Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 23:05
Static task
static1
Behavioral task
behavioral1
Sample
221f299b02155bc940e0f34ffc59ad93_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
221f299b02155bc940e0f34ffc59ad93_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
221f299b02155bc940e0f34ffc59ad93_JaffaCakes118.html
-
Size
27KB
-
MD5
221f299b02155bc940e0f34ffc59ad93
-
SHA1
1b9d61da25558f10c92305ab5133ce6e494f1b98
-
SHA256
81dfb1107eb52f0e9d5029792f06882c39e767c4987b0751900a5a0c56c03b4a
-
SHA512
0f8f66021644504f40c08526bd316274ba702d599a4781cca47e09e413bf678021e142e535924e1953413ea92b6ea4da0008bd8b7379482bb750d9273923ce3b
-
SSDEEP
192:uwrcb5nBqnQjxn5Q/QnQierNnKnQOkEntQ6nQTbndnQ9erXm6uvVXQl7MBLqnYnp:AQ/omJWVGSxN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B2CFE61-0CC6-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000061f3286478209a4b2108d327e5a984015e4268b28cdfb642b279e32213677e87000000000e8000000002000020000000fd99628b6214d25f12899962fa8973a1a59b9c4ee8c4cf6dd087372830bd689c900000004d3f772ecfb9b70c1cc850c6db71f27ed0b2dd428cff97661cff7ae26215f089bd8b3f988a38650c021b7878757673189edae2726db9856d372568dc20d430ccc6ebdec78fd696e7da65bcfd9ced97dc3adcd291d243e2c6ef73c051dee6a9f37d5d6561da5b192a7981b61e8bcf2a1e66efb74a7c845d3ab840ac5bb33b47353131fafa4e5b5c326ce6a52d1b42b7e040000000de4487c60888bb8784a05e9feddff89a7d484677f06ca26298ef5ed55bd9963f89b0fdda761eee9d462f642a174992702a65d95e235bf92a21d9a23fad4c4e76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002bdf2b95e89e3dd3701ea253a019e522b7d952176253c711dd820c40f1b5caa3000000000e8000000002000020000000f796ab26191530be9a67a60ffcb1746fe7d388634e573615ac31d8971c3333f420000000ebacbd933096ef8a9b38d6d0e3b7b84d51b6e5c63a2262926d785c8b01df52f540000000e61a0e1d15dc93b53359e74980eec64ac8b1032e7107e51f3089ef08e17a3e5ad372bd2ca40b3226f19d690af8e5fe98a51777def549156b2c71f8e31c55e5ca iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0efcd2fd3a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421285022" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2936 2264 iexplore.exe 28 PID 2264 wrote to memory of 2936 2264 iexplore.exe 28 PID 2264 wrote to memory of 2936 2264 iexplore.exe 28 PID 2264 wrote to memory of 2936 2264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\221f299b02155bc940e0f34ffc59ad93_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fb584368518b114fb33d7a44b9c59e8
SHA1dd21fa70fb84256202c09d061c45ad0453138f0f
SHA256a9be9a6a3a346d3e6795c16599a2864e2362426f74a2062cd2938458e5206a12
SHA512ffe454d9703cb872160e1f08be634d34f3efc0915e534cafbd480bcf97b02b9c9a1c99ebcf4d9de0df96c7a149e96f7a5a4a3e6c2bf92fe8aa6506bf5d76bda9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56135086ca93b9f5176a61589c5deadd6
SHA1fa7165ee4e5d93d25291d72e260d1eeb347ff01a
SHA2568a810f0b7f3193268b2e4482c8b841918400c7723d65a06788a7a466c009809f
SHA5128aae6d4037ce123056c2543d7c29e528f07b376b30a14d34e17f893af5330495b6cc9eeb968874c29aca7297ac4f53d32a21b9cf82055a490cafe2818b459668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af2983f89c9bb4249ff0e80c68505c84
SHA170cce84ed9e0a53a1ddcdf92fe5d72ac079a0bae
SHA2568d3d57365475506476f0f655585615c56e82d27d1585308004932995d1fd623c
SHA512247c3aa1701323f67be073731743164f723d7c0cefa69ffeb5a7bb505abc1e96188021c19c8d0a92d8cbedd9d052a00193fe4db74a27f0209bb4745a0633d67e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eddef8e8354a80323dd33699597b1526
SHA145c09d2a667df8911d1adb64082ee99a5083eefe
SHA256f6d0ecbad0aa0c90a53b5c009ff3195abc5ae6b218971236f8c916300eed4ae5
SHA5125dfe7a9e81ce3f3c0b4a6deabc9e94101c3affc2654e8496438baf5a967f2975a7ed779b9647b89b542b4e40de38336cba5c19e807eb9c3edcf0d570251b9b15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521309268c9ae8fe68faeb6fdc6546e01
