Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 05:27
Static task
static1
Behavioral task
behavioral1
Sample
287dd65ba414e1f365fd31b02d7765dd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
287dd65ba414e1f365fd31b02d7765dd_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
287dd65ba414e1f365fd31b02d7765dd_JaffaCakes118.html
-
Size
4KB
-
MD5
287dd65ba414e1f365fd31b02d7765dd
-
SHA1
184284781804e4a92953829617fe3ec2dffd7bd7
-
SHA256
42cef88368fc27e92a2a3ea6f64216df1d6f43c9831affca00cc60516a244bdf
-
SHA512
b9181573c0384d70f24187fff2dec1507bd6a9d053daa0504088fa3335e1bc7b51d365ea03287477da0c59b3a00feaa1129ebfba6533e4f7e86e4103fe69b8a5
-
SSDEEP
96:CH0n6t7gVRf7gVi7gVD7gVc7gVB7gVO7gVCT5o2Db8FmFbK4l6ovYVh06F:CH+a2Db8FmFnsWuN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421394337" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFF0FB71-0DC4-11EF-85B1-6A83D32C515E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002496b96ef7d8e056b082e8721f9f97f738cf90cb2bd93b4a472abe94980fb1f5000000000e80000000020000200000001a50f680e75e80e16ea2a62e13e1842053f639eb2aad43e4a7b5d607af6e2f9390000000dccd6a1a6ffd808d1eadd2c8bab46593054d20464362cf9be7d06207bb563f92aa401a549e435a8884d54ca45e8f02e8cfe40a537ef1106439f3a65e44609a64e58cdd5a2f5d28193f5dad9f27e106aacc0dd9a0a9b46922b29b5cf196330422d859fc2ed142f327604249d37022e9625c1852dd7bc3a38d05e411a26d4a0e80cca307696edd519d4141c37861f3794440000000472747535ae6f6569839e4ba75c207cddb96827061f96716d45465784bf9acc5f293220b558b49f189687315cd375f1bb2d1de98916767ee3a4c65948c4dece8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903e87b4d1a1da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ee048086b19cdaec1407afc5347734d2e3a1ec3feb8116e51e35a82b03d24092000000000e80000000020000200000000a4d6603e403a002f6854571b35096919ff05d17b5d7ce2f80fec3aa6618664b20000000a2fee1fb0a77982ab8cd1dd1ce448e2e44b91f4846ec91d1cc2b8898fa8303fc4000000082236573588b1e26163de52a1e2296eb141151395f4432b8734209c426d3a6ff7d05b00d1361e768d7345494482aa771f5622545db3feffcf0af3d0e1d315105 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2252 iexplore.exe 2252 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2504 2252 iexplore.exe 28 PID 2252 wrote to memory of 2504 2252 iexplore.exe 28 PID 2252 wrote to memory of 2504 2252 iexplore.exe 28 PID 2252 wrote to memory of 2504 2252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\287dd65ba414e1f365fd31b02d7765dd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516c6149f5070d9cc79a108185d05e870
SHA15e3a88967b1b8b5fb7677d9041723577e828cd46
SHA25634ce6d5992c79689f2624c8c6b775b5946a4203e8f8b476577c24d3cfb78cf40
SHA51260fbcbfa0c25152f303c4a261b10e26f2b6261bf24f0f62a48201d9f3c7e9ec5f89a9a5531fb9425576e7b1271e8198a5e170b9716cc5e076ee0c086df443b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5384da9d281229295e9c12bef71c9e425
SHA170a11d18cbddd44a64023bf01a8da6f51a325331
SHA25682ecbdd13aee712719b6eacffe6a057d9d752c4d097677da43f389b78a466f17
SHA512f5b40c61ec5a3243905613e4d6a0249d76a63b45b74a8530c9efbd0ef1a603f44a7f25c1bd5b539d285582e90d9dbbfb69953206aa8f92dd32da71fe476a642a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d96fe3ac1865345bd7948412ea861c0
SHA12897dcaa0f467914b225cbfa4fe57f3d18e2b158
SHA25633ddfb152ae9300713f1063ed4c00bca5679c382fb6628bbea73466e1d58da1d
SHA51257117d6f96a72ee3041c2c54c4fbb783c2955aca3b78d04943dd6b14416f5a436420f50f6f49d2b97c00fcc8de3e9b9698fdfcf998500968bcf0d1bfd9157a85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e57aa29cda83e583b0c810cc39f0cb86
SHA1afd35b54a95885168b65c183119e10cf81240312
SHA256fd8d0206b37d1a1b7ee4808413a02b4549866dbf4e0d8bed7bc0fc89da5f47a8
SHA512058fff88bd2b8cc27d8dac3fe2415476f8e97b6755178cf21f16a896d1c6d20ae5fac7fd21ddfb6c19832bc54ecb30dd09e170b7a7f025c7df86473eb468eeb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f714d9abbd7249318bd8343bd2b88ee
SHA1bf6f78d0ccea5141c23b2a7666ac891a5b2545e1
SHA25612f2346b8fe33dda7f8b2581c5da90f72d8efcc5e83df3fd65d86155d3a70da3
SHA5120446141f3d6e794f4f15237d87e56a03eb0791fdb55b5276a09289f2a79c5817af57dba6c96f4180a4a18babc66d8dcbbc08085b4b9afa1e42f34e749cd87131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5470d7dcad3686cdb10bfff4ccd82b6de
