Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
20c33c771e432bb3a6aeb657c39cefc3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20c33c771e432bb3a6aeb657c39cefc3_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
20c33c771e432bb3a6aeb657c39cefc3_JaffaCakes118.html
-
Size
18KB
-
MD5
20c33c771e432bb3a6aeb657c39cefc3
-
SHA1
f57cfc4c70079ba2880286105918bad210302086
-
SHA256
e8636be8380dbe53a364a579e0ba826e82b512b24469013136b48f3749f7782c
-
SHA512
cf2064b482b347fc9db384b79e6f386b58adae1564ca1165bb532ffc770f9639685adfcdcc3727ba3eb62a516e882aa3892b609ed33c53ab11dc96442b8e68bd
-
SSDEEP
384:3fa9aQ5yz9zWWDfe2v/yFys9Elkni6ib/b2fyo:3fa9aQ5yz9zWWDfPyFyCElknybj2fp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1ADBFB1-0C7A-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421252633" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d871cab4643dd5e9aa99cf78ad1d10a8f6b83399b72d8a2f622ee2ef6e821023000000000e800000000200002000000098cd2aa0c9d6870d51f7f7e642c2a999c1b260d44ca60e960f88b3b92fdc0abd20000000bc736c8b8ce3f623d6b93bca87f246712aaa619f90516291b0a6181c2a53d0f740000000011aac6e017717512648fcbfd92c676026b02b1ad8f452d9c8add7e7c559f55bc517e0ee169cd9cab0b6c4aec8032e859813e5be2b5c5bbf5214ff86d61ebbf0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001fbc919eb41e748871d86f882d5c825c4ef78ea1c455afe743e17990259395d8000000000e80000000020000200000005089658e1d91ed2fd294c8421676894260bcafee5196d8bf92adb8d333f23d6990000000c5a59e22c3d48d90e505d83b90edfd5f6733561b77537f8b72b5ca57ad801c008fb840ed2aceed8e1d593dbdf6fbe573145aa8a35d2cb0a3ed44fa44182631fbd4197cd62e1a6419fc84cea7d968cb312def62a9df64ed91a7c1ab22ea326b1d6eb23f9a36cab3de74187f17703c6af2921634d5f9e5cbf8db0eb660f45cedd76ad80474777a1a369016b8728189a1d640000000f8e1a1bd685fd202ac634a440f2090efa047f97e13d74197d6b2663cec1a3d693ebdec41be1673359456d46598fbfa55e0a6009fb6eac14105f56370a8f135b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703ef5ca87a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2296 2292 iexplore.exe 28 PID 2292 wrote to memory of 2296 2292 iexplore.exe 28 PID 2292 wrote to memory of 2296 2292 iexplore.exe 28 PID 2292 wrote to memory of 2296 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20c33c771e432bb3a6aeb657c39cefc3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c2f52e79e9b11bcbd55bf2501ed4138
SHA1ae9dc4ca4a4ebe716e96001eb40c8ecbb3621c42
SHA2561c8fa43c2c59cabc6e182de153b91e09208349cabfcd312872cf411533389667
SHA512b1205dee02367e7a9ecc6de7fc0ee807efce15d814b5982bc755e69c73f91e92dd5af7e083f80877086ad95db968be01de976222bb489212347af96ad40ce748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e29dcba3c1347d512a67fff0cf3c69f7
SHA133a4d3cb9cd353ed2aed5a8a15e5c6d13fe0d0f0
SHA256156cc72335757c359325a28daad9268707881445ca36d3a968d4b33b2eaea990
SHA512f29f231cd19dd40bcc17353bb8bceea4a58fdcd6f2701cfe4b1c78bc6564562e618e4433a36a61724b21995a118511c2841c1c623cd82341761ad2c0fdc60b24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb495851d92a2c0d413d53b15e233568
SHA1ed1b7f93393b2811500e8c6afa2cf651554ab6cb
SHA256800b8c32fb662e05840319c475e5be72110fab2c47c38ef7ae8a6964246c9617
SHA512725b7d24d41e2fbb253d68f5a49c73e6afc8cc325242efcc63c652bc05d9a080dec1ea3e3632948450ccc7cbaa299382a7a0847b869765bb11c498e5e3d56400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd5fa7bf13d886d31f1a363f09b7216
SHA155cce7a435256e5e5ae22297f6d6c0d4b76b8a5c
SHA256ea93cce72ed20b0a4a99befdd145ae548e03c49a46fbabda3b71d696a3ba5ba8
SHA512356caf58b477ccf30b39829cde6e52a1c10b63039d0b593dd36fb5de0d03b3f319174095c1ce4b580c425e6c3dbfcc7f148e1e189bd8a22d1dd0d72a3fa1dfd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531273df05f641ef613368cdabf291672
SHA168a94a0a6eced13d0e2efb12e36191362f26caa1
SHA25635e68818257db02b697411cac5ddd3be0df48e41b6807e692828af316e8c28bd
SHA51207447b838b389e84079b2a763aead7cd51a5d9628e770a9665f7d310d4a727794ebac31e4d0e2fe1daa7d22ba16c07fc0f9c98c34bc9bd945068bcf57ef311c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575d4f3b4f7d98aeff5c254a116b6f210
