Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
1f481c9d72d6878c5b22e7ab24c57c1c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f481c9d72d6878c5b22e7ab24c57c1c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1f481c9d72d6878c5b22e7ab24c57c1c_JaffaCakes118.html
-
Size
461KB
-
MD5
1f481c9d72d6878c5b22e7ab24c57c1c
-
SHA1
23b021754a23ef0b02f3566939a5428831a67bda
-
SHA256
9c0da7f58fadfec945ad77cfd40b8ace4c798c7e5d978d5af9711f57457e709d
-
SHA512
07cbcd92be76663c4e7e4bfa0c468c4c4c459cc73b07f7092816d1ec8b7293de1077b2786eed96b3d8076afebea9060f06a3b20d73ae66ff5586b3f5169ef3a1
-
SSDEEP
6144:SVsMYod+X3oI+YeJusMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3QJs5d+X3d5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421213916" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000098bf50fe42349a61e387e89adc985f3ea6883152d8f8d136abacf3695806e57e000000000e8000000002000020000000d1def702e33d30969a6e68cfe5b2d7d3dfa748151e75a1a9333c8671734aa2c290000000137038ae5c8ffa7aadac6891bcecb19bca5190a8057e039a70ba4faf1511929f698d9dc5d9a324b7c7337a366c9f7028446886da6b859b9c41adfb203243ff136b7d2563a046732628cbcbec6a6ac22d184b25c2e499c3af599d8c2b50c0472b6c388e4600dc6c6ac2835623a6e7b0fa2a08e4fd309eed3f04b11d53b414c673e78462535a3821a56e6df71ce676c83b4000000075c48a404304a10788ae6c640004b0c80975b622411773abe49b51a3cdc46bc24e38a0e999243c1e0d703c155e2515d77eb2fa5c041c9523e2d5aafbb901441a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7040aba42da0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000010feaa5e6a72891fc60cf107ca16301dc7cd27c0362b3f86d1cade780ef64480000000000e8000000002000020000000710ed7c9072b4184d59b77d21bb7b3093fc6d71a30badd2497c3b2540b7ab63e20000000cb2f2a0f09f7d16efe73e330a913816a859d481701e5e4d2c6c5e41f8140c69c40000000c4b9bb9502d6a1214bde05db243b29a4adad734b1ededfab165ca82467527703c9507878d7a03329fd76ace0bb1dae5d1c414e3745de21a8726d740ef546ad18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBBF2821-0C20-11EF-9A09-E25BC60B6402} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28 PID 2884 wrote to memory of 2560 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f481c9d72d6878c5b22e7ab24c57c1c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557737fdd4054518948189ce29883f203
SHA1fd4ace801dae8576d1504dc8ad1462f41b9d92a4
SHA2565724307d29209525ceaba3671001fb711c5e628a63872c9178aaec899e7f335b
SHA5126e935bee1b396983891e1a5092e54a8b3b0c7fa0fcceaf6be5da1c53527d10f4030d403f56629c8b1e42b20381411bb3436b19b9928e0e1060b7170767891128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558b474e24e2fc234ec0f15295f711024
SHA1f9ddfd268f06a1612d94dedb20bdee657233253e
SHA256482df1b3f3d8fbbb2474855772e28f452494aa34f63074b701751269876337a4
SHA512f356d9e4ede4d4348f3fdea952bb7d17c39d8c1847983a6985a646a074ec256666d1055773abf2632cd4e4091925fddc4561b25654f658d73740ca31f03b93a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559e1e536ff9d101fbbc09505990d3ae3
SHA18dc8a45cd50f4fafc8e3a65160c39a363550900b
SHA25601f9707422afcd3cdcc13975ad2587cb3c850fe5ff9fe95130d434406fcfe1b8
SHA512115f1f85a4eac8e7e06c352b2443b9cff568369e8eb3045f454875e093fefe074c6922c6a601cfb2d46d7fcef4142fdc4def824779cd8fd7dbb2016041e3992b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512cb2a67d1a3f78c4c1b81197e97242f
SHA15d6f58e1063eecb2e134885e322c404ee6ad5b70
SHA256f0193518abbe72edde8a9df860df550acf81602df3acc1fadd60e65af1ba6268
SHA51248a84546d1e5d0e4bb9e715f5d4d65cbff52443177bb6f6d54b6cbb18b1f5d1b76980a6bc4d33a9e079c8d99af63c4e4bbe4cb3aa5178e359c4378a71139d915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545470183b1fb1beef93b75485f928b47
SHA19cc41f63ada348381212dc7ceed8878dea1a8443
SHA2569d56a8888c53121e3bf428e2300562b726b998d6a6139e043fe7f5a411f64c04
SHA512ae9cf7fc7ea1e8cb1ddfbfa89e4f196941577fe92beeb6827cddeb1010efa167956da63fceceba9da43a1019d0502d9cd43ac3d49aa23ca525173335ceb68587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a81a441eb6fefc59bb7b4529211a971
SHA1c648a997fdd3e1cfe28abbe92807ddac82b50d95
SHA256fc4425991e535b1b07432cec74a8c5bf57b68412aa2d19e4fc74d64dab03a117
