Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 06:27
Static task
static1
Behavioral task
behavioral1
Sample
4ecbf1fe6f57ed188ef7c7fa580415d4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4ecbf1fe6f57ed188ef7c7fa580415d4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4ecbf1fe6f57ed188ef7c7fa580415d4_JaffaCakes118.html
-
Size
460KB
-
MD5
4ecbf1fe6f57ed188ef7c7fa580415d4
-
SHA1
6072abaa033c915ed7c983afeb5631d404648cc9
-
SHA256
5842cc2b697e0ca9129e4475a46986ded4de10f54cedb378aa4d7178525f9ce8
-
SHA512
7aa15857ec4edecee713791dbe5de39cad60153266bbd752f5122bbc22c94347901fd2cbc7f5ef37be8ebefe9f2557c11f22fa2d6dfcd91867a065c59296266e
-
SSDEEP
6144:S7sMYod+X3oI+YOsMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:Q5d+X3e5d+X3m5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422089099" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000b0709374fc3f59e17bbce0c65c856c29334e1c974ef617d8863436432ad3e30000000000e8000000002000020000000f51cd606bb2550bafbd0a7e3ecb074106f508db1d84cf74d8a2ff782257d3331900000001d69cc7abe0cb44f1b823c11b254996875d8e5fc3e1815a1d4700194b657ba59aae5df379a6d8157c817b0ede84bd4bcff61808764318375a194bcfa70030882d6288550115462ddcf2fcb23b68ade3571403cc0ab0957944822f0aba6696d94396b8283a83a71c15073229cd76dee1aa735c3993ab30639dd37150ca47ca247e8296bf6e934aa833a44f1ad1a3177a6400000003d937c250c5e56e1dd9b97ba1281184153b74096937a33503415a27f7f770a222f32b87673ea3031fa00e7800e5da35ab73b6c1eebc729daabf10e0e8d772126 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E5A93A1-1416-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c4b3e24b00c0d98a53cbb18c91f7b0a870352cbd445a79411898db96776c39b5000000000e8000000002000020000000997785ecd265b8b022bc49b2b5fd13617c3492fe3259f76a8c4aab3c263342c8200000008f56d810fa41fc087125e42611670e6a287e58f14b71244f2206fba998f2e0cd40000000c70af2f484af1f8a99ed96eab60a868e639cca95d9a53ca158724e412a2dda73a5fe90bd5909a9be8ec423d9efd462940a185f1f1191b3df7fad7f8f1005b612 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3041e05623a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE 2980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28 PID 2272 wrote to memory of 2980 2272 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ecbf1fe6f57ed188ef7c7fa580415d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1a9e74170e6deb118e9e19c104bb1fd
SHA1378cce8eafa068bf688b9266fc697b4f87015989
SHA2562409f74274fb1abad7f554c7dfe09e46861197ebdb2e5f96df7e906544ce43cc
SHA51292327a4b197aae67ad8823882e6ef1e490b6ca09f4a523387eb930aac9e471486be0b2e843175e8a77944831a850dbf9ede4052dab7c1d97a97fd30a10c8ad20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4a8ee96568ea11900c1cb20d34f2bbc
SHA163344b0a659b81e4716e9064a82e70f03d3831c7
SHA256ede9d6a7532d8810e35dc91ba683598345353e0dc1493f59e81bcf519760b959
SHA512e69e634f22c7bf9fc9af89a9940852c7a915cbe283037e6e1b419cff7b8e272d86960156ca9b1f0d866c422e4f9045477216c1135f6a0e55a94b4653726c7e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8dd1730f8f48e120f1c7d9418ea2f97
SHA11a827b47ce0b226540a9f0cd3485291040bbe669
SHA2560ea18e8266857ece97b060edeb0c179b46b96ffe1bfd492401bcdf9c42b9bb82
SHA51261c4a24e219dfc105724ec2fe216e61d686702da18593751b566a4383090169ca183415ce6d585b5e2a3969245822d5b8f5cc4d28fd3bcc091c53964cb412cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59353fe5a6806881a4157171b1802f082
SHA18be38985ac7470aee26140a992e163c525ed3cd5
SHA256bb2b1ba70ada9d2d29aaa7cc9a99f46ed8fb8c4f7ecdba0ba70bbe69bfe909c1
SHA512c7159bbce6457aacb53ada51ac656f7e9b037b85a8e8dd8343bfb2c09ccc390f45bd48d3f19f51b77b8cae26f784a71f782b0c641bf032f490b117018440d020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526cd8fc80d1557881afe9899c1318d4e
SHA152f50efe71cfdd80db4d1e990b8fb5d7ff118503
SHA256e021dc1cdee28b9037e2f2dfd3c48d386ea756029eb7d5c4b0dd8a03c1cf90ca
SHA512154dc905afff81efefbfe47ea99a618bd5fae2bd082bf3c7c37512348e4669880522dcaa739a969a97507cefa1a963467b060340bf05fdc54a8a7834f8ce835e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c60b047f9e416f84b7bcb05d4261117f
