Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 23:47
Static task
static1
Behavioral task
behavioral1
Sample
274a126d22bb329d947b0e47bb0d6df4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
274a126d22bb329d947b0e47bb0d6df4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
274a126d22bb329d947b0e47bb0d6df4_JaffaCakes118.html
-
Size
460KB
-
MD5
274a126d22bb329d947b0e47bb0d6df4
-
SHA1
188934d4cca0a4faa867f79ea5ebd50442c444db
-
SHA256
1ac3d0871251b3b2d45a878b46128689b9fd7ce5709c652b2bcf078f0f0302b8
-
SHA512
cafed252a8ece9ab81a77732622334f1a810bf7376fea0fdf7c2864201ff2d3c8edca258ea557a760ddc05465fd67f2ae0a26bece965facbafbd1b0b530cda9d
-
SSDEEP
6144:S8sMYod+X3oI+YisMYod+X3oI+YAsMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3G5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000cc2dd55703db6ad38e5af9cd85dfd2ab965a40ac3d2f0dedc8a9301e374d77f000000000e8000000002000020000000651b8d7cad9513e78fb827619c8a874c3ceb7082324b97f4434abb6d4d9e058c200000004752c7c38f0147038132048f8fc07ab885df53a2d5564fb4b37239331187560e400000005b978f8b7ebdb477159c563765eac139e901686f5d14402050f248e82ffc9a66025e71728a39baa73e93710ee45ff7bf88df238e48a61917d7eb4c05c22fe779 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61ECDD41-0D95-11EF-BCB4-4AADDC6219DF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01b8b3aa2a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421373940" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b5e70ca66919dead51b947b31d7547681f0a1a15aa3003bb56bde78065aae0da000000000e800000000200002000000088eab7d514d2d050cca94542dc566f437a9c9fc2efec376931213b32c27042f9900000001d61a28371dedfd04bfcc2ccf07595cdbdb9ef8eecac9ad1a6145d231a1f7725c467f19ee82c6f56bde43054a3ff677e2bf07dccadc55bd73d615b12d7846922cd2b5513c7261e12defb5f5fdb58840d76ef74b89ae30b5c8a5fe506cfb406595b9900e25e1d0f605ac365d2412b87e342b85d1a3ac598f996c399d6354667bb28de42f15b75e82c2f79297e3e4bb0594000000095ff472ddc3ff610c3d8d7efd783fafeca547d4ff5ae0ef7a4d0b01f5735d2c901379f9455a802292fd1f7a4d84ecc9e844620b78f0bd9b7b1e5cd0954f734cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1712 iexplore.exe 1712 iexplore.exe 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2980 1712 iexplore.exe 28 PID 1712 wrote to memory of 2980 1712 iexplore.exe 28 PID 1712 wrote to memory of 2980 1712 iexplore.exe 28 PID 1712 wrote to memory of 2980 1712 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\274a126d22bb329d947b0e47bb0d6df4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527e7446e9064c47059f6f838f44e1608
SHA147b1cf7f284a2a7be301ffc645e4232c5f83c30f
SHA256f9c586c09aff79f4e31c6ef589018bc053cdd5802c61e9ec7f61968b0e7243d6
SHA5120d5fe46d9e23d5a6ac2b7085c0242f95a18f690570e2ee7d72faf0d51bd56dab6999561154a4e75a0839059fac87534e0f0ed6df81c02e019e8c4ebfaa15c4f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53af21fdb0558f2d9d5a3a09971ca3b7f
SHA1e979a7664a2d1d9974a5f7e388c5d0a05d96599a
SHA2569ebf1a5a84576267c5dfb9b189aad5281ce9b355a1156f351d7dd5f599136b3c
SHA512cc49181bb62a171a11f894e698d9a586096502b85466b7e458f4cf93cd39f2997642f4e5ef53d3d4399cf8c68345f6693bb843d583bebfc87271675aa57abf7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e83a42b5b391b7a78b9dfcc4ba547aca
SHA1f7f3d03b184eb380209754e30ad84756d10c2071
SHA2561bbd0d5f6e1ef4ef87a9cab722eaaea10ce2fab31a522027ce208e2600eeb4b1
SHA512ec86276dcac9e4adf95fb13c3b5f40db656269a9003ef9eb1f370c59a304da3b63315a4aa436506b2e20279f7d5073c2aa79dd695cf0c50413e0cb66fcbbcddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a77072ca17643186a9433c285f7075e2
SHA1ec7f6774b24dd8e09945a9da0068e6aa4ee8dc13
SHA256206b6097a361fd46fe66d7948c7b6c4d444bc2cd9f2e856aa4266768f0bd1446
SHA512a5bc29bac9701e077e57ebae732b47c246c1eecc3db3b7e38d0a591c3467e44e91c494a8155098cb0e4d4613bb0c8d23f5134bd341be991da523ee5a0f30289c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51401740663a8351fe195563eaa4bdddb
SHA15bc03af85510385e76af09e36e2f0157012c7796
SHA25683d4cd30a57423cb0359254e1a9263e89d5349cd1a1617d27d0e7fadee16bb44
SHA512707ad2053a87cd2fa79e2242002ab194067dbd883bc09f5bbcb7905dd8c68edd1b5c2eab1e3af865cb81742ec5fb94e53443ad1321fcbd7108848a1601bde24d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8c74be68a9ad091768aecbd0d84a656
SHA16442dacd2349828e2bbace0426fe6c3ee229534d
