Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 09:19
Static task
static1
Behavioral task
behavioral1
Sample
242f6f1d5b7433409ecd775d0b50cf9c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
242f6f1d5b7433409ecd775d0b50cf9c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
242f6f1d5b7433409ecd775d0b50cf9c_JaffaCakes118.html
-
Size
24KB
-
MD5
242f6f1d5b7433409ecd775d0b50cf9c
-
SHA1
dd4ae2c6b666483b4a9090bdec6b60beb26cdfc4
-
SHA256
81c1bc007ebcc1e7132ba9aae297da695e980ff8c75b288ab7d8248347b851fe
-
SHA512
afcd936a43f6fda21e9dd7679bb855ecab58b21b54765b82546c423708801e0a1fad6365ce19e104d3f4be3fe76cf2438a2ff3743b90ecac029ece9c00f60e68
-
SSDEEP
192:uqN7HRb5nW7unQjxn5Q/fnQieZNnWnQOkEntFYnQTbn75nQeCJVevo7NtIFo+Nzv:nIQ/TygcnnBK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14233DD1-0D1C-11EF-97FB-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008a80bad14418950b4ec24cc6c511c0df88d2b54ac7c360f45034212a94fdec34000000000e800000000200002000000054a1667daf390c245c0804cdbd579af0ce02237fdc03f419be2a397fb60852db90000000201d8e181ee58f8edf3c42a1aa2592b85c3d333385ce1c4ff1827a94dfb1c831261fce32f672c3b8299c174c0bd482b0a6000b78d2b69fb9841a6d8c7902689225ba84f66cbaedcd6f6a95d81fd97fd0555fa6c88dcefdd709ff5d56402df33e1e9e0a7ef9b258f061384571d33c47dd73f90de0ef0b4e77c86aa800cf53ad0eff74203d58880bd39d8cebadc83237ff4000000049cb979c3275db6fecd6eeef9cd6ccfb269801ba3fff9d9d0ee7bfdaa56c3e468c46d7a6ceddf697325c3d7ff3a31c2dc7c2cf9ca4666a43fe930e4e85a39d62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907fa1e928a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421321841" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000030593f35a2d6ad00b5a5f5bbaa7914585c4aac41edd925963323459d072c1f8a000000000e80000000020000200000008a985219b264e10de4317e11c3c71e9d1b38951078df946c77ccc674c502ad9a20000000edd977449f4886b56ff026912f5471e8bbd23be010199ba0dfe5c8b8dde329db40000000615e76f7770c6bd97dcb2768aab0a35d8c27d4bcce4dc0bce13a539e239c78e5f6706c7d785d669563a50e83a7f8bd8d7c653d6484419900f6eee7d6692f96d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2992 2440 iexplore.exe 28 PID 2440 wrote to memory of 2992 2440 iexplore.exe 28 PID 2440 wrote to memory of 2992 2440 iexplore.exe 28 PID 2440 wrote to memory of 2992 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\242f6f1d5b7433409ecd775d0b50cf9c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d813157de94a5b4d3705ab252daa2c7
SHA1ee935df1b8340586ca6f70fa789454178eaf96ad
SHA256f9b654f2fc5f517185260892241f75f39ed3eaf6f3705652b628458b614a020c
SHA512061bbcc4e164f1fa9cbbaac8aabe37f8e2273b6dbb6367b74fd6bfb1aa180130137218267979c610066b18d3a1c47f5aae09942837dcae9ba9195acc5136734e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d61660733c37ba0b977383fadbfea9b2
SHA1aea504dc65c19c26127980739aae33a68da1ed84
SHA2561d30cb2218f5c6c3f57016b1dbc5613aa3fcb5187e0e7c7972a1e126fc5775b6
SHA512d88a6d1907623c29b30e12b54a12b75983b6bb908d91cf3b3636163ba1584a274dcb5370e8ac463ef16eed9680fd4a3ba9a23cddd7f48f9746c81f0f592d4f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d856bbff41c2cd2dd8b14affeaf85080
SHA1fd74689caaab6d6325feb911787359f783d0494d
SHA2561d6ca477084fda57b1e1b6ca8b56c2eb055869145b17a3f3be180f7e0d8e52e9
SHA51211d9d7542249203ae22274c746d1f55c32d60c9da90e33af63dd31ed9d705fa2f298ea7abeeadcb646bf19bf8bc94767ff6408926e42e85a9e84322a4f7c54aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5504f8d32369872bda8e46e5fe83b5467
SHA140e21529ee6da22be438de7e67723bb1dd062ea5
SHA256d54450d455a078ac8704ea3f7c5d5edd22c939d5cdb7aa8c8488b67a97954c16
SHA512ee181b73385f11622b02b4f3eed1f19eeb416aea0e0314c1de1cd887a312076cb4cb50512ec9ea908b680b1a8c22e6dd83fbb5d061a168b97c38f8df7dda645e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5417b77ad47c25a4e1c5d96d05d110e95
SHA1b17b057c6f0b5084c3e4fe330a7fedd4cd756c10
SHA256fc8c3033519ef640ba7df7549c4d88f38348f44825ea24428d78f81f6103863b