SHA1ef7aeeedb5875ba9bd8fa8ecbc3ef2574e86b82f
SHA256d20f1e2f7bebf706448a32881dfcc87213ab50eaddfbb158029626588ed3aa07
SHA51241ad11b64c057ae3614a50873d8f000f64208c7e69c39b15d234e3851b7dc8555dc25a58644eab4fff5b47b9d7128539f3c8764fe33f194ba497a8949bd9f06b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5273b8a7de92ffcee4ac61df5991cd4d2
SHA1eac73976683c0914b7f75c45f04648c65375bebf
SHA2568a9c22395cfd662f3cd27bdeba2e0f66ab92deb9bc1f5570965153cf86bf838d
SHA5122be5119d61eacc9a2904e22208a4baf61dd06ec881e3505b7cf6da473964f72d5274221931ceba468622feed9e644e9f44f2d7f060757bec49684cc8d8716d1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bdd655dfda0ecbd7bba0f22cf1efac2
SHA1d8d35c3545b32abb43c96c9fc55b806348fc8d05
SHA256b8005610817a3700dd93a0b3a6975eb07bd33e8f86bebddf44560194fb449274
SHA51220db321e6878ffd5ad97fdaffff111798a3137385ecdbecbe5624f7e5e86003a3884983bba146c9c3111620c2775c794f463d442f9af13ce0ded9eecbaf29e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5915403d02dcd30aaba14df9171955f7f
SHA1b6345e237a6d8b1ddb4774604883f7bc43a76a32
SHA256c05c90e905fc5346931846e8d8231ad5b3056850a132e2795ba6ef4c6e2b33e6
SHA5124f86fbaf4085c8edc521fa8b23bdf84b66740be74a908b3a5ed9d1c7257a5d9e6611a2f04da8c95e30ae8afed7240cbe5a3b2addeff6e6d17c78c7540395c78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401d5755b03f2f468de4cb6cd2fb3ce6
SHA1e0074f02176e6b34bd9544f264f054e47a681ffe
SHA25680eb8bca5adc1de29f9faaef7fb3ab968b08f047dac1c17d4628aa848277ff8d
SHA512383e1f2faf0a95a130fac8b618de07f1ee521db4e74c80be7625347fe612999f3817fd0ea8ae28d35be4321d8881003595b4c157d0b6c0f1f613dafb7fb62e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bccb737e434e50107c12cf71fc3cda91
SHA14cb6eb14ec4bf78ebeec530789f879d5c6c56cb8
SHA256c9d24a398bc6c2c9054b3c2d44765d5fdbbe343204161dd5004ec1b722334b50
SHA5128993209fd8b7666b20468e80af23613e2f9357353054935431843c26527ae20f1ed13f88fefb5debb7736d1d2fd19704128c11cb46d1397099f50801ce44f1e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2c20ae82ab3476332b556e1b64c2e2a
SHA1f13308ed4f61fcf1a66103c6d4e8d9fbdfe380f6
SHA256cef2b16fb9de963da810328f70d702f34b7da5f86f96dd28ecaa03fedcefbaba
SHA51232ee3e486644c0c66d5585affd4f733d6681b1a95abfcc4f740131a3e6d867934b3c204647a87849de017e78d1d98a5af9f2390418adca7fb833aa569fabc508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5582850b6d1c53ac9e135f703ebf70fb6
SHA1a0e1a4049ce5b362cf8324913033d28422444629
SHA256ac8944de0fba778c5efe5612e6fae95d7e9e598e43e0ead25c01891303c333c6
SHA5123f8149f0ae6afe9012b1834bee888ef30ed36e323dd281a70e5572feb4e057db451510c536dd79a815ec2cefb6fe349ad49ed8d9310e94deb8a3ded15f4e1dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a561727e9763a893d94b2114b523207e
SHA12947eab39f46e74885c30d433d83c2ca0d9ffefe
SHA256515066f1474244fc7080cb29aeb3452fb8804bb49bac1206ff39693cd6c2fa61
SHA5125d1cabca3f54fac7071593807a903af122ae42e4df55e1eac63ef3251fb61e3db93e207bac4a2f36f4bb2ee1b1d03068336301c09f332775fc8de33e91180459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5859d8d2f1670374496813ca40e04d848
SHA1dc57629931f73b2116b4ef9f0e0ff0e776d0e5bf
SHA256f2f94e534757b5e6ca56b29898f8efb9922fa9e61ba6fa683198f7804b8010b2
SHA5122a3cd85622ad0e90d918919bd8db54c75483b5cfc10783464f83b88d49e87615cc353b29823a1a7f4349bd70facabe7bc7adcc65878fc08896a92df8abdce6f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537e2adbd63f22f161ab067004279b790
SHA118f8bfd812e609c0ddab66e0c01f3dd218235307
SHA2563ed74802c725300a98edc251910308a04d0eb3c54371631c7de6857377f49c6f
SHA5127edccb8e50ce384c5963ea4f9a4b600415f462a84064fe80dbbabfff6dfc170a92652323a1cd1110b3ef382075ea6d3eec66f7d21d2af8057269870ce9bf0eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5907f33000da429bc4d31c9a65e3b46de
SHA1886f5d2e8917002c7bcf020590d97e51e37087f7
SHA256f8fff5bbe0ad5db9f7dc68961f1eb15050f55c0dcae463fd2b9c126f8c2b9dd1
SHA512e62b7880a33e1c91978db2ba750b1e6a63f2b037231936008abd5679602ee0051023e636bf0e98ea9aefe2940dde916131d8a6618e52908078abd988a0467ed8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a