SHA1541c5a6851c2376219666f6142b98002a896735d
SHA2564223ffc508521df387d5782fbd656050acb432084be7fddc4b46b9fa7e72cd01
SHA512ea44987b1cae1bb90c21077daeade3c9e5446f3cad7125f43b2513b03c96277c6b8bed81db76802a0cfac9a2ea7dd712e6a66912048281c66e9ff86a6277b1ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0eccbb410b616a76e3425124fefa602
SHA1481ffcb4d90fec84c971105bd3754b52df0b122b
SHA256a1bf6e982db52f156fc4b4d6a922f5a9191f11a889f87aad2a8e8d420725ef0c
SHA512f6badfe8eb367ba911f0096ac32effc42cf35a4c077c8c26b4ef92575ceeb2daf0193500779d09c39c05c23a83afe837d6cf968d4fe266a6437f7ab79f748357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52582e6e6367513e76b6f6104e33f3e6d
SHA1562cd816d4dbb9e982fc127e7a5b5f8988a20569
SHA2569cbb2b61c396712f91bbc2804f0cc323c1565571de587ea62720afaae083751a
SHA512d0f8eb5a65d1c59c59c5b25e805d9b84ded3c99d72627eb8c7d70d57ce9b956acab55ea985436fc7e95a318ac05d21666d26c790351f9e4dfba4f6dba0c42b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bde8f3070b39ccff4657be25f3cb9960
SHA1ddf5171403eb5def9ac2db7577017df7887891d7
SHA25662eee84a545364ebd329d11a23867d63ad5f761f5919dc7665852d8734fd4edf
SHA512cc93f61d9137c9631da508942bca4a42fe6d293c7d38633ebc9814bce47637ea65fe3523f594ea5d0a769f1ca097bf15bbab4d39c99a0ab9e07966f6899e6364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e61d3406c1c1196e026f15deb9615c29
SHA1b9f976e163e3f840efbc0bea1b84d4ad49005a81
SHA25666a29a15b1b9c28dbed77f8cfab969ca69f73edaa49099fbbea6addf7752f92d
SHA512944b32c1d246e2b7abc64b4c8653c5f102d0d45cf6506cef4ba0f0c0ca36f31db8e6e9d387f17034d366428fe0d3a419e392ef1a1763e58c3c8937c2d22e1b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f42700304ce6c0a2e98f0f8f42436f00
SHA1737c785f13482a3ec7b6c6266c3004e69e1036f6
SHA25614e915dac252eaedec4d815deecc0ac735f0d87da3c56bde7a629cabb25b4659
SHA512062f6e20e1236bbb9d0367c8e3be15cfed05167994d3aeb12d19a6529a45a2f2d53090e3f5bffe02e33df385d93d49ac682a38041e335d85b640fe5af6d024f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a36fdfa94e1206867b93ea121cd8d65e
SHA113713071e9fd66be736d2b3ac69f79587eb5cea1
SHA2569c8c22b10ea61aba52774fb69f4b6220a5ac43d0b2fda0586eede99faf8ae371
SHA51217f2b2c35b55b42aefe79b9f34dc2a5d8d639723f32003d7b32a474049f85a2b6ef8a4ecf225aff97287500e08abe93d6a83b8ef3be6b18f3e85ddb37a4f8497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58822fcda210c3d8174450102aea88ea7
SHA11177ac17a1652110065267ce10d29ede544568fe
SHA256d6da5be6efda9d8e151750d0f5c29b063b74def4eea54385b5d0c790e0ca7415
SHA512885d872c7e5e5a9fc1ed70be26d06b1decdb67085842a180afc297e0dfc667e45d0d66f9e92eb3dede989dced28005a7c0cea992141218bd61b28c4416fd7681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f415311d7285858232a491d5836ee5e4
SHA13ba0cb4b86e84903ab2740834292bcfbd6558f80
SHA25646aeef056c71b3dc999656d9db7b6bdc42df0f0310e3b89b1822ad0fc9a0d146
SHA5126707edc17f388f8ea87d8d5c6588702a99ce86506fd23dea3085f428ef57eb388adbb0bdb97e8ce2deffb02672431750cdfe1fa8b5f71ceddd22b4f601d51663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd7299456af8e087d16ef3e1fcdb9b4b
SHA10470fdfb8acdcdf20b530f68741dfbe1b5df0d27
SHA2562ee0c31a2da2e9728d3ee3278c619ba1f640c91756fcb9d2d5ca1bae2e4f107c
SHA512728f0cfb69ba506d14eb97126b574aa4fa86615fc4600fd91d585130fc506036436a854dbe223f2a133f52b7ecac7d697c8e466ab3d9de895e443d50ac080146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f665b05d8b9f7d39b4923d3b064d482d
SHA1badb3176f8e223a6aea3a02dfc74b9dd97ab2553
SHA25647c718d2d4ecaa65d46ae036bb07c52c2443bef9baa29d50de5021a015b1a668
SHA5127181863cee419970f18f1a538feb69b06e4ad41efa5022aca2e9b999a78c631633f494e70bacd5e84f7313c217b5fb767cc6852c74226aa673d306bf5bd37c31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58539d727b7a2fd9772836e3033ab5330
SHA11af3eb16f28e192cb8d4d95a001018652c91ceda
SHA2564e39ee406829408d11164fa5cdbdc48fa6ede64d72549943954435929fd188cb
SHA5129be6477ec849ed0ef19b812b4986dcf910b6851e6dfa816473ab6a71980dbdd48fd0215da3ceaa470f039e0addcdc5bfda89e3be776c46e752fb025ece318860
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a