SHA5128d504f0a6294848c3dbac5d3969e8122e673affcd5b9f5b0129b0bee1ee26222f5db63108e9147d4078242eca404c1b00892d4e518e5946c2b2091bd8747860b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d967eab0a072cbb4ad382788480fa824
SHA19d677ee5fcf845adf45359918913b22a7ab015b6
SHA25621961725e2b80efb846b175dbe174e97b11f469487b0e7bc258107598b47dba3
SHA5129b1b9f7789915309448cee295518eb67fcb2f262d3322320cd13a800a0a9cda3a8b83eb8d725cdd45ff27c510d2d8e090bfb67ec6e7cb112d87f258e49a31da2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569a5a93ee6126b9b96f841a0b6a622b5
SHA13fc0ee063d97ca0753b6c945c5cc5de634e5302c
SHA25689b599cc39f4769d26f7a3d8be3c31b1162f41ab75a64adfa4e96c1cd913c514
SHA512a480426a6126dfe456ad6ed8c60cd53822aa53c275a25661491e249f7a50daf7a8f38ba9e63bb6a0dbc9931b120319e28771bbf9ca7f2d0630285dbdb9dd6cdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd634bab5d6f32a09a698edd8f3ec0b1
SHA123c4d7cdbf62626f42cc6734d97f11f82adbe2ec
SHA2567cb9572d96829a8bf513a64ab6b115aea0d80f2f508e5cfbc5a7bb59a5425df2
SHA512be961908776d052177ab2ba4cdadbc2a7cc6fc978ebfb62d07ffff20761547d44d158f0f10a5b31dd74e756ce59d4f444f970b7795d69928da44ab5cfd0dbc70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b85b63c012425dfcf5167f16d4b1c39
SHA11e642ef264b85d8fa53b4fe29e9b0ad1c583cd90
SHA2564691d7a15d8f740bdfc8fe9043a8c85dc1f3e581c0e1ba265a0f45c8e655fc41
SHA51284a2223f097b0592530f6e0890367bc7c8f6612b144c05c0bdaac97a7a2e9413edf6a03c2d2702f0bd0a11441ae8a7004ca70702db99f612840c137bd1dcb1fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545db10dea24e395031c30ca8298941b5
SHA128a822bfcc09756406b1f2a80d45fba5f1c5dbb2
SHA2564bb5a5cc78617d741d3706c8e60894ab346dc61a9c9285e33db9581cddac52d3
SHA512f4af487a7affb18529d684ba1d78f41ae013a203d980ab3ae3d37c042df1b4abee37e097915a3996e786bfbaaf08662c0b493a270abc6e61997929bb2a04cc83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5581e77a2b31586e5992b9c49b622333d
SHA14e1e8d7803a1b3743063026f1182c9ac8786bf2e
SHA256cad7f16543273bb126415ee3a90b9b3359a4ccdace157e0ae91bc480d591d252
SHA512ec79f6ef5995f965a9676fae32cf629f374db28379ee47ee5e2fe3bf460c607686e416a1ca3aba6ee82921254a794b865e15d1e79a075647139a4897aa091d0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ba8329837506946496add24e1415057
SHA164a73ab100265f947080fb5da2eb4f534419da79
SHA2561611dea2c63a66bf4b6b35a0e5aa9b62f462e77e5d82fb112d334280d0cb7b22
SHA512fb170c5f3d61d5a67361546deda1074ec6127dbf07ee4779fe3462c64ec1aa782e33e2cbf434de86c4b49f3f991647c5ddaf64f4313bbd32cd3ff735c2d2dc08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e376d0269f0441f8b2055d63f14255ea
SHA19a19d7fc90a8e7275d34271ab8318521e3dfcd94
SHA2563a6d4ee189d5a7e836342d5a46c71fd73b2054ec896fa324c1093c7b9463d1fc
SHA5127d187134ba68881864b27a3fd27587059ec6ec1493f777cb3cb926495ede64fc2c399c00702be161aac5bf194ac25f2bf0761f6177501ddbcb3a29d828cb7852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d8761a36f78427d10c49d1607601d3e
SHA1f0540a1ead1fa587e69b9fbbb173cde80358d787
SHA256a5bc18123d4906362830e50476db18c53008a55c272f23d45cd2acd4d0d120a2
SHA5121f13d3f357418f96b82465a8c0fbf7efbf7c5676bece351beedd9c9e69a51e3cabdef7b6349ad7d21c12cbd15def0f3df3589b03a8926d1f940efc91b87b7aba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56535b666c184e2391c6aadcb226fef3e
SHA122aa5a9b96f951ec562b75c2c902640bf17d74af
SHA256aa917c2eabe8f169ed20afbfd757913d4002907cbdeea98f8e3d993b94d81ad1
SHA512d60d331d407c6ff75a2d674ffdc1a76eb2634968a55d1facf386ad3f52fcef59633a5eb95c00be132c25d7b9c1532ee2ae1df1d9861734a9d35440643d794c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e805722d9875daea302cb2b56e93c839
SHA11237e4a1879c29b8a945460714dcc0fa99b23ea3
SHA2560fe674b65e3bb03029e8dba03565e4d4073f75517ce89431dca5eefef73db96d
SHA512019da416d0d9f2ed41fb8ada75330eac4ac14b7ea1757b9d43b23f69b75670be612d74f691fddcf4630a12d4d24041242efd4ff72e36a28a029b06f8c88c9950
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a