Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 19:25
Static task
static1
Behavioral task
behavioral1
Sample
216217201553eefac7137ffc4d1b7150_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
216217201553eefac7137ffc4d1b7150_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
216217201553eefac7137ffc4d1b7150_JaffaCakes118.html
-
Size
17KB
-
MD5
216217201553eefac7137ffc4d1b7150
-
SHA1
f54d6cb2371be87e5fb092cbdf5b4dbbee23d63b
-
SHA256
b3b1695db2a390b16f29d139d306287b2c3e400243d7f9fcf59c0efa71fe1857
-
SHA512
c9e3530394fc1de2336d87b1a3f74a24cc11bd0b51bc0764fc4f55d86f915fb699f74c356ca2f2c31ea3d0069870174a46e8599e12113bcdd17d9d60fc7c435b
-
SSDEEP
384:Aj95mkQvRw9W2WauoUvNw0akW+iySp+oMysyB:hNhif+oqyB
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E9A18B1-0CA7-11EF-AB14-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421271793" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09f277cb4a0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005064a859130224afaecb311b8cd74c467435fd807b92e17b987c33ed0eb2fa5f000000000e8000000002000020000000fd365fd91934bdf55b563b58ed950e6a4544ede463cc10a58e0fd5099b79273a90000000fc403f8bf193ac11f4e6dcd98cebc03142fd426e3644851d9ac165d9b4ec7db501ebe355a1c714f54a2146f31579afd070b6348fd2b9b13b7827650cc17485936e1b874ffa24de46b10398aea9b721d67b18353583aa06ba0205e72e75723268a6256ef9b73b4a9430e48cf3fded97abdd0072c6be067ddb0bdc96e04e4f3cc82d34c6e50ea57b99ad1b9c0d4a87d42940000000c129aa22dd563f6b13ad12e7517baa34962bdb8e316487bcae7757a0561a3be155eaae3d36bb75f12b8e7a6d4e9782e294f9ebb6c2261157d887d5fc41b50241 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b81ee48b5656d2b455617ae17878bcb8ce6568a6b38960979f6afdc444bca3b2000000000e8000000002000020000000a483e227db1e17f9749120b30689096df7bdbe55b9721c09cacdc7e7a73df4ce20000000769b7c5acbe7225fbc7d5838b5154cc1b1031bca067a2381b7e3926dac70487b4000000005e1f0bbd9e9e2d9e0ef7fba14163615c77670c6e560a883904d954495aff17b8fdba81cdd537b38927552960a224b484ee8b3e5c9a719d176199acca518604a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2612 iexplore.exe 2612 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2332 2612 iexplore.exe 28 PID 2612 wrote to memory of 2332 2612 iexplore.exe 28 PID 2612 wrote to memory of 2332 2612 iexplore.exe 28 PID 2612 wrote to memory of 2332 2612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\216217201553eefac7137ffc4d1b7150_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b866284f670fb8007c1f38324ab09359
SHA13e5fb18b2c44378ec8385b18dd933e67b54fe03e
SHA2560210853de43f9859dcceeac5437ef68ddb7616eb17f92bbaec44da6cf8a87ebe
SHA512037f0d0ca94a6a33da40f50c4c356c1c7606e9ca0b84dd4e4cf7e36db9faddbe0e0012a74591a6c0694648c1dd89ce0565b8f67018fab86bb444854947d489ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5255359418585ee1c3c3957098a5fadc3
SHA136c052ecdeb8ae52e4ee21225b44a73e0003d5e3
SHA256da75a2652941d288db5f6a84679d342cd830fcf1ab22ba86d5a8d6cf701a9516
SHA5129e0a1af138a95d7bf96c234e2cf7ca65e45dff5d63daf37b5a37e84298d97d728f36a6d6819a1d969276454d39a9f8a1bea8497555e705c62972f29bdc987852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561f61acd833c48af8fa791a78f5e8c8e
SHA15a6b292ee017030065b8ca58d8b0fb4c27addbd1
SHA2565f3b64b4e8f6543d70286870450aa76e18921dd79b5a74d30b86ca34ab017dc5
SHA512e66c7212811b70c8dba8c3936b81bd138dfed81d1c7a1c6794fb947c7768f4c57843d0b6325a5bc0bdc3ddf9d85c4d8ce8de36b695fb59612644763d273348e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af819c913c0bd513beefde2becbf1118
SHA1ac84a8a0c1c129290cdda0f0479df72e0d15fd09
SHA256c56edff820aaf32b1e7adc06aa174c1af3bef7f34360f15b61e14ed08b50fd73
SHA5125bda1691c9bd413d091af845eed88305adca91e725fd60b8b6419b43b9b1ab42170738625148c6f6e011e66896de90bc190b156fc7b65288bb3d439faae6a143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b6025d4431ac9a34dd5092b25ab3dd2
SHA14290a0f8439a8463e0c2c7b5f127e78ef92af6dd
SHA2563872a5ff327ac161a0849c0f5963e3e57db839ee0c58cab0d13f479d181118d1
SHA512682553966dd733be4b9cc17866b5e7e93af9ab907f9c060274b0122fe243e337473bfa0a5121b6919c2b573f71b2600a9a667be25a84586f4895a861a6cd3707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c049d3cae7fa88ce9fc5564c661311fa