SHA512aa86c1997c81f855713ae45a9948fde80ec29c1ed1c96e09ac6dbb0f42b3793839851b912818e5ec84f58a391b24bf78c378d561ed16f3b17160873fe2adc85c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2757389ffa70138962c0c227319cf8c
SHA12a753fa5b8801a44266151b0737e4d6707d9017c
SHA2569d6ad14cbea4c6b9107e635784aebefe46bf69dbb52ac8b1a42d22f1bf5e74d0
SHA512833f97bd564d275e5589d359cbe9b838c9eda03bdb75fba56737c85bdf369d462560b338047699999a627703e42c553a1d83b1c21d48c16c3e5745f91e86cac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54182df0102bb39b408e3be7836d267e6
SHA14c56209e1d3825c1ca5ffe16445da168cacc5412
SHA256541776e9f4541d2b28b138df4d338edd8d5d958223df7b54abd5513f891d92ab
SHA512bc8545052e211c5d7bc23d34f71abbc3a4182bdc078b3c085775cea72f9163a6e44349a810c17f67d23acba14fc2437ce46b70445764d55ea3738dc6f1b62c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5031edd44a31053015dd817c0287ec227
SHA1a0c597026871b6e132f34011d2630bbc425d01a6
SHA2564d0b0f52bcca9241e8f01eaafebef89c100860af7b3b37e0f18a8241adeec00c
SHA512ee655859b2a5eaf53c3585c29225ca650a612228bcc20fd85a84ab9e7d7baf9a1f0a66d8678e00bcd3cd089290fc69b87dcc2956f3d835da2cf83fbf0e8e2d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f577c8a26bd62640e5452b00c39fa76f
SHA14892fb77e0c4a74679e50e7aa9f3d51b19c053cd
SHA256dab8f8cc38b7a03fbddd0af4db3d317d9939a7111316d74ac5bc39c920871cc0
SHA512320e364b881623b85d9795d1c24d4387ba1bfc26f4bfb25a55a5a810ac20c61c33aa93e779c433fca3bf28a3fec36a5feea254ecf14ffb7980daa71cf4728079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dbb2a7701c9f50ab31f22402808771b
SHA14913ea25a3afd01cf90051ad74148b2a8e62a54a
SHA2566565965946e776ba534dff92f47d3cf7679f620ec741abf68b495e1f34e6d853
SHA512116417a9a78464f7bb8b7c16fc1eba8a07a2ae75e1b0b5f7265e07709faec8f6c0d3cd2d30ed114943f7903912585d6bade35d4eb487917fc435b433dd0d2100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e18f885fea1a9ee3373850b1be60d10
SHA19375d500c60f8a0112276fb903bf8ed2be1683b8
SHA2561ef173185dbf1edaaeeec6c4a657f1e1b9e0f15a7013bc9d70e7f96fef19df5d
SHA5127ab3cd3754d9874ab338efed9c6cd67ea47d3f8f246d0d88a47d152bf3fc1b1ade756773560200556608ba9a19f006ba0fa499527a6fa14cf0427e0309661e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540cb41189a03e6fea8a2d806b58ccff9
SHA19256cf9218349809a0e39a4d3f64dfa7abb12773
SHA2569c9c7f7e77019fc0a170b2566c09e07e8758a108c09419ae45e928b2d57a4fe3
SHA5127f5be4f71050adf7a24470cbddc4c7662e5f3ac942e222f22367c76a70b70284d29168ad5070fbcfb47764f53601082a5ec8c058606f1a5b9d8e53e30944bd6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522e87e336ff8f115f23cca3660dcb908
SHA1bbba31e3b96bddcdd2897625fa4fd05b9dfa6ba2
SHA2564b78303faa2156a84bfd3423bda4ffe1c07686e7a0733f6efff20dad678df85a
SHA512d65ccfd7da7b1b3fea531b627db9f032328224c0ee751bf3999a155b232cab6dd8ad66b3ec44b4c241f8dbd2363378435e016df2a547701b99cad88fb720bf13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54319d72b51c41e6ae0644eff4b50bd1a
SHA148a92e550ddcbe35648847647435adc98094eb68
SHA256cd967058c8fcdab3d23948e49ecec8371143ea007738a4c30f3921661729a6a7
SHA512cb8aa24d1112097b6a0a176db4775d515d76e7d70af62f155e07a07907d48a6d56b3e8ed07c8e1eed7e9b5dc9a20089ff17ce86c655df9d9d139e47cef55ed64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cea65156f5574fac31431cf2abb616c
SHA10f3e7737e6b7404dd107822945d567bbe3000afe
SHA25635ec69437707ce94a67fe280984bc26e2679b634da82f3c51eaee8929b7356df
SHA5127405144591cd5473965b92c79e5e02127ca4ae96521d8681fd1b0052f50790b2c934c9cd12d24f9f3ace1aec7cc2eebba99524d1736f675893a6f2a1f0aeaf57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b0d73179991f2110a20f4f27fe93b2
SHA166005c96b34b15c9b7d5153503df59cb09a5a435
SHA256ca076777706e0f71f09b2482a0d0c921aacf77a7257a44c2f0dcd421daad356d
SHA512606e56da6b8dbf0823e2673909b64cb10704bf0d6a369be29540fc0922c39609acce54177fd53f3a86b6c722c641ae101f1f5893b22f859accb44b18f96e175b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2dc9bbe3993b1deb47377d9e3229af5
SHA13bcbe59895b8282f66d7c2d4812a32e8850bf085
SHA256554f6d9491f4b57c798e3852bb4d8bf4a6bf44518dbc555e960555b0c5ee4a12
SHA512a9d88406cf9f3806ba41b565fd5756cf9473bb77117c656ce134d2743c22d60c3eeb47695fcc02f0e252869826d3481b5932e7e1164b405ff3545da9652dd009
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a