Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
323f4cd67275a9ae1e16b31cb60b52ca_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
323f4cd67275a9ae1e16b31cb60b52ca_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
323f4cd67275a9ae1e16b31cb60b52ca_JaffaCakes118.html
-
Size
39KB
-
MD5
323f4cd67275a9ae1e16b31cb60b52ca
-
SHA1
1a8217badec1ed784084126cf6512a7ddbe5c180
-
SHA256
cc02c85110ff381593ce25740376d4ad673c33b5335445f03cd4997833bff3f0
-
SHA512
ab9be731ecbd97ae42ec843ca2f6b1e2fbe1dd2655da3d1b60b0b9926c84a076a31443117ad3fcdb11ee009a9f6feefd714682ca3b554654c1dba0670ac18c76
-
SSDEEP
192:uwDFb5n4hKnQjxn5Q/InQieTNnonQOkEntAinQTbndnQmSFxuEOsZh6oOLV5Tn7V:cQ/jmx/b6eqJz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421556279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a8e5d6edb3377517d6e1c864ca91653cbfb9974013dcf66a3312c7ea224f60d7000000000e80000000020000200000009270c9c0de55361722833b656a55039477556b78f8d6df10b01143082249c7b620000000f0c0739d1100a73b015dd77a50e9f650de7baea159719f66890f8591fed601e040000000f715d909d0e32e55b67a8e926360cd2a86cb2d1559ea5de0b7de4b3525b44ef58cfb4d6410b60f610a12979198dd4ff198e7fd53a1b1dea8e31639cbd0d59b7f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603af9bf4aa3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002144575cba8239b12982e7c76164e628c0f20786b8fbeaf497be2832008ffb4f000000000e80000000020000200000001ddd18e9da473a163d4a3c09a9a776e6fdad09de80a8b43cd0bfd28110c872de9000000099d2383b4b8b8c942c2de81f09724e8d9e952d4d14a1f4062cd7401c1efbd9e40b92c2bac0fe319adb6b255d63d4c643efb70fe87335abcdae199e335e8c2e58f6e594acc013086fe2586dc69c4453070540830d55c7c8adc3c19ad21eb75264721c7b5612b8915f54625cb505f3311cdf13e9e8004f6ef20e5e58f2a5a199889198cafd69b4fdcb8e71cdf6e2a0491d400000005781210ef4c7ac11ff903bfeaf92f9e2614d4aef60bc768887edcde4d394f34519ba4ed00633dbc255550b333d6a7aed22b4ed50e0f4affc34f6c87905f66ede iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB161791-0F3D-11EF-9371-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2512 2100 iexplore.exe 28 PID 2100 wrote to memory of 2512 2100 iexplore.exe 28 PID 2100 wrote to memory of 2512 2100 iexplore.exe 28 PID 2100 wrote to memory of 2512 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\323f4cd67275a9ae1e16b31cb60b52ca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e70bc8885751ec5d93d2612ebd8f060d
SHA175115cc4ac53d87ad3c7d1544d17e0265e26ca44
SHA256fc2e67b7180b4d19f9cf7725820d757f265c947bef81b5dd14f98302b0ebec6a
SHA5128b40a8e6efff099a7e8f3ccee9d42396d73dd5d59f0494a843f912518dcb7f6ec514fe9a8dff84acaab9e9b0350ea7952ef5f11658bdd4b79e79f68470685884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d20b3ab8e850b15cf904d8171677de2
SHA1840866184f6a009dd89e2ddee81dc7b8216e0566
SHA2560a8c621c15703c602311aaecf6f2f10388a59b5f2f4c6638af6ba370a23deb24
SHA512328dff015df088c5ac4cd28893920d0480b44090a15a0714a248516c3db2a7b2302449e050e9b82ed5a63932cc44c0d8e6a9c7e82e363f6ed4d2093eb4fa857e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d6d18cbab919ea0fa90f0cf9c6190da
SHA17a8f8693b5d4d7ae98fe58e313c41ba666670890
SHA256c4d6b388de624581dcf4adfb4ca405a968b10c65af1ce789170c46cd08c048c0
SHA512a867f3a4991784512467c70310a5c7047799e4a01f7c4fa804c4a0b85504ddad8aee9985c4e33735f9e49e6b796f472317c28104d181cc21e793793c96084405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceded81f4d7640caf6eabef0496d1a8e
SHA190bbc8eb4fa9081ae4c95c33a89e2496b6ae7292
SHA256262bbafc774c1d401ec4932aadc774defc9d4d3e88d35836cc0814c712121870
SHA512c25fd08095e25f8356e42dfb168304dda234b58983e36df64383a45ad9d982626cee451913a3af0571c514f7b82becaafb10561e7e11355b85e9290d6a100a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cdd4257f8517146d7d40faa32fb6510
SHA1eaf06b5a27be8dfd002a42f2fa0a05ee792244ae
SHA2563a2cc687cef991357f1036205355e99e33c58b2e85bf2f2ba8344854b309bb08