SHA2560de43567bfb43ed6ec82d0bf2d0df651077cf7a7ae6e49b4c092bdd9ec238456
SHA5125bff7f44f78ccafaa912db98b5367fdb1d6e6189f817129293516c34e7208c280901a9e1c48adb6c31fe3b828d793613d1dea37ecb79b0a90eafc6ef5cf88ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dd5f8b3cb018c57ec04ca1ebfb4f6f9
SHA187761ae7f2ae521e89ad8d6f78bcddaa0b8866dc
SHA2561cc77f00c15d897795e84fc03c10544c16f6d8fc9fbed5aa63bb7e78b71ad448
SHA512a2d86aa2dd0540f227334b87e498e257e2c66e3da815ae1279325b53b669fe418cfd8644935c60f3d7ccffdb419a15564d418f548fd552b88a3bb5f058330637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f27221df80328d85b4173e56c8b83f22
SHA16fac7769978dd61adb43e276b5920d4f749239c0
SHA256a95a7fdf7043ea005a4e1d00a325c27d58af9d197bfd86b7ffc957b10ba1a5dc
SHA5126259b4e2bb114c8ec78be324446cb8a0c778a3b558a09b59c974779b12ac458d3660622461b7102832bf962258c72a8a7ca0b9a65cf2268c30d78cb1fae0e858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5359b1d68b6d7ae23fb81abb270699a27
SHA1cf6994f5e88538110726b3cdce49082b47824e45
SHA25678c46b0fbe226add9936202d3072cf9a937b3d02fb7aad28c6bd330b04e284a0
SHA512ba3d00ea9a22aad84f01e0b1e52270d0f70ee4316fcd09bf3dd436a3ead6768684d2ea709d08175f6ec736e5807af69345d98802fa49623d142001073e6a9f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500b03b71ff97c413b0bdb67662860717
SHA10a722ad6b116088c7b2aee7ab89c5d25f1a885d3
SHA256f54c740f4a3cb1db1128912abb824c33be9e298b4da3fb0f5e666adaecee6506
SHA5120512a0bc97efdd83408568e9c1aae3b647669b77c3fcf1acd3b33b66fd835190c2a80dcfa8ee63d30d09cbb79e95e546d6126c90aceac055f1e20a7097857314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b40ba73089cf128b28f29e9ce9079441
SHA1354985eb859818c6e357c89ec491a6d2bc69c198
SHA256b25631e0b65ca443053b50805392236ca0ad48c3698bd38067826d7ad66b502e
SHA51230d023c94d1a84528bfbb37aa8dcdcfd42ad07b8af547db70ebc5cbc7abc785492da5bae4da676c9a8fafa062c6dd5ad77e5e601d39a9da6ae5d812346aae271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5910358beca89bfe6c0344e5e8c6b20a0
SHA1771a64eeea80f3702ab0bd905580b5f137bc9751
SHA25636ae7851f189f2d1e56ff150bafc42966b47abe664737b8480de429188ff0589
SHA5126cedc4d3fedd1ce6dcccd1267c70a117b0bdfc8d9b8099fbd0935edd25d392b86358b9461f57557337828195c0e336612eb7250e3d29a0fb0e9e7b7408d8218f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb9425e723043b785ef9c6b77d4eca52
SHA1fc95b940daaad363cd8e424d22159c213da7318e
SHA256a109e52c108c7b61b464d67278de8facf3fab538623849942dfde13b08c98640
SHA512ff258972ea34b294416c11e113955e0b8bad207d24e73ac4efbb4d64488d0e87f48b98fa1a28864385809a1b2683b02f68e84ec0e84239697777ae2451c853e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520270fed2746a1e2920b1763ab3da41c
SHA192e34c56647fee0465d60366dcbc0aaea0211a3c
SHA256cb3054cfcdad2a4460f4af2faef44b571a56f2aad2d6513a5e5a14e47e34c3b3
SHA51242ff4b87f9b3f937ace44bf88ea1afd80fbb27a3985f896036abd8a07b5e75996cd29f90c92ad801a7c61645de470b0eb7398c595b21268b53796a65dfca4b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5250f5fe458ee3317530776a5580de621
SHA173acc39cebb82f2bd211f1a6148c16cc4168f8e2
SHA2561d15a8b3377c7e652b099fca61193a762761cfc0833877f403bfdc055cb1f42c
SHA512422875e514c5a8f7437eb168d4464324ec14cf69404379d36fb8366d6ce94f24faa41b39c93c8824ff18516841e99747ab0889c240960a30f3a56c3d008f3b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad1c126a0000a72b288a5bf992750785
SHA147ec2e7aec25d420439e1c7b02083360c6926093
SHA256fadac50b4da63394416bdc142ddf6900164c25ba12ae7fde68aec7b669d7853b
SHA5128566840fd5d9967ee659d029d910b05ed3857cb5958700f574a6051793f3af682ef11469a1aac969e1dc192bd68180e937c05db570316e9743254ea443f3d1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56977178e9b03ef8f54c1de03e85bdf9e
SHA19321857dbd2ed16db3fac9465f436658369fb0f8
SHA256e62b96944991ecd1663232ce0948a4700d529f6e839361da66edd1a388927bcf
SHA512f6aa9b7f8b808708f1763744de6a2ca7406c1044e942df1399ebdf1347b7f3edb805c29767901d9686dc5eae5c29ac83aed5b706a677f7f944c396369766743b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508659cb3844be655e21b0d66a884c386
SHA1b670066d38441de8c5007926e4e5a5dd5efe782c
SHA256badc310b973df4f596e462351f8ec2ebdff5a9e3e80a90e6b07393e04f3e108a
SHA5121d75e62973946ccc53750af14e69668321469d7d3deb59a0fd091608b4995227ca2bad2ee8c98d5248231d1dd16c99faef4e76aecdeb2d1b47fafdfa88742cec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a