Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
211d45c9efab14eca70194cbdc1f8ae7_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
211d45c9efab14eca70194cbdc1f8ae7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
211d45c9efab14eca70194cbdc1f8ae7_JaffaCakes118.html
-
Size
463KB
-
MD5
211d45c9efab14eca70194cbdc1f8ae7
-
SHA1
365d4a9b334f92efddc2a5729b04d1eb5a312edf
-
SHA256
fb78704b196f55ef8883412b173074bea50941fbd631951018e759887ae5eb17
-
SHA512
85a6c3087b965406c5957cea25ed3d7e3cbb9256e23a73d2f9a2b49684a38ca53adcc823387e71d847cc3506f0558f821dbd2319cc781fc9a68073e65a8b9da2
-
SSDEEP
6144:SjsMYod+X3oI+YbsMYod+X3oI+Y/sMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X395d+X3B5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8EA5501-0C92-11EF-8554-DE288D05BF47} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e60901cf6c311c36e9b47efc210e1db3ad20954ede6679aeda3fc5d4ccbf3b6a000000000e8000000002000020000000757c83099408847c1ca94ad603ddfcad04e6e2d96060da6764d9e6ced2faf4a790000000064f6d82cf9d02ece42c761501329ca6f94426ecc67f71b666e572b6e016c728ff6e9dbe7f2afb6bd7d3c496be2ec5f94d74d04ef7fec227cfb71ce704eafcb7201ecab7a6286cc23569bfeb48c7f6cabdf8b911396b4dbde7846d14c34f95481ca444ca757adf155ccbce7423bd057a0ccb545fd12c7a77d79ada589bb16ad1801df859cffe037641fe430338458cae4000000080347152dfbdede237f40bd5aa32dec5616206c0e3cc17d06e91117a1b697b0c95425780f4a60464c79eb0d443c9c554991df06fcdcba82f7ce8cecfa198c4bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000a97515a25c7a95a234a71dd1d402dee93ed267cac4f1623b11809d40d2c9c75000000000e800000000200002000000059aca7849f34a8b7711989470879483f1c602e29a495b05aac6223c872340dde2000000010fe9f7bdf92c43b502fa1aa8138a5a9d0a2e70d538682c760fb1fd09e72a4c34000000086cf790fb8db96f2ff82993d012d87f206a8c500b1416377e8b227bdac2f390b7e0155a963cbc383d2bc14319f91f2b5a41e20216859e55c40d5338c6222aa86 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903d7bd19fa0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421262952" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2804 1724 iexplore.exe 28 PID 1724 wrote to memory of 2804 1724 iexplore.exe 28 PID 1724 wrote to memory of 2804 1724 iexplore.exe 28 PID 1724 wrote to memory of 2804 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\211d45c9efab14eca70194cbdc1f8ae7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562f07aeca68a9396d0d965c3124011be
SHA16acfcd6ab2a59db5cfa29499cb1fe2447e78bf87
SHA256e084bb03e826433090690d6c31ee4a5c12b0a5c9476b54d551910f4d8cd5bde1
SHA51290f071aec638cbb61797cc1eee8934584f5f442316c4add7f3acb3b0cc59e73152100ece9609e0fe17a94210fde7f2d921ab46abd42feb5c45f2da8e351c4aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ce6e03f62bcc234493efeeaf224442
SHA1b7a4f14369a91f4a3725cefc8c3820e373d40986
SHA2566be9789aa07de41b88079912f49846c09f70cc8a865f163833d57bf3c4a4660d
SHA5128172de6e2bdf8cc00339d90693ef52b25c2f3f9e84ba2d538bf0d70f2a3c1c45e1a9c57cdc73a17478efb94852f3b0dbeaab96685559bffe43cb9134768fca2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5672b11b5a93c11c2d5c4269764118fbd
SHA1fd6d39271f0df20bd3fd061f3fd2b435452e14f2
SHA25691e1df3b8c0d14a7b1ceefd6e339ace4043be7d9b8665614eaf62f074c357e68
SHA512c3122cd7b050977f33c10cdd7f546610eef17a728c6bdba494c8a6c1221bbe4152c61aaf15367e0511e07908a461f1d936dcd7ffc6c4608d0a59846c5fe5b29a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b4091c375bdbe54f9eec4b3e088a5bc
SHA16e0a3e6ca2a455b78a9ea7ec92c3485da5c3cb0b
SHA2569cf7684136e3d78dba1a669325bd30d8159623fb6db80f39a4c79bb60f6f4797
SHA5127def33811860d38e26801eb99340dbe65d5ae5ede74a35b89d379f4b344acf84e3912ddac5df8b89e4be1697f7f0371ba97c74c80a53d6cf0515a42115a30031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c0f031ffefc900ed3e9266817b7bff4
SHA1a1a55aef7eacf7423179609f6e917c4a7494d01b
SHA256126192ea82c79a315b6e9c6ed0c25d864169b0f784aa0ee1fdc3a6e2a04efea6
SHA51284987a50d641a73da763a566aadcb453f304788bea50d06fa3e112c750427d61fc9294358174c1818f558b57df4ef21f49c8b703c8e5f20860aa242b1984623b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580330069dd31a5acf7024d7de759f789
SHA1d47dd6d89a651389908c6185e265c8a54e520346
SHA256817da917fc022ca0dbf20708c3da2544f954d2f120bb1f7cf70c2f5bf55d14c4