SHA1e39f872f4c251b7c579d8e4225e9cb7b5a88fa10
SHA256d4ae5e457cf8941579172a10f29c27e371ebc0d9a5ffc97855f024b46cabbd33
SHA512f8819b5008ad28fd29e5a9899a813f7e3fb40ba437af077f611a4e459e9469dee2ebd3fb7672ecc2d62766e756afeec6494e3a53a0b68138327532694a8f88d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52902063162bebbc383b9bab2d68e22c9
SHA1839a7b5489168f39046df521e2077ebecce5de3a
SHA256d551b94846eb33528dd02fd87ae1c9e520d2fba5d307520efd7b5415ede352e4
SHA51279ef0610912ce8690eed05be58e96feb89323eb7513f5d098b0c633d2d4a4bc2a4668a1dc54f53ca2c7be53d376b07872553304ba39c593e99d07c0380b85ade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a89b979abebb82cb4ac2e6b74ffcb1eb
SHA1fbb96bf737b7814548c511c66d1ac91d1cdc4a77
SHA256601181c2aa05e36644f860cbf4dfc4cb854efe72411751d9fc85e49f866b2949
SHA512a4735b5ee1b2ab3504c0b849620b940b7c9090aeffe12ac237da137f6c7d289d0d310830b55d623503fe08afd03b6b2bdb1a510c9e1f26e2290668c9f69889a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0accefd23f8be3f44132def36596360
SHA1d60d5ec6bddc2c825b45d61d566ddd837b6fedee
SHA256fade3379d5d4c2bb342b8e44e5ce10761c5abf3ad08eefac1654a6aa34ccdbac
SHA51211d6c5342af848a9f4705f2962c8db629de6cd20a81dc5da6095751db7b7236b77e2ba5937689458149347b61878cb71d03c95f606316724029df766fcc3a037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fb5e9ccca72fa920e85b2d5b19e8083
SHA16cfbf3db66dd01ba8cc7a5bd8146e4d504bd5fb7
SHA2560668aba0a0ab3d28ae2f395eb0c39ab03adf8ec81fa5fc127257dc8cd44a7eb2
SHA512a5382ac34a5f3fee80607b0a01f84f3aaa7778d1af56bd2277808716283bff7490693db2d2726a696dadde29f0246ce2bff179350b76332544e4d41f828d49f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfbceb031eb912c2dd4003e0df1a054f
SHA175697aaf8c7db49517fab310d26e0d72ec2a1200
SHA256c03e42040a57c57801ca6e172b5e3ab815330805f5a24cd2f51a28535850e228
SHA512ee7eabedc53024007c8e2a17fe45087b5ffce4065c5aab922d331922dc8b7e1cc69e8b4cc3fff654d9847b388d2d2747b439ba905fa1c836bcb9257a8213433d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4f715071aa299a7ab11eb7f00adc219
SHA171686ae4903c402b7552c5e085257f5136c03e4f
SHA2566e87db554606d54841018f9765621da049ec914396c591fd87f579b8cae02496
SHA512508eecacacd818a1e3a7ef5c0e817828c236fe6887df81306f05dce8b026082b66915a9851d18a09ca15050eb00f1ef73cf6e6e58dc851d69eec58aba4921169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fd1fff78447bc50c5b4dd4f46badf4a
SHA15c33afd930439284a1a9b60d863ff174d5fee57c
SHA256eacc274ba31a841640fe84d464d7ca74f59f488f5062d1132a025c02552a7ca0
SHA512b0085efa2e9ff4db26a69c2311c4c601230b147e613cf87270034a82fb966fc83d69bde0fd4f23cdeef728dc6f2476f5cbd91a1c02ea0c93ce992125a0ab33b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4de11c00e67884bf2592541d9dc5a93
SHA1d129025dddd3d560ee1d64201d415daadb412f85
SHA256b397354f5d86e3a606b0982e37aa068c52935b40028be19bc883c2e81ba530bb
SHA5129fd391128537776aef4725f995bd5ce8ca21da81c8dd0bb9960052746f13f747de1dd55416dedb3a7964dc69ec8dedde06d44ae4bcef8efd699344b6bfca8bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1982e6213f83d575a4b6b846bbaf846
SHA1ecb62991c48b6309fe969d0013d00c5c099d7c34
SHA256244199153d48a3d68e5cb0b50964bb0d1a847fa818206adbb52283d5cfdb41c8
SHA5126a30932b85582f94f1c6a7633242410dc72346e88024a4580eb67190a9fb76fe9bbf4f1cf09a6921d058404985efcd52ba3309b6b09926ec73b0ffc5de894660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed57fcea18f4c274d53625ac29debf78
SHA1a67905911408e5ca658457a7d930ece529da15d4
SHA25666f87f3d37392d74a13e407093b67bc3c76ffc1ab1968c15f2525dbefc45a14f
SHA512ccdaa552f70ed0cf16ebb33a2406573e5cb451e62da83ac7a75ee8b5a6a94e933173cf21cd6c78201891c1a76d1789b843656fdfa6d4b3997121530ce0371b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f81995df7752d57f4c84170eea639f19
SHA1ea157697f4b6ddc45bcdcb6dfb859e74c990b8b7
SHA25609acde27995b3d463fac56dcfc3277ce75bb54755701d206edbedca48e71fc48
SHA51235bffc74d9876cf05b4568bbae8da599d03aa4fb9d4e064fdf1b0b3884ab317cfb20efa6c7f5e1ab8a24856ff1d01e1bb9be013b32ae07f755fe110b4425b999
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a