Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
17ce9665af87f5c07c5371a020956fdd_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
17ce9665af87f5c07c5371a020956fdd_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17ce9665af87f5c07c5371a020956fdd_JaffaCakes118.html
-
Size
460KB
-
MD5
17ce9665af87f5c07c5371a020956fdd
-
SHA1
1043642d9986ee8110891161c1842493f64fe989
-
SHA256
0212c3a05dbaf15216430d361953ccc3744665924a6869540ab4e278d78da60d
-
SHA512
547e6ae8168d4a4d2120db331d6ff7cd00f2204c4538f795dddd6322cde69fa5e822fa015cce70c87d28dc245e9598037ccfdbd888da4f03ccc59277da1d8a69
-
SSDEEP
6144:SLsMYod+X3oI+Y8XsMYod+X3oI+YGsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X3675d+X3K5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b82963efbcbf89cb95d280e4c50db9d457432d97c0dc2e42c02eb1f96b272a0b000000000e80000000020000200000002ee44fc10afaeffff0620862d6df581debf1c1880005b1af9222f2281c94464320000000774bbfb98d494eff9dbec73bc7490be54faf7b9fb4c1f184372e5015ecc9a019400000003227413c7e4f261a03983cca9a480b2572235bb79a69fd0a5063b4f864f42871a5cf3aac267301f9e1cea81ac73300e899f533ebe482d20e0935be63080e0cc9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03c02deec9eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421076143" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05807741-0AE0-11EF-8A04-E6AC171B5DA5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000072a033613dd548e76b69137cdcd891c560677b0d6d4932a8085a077e036d3c40000000000e80000000020000200000001c77eaf1169c9e7029a6cd1acbb463359b79dcb1560737e61ac83780a8e7f9ac900000001be969e5ce6d77f4e6131264bab46664546cc7af9fb99d2c94bfbb55fba3d6260dcd1eb8b345484c7bac9a7e539337f462d1e894b84f6b7a2ba41e5e7e88eaa5c2a892a784912efd3f747e4de64cb4e5e29498dd01e8ff03b2ee4450bfeaa98271de602d606a6b0e82bec7d33d83d172eaac2dc231246dae1c41a7640a05fa124b9990aa7d31311713997318cefe4f7b40000000ce7d54f25b3f88d12b38ef3ba9b44e90ce3bfafa628b1cf4db2f5630e26c30bbf3639b7ac82aa46f3ab6f102e79e4e4fb8265d370cedd22ffca44a3880c41213 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17ce9665af87f5c07c5371a020956fdd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c88befb6ff746c5630014b13bb1369e4
SHA13a5018d56a606bad66b2098ff81de42ba218d988
SHA256503324af34aca59576cf6016b123d10e2cbb562b4b51b829fd843f6d525769dc
SHA512a38d5bce6451ee51961fff210bc4f6556743aac86c7543374b9b91d2489c331e560666d39f429699d6ebbc6c31d2940bf8fdc5311c307a7158ac33f79a91bfa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504ea3151eaa50d74a4d4b9d537af2df4
SHA17096e45024b1d6eeab7cecd8919407439a73c5e1
SHA256d6d8123369804a5eb4b8a8629509c9ebf2d782c307c373d9eb0e9419d2aec856
SHA5122deec6c4b4f16f7c98047e87adf2af3e56a7c17feb2e3f32850640fcc6f597a2bbe4ce11418ce31da89416d2c76117b6452d5f155209401ac332abe40df97088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e5e5dc1c2d58e19fbd5a9e1faa0a37
SHA1b1f89a9c348f4bab48291a9e736065938545e387
SHA2564dd0cf6a0e058296450d980989184583036d786ca45b608bfcccca6610ab0843
SHA512d4afbfe815e4bab0291d7930fcf9d7d5f11015f96b35aeeb25424f59aacf8fc6cf799e574e870b4161809a08f2fa63f5fa80007ae68303d445f751994a855744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f32227d7086237ddfd181c8c03c8a909
SHA13961efecb854e8c7812bdc22e3624defb244110d
SHA2564397c35ece7636303693c1754485b589bbcc9d7cd1e641d826a747549d43993b
SHA5126ac5517d964f18b4352303ce152340184817c8549080919cebe3acaf49cc5842d5e56c9a5328aab7084461f494f36c90c165019d889b20b46d153ad93de7fca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55199cadc31d3b18f37cc1bdaaad67648
SHA1e1a828a6eb8d813c0073133dd0ba2d0a04c09425
SHA25613a398b43f48a32557461f2f40514901eea5cb2ae62a263ceceda003fda7bd0d
SHA51223b839fed532b0035de8248268e38a724aaced030e860df63e2486f92cc427c6af682eced61ee552b22b53ac74e36d2dc25415b913ae670c5385fd8de3f4032c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5967932ba0a293c517a988d53cc32adfc
SHA1813a2265a85e20f0e4b030942ae08b74ea2965a1
SHA2565bd62570b0ce55f919fcf45d941fc0b1b4aa7bb19a14e11d7847b161edc61648
SHA5124ec29ea9abbd6cf36fd7008189ffcb5109a67f687846ac5031c00c3cf576ddb3858db85b432db7c8d3455fd7007b835f244cf33864ee0ac17c5295c39dfdcbbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7638dd08e4bcf58cf08385088e2863b
