Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
403dc97d9d44f6f5c91a0844d0183639_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
403dc97d9d44f6f5c91a0844d0183639_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
403dc97d9d44f6f5c91a0844d0183639_JaffaCakes118.html
-
Size
28KB
-
MD5
403dc97d9d44f6f5c91a0844d0183639
-
SHA1
2c5bc8783544c7a9d6a60a74060a45ef0a00d631
-
SHA256
f43e644a9c18b51d2889d06336a516df1bf1f1496b35a89f1576a425df21cf30
-
SHA512
c77bdac514519c0dfcefd68de94d4f6dfdb562ff959ea97b48ab30d05fba2b69a25d9624752d60404bb2abaf492f7bd4ce4c0fd857e91a8dd1defe18baaa90c3
-
SSDEEP
192:uwTEb5nPUhwnQjxn5Q/jnQieKNneNInQOkEntJ9nQTbnBnQ9ewym64ZYSNDQl7MG:vQ/A4pasYSsSnM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98516911-1140-11EF-B238-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004280b6a473b57c210078d580e55ad5ca853974cf31a1ad072be002e5ea2957e8000000000e80000000020000200000001cabda8eff4ecd96793d5c0368793914629877e34b95dbef92f6e041a110a38120000000ed1e2508382f3cb725e798ce5d2aee91aa256313e07ce859c7fcedc6b8bda51a400000004d9c2a5ec611fa5dbaf1f1343ee795758b6333e6b74bf91fd14fc3e316dc5e91a773d411c86ccca76a27b9ef3c379501e350c6f973467d271514162d3b5a341f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000050b53f048e026af71b918d37ae3dc045e83ca0b3090aea70b94e708cc30c6ed000000000e8000000002000020000000a43461498fef6fabf0a5ccb706f5ae8b1e54a73e7d95fd9a9014b81583ac1d0e9000000053d85f013892e7e402d3f8fb62c076b8eedcf9daf023eb271a2808e6a12dfa62192df67e6738a6a7261733b942387dcbb5d3518b2116f643d5ebf9025df1fb0e4b99e7f7b3f5d6478509f7d6eef40707bcb752faca1388ebb599d4a2cc537b94e10c75edd1437174b0924b293fc6e5345514cd2fd6ab54544fc34b39632b3995f1d70d832b5fe0e1f76c858cc2e27b3140000000cae302203c944665ae46cdbe9f544dca58f793fdd6ec1ec021ad40d6d959455db9ec66c88cffb722f01ae9d981b157b9cf4653ff264883a02b12ec325ba3b73b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003e36d4da5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421777327" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2080 1848 iexplore.exe 28 PID 1848 wrote to memory of 2080 1848 iexplore.exe 28 PID 1848 wrote to memory of 2080 1848 iexplore.exe 28 PID 1848 wrote to memory of 2080 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\403dc97d9d44f6f5c91a0844d0183639_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b55b10cedd8e534a902a26f5bc3737d3
SHA103c4dd0bbc38943c64b34e05bc0120b8d543be40
SHA256472a6df336946d216486c4a65a7ea67acbeed2e7147d26517151b328009b2f8e
SHA512f700cf9524afc67d85e621e520385f791f77bd2a8f5c421ae8fbe484e4a9ae0228229663329fe2d533dba8fb91f559ad9c2d6e6fbb92bf3cbb8c556754c100d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c15738bdc8b7ec4bae4d82ccc4767cb5
SHA1d3398ae173a2aef46b8fa3cbfa06770961985f70
SHA256b8033928e152ef0bf512db5942b3f986eb35c82117ca58ec3129c8002c230158
SHA512e34f2f82867213832202ceda452f9197c3721dd12848e7cd3d3942cd5b19e9bd56339a8c6d21abac49ee84d71bbf09853c4cdcc5ee10941de3fed819d0e036e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f42a89f684c0936a3c31cf3053078a6f
SHA10f5773b4733493e6051de6ba8db9926f7c76f7bc
SHA2564e4b2f44aa344b10fa77786e340f8e28d38e4e141bf060b439046b1be6d15593
SHA512e959a168c7f04ddb8f26599f84ce4caae948797a874d736797211dd7d27afe1359720e23160d9818a8de94957c969b92dac7a3944e91d24f31d55b553d4d0833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5328db7015f040380efc295fc13b69d
SHA1eba0885063e6435e90666742eaf90576d7d293d5
SHA256d339412bedc446235fe91a77939b4315b42310c8ef462fdbfa291e0678d8fe72
SHA5129b872692b0b66f7dc9df93d9809b51dbc0bcbca329959e33385f7393ff152a04f440aca769f9c72b76370b8419861bdcf4e05fae476ce7e38823cea6011c6945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594781f46627f824894ff127811be1e66
SHA14facd3cb1985402a71633644434e2bd7e38d3273
SHA2567d24914e9be5a291a98e0038aa7cff8f7c8a6b1a048b5c2cce39b202098a5b4c
