Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
484501ff0a0da0b2ceef59f87b6e7c25_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
484501ff0a0da0b2ceef59f87b6e7c25_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
484501ff0a0da0b2ceef59f87b6e7c25_JaffaCakes118.html
-
Size
4KB
-
MD5
484501ff0a0da0b2ceef59f87b6e7c25
-
SHA1
bee664c34cfa26e9393446de9fc19ea7f44cf400
-
SHA256
aae1c6bc58646f328a54d54c3d9c19bd3723a990bf67762e2c6d77fb4846665a
-
SHA512
11d878ab2109beec20f19e6c17c69153a8f4332b331b6c0571a67b0e0e9bc2e8421029623697fa84d471740aae50f473c610246cebca9253eefffc9fb550339e
-
SSDEEP
96:JsrAqJzPtktRXTvEXsWkvLsK4F9Twk/d3tFaYkoaHjaa:oAqT+TAsWkvWrMk/dtFaY8+a
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421973036" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000057b1015147c6160680fae34221d6b6495c3889c54d3c06327a63746e326747bc000000000e80000000020000200000004c4b98b50394c30a38d0e8856a583911399ff432955aa4838b04201299b5d465900000002b6e632f09cc37e81bb9b9faf56e90330f3ad599454beabd80388217441e321e8f259ca5c8bd1e34abfcb561e125472487fca6e5f5d79bc76e6fb639181fe67d8aeb433ac6b2315e06b58f9c330dee876b50c61850e53e5a9b489b83a1167131277d86f7a0558f0a957e12fbce9e7a67d2033fe8b26a8e3cec304ac3a1ff0615764a5e5f39469f571cb250017907644840000000c8f2f93d958a55e1d83fb83bd53eb5ea61ac76891a94dbdf513c973b3a839a3dfa1d5b2c996b32665aaef4cf0e9273dcaf89dd03d3fab1f844f52bbd67f268f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d312ddda11e33e5eaf3eaf54907a605f761be1b27102a7c3217c56f523992506000000000e800000000200002000000020ed571118a619911a9b1d2e6c9dd087782716d0a7f0699f9a717dbe5d2dc0d1200000003fd11dc7e944de24b6692bf98b0191a843592d904b7997d19ce75a1d1d82d0df400000008220d3bd470915d00803a0e27aa154cf1ba89e0106c567054a0b714aaba3bb500cd61ed2909997e09926a74d713091fd700607a6a1ccd2ea53627d66ad1ba440 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e6131815a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43670DA1-1308-11EF-AE43-7A4B76010719} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1668 iexplore.exe 1668 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1668 wrote to memory of 2936 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 2936 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 2936 1668 iexplore.exe IEXPLORE.EXE PID 1668 wrote to memory of 2936 1668 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\484501ff0a0da0b2ceef59f87b6e7c25_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d0079faa53bccc6cde2d5f9982583be
SHA184aacc392e7818cc1bde484f90214780642a4533
SHA25649d713b86cf551e40ef6b852bb115378768f6d72d9a78dd20bf0230804ccb305
SHA5121ac34608c483ba54f588849da6000c8c30e8c5206ddb6725c00cd95fc541111c8ed9326198e6907a519102c4247fe2cf9d648e482b2a6bd7d1321fcc4fcb6a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ce08449182d9335f228801ab1061420
SHA1c13382f110404f6193ad16b406f84814660d0e9c
SHA2566626027dbe839bd4ee0bf89c54b5bc484ace0fc8b55aee58e47bb5d82157b85a
