Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 11:53
Static task
static1
Behavioral task
behavioral1
Sample
207d1d0407fa1f9b922ca3db3aaefd02_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
207d1d0407fa1f9b922ca3db3aaefd02_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
207d1d0407fa1f9b922ca3db3aaefd02_JaffaCakes118.html
-
Size
43KB
-
MD5
207d1d0407fa1f9b922ca3db3aaefd02
-
SHA1
a335a5e48dbe93ca9d234c634a37b8f6b876af4c
-
SHA256
7f3849ed9a7a8dce20d9386aa430b7eddf3f5a453545029d77f41f6c911d0c6d
-
SHA512
0d8e734c88ce719856f5ce85979074839cf05063292236fdfdc091657a13f294c9065ef9bde46c2409cec614640c06b01ffb65060e9374d751bf1a93a3740412
-
SSDEEP
768:XwBCOE02eEQBJfa8T+7L/qgKuEXOjeFUeTReWKe8CtZ:XvOE0iHW+7L/qg1EXOjeFUeTReWKe86
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B7FC901-0C68-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20725c6075a0da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421244650" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c0459591e91aea241200f7c7953c1e6d5c9bdef25722a745e1a3859de76ebf78000000000e8000000002000020000000d1d582baec6b2e28aad36a8817917d103e9f37cafc9eea0abc81eb35f432661d900000003c9a380b304154410a1e8cf4520afdaa01aa414e55d263e4d42694b327bd4b0e70bac15e83daaaf3f7eea2e3e50e302aeb59eb806c71494fa89489f2ccecc20aed84d0544a9a77b03b683a411ccbcbccd4dec61486bd4259982bdf6ec915ae39c6fb2ac28a54f9f03441fcb89f71dc10ec8e68861e755f1cc38e5fc1d0d95266884d3f35997706562c7a18691a8746d340000000cff57e929b10c199d091bca26cd56089242ffcf6b9746b294668ca8068e535b5ebb481027f87e5ba8d4e81321ce7bf1ba3bfb17847e6908c421c57fa2d66bd6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000012164448c4dd0773c89a16356fe0fc2136bda79de1578bd6a599fe63e571abd8000000000e800000000200002000000062bc2831b67efd41aabc6927cd4743b9e2eca154c1beb567bf073683d82bf53d20000000d0933bf92f11c56b471d245676c89e52f3c1636491db378814a0dddde9ecde9d40000000a028b9b851e3bccdb33ddca122ac49916ed38e5be704f7a2cc0e91485b6a82cacac5a90e5d084f58f765ff013b30ef0d5ac8f32e1e62d77772ad6442ae5346f4 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2412 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2412 iexplore.exe 2412 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1712 2412 iexplore.exe 28 PID 2412 wrote to memory of 1712 2412 iexplore.exe 28 PID 2412 wrote to memory of 1712 2412 iexplore.exe 28 PID 2412 wrote to memory of 1712 2412 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\207d1d0407fa1f9b922ca3db3aaefd02_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56727e6e038f799ceb581675a3451e6aa
SHA1fd92ce7271b97a7ecf90c06ce40b889b534e6f13
SHA25608665721847cdb14b97a9014a3dfefa22ff3a2a396d350c0ce4938e2da2afac4
SHA5122a05ef93c3dc56a01664e89d7f3accaa8cab57f145e6e525aff308968fa03e041b1dccf44e6b27fa1b2cac83666c948acd6c22cfe4ff37144b32fa7a4ff8bbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b5240234efa963446f5db297c8bbe29
SHA1748f9aa96353e7f6f1634b4e61240fdd2cb0991f
SHA256ed4d79ce7065f2fb42412c0f01f9f019fc3bb5a515e4d28ed07b31704c4c3a08
SHA512bf9a8b829b5249593d51c1fe4032df216713cdef07d159562b004f9efe6610bcabd4e94cea735d052c2e2aa8655a0decda98ce91120b8042782b6a4a6f45bd95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52474a98e326c76422705881f476d8378
SHA18acb5d66e5b211d4ef9c843333f91f71614125f2
SHA256537d97f84e364e3a38016154da71417947db4a3c6200b8f62cebc2a0f527c811
SHA512d576654bb943fb8bcb00a0e9e5046df9ce306d97b93ed92bd3540d4c0dff51c2afb7f0eff10f7e06c2e1b21ef77f8dd17c403b32a7f35ddace69a12f874f086d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a25ab519b6b2c982384e8a52281fac94
SHA13241b01255af9ca32aeb14385cb72b0eee1b4edf
SHA256eb537b2b8bc716cee59388e269e9d045e3938903bc81fd8c689fa7f0e6e6d9c5
SHA51242fd794a4fea532d8957e488cadb6cf2190ee75385e27786de434f95da359433749a147fc475bad83a8929134252c3964341715a097621eedecde47ffe29eeed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aba70b469cae880d470ed6c744b9c65
SHA122a62736645ab74b9edf7d66d6a106b32263593c
SHA2565c1bd8b98b5cceb93250ad7d3f76a90d8898d176d2de31c85b61f4d8f3f47baa
SHA5121838051c1e8c7eea88601f7bbc1a628eb6bc82fb78e59af5aef839f7e0ab0a5525439e96ee7175bedf5ef21bab61eb471604ef1ea8b0317a3b9b8b1763df0b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517c360d503a8a180247fdd0863c487ac
