Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
202879d805417099501e6dc9eb214041_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
202879d805417099501e6dc9eb214041_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
202879d805417099501e6dc9eb214041_JaffaCakes118.html
-
Size
460KB
-
MD5
202879d805417099501e6dc9eb214041
-
SHA1
1cdfe6e93bc0f5b80c6ae0fe884b29ad1dbc381a
-
SHA256
a2dc47493c88da496b0a2df01254cf77701c7f3c57a3c321ae020a9946a02f64
-
SHA512
06d19bcc36c9bd3e1d5029a05cf53474df05f20c4f5477c15b9a708ccb3f3b77c70401ad9fca480e1ae503370b656aef90625979df500dbd5dbf5a944fc5015c
-
SSDEEP
6144:SDsMYod+X3oI+YIsMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3c5d+X3p5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF1F8091-0C52-11EF-9667-569FD5A164C1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f3d9659aea1beff58ec6081fa0c6f3f06050be36e4e05ad4f8130a3da07e2d15000000000e800000000200002000000026d3e958313c2604d42e712cd6992ed5fd69a027735eb8f4f29272e1cb7bf94690000000ba9e94ced17a086afcfff88be2df077b84aacb0f1594d05756563f67ed00376eebe0953feb8a3ff235213051b7ee01d5e62342d2f9c50f0c29b085f07992a977b70487d4fc6a1aeb5963b1427c6d55c3d7bf1fcbe3670a1b0d3152e2696773fb6b43c0b23d0ce56f7177f740b9f502f49a735f96cd7391e7f6c0e46b3cd6aed9ebf81826615444a9bfe78cb7558f206d40000000eb41afe3d3f1a5a049653300a81fa435d5ca842ef5623f77bba4b1ec230f39906de176e062bb5fe6981467f1648e6311e4b93bc3659a112a94e8532cf5a0b4f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0de61b85fa0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421235422" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000934f8e9cefa3c4599f42f9e591e4aadedf3cad716006558064b194b4a580917d000000000e800000000200002000000090a714c99da1fda11a5be7e9b06abcbf6141751af4ffc0288f1c1e826931097e200000004e1faa35185694dd86b4300ed323a54cebdcd5837dd1556f762b69c30508889240000000bf69ece6f54a70e4424571cf2063a64b670a7d698e2cf20f5887796025eab6f12b955ea7fd5080fdf720525ac1ecc2d31d42bc1899552e50b0c7ee661cbf9e6e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2776 iexplore.exe 2776 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2776 wrote to memory of 1612 2776 iexplore.exe 28 PID 2776 wrote to memory of 1612 2776 iexplore.exe 28 PID 2776 wrote to memory of 1612 2776 iexplore.exe 28 PID 2776 wrote to memory of 1612 2776 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\202879d805417099501e6dc9eb214041_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5963729dbaa4731b170ba7a7a63de3fdc
SHA1ab7d0d3d35cb2b61732019adeaaacf516545b48b
SHA25670cdc90265905a4605584d4d4211581664d8e38c91c0afb36ad0dd03af0cad24
SHA512ea5b2ef5fbee570d5a52f4554c8048347971bab008e89a0abf077b13735799c6a7e556bff97e3eb5f9fd418547c601e2165dc1542e3892cada0ea2c28a60c040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530b520e27f038b9e0690c43ba1d18fe4
SHA1ef9c01cfb2587fbbb12340ab193933025fc25f91
SHA2561e39a8a93be075e3c884b6605a93f5f50e0477308d076c2181e939061fa9a865
SHA512052701490c23601bad8faeb45edf210b58af99d87abffcf6cfab69a43f029712228a965c2fad3969acc511413104b129a0dfbf9ca837d054206672abee4f74ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593671b84114b4c3e39c924fdc4c4ac2d
SHA154be04d621e819dd9fae2e1f55c4883b7451e85e
SHA256b55def240348feecff948021e2ce77266733708e60d167905fcb11ee1e6c694c
SHA512603980c334cdc59255b75364373df944e544950cf1b6592ce092079cf32dc0f8725c9ccdf736197d8c0035f4f4ea94b3a280b545313cb96a6305045f903bb16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54aaef84d1d4ba4091225cc485041c718
SHA1204a37b7e5172b18b78acd594eb360e633c8993d
SHA256d546c17a80d8aa7b04c7fddf7b0e59745e26cccaacc68367e399f226ef2f0dfa
SHA51272f38595f1afcba7082b704ae98e40a2ab4f1024ac0e92501abdf31d0214b2056fcb3674f6c46f0833498d60a5e782f6213d5863fac4e4ebfb0dad32007a07a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5c33ef9b300703e101e095d1e6ad261
SHA17e6a6be0208d74817d97a6a1cc813adcb550fe2a
SHA25678195bc762fc675721d332f3b0612bda1f5192c15fc2d9b522092fc55a3b6376
SHA51267e0a532195b2835094eca31efb39d7a45b3bd47331c776149d098fa866cc5693ee29edef0b146a28d56bfa769c02746c798a7aa16905add96f5aac72dfdcd70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588c732c46e5f5d54163cfb939d6ccb4d