SHA5128541de0c528f7d2958102587eac0e8d1102f5a072ef813fdac18b0443bd962d49d889545ed8f138d9a21c2b3d7720a948789d6f5b9862accf285940a4d6922c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bd9de32f29b8d29b2268d641b672406
SHA15d8c7cb3d670307ae5475a132beee8499c433184
SHA256f3a41fe74a64758639199eea08fd4d53fc55e2b2e29fa3a18dd224f4b9ce50ca
SHA5128dc0f9ea8b6bf1244d16e5b1ee0a93c9a5731cf20e773c5461d6e60f620a57923d87eb5b4bf0a073409888cd4d86af9b63c1a09abc1dfdb0ce26fd7b19eecfcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b567ad1b536ddd213320cdb386de601d
SHA19f49aaf5d3a1fd7c4cc30b2446e282a9174fb179
SHA256fe7adc1d2ceb8b816180f76a400018849c75dd65202acc55a7ec2420f5203bb1
SHA512fec14e99fc83500f319bb2e8acc8024195c1957063e29d03d0a187c7bc99dbef567cffd1cb9564ca313c5d83fda092a67d625f57ec9f8f427df4cb512df8500d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5211db248829727a1aee043879afb1c8b
SHA145e3d538baffbaf4c175f29cad5792a35540c41c
SHA256b4cb34d2a221975b9f64bb47d72f15be6984154270470f02b539c95b5bfe47e0
SHA512b8071cefc8efa5b6e23c209f3a36efbb56c1d08c936908b54040ee8fef08dec1573f897731949f967369dbd0ea254c29df504b72f46598a3bdba95d873522f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf8af4b10cc6005dd24e9da48ea2816
SHA16e8caa2225c0426e8b9939c25bfcaefd787d2749
SHA256ab818a65a8c20a0a278a398810d788b5204839dd810ad1338664ec2d88c64530
SHA512ade192a5e0cde83180fc2bf07ade5264efedda7b71b66f95d1882cbe1e5b44747bf164fb6d351061ae1752130729a179e29d9dc11725c7fad4ea3a08dbdeeb6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d347c829aa4b8612f2f77fc9e82a277c
SHA1793851fd9d0a1eeb46de0291d7f67ac136441535
SHA25656b81bf92f5f742c46b5f4bc1003753f9fb55fe5d5bc6adde0f1c62b84bc7682
SHA512a8fb403a928855a52a6a96340dfb1b27540534d48df1d37cf36956736e4328205d8bc370d0042df8173276bba7ac0bd6e48e8d80dec15c7df9a6a37d75fdbd19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5889403961961abb79e31409451f857ff
SHA11dc98bcdbdef1e5063c003a93138db103c5645e8
SHA25684c5ace8eb4219bee7ade3d3a9524632761610a9effedac9c0557af232edf23c
SHA512b030da1284199d9f1b95bdcf39ffedddd6efdea9cf11b565889469b027d89dd7f831de4b8a4724c1891dcae3c180904df8bb26519d42623da8a4787ec0e1669b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c7bd541a97b4f0d16b4029013ef27a5
SHA16cc2339b021f08b080d602186d49aead1c13571f
SHA256b5aab4485b4c2049cd0a059e6ebbb78a1e264dd4b75e95fcf6c8059656fec4ad
SHA5122a7ecc98aa00266ad8142e5de83072dc2dbd239439d73743f761391a163127bc4adee378594d30fb97bdb4d02460f87da33b5431d201ee35638d2aa5d7171394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d020a092aa5f603a9dd04f4aa56187
SHA124692a827e98ac7a6a6595f8078a051dcb5b3a44
SHA2563ba66ed7f031144a8109ef8e5d2c8d9ca20f235553ca978abe67b09eee0f8ae0
SHA51277a5d8947950515c517036c6553b9fb6075976caf2df401159f5ea6b1b290ce7052f49482bfc5df76fa846d3f256ee1a8c50508226b148d88ddd010adef8b7f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552491a819b1eee2c4aaa66aa8b472481
SHA133226b5b7547587772c97f0166073b10ab5ff5be