SHA1daaef834ce89b1dfd74705805c8bb8aaf0296c88
SHA25654e62e39fcc2bd827fed0ccd6ee7dc08185665d81201b9daa3a032722ffc0830
SHA5126e23c2d1aede8e1e6816b5053673782de9c2cb4aa6d7f2348720d738857434e57ffb5227233bd8ebdee58edbcf6c23db1379031bad34f2fc2aec5d68b666f577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f096a668a6216905b778bf690be9f17a
SHA15a8fe64a39d21ed3616aff7fbc2cad516b8ef518
SHA256e6747a0613351a233c49ff1a8286ffb2fdfa71823c4ca4c88b0230181550399b
SHA512fbbbcb2b2ee84d137aac0937b046937f0aa87e141b60a303ab576ab43156fae08e8941988f93a927cdc14a4a3d5719f156510f51dd6b8035027631ad34a1742c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7aa11cffc606a573da9967e9510b4a2
SHA15033db8ea659e05a1268aa67ad0ad14be37fe9dc
SHA25669f6862c2d8d0bceb1908b56547238e1fe7afebad286b3e5a6d8775266910184
SHA512d003b6df5c54aa950496e17b7a05e900eba3502204f67395d0482465b24dc310485e8c75535a05f0e410903127322aec10e0171493454146ec489abf1cfc614b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2b791d9321c92d0297f7c6c47d57b9e
SHA10f8b812b0d0c5b2637af364ec4e1e02be5e81cb2
SHA25623ef338f1ee6527d4510b6c3499d7207b16db6b0370f5beb1a07c3cb45a25561
SHA51266838ccd2cb29d3cde9fde4437cfa0a940d98fd16e0cea346ae6e277b9271f262d1636bae625dde071b26673b3c9532793509a0b74de92f0fa88879248637ecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d111727b68bf261bc1ec1cd7e8605870
SHA19ef0d2aa2d568be1aeaabc59c6ca19f178931387
SHA256de456a4b4c2d42d242d5fe9fa146449962f5e8d59ea637c5e71d486b0b4890f0
SHA512e7090f3cf2065d97fbee89ae0710bdf562f91a982823ce845512ee686a65331bdd51eee1f8002a1a8afd717c76678de91ed6606d1a3b37bb379262eeb18d6f11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee9ac1bae5b4acbcbb40a169ab6e5909
SHA16f73cd2a6eada7a520cbb1bbc030838738f2c76d
SHA256404d07670ec2e4a23d64903599ce18a2e8e76c150e6a5e9d8f8afdbd096dd3cc
SHA5127aeb500e415152a4a98ff83819928a73d664dbbd5ffa40be42983650cc9f77ca96f96b588a4107fdc13e9025319e1a0236971fcc8811f802f9578e32d348938b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2a8dec879af02ecc5277c1cbb7a5177
SHA14cd2f38dd2611804d0d263d4a644e2272656b9e0
SHA256a2501212ff9955fa603747ba268ad4d312543e745a2faeca28052361a6afd075
SHA51215d4a4676040eb68734e38dc3b4becaa81258f020c0f721f93a0302cdf9ceb195ac04167b49de48ee661f96290db50274ef85fc826d16559e4766bd2eb174c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583774cd245487f5b3ebc6d974308973c
SHA1979b44cdae171ff04aeec0284a94e4f1139b7527
SHA256c6b0f5a951986c69e17782e1fdcd977471f066ef9e4b1b32d70062eb8eb05634
SHA512432f9ec40e92895c9b5683b5a66d72914c2a19691b16935790c9154bd2ba856173880bfb43d0843a9a47b2b1f77a5a25a531d6fb3c94a62d4494243236c7dc1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d2b0453e7a08371a67bf5386b069f0
SHA10b3d0e136709bcf07db4b76bcaa69995fcfd5c41
SHA25673c45a3725063b76392c724c81de848662c3b39f7729cce3d3a9a32cb96bf7bf
SHA512104379ebc73db269f15b17ad94f1d6663e73c0e997fa0fda7bb847116fb9ed036b0f12a128f83458ea35fb39ede30609db4a2c6e3bb27b0181a788889faa192b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3517c66a61cd0d15e19ce041ef328de
SHA1bbe187fa18d70d2344f0c1da4e68367d5b6a59b2
SHA256a70941c1f346ed185523550a32a14815dd96fa578f44d957a443cca8f1a58a8c
SHA512ebdd9981da9d2d2fdc120c272a62264cb7302d633b555ee00a2a35503648734a7b300313bc0ffb1b0cd85ec19f4a29b6e94603c4bde30e6a15c3c61cb7e4469a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d61a5e2c8ce6b177316366c50a0e209f
SHA1a86b601024afd9c2aa0c5fd5f073647333f7541a
SHA256fe663cacc8639bc1075088eca79c8723545525f9ad62923bbb1247b24ab6969b
SHA5129e6f93aa680843e25ed961dd21a3ac7a6c297bc98915bb1e48bb9cb159d5f80da910b3040d8727c5604ada144e53651326cfa8d76522f51f98847e73c276d066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52133d3a673854fd42517a0c5cbdd37d8
SHA186a509b8e58f1d8ab00760c3a57913b0f4628ca8
SHA25688de30bcb6da969004be7c407f731c68e5d17d44c4afca428858aaea9234d392
SHA512f715f19c347f050e5e8de38351096c9341ab1b2e8089a62aa31b7144549ecf1443048f19e4307a3efc25ce1072d70a48728dc21b249901bff981712a640da871
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a