Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 00:09
Static task
static1
Behavioral task
behavioral1
Sample
1eca8e23fd34f29968634379a7a84538_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1eca8e23fd34f29968634379a7a84538_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1eca8e23fd34f29968634379a7a84538_JaffaCakes118.html
-
Size
138KB
-
MD5
1eca8e23fd34f29968634379a7a84538
-
SHA1
9c201be0a33e27f00be391c56bdd919f80b710fe
-
SHA256
4e8a574a2997822766b9c66a59f545ef4bc3be21a9c5b66a815db719a8a65ec4
-
SHA512
e97be1a48597597e7a10c958485d20353dd5610982e569490483834621b4e894bde10298c16e1c6d62f7cafa7a3b929974b6f925805fca97312df5fafda2ec8b
-
SSDEEP
1536:SQDcuX6lqxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SQ3XTxyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a6895882e650c69a26d10ff5b8b86f1e33dc1e82f52fef87e9caae4ceb404b4c000000000e8000000002000020000000655ac8656dd475bf0effb91a7f780a7c47a0ca038d33e670b5fa03dbff9e219120000000d36afea102e3c26f4207f61aa2892b1e25450ce45feedeb4a36bf34218e5aa7d40000000825b269ac1a65593e4eb5eaafa40a56357355887d65ea573b0991010989f3c12cdbedf2200b77baaa5b58d5544bbe0e21a9ca129c93bdad4c56048133e85c8ee iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A8126A1-0C06-11EF-B2DC-EA263619F6CB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d020626167be0ce3a61169351d22587422b2d1998cba01c59429311621126ccf000000000e8000000002000020000000265805eeeb42b3e88d586b4d475325788e7a913534057bd84ba9276f1cf42204900000007e5779a3853d8b7a5a59d0a5d9b5484731a22348d0616fc7fe3f9024a9b77036b31aec150669ba976e3fee291dc618e34b212f61799ac564a09906f8c2f73f71abbc90ed8930d4ed15ee9a6e9479fa4ec5fb7d4e044f65bc670479b252d04278f84ddd974c9d62e29f53d1a5ea33648317f4614f9cec9b2c1b299536392c0064077c43cc45eecb268ef0986e6f9236f34000000005a7a9c066f08aece80f5b96e0ebbf2c8f373199fb3837a13cb201c7a18b878773db44e60e9b8638aba6ac96ff689cc5e4307c52b0210821c9e6050fa7f3ea87 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c03f2113a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421202425" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28 PID 2904 wrote to memory of 1960 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1eca8e23fd34f29968634379a7a84538_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f03d265f40491776bc5477d510bc115e
SHA1bec552dd876669999060248293b86b04d986ef0a
SHA2561c521b82d532bc5ed4c913d0562737744958ddd9c146197641f8758bf0c5548d
SHA512636718ea0be5990ab284647a0f68016c4ba24368884dc71f6e0cb89ce4fbabf2306ba69882c77c96c5ec6800d33fc6511f5f7ca4e8ec72c905787a76b153f4af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5fd51803c77842411c3736ee29b14a0
SHA1fee0d1bc75acb67bf7df399956d372a18bf5697a
SHA25614aefa6e768551327d43c71d4ca55163a5ed31745bf4b881f6567b897715d43b
SHA5123b3516af1857551c5e507f813ab309e109df43ed82c2a10ea74f887fcdd0a8f593abc43589f665752b563f668ecd8cc1e32ac298e2ee70de4900a72ee4efda5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc797c6103272dc93542ed8285252d80
SHA1d093ee393b7ab937caf4a6b2b2ed314744451104
SHA256e5e61a98d4499b0db42a06bf5958282754b72515fd97a97717f5961fe7c43f39
SHA5129059425b55568f46c759c9ab2390966eaf0cc32baea4bf2e927b10d726b7a78995e7cdf2e960e4f0a659cc821cb276c0df2f76faa54cc010fa5c86ffc90e2a65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560518609b90e5f9b7408f4fe2f92fd79
SHA1b5d62b3c6513c072cd7543e8ebc5ebfbeee4cfde
SHA2567ff23040d95df314aa435d8bdc504edae6365588f74f8aba60f4dc8433b73d31
SHA512109f62857e8c57bf08ee5a385714072087aa01b716241743d4f75896a2d36975a47184d77867a050b2efad659cbb2c9215f96fb04a1d9b8da0a54a856575371e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbb229d2087d5630ace8fe0effc7707c
SHA11713893d030fe4ba99e813dbee2dfe318f2fb7f0
SHA256e042dd5af4ed9e90660d00d89bc495e27a2f4afe8d86e1d2dc3755179c446bf1
SHA5129fbfea3294f8a57ad7bc6cbe109b45ab3d3e8e68f6ca19111ab1e62e79c0e4d121cadfc796b868447a66bd2e7b78eba9aad9810e458cf06ae0d7794c62df2b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53dc7d133d950ad729f4bfeb0e481f257
