Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
1f454e9af4855d761ccf35c1305e9ac1_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1f454e9af4855d761ccf35c1305e9ac1_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1f454e9af4855d761ccf35c1305e9ac1_JaffaCakes118.html
-
Size
35KB
-
MD5
1f454e9af4855d761ccf35c1305e9ac1
-
SHA1
23647114dd1014f43832f536b546ebbb46568f44
-
SHA256
2f7864ff25e3cdc0629bda8f0b4cccec182f5c9d1ec43442209c829748a1bbdf
-
SHA512
923feb73f953bdb8e111fb746b9e22293df515994a86f31b92dbf61c1f21506993b8ecc0816833d315277f0c7901b635713a784f646f549d14436eefd4b8aafc
-
SSDEEP
768:aJPM5UqlQgiJEa8yQIzu3dRValOom3QRmW:OPM5Uql46yQIzu3dRValOom3QRmW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000cfea4444462fba38e1965bd537e2cd2cc419991ca758b4abac8cf061b344ef9f000000000e8000000002000020000000c1275d6bf62693fc9b88bc031e36934d1e556495db1caf12bf469c93fcc5342c2000000029c71a63180be2571863aecc5a8795908def760744303f3844598852cdbfa18b400000008d4e9537db3b0013768a418d40dff14184d46c77b76412e25350d007f23911910cca61ad8e2791b362bd1997171d733cec971455b1d25d02d22faf7b0ebd9e9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000057e33a26690206d780a246b32e23406cfcd083bd3d791a93ee0ab9515eb682b4000000000e80000000020000200000005a6262f61fb0922a00b0fa1f73d4291e9168ffde35efd279028216073798fcd990000000793e8d0376851118616bd2c5ae82ab481c9c4cbf1d9ba9ccd47b6cfc444f3d87cf7d276b87429e1b525f7e0e49d3cdb1635f13e061beb7ef4585a971bacb828373b12983366bd9d0f2fb289e1dbeb7ca2e92eb19e39f014e0259e95b567e4a187b4f64ef6371db7f4a1df270bb33e32a84a5780dd12ff326a05819941704fb329ab6f8b4b23a6f6bdf785805b76d2d6540000000be4c7ac1d9a5766bba557c08292f8c10a0acc31e35559797321f6e05185638281526e93390d2dfe41c4257051ccf6d9fc0b5b84896f45043856673697107ff1b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30434c282da0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53A093B1-0C20-11EF-85C1-E69D59618A5A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421213712" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2400 2888 iexplore.exe 28 PID 2888 wrote to memory of 2400 2888 iexplore.exe 28 PID 2888 wrote to memory of 2400 2888 iexplore.exe 28 PID 2888 wrote to memory of 2400 2888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f454e9af4855d761ccf35c1305e9ac1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50374165b4eb04048c052e951b7a2effc
SHA1afa7f8c0eaf464723e7af850e093ab05dd78e2d3
SHA2560658825386cb7f44d8b888a163323d2eabc66d4412a9eb56a7221b6494fac4b1
SHA5128c9bdee6aaa2a01f7da6331a252521a40c929162379fb9b29a4382ae83e08e093bd0ad526c8f7a2f4cccd1ebe341007cd98f7a0fc906a10868ca97fe120a16c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52253c551bd01cca4eeb36b3aa05de7f3
SHA1211feeed1fc2dbf52d5c09b1fc6204a78a13645e
SHA256162cff95c965575da0e4e921a6bbf0614fc18e571e5b27efb3fc5cb8007aaf3d
