Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 14:55
Static task
static1
Behavioral task
behavioral1
Sample
20ddd9acd60adda530e234466a65a1df_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20ddd9acd60adda530e234466a65a1df_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
20ddd9acd60adda530e234466a65a1df_JaffaCakes118.html
-
Size
461KB
-
MD5
20ddd9acd60adda530e234466a65a1df
-
SHA1
c908d39a08938c4fc950278cab1c50e267528d54
-
SHA256
33e3ed28c7591ce148cb0c04240cabf839e814109c0a460f8ba62615b5921781
-
SHA512
2fcd03dde23a6a7f5f5e2d05edfcbbd606231090651d6de7707f4e72338a3566c393e20c0180fbc74b85e63c81b64fe40c658db84f9ad4df762c203070478253
-
SSDEEP
6144:SlsMYod+X3oI+YLsMYod+X3oI+YyRcsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3F5d+X3N5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421255619" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c28cb8373f2d51d81c94f9e08e4cd31760f6a68768beb7c66a730cf9f325f007000000000e8000000002000020000000f51d17fd462fad47671bb62a06f2706220cb6f2ee1702a111477e5bc2a23829420000000c12194697fd36d9502fd21563be26e798e2def59550e9269a14d74479234c22140000000bb3a5af2a483af7da255e066e7e01da4ca2fcbcdb6214e0fe6395859f0be38523dde738e95e3c3ad57325528c4feddb6daea1eb890ba07f9f626f2cb690ad2f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E58DF901-0C81-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503f1fbe8ea0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000800673a821c77994a0dd36ec85fc1192dd72dce06a19605280dc72cb44ddb062000000000e8000000002000020000000d6b91b78b02998d8038a4a6174cd87f1cb76986398d75253ab6211df5806f14b9000000094f1284d384c070684b00a73832c1823c965a27798b211cb6bb40dba839fcc5a1307acb7866adccb8450dffc7173d2f8ef90d259f8d186c8e14e314bee645e7f2aff4ea523cd640ae727979e555c930ec60914ec74b97b4e899bb15d034479396fbdac29cca1dadeacbadad204d976305da0638ead714c214f2c685534207a0ac97d530986e7ba1fd75ab9f39def58db400000001f2b7b587e105b5f2f6d3cd77881a7af311da124f3817cb21df9b9409db6b7a1ee704d78bc09c239f5e8e0a1b081f2ddf74f33146b711729b58a50d170a58da5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2612 2204 iexplore.exe 28 PID 2204 wrote to memory of 2612 2204 iexplore.exe 28 PID 2204 wrote to memory of 2612 2204 iexplore.exe 28 PID 2204 wrote to memory of 2612 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20ddd9acd60adda530e234466a65a1df_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b68f82ee80b4f8e277bc2ee2ae6f460
SHA1caf3281945d6615c9efe890b6855df2c733daf5d
SHA25641d9ff549ca794e260a4f09937cdbd26eae1ad3ea4c767ca6098de040ee9095d
SHA51206afc9b5157b9dafaffaf41be9a36979087f5d2edea989aebc0729b5fcc3d36fcbf632639b38be7ee83e38afe00624222123c5ac3fcaba1219d9405e8f70993f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b35f776b6aaaafbac0b9acf3ee35fe0
SHA12573a9df9e1c055c290ecdf5591cf4c8588bbcbf
SHA2568556877897587cca222e601a79ed465c1a0618955114e469ba7d671eb0844f28
SHA512efba5015bee2cb955cb609c2cf28ca1dbd386c004c0f3158105ab8f3a9be9cad67dd8a23b16ad3d63f0852beff9a43c7a18d2ed4bc7f9a51ce9bc994faf48307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595dbbe8045a5a496fc26678d55c45f0c
SHA1d0921401fcc247bd7066daf0befcfccc1df86a13
SHA2567ceb04ee91b4d38cb360d6b6e8790a047c5870d8162271f408ff4e32b978f808
SHA512225870959ff2f5b8e8d69b305fba795c410c07b96c1e3bd28c4e2baff6c4100aa3b2a65fc32441f6f3977752fbce0b21e67565671fcd553aad41853e090ad56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5961ee8d921050096cd182952c3ae1e11
SHA1ca29c2bb4cddf7ceaeeec73e3c4ee679aec97038
SHA256df71ce29cd9d1019c14caf7a1e5ae8d82be584c89460642461121517b30f0214
SHA51279437bef367a53d4a82906a8cd96c31b16308704f45a595d9a6e39909d6bc895487ac0c4aa0f515d87b7318acb0f55435bdcc8f2bac5cd31e4bd8dfc0d0ee02b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3dcb1a74fb7e008ebe3f748c76dd550
SHA112e5868690cf5812bdf0c90fe984ea40d30290fc
SHA256678fa094651e15d8ca4327961c208452742affc59cd039004afbd9642e9925a0
SHA5121f2d1e0f63a33597384226a1b2b40c77393e121a195d16e5f4f7fc602d23a31cef7fb068a6e3ece3be48406d4261e1922dba5a633e86be55e766a4762a8086d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529cefe2a31cbaa726bd689cf02fc2f27
SHA1187785210f4c1b1d4bf8855eda9c329bb6c6763a
SHA256b71e6686a6ba895c06ccc3ab8e1ab7f1466cd716d830678a0e47b21a04cf94b7