SHA11a4254c149aecf24137c3ede9a9dd0077c28ab57
SHA256e03938b656ef3178913578696e5aa5e8ae42144e854715007e09c6e150937058
SHA5122936142e4f7cade91e15e594c02ec4c0ffe2b4e8d1fd0f26202b52e8a310c3f6bf862962ca7350e394e946b568662fb4fae61cf13350b433ed3f2be4da4bf176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f318af5be5cbe352998442b953effc34
SHA1ce1453ddf52de40a4232149230a2319bafd80b73
SHA2564f17090c0168b9ac670721c4a4986807043cb689c72ed5f33b48be25f895fa67
SHA51240e61c1eaa71223a5a933db9bae2111749089a7e8d719eaa8d4a48908c52307a0a488f52a3d44cc4dab3cd9eead97bcdc4fbe482828e6666cd12344ef7b3f808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ec83baf5cf4039094d0b10af075d43a
SHA193268f6d856737aed310a3ccec211d29cc4bf6bf
SHA256538135b527772d35f833394f85a13cc248233db70ba5ea49f7b728662a94550c
SHA5129f5adc28d0fe0fa8bc7fd4892fb4fe647e776fa5df35bed8f6fa8b72d5ee75c31e2472968468bd3d66ddc829b63b6214fe7a32872d184ac671e1ba14059597d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b9ef539917015c2b46734019696695f
SHA1cc8f749b651684f6dadd0e333bc62ae4d57bf7a9
SHA2563830c9c4fd69a9ce232caefef275f9b7a8f982ef1426a2e824b6b383dacf3bfe
SHA512a4fc8fc1b0798d50e72de65220717172d4f0f0be49cd269c62ee6cbbf19276862e24f7943288d3d6600d4ebcce7cc38c7a14c7188c128c9822b1f12e0659b7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9ce6083aeac218e15149bb4a5215f32
SHA18c58012210f021e0ece218d526b652f412749478
SHA25604c3f91794897dca762d8dc9b73e31f8805741c566bb39bce7a570bf7e9c8f60
SHA512caa6fe324fba04348ccbb949b174cdad6caf81ec36c6299e69150092491653e85bea3b609972fc4168b9b90523155b19aab74e3e389674b46b29df663278bf98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58141045e8da5c2d7cf28637de420fe6b
SHA1b83151e550b73234564e117af885ca8fb6c31003
SHA256ae8aab61ee47bb211650f05c8add67303095a89fdc7a72a6487c0c9be9c2d14b
SHA5124f71d5e38207f6b6df1a9960e1db5ecc435b25f40b9da6608c31ea77a9d981fa7df16c4d11b0116f04d4e0f9a165e56df9d49780676aa498341956cf7e8c5462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d953548f7f2b6c562c10b7e4d1f7e7e
SHA139edbf568655f0a8ad275fdc3a8b4a69c7d2081f
SHA256f4c242cbf608b14c2ec0bd07f77aeba3ead6591f2e32fcad558329bd4d2ea57e
SHA5124a82a62e85de05015cdf1c52312dd40e73b0a118d6216215b55bd97993ea74a6a64f836ee2792bda435fef990b8e83b5ad5ffc4850149a3a58c2d7edebaf4f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e855a109b2c8eeb7881617611dd3576
SHA119d4f8de06ba5555575a5751bcdc3a800cd27876
SHA256b146483174b54995b43e4aee996e98e433897d7a634ba3607520efb5d94f359a
SHA512d49bbe66afa2b7e64774a686afa61955554edc4088ca71ccf0105d3cd956b616e14442eeab3092c6b2796719458b2acf262233383ebbf65af636e60d769f7adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e9634b630f9cb7d39faabbc2e35e3df
SHA190a51d7626386567c47952d8fe68c0eb79572c92
SHA256c26754f63bb27b9e79ed3ec1f036b611c52d29e763fb279648841338882dc4a2
SHA51232af7b533cef76c7072488caf5bf9bd8ebb31feac56b6f631722a2f6f11fdc226c78c359963bcbe01edba0aeb6da54830c80d967da174cb3a33cfc90df26911e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ccab12c74e753c2e8de8f17c0eec7ae
SHA1e69f0bf57579cd9349afed84737d02ac38227fb7
SHA256f12ae13673c406aa4e3a8b23af79abf3246f87b0b62acdb395977f3340800b11
SHA5122ae68103578aca57586f3930c69a85369889e7136d5760f988c0b656f4790b83b7abeadcbe1e866eda914368b706ca8673a5dbc2adad66ef6e4c01e7d9d7a60a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a6cf301883db350ddc38f4ff6bd7f36
SHA156294d29637f9118a466117bcb3d92c61e83fc05
SHA25693f860fadb913d27837acb61ba0f8534346de85e233b1551cd30efcf36008282
SHA512cd7443649f24de5f8ff1375c0662090ba6ae02c018b38a95ce319d1a53becb39bdd37d1ce46ee651b25953cbc84df068de24b2cb2052506cad8a6fd667621a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab0d1c683fa65a791a18a0ece0eaa02c
SHA1e6e68613f841a6f9a729cbd048a9ba7097d7dae8
SHA256e797375f64edbd93ad15490911fc6850078c01606c356760b801b6bf812f93eb
SHA512ccda5aa6b179d7896172d066916865d5db3c9119b8049d4ca4174838270a5b1ef1d348da4adfd7b4813e1925ea5ac0df83054001f705f5f8230cf3b9083fa3ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a