SHA1216275131e91763f5eae57a3701dc2e9963452b5
SHA256646c2d39ff81e7fa6a835476ef09f2107a7ad1b673dec273790d4b4a89d0e543
SHA51200608453ef1cadd3c3d2696d0346174170e471fd7b6bf1f911d99d7724c160246b39bc4122857dc3396f784706833317abcd91eb7ed858952e38d56409806e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edd66ca8b8abc739a959973da499aa15
SHA1060173dfc523786838377842e9a8219da2e874e6
SHA2568bb23bc4bb84636948432dc1941f88fde690635acfa7d4b4238acc344aceffe9
SHA5127bb9ac38dda76011a53ee21b76b37cc4caa1830491f00cee60e0614b5bbcf8500c09be12f1b35c370daafbd3dc0486edf251bf7136c27c3b3df05b3ed835b6c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55752b02c61eac5193ba7768ba692d142
SHA10afcf5cb9458693e81fd12278e92cd08ea9a019b
SHA256996c1e5da2c85394d7906340098907cdcebe60b963c82e36aaa35e2b03266e38
SHA512a2416b8379fe57266a52d53c3928f9d94ae88350d4583c31a56fc9093b028a86cc8113e04f7f836dd307bc13cb9c1a9ac43b67f30294e56509f276078fc730ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965d3f97ede0db4425ba9bdc39a65643
SHA1b68357ca6e16cc03d3f3873b16f3deb4727c3f3f
SHA256e976241d31ca6fd3bb5f4aa34637905e29a5c2dd48dbd1daa69ba09fc3e1324e
SHA5126b7f5632ec0c2996f5db55c66008b00945af9a61340cb8c745d91fc7483463d66ebc28b88c28ee1be48d01e7d7821e240af2cef6069a46df41a8e87416bf2e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54381921048d9ffe264debf7a526bb836
SHA122528526344a96e53ad68fd4362297c5bbb74d17
SHA2561b9932f3fe51073f37743fcbafc7b8d638008fea704ab3d969fc719e318c43d0
SHA512797775bb323543b1e26fb65d77f879229f1988c75a9704ad03e18666ebcfc36da5f2854eb8b83768ceb3eed15cdc032ba537da214da8fea984adf59d7dfc9dd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5116052b118d2f2220890569458f30b86
SHA168d681487620851309c2e3903deab14b0392ca9b
SHA2565ce59738e2dc6c4557cd62b67d104848cc43f9f09b100856746aee0e689ceb0b
SHA512d41441c1a09925c73432cdc4c93030284746db170fe17c883e077835e1d7b91bb74c4519c9bb1e54075a6c00ea218e7dd9109b358267a91c888987e6f03ff53d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccdedf76590f190468984504bde12d63
SHA1f64eaf3726dc0259e314af2343af2c4dab0a0f32
SHA256a8a400cd253281f57a58e92efb0dcf03baddc837b61b0ed5ce24ca13fc63ca1f
SHA512bf6808824fb9c4a85428ca3e525f15cffdf245eee49aecbbc3414f3ad809688c21c9484159946b285175ea0742efc21eee0e6a7094e7acc6fbe8ac1727fa5d66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5075caa4c8c52dec8d9b6bb7e7adf2f
SHA158076bc0cca892f7da24598354c48be6c6c8e995
SHA2569c26ea1180a859a2f48af3c04fcc0c09584b0ed5c3a0fc7bb00db6e67704a9f4
SHA512175122d788bdfbb9e8654426437daf0aaeafc2954890fa9b3fe31a9bc7003b14d8f8107f55a1fef03ba0ed0c6afb37166d311d5939f82c0f17fd7cc4e7dddf8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58deefe41ffb870ac25fdc51790252a0a
SHA1ce5793cc85ee87178d660a00366b3df393ec0f1d
SHA256758a6b2bdcd10117596c94134344dd1df3b78a0c19dfee9fab49e4802a560257
SHA512d9d0b7722ec216eb131776755f65240f7c81d03099adc89bf43435e680730ae4b4a6b25133a13eeec0835251efcb43954a9559b5bf00ec495eb009e1039a0d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54da9e65635fa55ee53a609f81e5a2ab9
SHA180d908af5b7f3665508db9210151b946e0d002cd
SHA256bcae2b2e9573a842ef9cb837fce55f1a7cf61ab427462e2d0cfe9ddd7f4c47b2
SHA51287f454e641f9d42666b54a7ad2d50d19e22bf0ceec1efd8cd6f3eb12c174b8066120d8cdddb91c329236ac6596376af8023a828b6272cc1f78af57d535efb2d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de491d065d303cb3c26e8fb159379a23
SHA127d30210d7cf9918e0b7df41d87624ef4c21d7ba
SHA2564fe29a50b6d7759664a997605380167f3a4c0cca01a36d9bd340e7614f9a71cc
SHA51268caad66c75bece639d5543acaa5b6e76c603b7d3bf9a4142c55acba4d21fb339b9417daa383d9051b316b5d6385f2746213178a59d94ea88c07179952b6bbe8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a