SHA512b129b494596ded36e8b619ddbe49aba972c4445cd21364c9ba94dde67661b4b12cb2375d0d577ebcb16357e9a28284e53c9a8f095e82e12e4846ddc6fe1a0bb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550aca6c9aee7361704c2aa14b19d51ba
SHA19514d1863b13135b9d043bc7ec53f7ab9cba0521
SHA256db7f93bcec53665acce2c34bebffef60bcc54b98ee911266c8043afc2bbeff0e
SHA512c61906f007bfa1a7074a14d9b3d047cd0a651d808a50822f19ce3b821e68f4bee2ccd3ba29d0e6240922401ac42c7e6aac803c97dde15c782a0020debcf59020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8cebff6cbe78c821c1408572bbb2736
SHA1dd81bb428a8c1296c98b40468c2ea663e56cde7f
SHA256d505fe6ca202dcbcfe506a8e03fbd957cb3b55600d9edd521d0d466622712e38
SHA5125380c67b2535d6a5571f9f768ca29825c7ee07e05b1d7be4fa6ed4b007de830777641f62532d8092b362070d4d70c30efb05f8c7079590fc702cf42b41560665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3e7141abb7fd0f07ba72b129f8a4eb2
SHA1cfb0776106320048533a06ff513aedd76c38227c
SHA25602878abdc5661ffa77396927c648294ee5a7224de181091a5e4f8d381db1c594
SHA51270d30c426a6dd31a9d7af0a2f1706861df5b5e02256013a36d26a383ef996b60da9f8b423b7fab4946f606730aec3ded4215219dd4b7cbdd60fc6c9b74896d5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598ae3a7408243aaa6a7d445420b10020
SHA177fd1adf36d2c8f382591b6f735a9377b7a44037
SHA256decb548019208ca45c95d517f7626b664b29c055b5cad91a83bf4cbb8539bf31
SHA51264a88c71df7e7cb7a4707dc343597c006da97cb60256698fef802e66a5a80dc530802e7c5ae99e0339542fc897b0135e99b5bc1a976ad6f684d44886de9a6287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b69548a1ff316fdbba048d296052117
SHA1d1d2d92433b51278c59cfca3370d4d3274d534fa
SHA256d948612a4633afb90b600a4330edfac65ca382a32a9a6fc95b9442f0afd51b71
SHA5120c598e0f3ead15f58617dd9a3ee6434b774b3f28691a806a553481f85698d603bc9af105722a759de8faffe276e0b3567d283581b7e0190a559a6d517fe727f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bfccea1965f19a6625e369e0d99ebdd
SHA1d7b7483a017c61cc33162bfbfeb069a82beff0f0
SHA2562f6b5936991ea2021b6c9d83db0f9bd6fa6d5a3dc3766bfb10839323aba6b530
SHA5122b6cf70331f6c582150d75ea77b31d37b612b4f63f98ec88d185a3460fb6e48f7cf28809e2720f5ebb77fac0f915034ae7d5039e6d5f0a0bc3e427104416c63e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aabc60cff8b8228d68f8a83a7599415d
SHA14850df3c1ed8b5adf0f999f55a4e4175f44ff01c
SHA256a069a8d4cf476bfd080731c5305b0ad38501b6bced8b73e9fc85484ef169dddc
SHA512690951a1dfcc31bbe80d623b094f50de06969ec722772190f5bd58d51434dc5aef3a10512c32019ac590ec3e92647583a7e88db26acd6a86589ad73965ac6936
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d43ea6f6c2e8ddfba2f25b07a8544e98
SHA1271a96b6de1019538c582c41832055e004ab06e7
SHA256ca94e1525d37fc91989cedcc46ccda61fe66b93e24ea755cd809f7ca0dd0541a
SHA5121ffaa3cf789c2ffebb983bedb84d7e98223860ca682962a3a3aa1b02a63c228051dca395b2666e099b065b43fc50e365e20a8a8cee227db06742778377981d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fec04eb68b69cebdb122fb0e1b46c7ef
SHA1d82f1282bbb9ff2a3fea10968b75578b8495b5ab
SHA256823ef696f800020ea27d87f005b9628fb21515cd79f9a2ccca0c986af272e0ad
SHA512780cc56902ff0839d0d6cf685a2cf387c6a6d9e41b9d6c788a4f39fcfa6b7c9f6f0d3b94d7111ebf33672b778866a59c7ad5bdac94e14f301e410b53db95cd8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589285190521d332e39358c4edf7999be
SHA1d8ad73b109c58839cae7939d3940a94a7e1afe94
SHA25671d0f955760b524c3e96de3be9df9b19d47b61c9c36159ecbeb24e6974fd4ec0
SHA5125df7a78596c809fe182e36f47f9e3095dec7eaf22047962b0d36300fb60c41890ec217ffc1c1b3207346ab5141dfb9fc26e13993de211eb831e4c4d737650ae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c107c642af2800ae9bf31ee950379c4b
SHA18a8e99b4eb434afe8854a4223af72c50305936a4
SHA256684a08f4a841fd8941d10ed818dad586184a58cb61a731f57d965310da36edbe
SHA512cdd2e21efa52a2ba34c9ea3e8cbeaddbcb97c714c39f9d3b6c41e5a8c21f5829ef249b43979cdec81d399fd0e0ebcf32b6c12b4a8794bb33bfac7dcea05aef14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cddf7fa01a2eb4b01009042de0a2adb
SHA1a5c8257773d99fa63f4169f763660dfb1ac213b7
SHA256df92bd9f2982c70ce444d174d934535553d89ef540860e46c5d70ae9b2935d1c
SHA51295bbd9cfe28d9817761a527b5b3e7f21ce8cdae95953dc46cea08199ce5c4226408b5fb91a9c8e90f6376423a3e78cefeeb9e368bffa6c3c88c1e065ecb44a85
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a