SHA512ad81e8635a254dbbdd5fcc40679440b687bf0e13e4808858445b837b6dcecd6a8fa644dba0c50978dbfb524399c521ba31223de6c41c4a9b70cae0db4d927dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e0cb13b7e441c6be9a0985c08b3f05e
SHA1f5eaf2b4be4f6f771914d6ff303474d03707406f
SHA25656287fcc0daa84664b80053bba43bfe0d334e7fe1ef8431eb1c803db2ab52f73
SHA512de365fb634fb41d8c53c026f37b362a4b2a0d3cab04083d49dc91e3f26c06c883c25f23b7d1e1f298f7f18a5c23fbc53f2f14cd5de4ae5fc9e0f95eefae81da9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e113e3fcf04596d3f55fc97f4b6a35a2
SHA19b248a7d5ed9f92070251f73bf52f2bac3f374a3
SHA25684bc638d87d718f58ddc4accb0ddea82428af94c851329336eee48e2627cc914
SHA5122b0bfb0d3a8d8f7dc97b1fb29e055081369ea2b593397ac3e1cc083d65e2b97cf8215f7af8b8b764ce35785998503a9d950c47557370915b877ede0d45ac1138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e99875295c78d93262f9c40c355b9c6c
SHA1dc91f7df9d49fddcf0503fb280c98ab0f6d4feb7
SHA256d52d46974aa64eaf3dd6f32b5031c3247fb0c5c8b8c481ad96cbb61c6feeb9d0
SHA512943d3e48ab640b13547c392280bd51c887e73d9ded6c6ac50549c2802ae837adf5523e631638f20cf3352ca066afddb4451498a479443f02804d9d6d58cbad9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5978ecfb00025893ec7aee0e1db46c541
SHA1a3d607935a1cd9caa6f995724ce68f405aadf651
SHA2561bc68012c76f449538b47d0aeaa1228fc95befbf5bb80683f7326001cbe1fcbe
SHA512d813528156a4a6528aa6f90720c414fa1b9853d58c9995c2b42e488645703e2e99a7b79316a826c71d27e56146d78b93e65150ab1a1d163f03467edded5f9173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5700a370d314685db5cfd7cd1c110e934
SHA1e274bb740ea81c0c75ddadeb8a4432ca50dac98c
SHA256b8acaca4526d4461d012b1303effc1340da5ec360f11feaafa8c1f6f327d5849
SHA5127e10bccb6d20a34dd69af63a52162297571996683595fd23abf11477b86817c2cc3aa9080793bcfeefb8e0138f7794a067ef25a15b5d86638564dc506dc2f2c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570a0e50249a7cbfcc48b3cff08cd02d8
SHA194acc88cce691cb7f3a6795433d83477857987f3
SHA2561cb15ed398dd9d124d613a1d67989b431a0ea951d700b9d8bfa6e2d63034d85d
SHA512f11626215f0135ac43519f37b150d0b4ff2b05d3f4c39dc9b573f6548a649cd88335f5e6f0eb212ff83d43c299d74bcbda7cc07cc852cfe26dd900e3c5cc0de4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c607be5a5db779a84cbf9ab380291df4
SHA105e7290a175f04e483fef1e340f2ed5007a30f5a
SHA2568598b5bcdb7403d72faf02fc01b3314368a703103e5a212721160f281ea5168f
SHA51264c94482d77b29e02156214a5fecf9f7b417a867991673828083a7a86d699c2331a603f3170f632b6f2370ba1a40f4d2b7221f4a22df327f850cf44d60febae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b2e4dff4d88901e68d54138ab6f1590
SHA1c38b063dea0dc611f8a2acfad028b7a15f38ead5
SHA256265f5303512e6454215993aa189612cfc74c003d2ea60d9b77e12ddd8bee51b2
SHA512089287f534f2b9a4bfe81db90a9c0da946af51a33f33307e3b6330efa07d393455bdc2a7e7298dd6c2e5dc49989a08f6cf52d23401ea72623b828318df55d52a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a21a98a567d52996dab3f7beee7a69f
SHA19f2067c89d75ca33ab9576b0d9ef557488030852
SHA256255cd3f356409e3e3caaedfcd296f2b96f8779e7439a884c6bb53603b9084e4a
SHA512496f65fd550186ba0fe3a7b770b7d6fe4ac47b0cea67db96f459dafc465ff56939542a31933a1b2d2cbfc2b6db988caedd48b74f33e48c8d87332dfdcb23fc93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57744923d35dcc9781c660e6acb66ed63
SHA15a1202d497d01353d9edffd30581c9c82776a5fd
SHA2566e549ca812b297366ba4b82267834e7afbf9c4e05b04451c1aba28344ababc0d
SHA512516e7169b7cf4408ca2b4b79b95e5ca9f19026cac6e2e0c13398dc6fc3226f6fe94123810db069f8f5372c8abf1c36b5a3b50dfffeb945cadf35bcd47e9fcf44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff620587a81f278b3e097dfe7129f7c9
SHA124202da56bcaeb15fd731039d61327ad08926bcc
SHA25671753af264c8bdcfd6f2f103aa7cdbf1f10fa1727447c9994a71bc32685d591f
SHA51205ab60fb3f44f113be9cf0aa7e1fae75f799940e540fa3c4c00428c855b4d33db27d55d63d67251522cb455b84f86a0a230632e249084c22de3debf6c17c3994
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a