Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 22:27
Static task
static1
Behavioral task
behavioral1
Sample
21fe80b10cc7392a3fb70f98e82fc756_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21fe80b10cc7392a3fb70f98e82fc756_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
21fe80b10cc7392a3fb70f98e82fc756_JaffaCakes118.html
-
Size
44KB
-
MD5
21fe80b10cc7392a3fb70f98e82fc756
-
SHA1
69395132e15c01bc69fb4224840351bdd7b9ebe1
-
SHA256
a57a59a4d30090c61f3c4033b68612905ae0ed7b32a3050efa91682c81c0cd76
-
SHA512
c2d609b2e2bf9f0a8ca68673ad51018bad1c7ad3b4b2fdb42c24e910efc31ad99849d9422be7efa5ec93a7d064a92ee1658e0c493d85cf21f60d95c3146d6ef2
-
SSDEEP
768:X90qJqbTBxMTaz3NtOCsOWWM34I8q+21mn9zeXjw:XZqbTBxMTaz3NtO+v44I8q+21qzeXjw
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007dc58f20532f73b77c44d84fc4aa76232f68f07eac0af04ebd5941639c1767fb000000000e800000000200002000000061fab27e70e3fac0aded9ab3c13d64b257028701f412e218d6b5d75ddb2d2cb5900000007dea5f78db7c771f5993f0416e717c8a50446576749f2f5d27d70d306939f316c6c6fa3f0c6329b7111913f52d73dbd7377b2200ff3704408c85d580f48f9b296c86e0e2063af0be3b9edf1365871578b93937d59348a4b3e58f8627efb733e09f6c3c2c6d17808851ef3cbb6c162eaaed49cc1a430133d27e271ca2773614311e57708e4175fb186158c05d3c205b274000000084728c64f00809aaf587743171bc6463ff9589111d5dddc18cab13d40e7d90c60044bb48d73c4d96e330a6916755f88b18d43ce74026c43a66298a42591d6a97 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421282745" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b242e3cda0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d0b85c27e0a7282321c5af944e12746ac00144093d3375e7be3ac5b85aeeddaf000000000e8000000002000020000000e5a5281a49ba2a0da0896f764f758bef531c2745ed8ab7e1a7b91ae352bb6da020000000af4ac0df34e5afca7e83abb4f548e1a78f3601baac75d9ec14f87398f061387d400000000fd5df27bc29e219f04bd6f18b08f08267ec31fc0e80c5dd3cde01ac19a5f50f0e7fdd33b2669f5038ccc8f5b180cc4707c35c4b7caa5677a75d74105803cc3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E7D7861-0CC1-11EF-BD10-4A4F109F65B0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2664 1948 iexplore.exe 28 PID 1948 wrote to memory of 2664 1948 iexplore.exe 28 PID 1948 wrote to memory of 2664 1948 iexplore.exe 28 PID 1948 wrote to memory of 2664 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21fe80b10cc7392a3fb70f98e82fc756_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a238e393de03936b9c959f981514c52
SHA1e3a92c3bfff45eda82d361c891d6f58ba69d87ce
SHA2562d2f121f41833a1afb8b2a49df36e4f450b35eb5e83add7e59222474fca3138b
SHA51207f09d75d58f45aac0fda954a829cf427dbcecdcc39d2fab1dcb93a74213edfb9d1de6d4b02e2cfa015f9156469692b505f200a2cf813954c1c346050148b506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd73df2158658e232d253db56404a1c4
SHA1fb1c2eec01e2539373c8da2608536f0810424c31
SHA2560c5cbacf71a15b4f70d3af20e082375b9792eb2ba83766557995712606151a4e
SHA512ef053f5035048703b12ff52a017c4cdc17d3ed479ced74c7777800af3d91d69ede5f0e848b159ee0a8f73336421305e47bd52db3a64f5b5f22c6c10964223bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f95a6a74d88f6f3587452464fe6cae1
SHA17dae8bff60dc6e93c5b8e4006662d5eb075c62bf
SHA256d02f522b3e0f69cf07e90acf498a1170786954b827afd5bd6320f0931631d74a
SHA512dd258df9c3b7c11939839b91fc13ffe1f6f792858f173288392d92d635eda0c089386e2c94c567a0b6c566cc844d7d8d438c95128ab07ce411ea4caf65f135be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59546c1c22ad407293024298b735bc428
SHA1fdf2d3b997d9da71d1c22c54972a569f2dd4aea9
SHA256ccae4432b0253ff50ec00e1139eb7eb0cf7a7ad53bf641976d41f61fcd1bb6c7
SHA512249faf4d0790efa5694788e4ac201bb016d2adf90b452c0556e4d32b7d7b0f0af50b19f0ed1258dfb8e5cf2915f4deff18823165a52ed5ef8000a6964bc1c51d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59497c21c3925f1a909c0d1fd060a2321
SHA14ce124b703464da6d0aa3175c1889b7c5b2b5158
SHA256dd0586967e24cd349d066af929e0bb105386605e9e4e1abf536445556f141435
SHA5124dd7edd8fdcd53821ec9a02bed4783073046035d474dd5c9a65cc2e1a34636d4a8f07b09fe15f2a59b28a60935b37a09886c8a1394cb5b8685f37838c450f54e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5563013b9f310ab1ac1ab0c8ef0efb741