SHA2567e7dbca83fa56d2fea73016ab7fbcdfbca8f492014b16be6d4626cc432b34daa
SHA5125044734ece6a1e35dc1e32ee07f07b8852ae3cc81f9f89f453985780b3789900c3f9548155815f749f7450473b3126e40b17e979e4622104f010edab0f644edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5478ae2f15a1e5cd97334091265cf327e
SHA1062be5f0d2db2c6fbb3526a4586bfffbe64ee90a
SHA256b9ab96a2d0a88ed473f4ce32fafb2b8210dd68413a2fbce683fb13c6dabbaa62
SHA51297050744477561b209ec4d8a6f0b89096165595e2fb2ce7e7ab4cdc892fe9cd70dacffc519621855a18494396793e16b4113f36659150b42f2fec11aed38cf31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e31ef1379c77b32c5086ce8ff2ec716
SHA1086918c0f038f936e4acc4ea1bd5849adedf64d9
SHA25612431f5a10f31666c575c44462a27c9389171147073042b0c048f4d1078a4916
SHA5121384d68ca3f9dd344595c567a582e651c3ddee084eb4a08c47d79053c5d9cb3dc477248918e5d4a3430902b20d85972d648c2f6e66b2e29cb265afcaf127772a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a6a4210d42e119ed3cbf94bf2fdc1db
SHA1694f7a46e1dd58fbd51a7944c6b51e6593536bb2
SHA2560d2245d16d5e8750d3f3f167fbd31e84c1980f618c648c52a980e5be86badf0d
SHA512c162c0275680ddb12383b9ec8e1c8257608f37f71815e5366bf47509cf2a6c0651b6701ab56e5c1d5b136b4bf7f97b3889e3b1224c0d211a1e2296ef0656384d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c8774ba6f8250dea7f1f0d54a6a6779
SHA10278494e164df2587ccdb1b226e6861fa37835d4
SHA25665234b8fa22986fab6675e847c15a8f7ceb412839943f75162eb79dc31fe037d
SHA512352b0e80c6370f024224dc6d9c870e4a93722bb664c196d09555deb5ee14ad7f1849f4ca75146775c7e0efaf50b9904649b4c315775ad929e8edbda14d325d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58765e40836945ae43e76cbe40fa8b94a
SHA1f00b2e44837bf2b4dc3a0c0aa79fb8bbf1a7a5aa
SHA256416fb59ecec7e6881aabde8615db9bb8937220892983031a8c7429e7d78128d4
SHA512f0e187fa4549b168b75ca037ee2722105d5dd6a50f89f364cca0525bd1ea6ec073a6c96cf2ababcbece7971e1e0b0d6a1a53e814ceae3ef7446908b1f4dd4d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51be4b18ce470d376579fc2d991d3fc4f
SHA1269c4016186eb0766d7984dbe70ac51eba65181b
SHA256379753f70c0ecfed694b9be51469dc26a554b0da33f95a06faf30aea2002ca28
SHA512a706fabee42f28f07d3fab445cb4b830f79b2528bc03d5a4ef7ba8d81d9e5dfeebf0b1b1655696d88fcab00423dccf53dd7673e484127a9f6e152c1da4bc4878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585c24b1902bbff31d5a20792d636a63f
SHA18389cb892369ba3c1a8be6a2481fd256ef358bd1
SHA256a4c271aa00f716534b226b9090b9ed28da30287d5fbfbd3519c2fcc14a684068
SHA5122abbdb565778446e7a3220cc32ab9cd76453fddfd61b7fc4663ece0f2cf17b6d0bcbdb4c52451927fe61ccf6bb6ae6d31aea04c332fd66147300c0fd764cb290
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585b71fca15c93160c5afc8ed15b51288
SHA10a416d1e0961d87fc4737df5971fefe2d1c53ba7
SHA256d7d23966c982636f0aebaaea242c3ee3e199958d538edaa496b456a9b6888074
SHA512352eea23f342bc9a7672cd393ea0a0f2af4c4983001b9e8ff0bb13d4623616bbfb01145bd44fc656de69b4de0c2ca297ed94f0e8a7443e18fc7139248f06dbee
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a