Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 14:46
Static task
static1
Behavioral task
behavioral1
Sample
20d8ca9875a0f7fc948d7eca9a2abbf3_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
20d8ca9875a0f7fc948d7eca9a2abbf3_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
20d8ca9875a0f7fc948d7eca9a2abbf3_JaffaCakes118.html
-
Size
4KB
-
MD5
20d8ca9875a0f7fc948d7eca9a2abbf3
-
SHA1
070f52f70f29961f3bb3dc4f20ae966b2788c90b
-
SHA256
d0e25fa83c914ee2701f43be53b3c5bfbbea0aabc89ada08f2cc09a25003943a
-
SHA512
418ee2f19ec4fae692466f77e3fc692d5c389a4712bca7f9b51abadd0b808e7a3028e7ec23d1f3713ad4bb9a6d7f61af2642e9f7080440ab3373683e67d23165
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oMGLd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421255090" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AADC0D71-0C80-11EF-88D8-5E50367223A7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007896c17e824a0a6c380b00fbf437cf28d93f04aa932bcd967d19aa604b5b23ad000000000e8000000002000020000000e9731d289a63f013d97cdbb87d5a764f717f2cf2d711a299e9b7629915967f6590000000fa46a57c84bdce4fcc2fd4895d0e4788b961de1be45b2f44cdde0a152289cbc09667f914124ec2acccda85088b7b25b46b11ad86315e7473d543ffe03409db89d20216b3578a08af1fb41f746189083891aa31b103f9e511ceddde7c6e6db378637c67c09884ef731fca07b0fa92386bd1cc940b18a0b7705605f0ed0217a9680d3ce5ee2caff5a31ddf9527051e4c884000000028053ecc6750484527ede73171fc03af9965708006136b25a79c13fd0534cfa16e95647a4e876e7ef3d5711e02b552082dc9f9e2e14c71a522d9e8b505c63b9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002fa15d01686902c4cb18ac6e3d4c59c5db12948c7ba5787cb81aca6ff3f38d6c000000000e800000000200002000000019b409da4246d8d84b2529d832ebf78c71b4c5645c258ab0f5546fe9ad4df4fa20000000cfc82638645c40272d9365d99f0d8e3b408f8f71c46af38e48b3c090198c709540000000f6358b9744c95a277f162118356510592c83bbdb116990c423439ceaeb075aaef7520ca613a59ca39e2c094254644bd2d445f04b32483aa7b04cb7843b843d93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605e717f8da0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2396 iexplore.exe 2396 iexplore.exe 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28 PID 2396 wrote to memory of 2320 2396 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20d8ca9875a0f7fc948d7eca9a2abbf3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c00ea84a3124bc55cc69088e8076117d
SHA1d6b70d8f460c6272b808ad92ab0b18db8e78629c
SHA256d2aad70f20e13f15104030f175cdee15eea2437ee29128c063eb04523b349e48
SHA5120505556155780b7d9a9fb823f16e190787e302fb3403238d20df0fc26f603c838ea36cec7d3715af62ec859c745ba410fcc9e8716b770102a7f89eb6840ce2ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e40443540f03d3f8b537f82747ca823
SHA1dd219a961c1d3b123a0a2fe4687c5c57d0f84dec
SHA256f8cd15ebe5701f8546d407d33acea8b30eb7a752e3bcc22135a24cda6d09aaa7
SHA512d97fa4e0c4d541a56704c28ecdc7261c95d83a344833757be533f22f1effaef8850bf72177292a828840809418a79752d7a91ce02b00640dacef665a1500ac69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564f1a332c4d0f95715ba7eb1f8a35e50
SHA1d4269e593bbebb20507230f40bc3738b8b569287
SHA256781fe204d3abe4f62398e48216b9a4676215ad0fe1a8f79de0318e686c204507
SHA5129ac5586a2564da33db226fa7227a72f4c4745819516e59e4fb7cd4ebf61b7e70c098792b8badc0f7d69b04451eddf7e7651e45a14eaad313134e2b0ccca77a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7239435697a1ce205600594185d28f3
SHA13efabb0fb09f2a657db33b387ebb67e89cef25ba
SHA2560b0a1eb053dfca72a35f7855f82de5320428f728ccafea94bc1af235920c4319
SHA512cf745a68e17e447264c2b043fe6eb84e23480b235ccd8b1f70303d7127b549855c7a6bd7965cd9d64e837ba73652d6d26de254be789fd2e19ec3c8ac42cd2830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588a4d17cd1b23c31bc62497f06a084d7
SHA13b8a5af9e74ba6a856efccbf959183a1d581ec75
SHA2568b306357d8f0a115b57066237df51db96459d8924e7cb3287208314d634a9248
SHA5123fe2d73f0f51553c4e6863884301a53c01688533b0521b33c2ce64e9a0593f1a46c07cd35060c3ec24b681d74bdb5b4584e979f007e1e20e7075e70f5cab384d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5495fad980f0b617b343a1eb8b744c1d7
SHA1f97ac7fa9714d92184a245a192c7d3593d37777d
SHA256f81205be8312e899987969d4f1ca34e122acf71829968a71f965fd75af28b343
SHA5124ce162747c286c81e6fa4a5711c5a7ba0eea7ad29f9d22fd82102135179da0eb65d10538a768b212502cfbdb2cc8d4f9f104fd8353d7d22598f44378afaa51bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ae804898e9c5aaf15a509f171e8c484