SHA18821af69cde4a0ce69b98d35ad8e9714317689b5
SHA2560e60368e50fdaf2805210932ea8fac927d1748b19069bbada0161626c5357ed6
SHA5124dec56814c322d22aea321aa296253cb4fd4190ed582f998cfdee511678f3f680f2ad74b97bc9417a75e2add782b7199ddfda1a9c32ccf872d25e60a36da38c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7acca163731ca926a3aea251e148d47
SHA104f287ebdf2ec39604712508ad2affbf9e3b1405
SHA2568f09078b55249a9040efc3ce88428d5dc02904db91a1648a04929ad73cdff2fe
SHA51258af5d59673044d95f8c719c61a42c18c13afe6f94c23324268edf2977ada1ae1d6956fc5ea8d2ff14be5c5750e65da71cc83f2e7954a53f8ad25d5023d4d3e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a5681cde5ea4d60f127a22834082917
SHA1b75500ff8f7e12e8af810f0fb5e6311b347d4500
SHA256001858434ca39e373c48689c783c72701888799f93b1df20e6651ada293941c8
SHA512577cb2fd277ab9c707b9574ed5c68bde811f111b46bfdcaa7462189e5e96bfab8a60e0839cd04d23ffa47f79388a9cc7444e7fac58e0c9c2a92de8d251a10cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508351e4271cc0f36d3606ab911c0d736
SHA129cbf2dd8225d7b74aeb4d2392b359bde3b786bc
SHA2566f40a6f0130cbebd77ea043231726fb4b64d8f404871375991e8db3ed53d1f4a
SHA512c94c6bf282f85a1f2fd0f2ed12eb8d07b331aed47e93f847d5b2b38dfbe77eca44f9066b2b3820a887f691ef660ec3559729750d67bf8c967682853cdfa51e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5378a80f5ac64b7fe9dfdb8d44e801769
SHA11ab7b3312cc26db5bb51710c3d9950d719987d40
SHA256335c2ddbf2076372c5372b34b26baaa94f8f66b7437c9bf96fbe7c690512c9d8
SHA512737484fdffec78ef8c33d87977ac9db6142072db35147a32ba32a6cdc90553a0abe069bf2fa5c6fa66e5ca1e2daeb73a6cbbdd854b183b22075427a929f823d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500d0b89efc9c94dd625565b722532780
SHA1bbfbd91d26c0f73646967469e2ae9523514a7d0d
SHA2565f1a897042576b5e7c893b6039519f258cee6e95f06d8ec4efa672cff0f07f67
SHA512cd3fd5cb9c9bc9dcc2667356c4f83d69be4069d48eccb718048f8ee85323bcae30a2dffd6fc5f33818cc9b69e08242b7523fcf10c235ac88ef90b748663a9454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe4b201f9781ac206725d953ce37cd67
SHA1c8df4745c6100733920e1da48b1da30e20b09747
SHA2565c513592e2a26617fc50606ef0e6a1b37f7e2dbf3958bba2dbabe36687e3d0e7
SHA512a4e8e6d0592012bd54c37c222f580b7d4aecac81f0486f769a820e472202360b8af84dfcc678577c6ac62aec7ea58af7e287aec32bfb4a9b8969b7e35facd325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feb4b0814f93e8ac42458dbe33da021d
SHA1dae07553e1ca8030db71cd06ebb54a3e6814653d
SHA2565848cd647460196603d151e8521efc11f5ab696f25f5bb0c8b5b7206cf55ce09
SHA512db50098130b24e796f719533d18bd5d52fc0339d35ab93d9ace032a297441dc112c95d455d90c7dd5271903520ca031e16b745576f2e43ede193f560d88ac7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5263d143a03731c23446e6ff3874ddd86
SHA15d66239e3dafed80f7a2ebabac5e9f7eef5323a4
SHA256273ed62e12813781b4d4b67487ba43349eab8af1713e0db4b34e3bd4d2c55815
SHA512a908eb80b81d8a15e73b823f3971defeec00735b4e6c2944a0b037ff01708d3fedb89f2848c4a8f80c9c228018832161dcd4ff15330be90c6f8a9c4d84e6f52e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af5a488e0a970df21cf271a8cd68fa90
SHA12b6b93daf455f42d76acc41273d72a0e4b3d3fb5
SHA2568cbd1b8e5153375c265d80c89b8a751a0aec3dcde76be6cc2cf27fe9cad7409f
SHA512e23dd0e5b5263eb6d4c949d819000b84d44e8b5d6caab6d1d7e319d39beafc86b49fc9a1fe79db3a5f9ce67d256aa0f055401a1f7fb40b3a8d784ac92f6f3914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e2f282f34c3010875c23df107236c00
SHA122520b279cd5a5eacc437d8a0c7a4813f8d9a3eb
SHA2560c679fd0aa9cfc42edcd14c0c081b37095a75ff9359e502b47cabd55bc45b659
SHA5125180930db7c4e0c7fbf563fad80659ee8ecd631676e79b8d3e23565559157d394ef8c49ade43d0d1f54f59fd8fd3f78e6406b1ec793add9c240054b3b9df837d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6fb54775ccc169a1235bd1e50b9d9b4
SHA1bceaafd3cacd4ef1e324314475c6c3a5040a2a5c
SHA256849c97fc8ef04b39e21750d001376910501e56e40b56adac091b3ec262c52886
SHA512a364bba15eec7a672d3a6bbbb5c20ed84b4e1c00a59335ed8b8acfa5863a186128cf7fa95e218ae3065cd559537cc050b8f77e8b6ae6a6260db1fa3f3040c5c0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a