SHA512ed98ee74618c32e7f7f70217b5ccf1e90d86fc3a8a874d63c3ee538e6345da6ea8c39e1eb083db209dd06ebc6e99359dd11000ba62caa6e237fc9c56a27ec5bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbd509c4805e2c3c32248be7722ffeff
SHA199cd788f46fe376707c389394466d8127ce2c963
SHA256fda5c970c5b69d427a539976b44835ca21ab07f97afdb1b18e1c1106c956e4c6
SHA5122c9210899365a1b2120117bd8b96b94a79e6605153dd6b390254b45168dd2bf6cc05bc03b65eafc2673e121c04f17fa3371cc6ebb9d1884dd3e225f85c93cd56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa9344b7e2b6e1b0026004a90d333e8f
SHA161487540ec651d238f34277614e6f8da4e76c459
SHA25670fa9f3863aeee68019dba7dae0a483fd564cb927084dc37e35fceef955582de
SHA512d69f084b5efd126b0f4bce3a61336157cfac2ce1dd349fbfcf14707bbd3f7d5f87de84961824fe7f217f5704de3aa16dd681292e870d57afbe3b5900757eb411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59838900ddf54978e5ef74f0dd6ede685
SHA15bf1373e12b2f982924b6f1b13b32ab738776983
SHA2566938caca1e0cadfcf6731c2c925d4f2a0da18c346513ca504d8d9d81ebd25e1e
SHA5124aefbecd6a29e7b9df73b4419c5b984bd67ce3c493d219e12153d364dfec72379e5ad3f378af4e705dc9bab7f912215e6eded3c9546ed110e56f8df2a3b91cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54798607c87ca02524975ce1f54c7d324
SHA1825d720e55f46f5d00db168469c4e1dd0f4693ad
SHA2563d6010f51c171999855ae63da2018e500867867c3e5632ee8d7925eaca8dd7bf
SHA51244cb1483ff8cc1599811f1dc381d448a23729ba5d612ae8806ae7260cffa3178b6a6d8ec2e0852b48a84694da66bb7c6ae31b4751ae68d7633e4b2574efc0965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583e47bd83ddc3c884a8e2bb246c1993f
SHA1128552fb4f432e6985ee370869fb0839239048e2
SHA2563c43bfc78313edf635fd607a88c6e66bbc725eeb32fb72114cff567153cf52f6
SHA512394bf4e41273b863aeecb153ce2b0c763ff532b205871a5c98d3cdbc111c39c9881fe6c7a243feadba6ec17c3068eb216ea9c4960955f26366910fa3db00492e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1f2e67926919514407005bf144196e3
SHA1187d01293a21edf564a307ee5eaf09404df5bded
SHA2567a88146f1e65228d14f8ce2c12694841239132424fcc10e135a6396c3622cc75
SHA512785dcdc20b79307be75155407f59b083acce5acb2f438dd03b1e4370a5760090a49b9fdd3004bba7521df8a888cf7963cfa22046e62fbf0dc1d1eec7186fc810
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd6b5d6d9540ca0575417a1b5de48de1
SHA1ba0795288fbfe26e92840ff25d4ca7ea91a9f801
SHA2567f462f3ea6812357ad0887095f5d00075e21d7707195a13ac489ddcc3a1bb4f0
SHA51260bbbe353790d49bc37efd6baf42011a2ace7b9edc2862e13d61c4d6c6ed8f0ee66286994ad47b3695a88b0f5dcf294c1a714a4150c91cfed9dab60cbbbce181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c09705df88d981c7cbc9d1b2d79e4e0
SHA187cf7c5b3fac9ac052eb6195977db0cda1b02987
SHA256a02351bf8fbd7ac091981d54889cc802a549ff9e674ed8673f30f219b3b5bf29
SHA5122dca2c81d4d1b96e1dbaba3aaab46a6a34aadd12747532e87b56d9d84a662e30ae56b9f5fef9f7f8f63e6b458879370ab7ea931264663093e87aff77d42586fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5559cc1be39baa7c4c46505c5152f275a
SHA1f768c46d9ce6cfdd4d86d665b59e42cf5675b56f
SHA256214af1e519b41fe119388b53a20c7704c25d600d43c055d3cbb86cff9003de28
SHA512080710f9d76ec51649f6c7531bf58907e96d8c18962b81d075793e3879d37b276eed32d03b1deac91ce7063509098a084a1cd353e685d69d0998b447d9b4e79b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b0170aa9c17d99c348bcbf68b76f0a
SHA15eeada1b43afc998db034bc65a34bc66570333c5
SHA256e5a651e034d97abdd59a8d33ceaa4ac1687a78d4bee8deb8e9a176b31a5b20c2
SHA5127a77a7d46613ffa5b5ee2c0aa017077c0f7b6cc1f88974b599a0abea6cd718a15e691d0de1d891eb3b2d8b57e60b303d9b8ccecac42f368d4689073367ada6f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7a89954d0f7ede995bd90e87eba0755
SHA144ef4edae595977f697874fe662b63d03caf57a4
SHA256ef5925d367b810c5127d492bc90e7e83da56e5ef41c17df851afe64ad0b74fdb
SHA512c7e31cd08077f36b564298e11e5e47531a066983814c22e1c03e4cf564169ab6e92f637ad25e7577067ff8987da5fec823ea047661845283f7d48bba52966715
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a