SHA176c41e9e51ae02878bda811138cafdce43c5f474
SHA25682a428bd8296c31b0b954895cf76bd1cc6667c114f9296718dc7d8e75c9d64ed
SHA5123e1643a51980c2a52225aac70761ed83eb5c1d8ed86e04b2dcbb5690123176a47a552836739f52515bd956b9fdba372036d05123d4739bfcb3100136b820a8aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5ce32685799efe9fc1e796044e51f61
SHA11c32529f0e28143e235749e26f442331cca265df
SHA25697d1ad4f0293059bcc90de1a512c3c5f473c35a5c3c4f3d8148effaffc04dfbd
SHA512eabdb6ac4d7b7fcc1759d9e31e2ad1bb0269dd4355b50f728ae3c318a4217b77d60ad9c6126b10d2579c50eee4234a03b70cccdafd1ba46628a2f402c29a2ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e45b92b67a56a360dc9e1a2763eb3e3
SHA1caa67ee57fd540ca775cd66a0d62521e07de61f1
SHA256a7645fc49b005fe46a569bec9ae52efd7ea114f9c7ddf63e77f711bf2cc2943c
SHA512f08fb4cfee1273ca5411215212b943d1b2263429fa396ff35d63dbe3b8c342515e4b62e3aa17ea318512af4c04d75cbdde798f71e1ab13dee61d9bfd2d7864e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a05b5cc9c7dd759f0aaf6296bdc4b3b
SHA1569221c7df1854c30dcccb253eee6782f3fe4e6a
SHA256bd3383a3485fa2d8ac7fa92c7cd0dc1456a18b8eed7cfd2243217a01e22564eb
SHA5124c82ba4b46ee4a53c8ff8ea85f60f4b45863c8777a36179e1981a8413d3f94022f689fbd594c1f38e27014ef5863d40b35b32bac39ee9d34050089016ac3f524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f27f91c601c35db870b68cd0b85b219c
SHA16c699bc642935851c0f57683a3d5802ebfee985c
SHA256e8a07ea52e42d79a0ad76e21291a466883de88552d9de4d24e58318beac4ee1b
SHA5124bb9833c56f854e8004d8c0ac03df9511b4ef6f58f8ad85944f2be15bd839a8e012437d78975d4f91d158f254a0235531f346f558721006621784e737110260e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f10ccf04eacab51d8aa51bfae937a9e
SHA1ccfd9aa9123c7182cb4a133579adfb9cf590d66f
SHA2569146eba454b7ded0ef0b51731e7224bbe8422e409558b4ebe66e0eac179e9fba
SHA512b474295e14f6a54279433cc8d97e7c796a9791458d79e5a0d5b7bc9187350fe4824cb40be88200eb5ad8be0fae022a8e845d97714d91e384d571b8029dc350e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53927b0cc55f5d6bcc8fe26fff82961b0
SHA121d8d4738bade899802d995b077aba66e0e63f21
SHA256f8f224ca3825ee56bad7b33ffef9da7781380ace354ae7cb80f987a33ad28356
SHA512478729e26c87147b0f96ccd127706e1c43c927b5a5f1d7b67fe6c89d1fd12242b11b1f45353cff14f551fc2800e94a67ba8e186a158bc21c8af66b1429e982d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593dadc357bdaa3665836460391613328
SHA13b77eb93ef50ea342216066d15b0a6884d23cbda
SHA2562cbf2fa175864585b5c2272edb74d9463b91f8433c7d5cd2412f00da54751033
SHA512995e0336df8f760e64b202208f88e3215a2dcfcc3f3ba80587cc6e2d2f544e28176256fe9e842a76b448018f1e1cf0f4f2fb975da1b94ab85b1bd25f319cd33f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5865ff6ef27bf7a6748c915aeebac7f26
SHA18a7342b7cc073f5325b579e9a0928d8a6c78c3b7
SHA256713d0c10a9e6e85a00c173b0ae48a023beac012c4757138db7035c2387f94d6a
SHA51215a64da0bfdd505695accb302cb4dfdb5a8760bed07630c0ce98c3cdc9e43596924c970cffc31c1c4992ea3ceeaae0c52f539abe694ee9646425e922d3849d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557b190e0c55392d1a6efad0c415deeaa
SHA1855badc5288fc1b943d732bd6f0cd47cd2b651cb
SHA256fc729d9f98ace2e505ef0af9a6ea82ad96a582c5c2ca3917d25fcd52161dddc1
SHA512b3896eb9670b84a6522d36b6ac3c7f4d028279a41acdde5ad3b5f6fcc0bf84d66e7a12ce372d5459211944cfae67fc6b8cc2f3715dff7026c03dac3899ab74bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c18bf5066a1282429866cf769cd1004a
SHA126d227c761000a2408021779a59ae1d09a67ca99
SHA256fa7b2dc66cd3451ba932a1f9ef3fd82b06e22a997be519839684d2cf94bfd5f0
SHA512c9308dc21dd080b147db65af148da023b49a5edefb4bf17978680130034245170c7cd3fac9ca0e566cc1132e890d96b37663e7cf63ce82dc6e1eee4677741df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bec327b29f0b7785514814908c288626
SHA18d57650e4ba9400a488c719d84241ffdd73d93a5
SHA256e428151a061f91c775b8074c441f95b97f1002110e9e3b3b244b3300ad94dc05
SHA5127ddf8926cfe31338d808a27ca36cdc450c63f342205e3bb7229cbdd57395bdc7ceb9d94f249a2d7d03f7098e24edbb7628da8c7020931eb2cb01968b7d3789d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589495c54b4a9bcbca1e512dd5b581206
SHA16ee3d69967fdafa096d68298864f1f59277e8a13
SHA256708fcb0d648cf41a3b7d87869fc9302037076f5b147ba27d9cc3f36f9a1f3aea
SHA512af83b52ad3fa2bc854b751c058576cb4d0b7b77630db739c4712e7e55d61cde807151a20886518c8045c12eb205d2d69f0b4dd02faf2a12c371af25015157c0d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a