39ba8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567c4ed00f6c79adf10b04db269a21b0c
SHA15579b6d57c3021548b0ef47458e9db074c179be4
SHA256eb982810ebcbe2754783657715255b3476718ce055da16998f88fdbd3caa6e20
SHA5122674596cbc1611a38cf317e4cc390ea6dfe47f9a79a4438285a1711d40ee96433a2dd08085713a9a4876e0b7fc3ed4c1a9a964901efb859dc88c42fbb2238103
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538f1b9a982095a4e844c6572ba61c05c
SHA1be82f8b9a9b12581e1a6480e49705c135901938e
SHA256f958da1ed6c6c038cbc69f55fb8191799aa21ebfd966012b06bb75bb84d47347
SHA51234824eb9b379aa877b2603e0dd9b09c47633b6f36223ae40b9e5e25c467672b321bf7cb300c84d52610812cb0ef0c3772262b71b682949762592e2a6739dc57f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593c2f66083bcccddde7bb1c76afea9d3
SHA1a31e5f4b6a8caa4cc9a34253e55fb66d2e272e6a
SHA2566585a8945ab5a545c683d845ec089fa7acc9cac128921221b272aacf4eaaee10
SHA5122410ad719c91e2ab61548fc9576c556c93e94e658eb8abe53a53810ab8c5be0b4256e12a341351b3c4e8d592b8f33f6aa85a78e19864632141617a9dd7c47458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53464c6c20d3165974d6a7df25eb5c712
SHA1b83ae604294b9e75684a9a1e539ecc8059b3f17b
SHA25630e3b1b8588d92aacd58f56cd9689068a4e8b0a1e9d16be826f9ed778344b133
SHA512ea089b217793d9397dbbd07d7e2c479494978b7a1eae764d6c9d54f92d629bd8bc72e7d58b24d2cb7ac57d8b04d0561782f229af8512847893165c572f048c17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543cb37e157c956ce1be3fbf5e1b34ed0
SHA19f5ade7fdf17317529f64f45f36e26d5ae3f9d7b
SHA256b238593408f585a8ee61c22aad233d6e75b8a8356e7e4a6d17c5cde2867319c1
SHA512cfd8734967852d551d42ee63732f93544a5d356759d9e0c92b325d0a94ee231373fbf515626bd2292779cfacf51c94723043a1879dcb5eb952d1b92ab2902c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57454c41658357acdc590ccc877ec5fa3
SHA172cc0287b4e444ff33323b98b2223d277942b617
SHA256a2bb64095f264e854c6446c052c629c39aaa2d2f45cc416d2e56efbed607f493
SHA5124314cd9df8fbb190b7462d966fb5f6ffac8441d143e37332e9c244d048315f040d28f55855a3402e08db34d6f874f72dd27d096584b43b7931a027ad1ddb2f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8ba2feaf9eb9f8b51b7433758f5a88d
SHA1999ced1945cd79b80994881e3403da8d0e12b31f
SHA256881c19096f05113a32584e189194706dbee45865f1fce369fe4f349a9975c04b
SHA51225daeeafae92c84be40cb409f40e2abf48073d1b5d5fa2699db3919d2908e41556070a2626c1e977888b708f56b62bf1b338d0fe3a05fde7ceafc0ec7555bd34
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a