SHA512dfc0839d5dc5d1036bc386cf445443d5412eb3cdfa0d96ff090e5c820f290ecd44246c89012211ad9cf3ec7351ea2e7ac6f641d2d7773e47479c633693741d43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3dfc1c2c23f4350b611178f63631907
SHA1682590a05f7dd366856046f9d7e1443f2f5a0656
SHA2562a7885e4af5b395079f331a9c635dce9206da284b9bf5026ee63375152b1a24c
SHA51224d5ec32865706831d4ace09f020cd596f8792cdfee17fdfbaf802604535fbddb2df5f1fee308f485b53ef821f1518638c79274df0877e63909687fb2a999cc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550b73ac684af717469d59e40f6a8eed1
SHA1c612666dd5c72c3be03601aa0bac11c8cf3d75f8
SHA256a4eaf7ab005e0d13e2f2cf677cebb3be370ad39cc49a19fef56977d0a8d1131c
SHA512ef5c2e56cd58dbb6dd1f2ce5e5356a711f3c80eeffd3ed2cd7babd78ba0a8b4efe3029d5a8d3fffad427b1d43a833e864a3dbe84a00c87f2df7750b01282a544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0525209cc082818586fa3fdc8f8b525
SHA10964dfad86887beca25f0a1b372a3a2612c93775
SHA256c1558f8cf90bf4a8cab8dc377868e5f144c2d063ef9a793d40457e2cce210d24
SHA5121924e5317169b98ace05c306bcd92028de0d614b9e1cc4f12fca9076f4726c36051ca08458019f12bbde9ca1370f5807818235055dcf58a4173f7e53c5d8612c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52413fb019a5c99b8120b29a77ed5926c
SHA13eeaa7f5f71bfa3931bc6e78f8e7e9c2bf079bcb
SHA25693cb1b087238bd52aa9dcb606bac8c408aa28494744813909ca9b7ca41ab92f1
SHA5124fe6dc6dc3cf78bd179795ac095f0c5d17e6938cdb9f6ec437681e8abda2f1e8d3256252dc5e7a03a95c0d97adcc5d667e63fc2f577bc2285698d7b0c5433988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5867f68746e9656d4f412478d3fe74dbf
SHA13c60eba0144d6e5251b97c7cc91dc50b52a8ec9c
SHA256720d6a3481dc2cd86708778838ce5c6bd2df07ca493707cec1d464398edd07cd
SHA512d9a82a595b532d537096d1a757d424b39dd655c7396fbab9d9e8d98211992a8f87dab2bdcc3ed628b43a688165e9c9ba3f5484901936eeccfbc996686df64ac3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7f91915228fc933c3cce1d34d3348ed
SHA1d142e727dcc893cb003b261c4ed8f94da712dc56
SHA256059d4a62b79e56876fed237538e7a55b1a89c34628bc6e5dd499b7e43de9b182
SHA5125f58b94f38654786bd0c302c851c1d596960451e4783ea86a13b0aa35106640a0cd70f5d4e9141159cb3c3ce27da4c3e8d98657bd32711fdc63e857624ba657b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcabf24a3880c9c0cae886bdfe758e7c
SHA1ae707595aa2541a6ecdde4403b3ec660fd952114
SHA2563f2b74d2b1897a1fd5a660dde732319f3c3ea9a084056d24e7343a584dcade4a
SHA512228bafc825e735022eb611349fd2eac822c904b2c414d2f4e8ab501b4a382347cff0a7febc8c738ddf96912a19539129c40ddc59f08bd84c0a46a1027b5d1c2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50894470e353faf6cf6c9b4ec244d5b5e
SHA1f888794529cf3edda51a4add84e355267ad76322
SHA25654e4be9cc33f42bdf4f387de8f74a383fddc16e75821731dd5fb79402affcdbe
SHA512f8eb31eb3a19648ff8f5c0e837fddc7070013a18adf1fe10cfa6799a6975288124ddcc75ae15044764840eed9403d4aa9b7e3229457ebf16686b40b437140238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9bb30bcd61da61cbc2db3b488a80008
SHA1654c1e0e7bd0a897be734162daebed04ca8745b8
SHA25601d6db09e86a8a775261de19f8b55290711a3e7f90365027a316693134e2dc10
SHA5125851f1479d023d6b876adeab96eb94934ab895acd86545d9936fd96ea031f2cb1137ccf1133488ba6f8fec379b2d185023df5f6fa7215641c6ad1b4147f66287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5672c00b3db93c6a32dfce132d621bd09
SHA11839fe3199b29bff4c9bedf353c6b5ce51e4a242
SHA256daf29f8ae4959dfbf48504319058ad9eb9b730a25fce802e1def86bb9eecd67a
SHA512d7e11f6fd6363089ecc71b2d279dea88ada56ce65bcc11056327d5826b009c9584510cdd4e64b8020213c298205221caf488c0285c2cad207e927039b5f98f45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bab09711128d3382fbe47a7971dc7862
SHA10837c447c2f43c3d04fd86d5c70621ba73ef4055
SHA256f3c2f9591e63809efc27787e637a61c7bd3966c68bf5a5e88c8ed31e4e4e7899
SHA512d57a4f9d7607864b73e5d5df4a3ec9f658086093018e342e0ffa21257ee6bd410f93c44adbfcf0743c59f0fa63fc2d1a0893298140dcc847b44f8e5d98e8594b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85385cbe640276aa50456b4259af31d
SHA13d8ee1bc871ab75466425870519c1eb2216ae0fc
SHA256e41daad34e1377d356f4ad2854989d1b84440431e9d589b5cee7e403198155fe
SHA512a4974d643b76a32929325924bb62f3b9f3b03a9a0682fce950f81b89905ff7ca6dcf28ac531e94731b074f8d27ebdeda95424c76db6e3c06bbc154ad5561d6de
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a