SHA5128ebabb1a07698cf36406ac4951dc63a5942fde399184f3d15876be8517c2649f9eb2597393534d07012ad6364d5b2f566c444d3772326163f4a71671c48b0317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564510a42d602e33e768162943b14eedd
SHA17dd56356f478e4595694ec2326b34e39d41eaa38
SHA256ec306b815af733e52fc7e99994113b702d55d10d7dc76d30883525006bd23bc0
SHA5128c74b8983ac0ce3accf68db8d4b17ba8050ed9d06d5af316939152d751724c3224c3f9f8aabe5b6c060815281ed8e4f225f9b560c443fb71bf53c9b408525434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549dbfcc8280251ba51d17dd6fdcb923b
SHA16217a83fba2da14029c8269af16f07ce9ee4a237
SHA256299c32cad63e7929f5d56bd1eb0179759619036894c25a076ec29a427046e4d1
SHA5121b44ce4878b638290aaeec3a8e3fc2e2e0b6739bb7b8a34dd7feff5250e92370209e6a5b9dc9b7117ddc1d7b2e1b5687cc7de8c4c5d162aee742c697222fd7b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566bec7e41ebda8d1ee0d01ada95c6c86
SHA16ce257ccabbca3b8319221811c76cce08dec7519
SHA256f3e8492a39156c08fc464facbfe2cabbff081e0ff0ba84411579c959935a75ef
SHA5125cd9a43b78c41a8850aaa2bbc61665c1ca902ee4745ba985c08fb43a12895f09de3503f9d8775b0d3718238679f1934d0d971bb38bd888b567f4e5164c804746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68c0c2ef70e7a1f3f93ad059c7beef3
SHA18883982575d6b75e8b3c7278e7172d995b3893e9
SHA256f66e2e61b99871d22d57a1a93cc859513b406deede206a513340d82b71d4d3db
SHA51208ba8f1740860e63655b66f26691a826e96f1cc4db24634cb600ea10a92c83f341c7c119ad6a0a941ea54108948f4824f816b47585b01a0c946292c9a3dc2a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965f4548c9c8b1e4a931ef5cb786d805
SHA13e9cdaf61f3febb745b6757fc2229b24701b6878
SHA256010e77635af55ee8edda1e9e2a92d978ab4a9e2fd8de91860b9a79d33d5ef5c6
SHA5126f9f4ea589fd155949aa8017e2803c6331a6f13b69f7641954b25b1048a8e800688f58c801b8f704e55e562d18caca63c012a62da880f2ed92234c2c77370d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a23913950a4da0484b3290ea42dd9cd1
SHA1c8abeec041e546000c360aebd7bc47fee7f4da01
SHA256dad1234f92b7051e5598724f1c61042904e0d0b9e552516624a5da9e74f918fd
SHA5129121328c108dcb2d66396c7f5195f98b54dcee33d6ca4a74b865125959c0ec50aff9ff5e64631e5d2c6748846bb0b85486971836a0ed6cebe21f3cf8feb0666d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b25cd4fa24e04960769c1146fdf4b46
SHA1fde998e3769255ecb1272c14328fd0b8e071b90e
SHA2563f0375c4d446ddeb90278f61ba9b476e9f612bdbaf5f437099e302aa7d85c81b
SHA5124a398cdf54855dc41279513c892fe913b0f0000dcd76916e341b964c986b48bdcc61e66c08f622ae18477dad186a3714a5b8eebb64f7e2e2b6a74d94c00f2486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5802490c848b06cbdd3755553663dcf7f
SHA1a0d51b4ef05138d270d714f03a3c76fef1f518be
SHA25626264fb10250a19b8bf5c7488e1b99bbf511004f2f82ca3ee33e6e77e3945079
SHA5129729164e5cf38c61971c2b2cd0702511a16f8273fc094aca67a77c8159adc7df041efa7133b70ebf26d8d6f87ede830c258428b726c97613ac2aa9cae4186533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540bff2a553aa0e911f95badd3d125882
SHA189c86dddc23ed69982c754eb2987614ded8c3b65
SHA256ec411324aa7b7307abb0801d0abebf6034d44b1e3e2f3609d82208c3a9b904b8