SHA152a28618b44866347037c6ebf0bde8a723a21b9c
SHA256cf09984bfc1b38a3fdeed8244969999c4d5e6dce1cb5dfe73e8ccb222f3f263e
SHA5122840332ae305da1644507ff2e70b9d081deda080db340c45ae0671cdd1041e7aaff2c454deaeb170c25df0ef9e354318db91fbe0ef31a611ffd8aa8e95f6b0b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf4cb53fc4cec27fb3e7db7920442ee4
SHA186154449cacabddfe3c248e337e800c58590fdbf
SHA256a3c42c5862811178b0a2d0a17b7fe9ae58eb85c4ed919daf2e272f0814da6d84
SHA5122e18a4bdb80f29b6da325aec31216c9a0f6c4b728171c58dfe91c3ea5ec9b7930070077eefee3dec230002e744ef61ee4d185515979c40f3c4bb402e51fe303c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c16afbaccd75778124d787fbdf1404e2
SHA1528919da5584b758f2bb54bad92f6a36ef72a336
SHA256966bf1cb328c7a667101f71e386294d1aaa472ddeaf49bbef2e8cbeca4ef35ab
SHA5127e33c8a13a0b77c0ae9fa1cfd29f346044992fa3dcbfb0b9df8a6334aaf7d7a9fc25b3762cf93e416a378c59e9e467598e2469eda078476ade4d010ecf7a22fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52341e20b67fd87b448f6cd4194f14aaa
SHA1072bc985509d5779fd917930d4061b24811b7b31
SHA256c337db9f995ca1da7983282a3ec085c704dba086542a847b6d989abe5e73fe2e
SHA512adb29655ac6140be7189c478040dfba0d586e94689d2cadde23b93d41f444e4a273419d27ce088d63b1c7ddf251ec4a4989aa8bb6715fbc8969142ac9e4b78ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52289f645ddfc76ead8e4083ddbdc476c
SHA175b5b78b2eb21acc65e4f67826827466cff54cb5
SHA25655555aedf7a3aa2703d80acaccc39fba13e12e6a71cfd1ca9957199a5c59237b
SHA512937537bba927534eadda4e5db81ad4a79524428f6a4a86ece06ec571299ee38f12163abde3d61e341a1eec3c05abc1cbd92d988b71cf2dc990bc1258937d5a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b92711a49b7884d4d581f44b83ad12f
SHA19520c8858036d9f7e9f651fecce4306d5ab965b7
SHA256ea24dac6ac09dc7fff761f3b4d4e2fcd3316813debca7d77e9dc22d20b3bc012
SHA5120f03a016e2772849b5d23a76266d0fce2597c850d7d48d34b552d143b6c9004e8362e0cc9f3f0ed4b5ba867b96e86c2e2ea9ad871113ea874472a907aa83582c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58037521d14907cb47d5b8ab04a49f879
SHA17d742d93d22f669b8e4c627f1cac4a3d3fcd17bd
SHA25635c0f6159ca6c0d4467e329a87ee9c41dd8a4187461b9839810373d9d5e78c01
SHA51228d6eadfe155802a44c1883c7112d78e56491b8e1814e21b55ab653273db8f43bee4088af7c8695c034d9a17251143a3cfb9a6a359faab7ac679b187b41e8bda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5641711d23411372e3f870b1f7da9aef8
SHA122055d77ab4ba81854e638a0df8a7e0c3c0b194c
SHA256547420680e083d4eb4888831c465e391b34453cf61dfe3893853dc4b9d7252dc
SHA512f81f2858be75be90a37408d9f7bdc573f76c3d0f8461a3fdea22fa66fe4ef02708201f6e81a98f75df3b09ff9503cc5016a2ffc57614425a75f4ce32283d8809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5100ef24d38ad77d87bc70f60de517cbd
SHA178eedd72f1320ba6bf945b4380e07743b383a1d2
SHA256ac1cb5c0471401af952efb04a2065664bb711e5dedae64d04be95b42f657c759
SHA5129917fef6026e74f1b93b5c3804a42e21dfc885fcdd342d78cb4c50a332174d54a695f1d1b7abb0c70e485a3b55abfce34151db96b468ae80ca501a84c77086e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5137a3b7381604f877e0691b73fa11a53
SHA16f086d5df5358069d9ad3b0923be32ab8726c5e3
SHA2565a3ffdc4d37b299b8b729cb679b9373cae7b08374dcf690310efb7e4dbf8a062
SHA51207dfb2f6f3e552cfb3b0753a0a8fed0f7c5be3a25873487831f0aa66c9a83cd79e6f81a39cafb28716324a809fd08365ae95148cffc122e832d9988c018e1865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56236b8d312ff1b7ee87ae17c0747f351
SHA17be7a8b3fc031538c9e6a302bc7e529a8d9b3f8c
SHA256dc888d0ecef9bd1bcb96ceecea1d2b05d5ddab126d4b54968bcde2c816caced0
SHA512b510e113c6eb160ff5564518ec210e0d98278a108b0efab18372faa221b968c822be43f7374c6d330f658dc69abe9dbc0c0f7ac0c597ee2bef4b1a3a556ba2e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53565a51287b0f56757f5eb0bb0120465
SHA1e09030ca8db752b00122124b58461549db051685
SHA2563bd0e1e4336b47c38d78e2970fde091876243f61ffa77c15ca8ec703bc246f81
SHA5129c008d4a94ff840b0e032d3e01e407c8876082a39e42fa8759f3251d17608fc1e57e4ce07363218c8b40fffc28a5e46ce47c8b36fb3f61cb66d0efaf29e86e38
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a