SHA11c6ef3299cc26ad77316954916a4bf32bd5fd2fd
SHA256592697fab6e4e2941b6ffee0664b0f0170e8b225a00fcec53b3020806afceb67
SHA512909f7d49805b53f359afe5564a456b87a2446968775c39a5e23375e61b790ad3dc3a259b3a32045020aff7fdabffbfd07ec826a11b0523e73dd156a9ddb79694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58926a4ece04610599bed90822704fbde
SHA159acfa093143fa091f6e23f104506ba7c4522c77
SHA256372607ad70c061432f84bf2d415259f4bd5218ab70fde3487aaa8181e7c24371
SHA512a0473e1898e8a69aa64ac4ba3d875465e0f42fed156c7fab61b54cb5b8dec07eeef2941ec367a36572ded27b9ffecbb38cba0a56a9c303fd2bec9facd894d7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a75e0c9f3dcb7a092706e0cd3eb6c5
SHA1e6b82a87815498a4c50c1589abad83351017dd41
SHA256906daaa87ca6ab48241d87cbf6c69adba9d5dd0819f8441e5793774aada39984
SHA512446863f9389dc38fb2b2e08b388d52127e245081dc8b89cd86b6f9dc7d0f05cb5922d40c7536632ea75f3eb001944f06ba3ca8fcb82b8b7fb6595525704232aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559b6918b2e8cbba8ba8115b5038a5ab2
SHA150b0132d02d600704a19e29a511ead9d5fa3f359
SHA2563fb36130bbbf5a8fa187d4b0a97e7d51035d584bf9816666486db8452ac4a2a2
SHA5127d3c5c6a55b52c46a4540c20ec835a933232388b334501800d6f21ca82f97742689c2998369cd4567feba2b5051a6c74427e88452ff7901c9e1a1d5d348f0246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5842112421fd494d71dcc5341e5a76307
SHA1c216fe51484ec863bfbf0133fc9a7ecf88f00fe6
SHA2560c3074eb30ff3a9d358d56eb86aa0a886b39eb02262b21a98c9c42ed329a4b97
SHA512303ce111d95cdff239b0a98de0f0e3a256a85950955ba12a64b3528da4458331eb2c062399b5fc05b7ce012061bd51d9aa0d45da8aa0fd7f9cfd0f2368071846
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5225d3825589d1af45592b3047270e39b
SHA1e046a7d8892bb59fd31313b8b90d0bcaf05fe871
SHA256ed6fbf39d0efd57cbe1054c23430763fa51b829ac7d8faa86e836e1119c52d47
SHA512fa177834e872cd76a283f6b6fd68490367d31977f97177c1c8b9642c96f9f4fdd758b839452a7ae989cc0d0e75c09a4e66ee8644dc15ff1275305a1248050cd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7d13c363071163e8c24258935fb533d
SHA10321713d55e91647fc5ec90fd4880ac9e31290d2
SHA256c91232d204b3b4714e871fd95409021f374d541846ed7baebc43c4ad13f30bc1
SHA512fb869ea746494b0eea8bbfba73efcd899bdd28be098bad9b7982416bbdd632fed88c8ae7e164b6e08dda37c1e947b658833fb14876ef8f9a9bc995b6839fa631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541b72941eb6970d57fad327c669d86cc
SHA11c2ce194a469868a5633205df361bb08d5f6669d
SHA25624ad9f017704f10c86f7f84feeef55afcf8e659c6ad094cb6dce1fc06889fca9
SHA51240a8e2cf59235d29172bd00e357329ebd75d2c19ca8ad18bc45a1ae09b1c76700338b6ffd2b80569c72e6d17848f9f127d9eb50c4639ad5efeabfb4f4606d2a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577ed4b29ebb720429282a0be9ccc78f5
SHA1afc4664a7ee28b45f2e60f8e35a3462abf7a61fd
SHA256c1e735f4dbad8401c83f38492fd331fdce297c127fd72006c4a53a7a48789fd1
SHA512c8cd23a993697a05b6abeda34af1f3ad438c801366456d480e76b341eb4db86d070b5a6621375f6bfd5caacbb4e2e05bd3c8777d98ee1e6235bbc28d60291f48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c27aaaaeaa8ccc0b94acf30801e3eb59
SHA19eb4384769a96047831e9b56ceaab13ea5e0c59f
SHA25650ceebbad55eab4dd6f8c27207fb916c6d045c84fecdd1706bc06fa00e26f907
SHA5129b15a71c99a857a452d5a24de1fee16e3434241bbc458da811bc0eb023b602605eb8084311e1878ed0f412655b2f2ec15bc6f0c5a4caa9173ed0a85edf68dfa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503596d49c06fa8875e046c3146b77a1e
SHA10647a220a3e90d368a23a2be3f0180c2b9ad3306
SHA25673f3278deb589f16bc293b2b602710449ed6969ad75dd68fbe34b623320f0cac
SHA512a5b03149b16ce02ff0a577e2c6daf70218af6d298820286834b14378970585b3cdb00d13ab06123019f033256cac5d3758775ced7cc89384c0de91c930949bcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5910434c9f50867d53d36d539c722c695
SHA13b3984901c2b2a695f2ebf733c0c5c623d0b526c
SHA256ee9743ed83af8d82fe8400152a9b2c0dd54ba9aaecfd7a414d62edf9858994cd
SHA5121f1fa1ce64b3bf90cc81cd0bc8e1bd510d34b5b387839a05a4675322013d34910209675d1750e96ca1a325e199976545cf1eb909364d07e9047dea033cc191cd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a