SHA512e5e9bb5fcb5c8776b7e123f82a50b9bd4e1cc8b00fc93b9fb741f57fadb9620f2b771d002207cd7f85fbfd4c26f0de9b1d68d3080bd56ce141cde7e704acc521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca07f6b9b4a6bf5209f31a1fcc7d923e
SHA10da365107c7af58c8e930df5ac86641249409f05
SHA25674155fd5421a170e4622648698c0caab8865076faac8e70f4d59a101d9b27930
SHA5129b0b4e1dd89414373b173d986a19c7ecba638334adc14524169b7f9253cba2dc1b0b7b05ab236f6b3a14ed480b1b91a074f2e7abed84338c488c3cf4eb27093c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525de8a355e87224b7fbdb8decfec7dd6
SHA12b52b8f840f14b59994de562ac7a87bf5a54f0c8
SHA25669f5f479178754403a5430376dcce3a46263b7143a897d78899ac8a571a8eec7
SHA5124a876ef5674edd4336d02744cd7a97c0a75f28ae05d55ddb1cf83db870b76587a12dec22e2d67f538e89363da2b63695552f96216bd9a62440ea75c33341859f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5887a4f6e967aef362c7613c9db82feed
SHA1958b2f1a113dd6a6205aac559d010936b44b6623
SHA256be337b2d0a06c4eb16b2189c462c00d908ebb78206fcc4b035b0e0cdeb934ec8
SHA5121604ffb4f882a8819e2f7adfa7dee33e49631bcbe2e1de3e29429d95d2f8e0424169df9c17909cf110369a7db28f190eebbb200bd6e5c7230b3d273b56982e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc545d40ccc5c84067d1ca6ca3e5f4b8
SHA12ad85940a9ebe1c535343f2e9bf66640de0d6f94
SHA2567065b872fb706d9462b0072b5b8bb6e67ae474f4a4284e77288ccbd502799142
SHA51291af32cf43bd4e50c7ea37d2690efc8977e938eee579c94a6e5921f3455b477c895398b5949751123f56bcc40ca7c2468fb0a3c8929471cef57832d44a82bad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a91c7a1aa1bc93ac7a50391ca34a2c4
SHA1c0f69fe48d8220c73f50fbfaa4a53ecac3815d57
SHA256bf14e8468f2aed68dfa2ead0fa97c8f99a3af4ffabc93b3eac55dbd2ff7ccaf3
SHA512db4488fb372a18317ab162a3f42cb7a7093cb7b92e12d83d57839983eb15fd8bc0da7f8f19d15abea92cb6ab878bc49ec583247ff8fdcfa68d67148d853ef697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531c8cbfb9239d55cd3fc648193c40a63
SHA17470ee64701668f04481a5dd07332b251759d735
SHA256b5d6222ad376891e04928936de53a166d88a17deb8189aec10077f4059a99ad5
SHA512f3406c82ac3cfc5729ae6173ae798ce678ccf96904cf1340c0d4ff7adb54e6af0413cb33ebecd3b1c486082910198c67a2a45a4838bba88ee568a224fa1a83e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4927a88819af4c1be019e57655a9d3d
SHA1346cec026637f7dd222e63c4a6cec1284f55f7a7
SHA25601fcaa71814d8f5767d875123b819a8b96df8ec784cdc16434086468a3b806e8
SHA512d2cb17fff835d8a07521665aafd7c5510051d2e1d8d1bca52303977474a6a60ffd9ef7e758149539d479d805fdfd87c7759879377c9cf6151b079f81a7fa1cf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548b5c4bb9d375d05579b9d82fbe2da37
SHA1019b162767866eaf1d9601e773f8b5beec836786
SHA256673ce9f75fddde03bb2fbd1a0cabb0a2a298553bd2fafa2c2007d9f7d0568031
SHA512113a1d444de2258939db888452c12bb39c4422a85194ab4b9df87015732b32b4ee6a88353b0a89cf229b346b308f3ca00339b33a0cb6208004a07deec2ece912
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a