SHA1caf140a7fb9b3d582439ebac39be32adf61e250e
SHA2561600ca542fc3e10ae3208a4abd6a7fb6a09f761082e20d825aca20b53583f205
SHA51240a556734b574e63929df68cfe180e1b1e75ddc76dc97809e5b810018d468ef8f4e8bcf8df99d45faa1284cf89b4dacb4192d76b866873bf2e897008f10f99c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55144fef2f7bc263e800421cbf81fe242
SHA1b604fb0b5bc18b5e2c7003974427fbc020ff2705
SHA256bb0627cdca2d716919179f4e17459a1397fd09407094626715700b83a7e707ac
SHA512b1101088da6136e076c5904265c369526a10da5a94d705bb7c976fdedf87f8de8c1b1377c5563bf7d9a6375b8623a581f0af3e101b8a103ac77a604c295cb1ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4d0bae342c3b49b83c8862f24fbca43
SHA1ff9fc863122ab26b35efa821686b11a0f6bf2f27
SHA2568a396e79f32e3fd92e384969a10042011fc14601a11b454061ca151a885ee5d3
SHA5128e74075baf8c107d6def4ed6726a91afec39c6ab28e4a60c20a5f69ba800710062a02b943f143325b344e61b58592141a8c918b63f1fc5e50b8d43bf9685216a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e34b726c2e55bab8520153b9fb487a6
SHA1eea36a8715020d7b97e51420477884d0ab22d3e7
SHA2561691297a2d63b1b0f7e3a29ef7b2b0670ebc351cd26f488ce4e3922d65a41357
SHA5124641f6705b16584f30758c35c3f8272dbd3f96676eead767b190a39963dafaf5c72d59bf7742a7ce8210e7e4f8b03b82eeb37c39847ea0e5b6bfd9eef22b4d81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ffef4ee65a6e77e0a6e87302fb82cb5
SHA11b8d2b5cf2c9dcbea1005fd7269fdc582f208013
SHA2565f8ea0e6a2f5027d3434c7ce9b6b1cd8450811f3938fd43dceb0a2b85f265031
SHA512ab31a544c03691b481fbe6c339e26f4eb005a0668a07728fc4c60df82ace1fb6a8640e8a169c8833a95cce62cb0d66af3eb00a64804dedbe0da291e136079169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f36e04f3d24fa5971a2a2cb3bd3f859d
SHA1fb538d905aebc0a6263aef07024412e60479848c
SHA256474c4f75c140d7d2463c3fb9a2da3394c64e385c5bee607d4c441de8fde1ec35
SHA512b650336fc0a4d8a395da226296234ea1a22eddfc53d41574f4ad6a1ff02373f8e36c0cafdcf81f29f92a65e882364a9d3779512afd2bd58b0fc70818dca358b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdc1d9ff40231b3cdffde880359fb886
SHA196edabc3d5a70ac12c50694cf0ff4ef622d66c20
SHA2561b6e99bf0a835d3ce28640ba1efb22fe38136bb982a61f6914e188faf4bad89e
SHA5125693c4ca49d1f9194e3168dfaeaec4ffcbc7bec7ea924b671ecc2cf7470fae79631fccddc2f772b453bf92dd065f6d139d1c8ae57a9565629e0e2b400b941c7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4d366573a47882a340ec3e50c4afd14
SHA12828fac1a3335c5278f18954c32e028fd248e076
SHA2561ece6991719027ffb9b4f63774e0be99a6b6b83a8a9213ed7a2937a6c3a98e96
SHA51247ea63d33207572027d9feb7189e4c3f05e389ba3a4cff26bc2adb332eaeb7a24df68ad26a5d84450883265e8938ed517f32c451021fada2c3a968c172968112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7ae91c89a2835ad575e3c58ad16d5c2
SHA10313007badb5dc0b1f1102bf43e77dd569dc9258
SHA256c9c5af215b1959a0672b7b1144dceeb1be1fb3614af5542fd28d47c5466bbbef
SHA512c5f42e017744ab061a0e2c09ece723a28e31082c9368f9a87818c894b1aa3a5c1e64724e8809fa3772470e9e39d4d545a0579fea30eba41a1877dac1de9d9800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cb2f9da2fcff894ffd8117b1435f0ba
SHA15a982f842c2624f637a55ff25c20c34b8f62146a
SHA25655009325fbd62853f07a5015443f9d2d71ad6eddb1c5dd82eddf6fca8b560ec6
SHA512a547631e64f660421c1e17ad1079dd520a21d5f0e30a7b3c02c407fd5f27281e779b2ea711fa90b6f9b19b1e54d7dcd7f582bf995b153e2602f72f084dca0f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cab7f40057ef3eb6d17c8f52b07c1073
SHA14808f77629d9ac05a5afa6442c4e5b2d7eab9656
SHA2562d31b369702d5bae14fa161978511af91f090e64ebf891d657e3a8fabe1d9ddc
SHA51239b81bbdd06f413f30b11e2181168930b15583109e81d27db410a0265498baf2cafdbe3f67690a69e8d331e94ccb73bd1c618f6ab142b3d32ea6d5583756bed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e508d66e8cdd4596d0dad5b5d41d88e
SHA141f67db5b9b9a6a80ee38fb8c8198a5bf9c50f51
SHA25685ebaa28a47f834d8dbdd0289151c253740fc2b727f610dad881b75b313ad71e
SHA51296c6efe7bf7b0333a80d57de0f07a20e51622c52eabbc65bed79320a5ada4232ba47a0a50406dd2c38c5cc12d2111d571a8b78cd442530d8a2adbfe73c254be1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a