Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
603a59ca6242b1b6063bf036d5a19eb3_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
603a59ca6242b1b6063bf036d5a19eb3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
603a59ca6242b1b6063bf036d5a19eb3_JaffaCakes118.html
-
Size
8KB
-
MD5
603a59ca6242b1b6063bf036d5a19eb3
-
SHA1
88260fa95596143a03fbef8b370fd2d5272b5c82
-
SHA256
1561ba0b24a81103ec2bedc8788d0bc5e0049aaadf2f4cabb401036962cf779b
-
SHA512
a8d45e65dec946c82c9812e1ca288f3d1f0b2a9c9c1c1efbfaf2a4d95eeb1f44d33eecf31f3a2f1e7105cb8d6b281bd11492e0b2da9317f25061431c27eea981
-
SSDEEP
192:GBf+GTPkuZMt9/jk8/JZoutfA1687QyjyUBQmSy7cdAZY0wFoqPI:I2GTMuwI8/JzprymUBQmSyeAZY0CoV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422386668" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0babd13d8aada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec6b7388d5275046aa3eae26769fb94e00000000020000000000106600000001000020000000b5b6e15cf7b1a42730cb3c233a1f66bf16c2ec8ad48ab7282ce70d956150a538000000000e8000000002000020000000798bc6ddfc295e271696f3f8a4fbe37557cd33ade7db39bc49f03f98bfd9c8b590000000d511487e38f93b361acc3adef46dc371864bd48ef99bdc0bb4b5790a07c8b7c171b88daf4d23d3420dc907ea4c669e8a7faaa110e96975a1f95b96b53ab7ec06e8aa1926fcfcaa2f9eebba8470cffee05b660b75a860ee21c9253d5f26f380bc2a6d8d2df5d0e6aa6839716279872eeff185d8b0f197bfe3ea2646d539d7f86bc94f5330a41d94680aa38520aeb47b9640000000af55f79589193c58a55f46e7aad53c1ed9e0b3ef1c35717ead83e930b4837cd07268ae3aec9c8d877121037bb31ee71b64a881daf7b55f2b900ebb5f6ed4ef24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{504BE511-16CB-11EF-A68A-46FC6C3D459E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec6b7388d5275046aa3eae26769fb94e000000000200000000001066000000010000200000004857b730a73fabc60c180baff018f376543e4c0f77df5a3aa12fb14d6da578b7000000000e8000000002000020000000ffcf7905d1874d6c0fd4951cfca6ec540b4fa40564c82796e24fd22eae5265aa20000000be1255e8f701a0ebe7cab0800fe370a47f55eae1db9d19c3d18b17c295ac7af9400000000275e1f609e9f1b3b2bd7f4e208781b710873f71c534f29335148601ad7dd9f2085d687a777ab4e54c3e1d9e563e677971e39062dda59b0f6c47acfb512d4130 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2820 2216 iexplore.exe 28 PID 2216 wrote to memory of 2820 2216 iexplore.exe 28 PID 2216 wrote to memory of 2820 2216 iexplore.exe 28 PID 2216 wrote to memory of 2820 2216 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\603a59ca6242b1b6063bf036d5a19eb3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f8843884948de5c962f1a520fd441d73
SHA17b634aab3e429ba2ff1e203005b96fe7e2d63fc2
SHA25660a6fe5f2f51cd7fc67bd418aed3f1ae706ab688107d94f11a256a30ed82c376
SHA5121533193501a43005a648b7ed50c585c9c2196e65a9554370954c7275ae83eb7a268104fc8c68c57ee6dfd11dd3eb1ddb8a6cc45043eed06756e8faf2baf2233d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faf02de4f313cacb4a994e61d76f96e4
SHA11a9521c1bacfe877e2bfa6d405c8e04ed3b64a41
SHA256db6073f60e9edd61888aec43d1cf7bf90409e8e69e663273ff5d9f76c57c4d83
SHA512101d8e9d447b9af584219735692dd46584dedaed8fcd7bbb1534ea4fe098bca69676eab2362a6c47817dbc4dfb4158c03fd1af978743828530ad1c3d0517de9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5589ba06b0627e490ee25c719c1a45e1a
SHA13719c9750714f7c3275c935088fe87d3e314e745
SHA2564aaa6bbdf4d08e5a1f841d90883e4036e1e3006a0ebee81f84c2c85996e39c0d
SHA512e479b9d2a8d785bceb5452565a3c55c278e22d8a771e7fe35d301d8541dfc2e505a86a4dad0b0c1de897bc9af4f994d8ce60254ff45baa915233a61b34d7759c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597f3dac7d5b149c79f52ef6ecb4be48
SHA12f3f1d0436cfecb70e4c956989fdd076e927952b
SHA256a4e9cac9f3dd797cfe0bca751634cc7380a82ef2f95d7bd53ecad5c5c717440d
SHA512d331d392be241d4a974713d88aff48c9cb156def98a86ec82a98c968bd1d2e8dd04a79109fd0bb94410d55eaf37987a33cf202b75acd84a9771ca96cb2d6e651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7df6a446a2b069571803ee2e12057fb
SHA12c1c00be1a46f548417e4705dbac02c3be4088b6
SHA2567cb4c361ca0fe12586a41ea5e915f4c2626f3fd306d10825542b2e90bcb0abe4
SHA512f0d1afc966dddb6ad54a03cbbb618b7673d42922d33483636cd40966b04c8f572268490a9c62f57b34d4a419fe1fd99e6cd514a4bc52dd3fbecbfe60915c3890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3bd5bb77ea8d7e0c66ed5d68099a203
SHA125adfe96175af5869428eaa2a2c2d7bceacf887f
SHA256041f4943237317111ee883c0b4753124322b77064ff51ebed4d8b4f3237a69cf
SHA5129518c6710bfdaacb3076e392def881c1e82ea1e12d53ce4d52305b51a3c1c38942554ffb7f3b60c4cba8e7b6715c981f03834b0672e90cf55cb5efe8243361a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5152ed629de1ff784a8da6cd5858e43f4
SHA1899804cb9d7f565610f1f0d79cd3816b34188cdb
SHA2563593b3ab807a43bff2b61c683da2032b9d99c6bb248ddaa73f6a1aa76ff4aa8d
SHA51242ad1adb6b8287a258de9b8be1de59532d8e31c568f1465b5d57af911360dbbf7db930fc8295c194bd2b8a8296194e57341799bb32f1b46a97ca024e2f874b49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53627cc2e65c5912683d91cbf8c8e7875
SHA196c5c940f24dde63a130b21251960ae4b59b0702
SHA256c88fb3c786c36607507d6b0d322acf8ed6d4e070a6085d7fb4f840caf624e393
SHA51274f745c044802abdeea625005a4897e3dced9bdcdbb3577468e693a91914b22b5e2152535605fddf827af171f59006efe863ad63b11730d4780256a35866d11c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5105c0a4a1015379d6c290994bbfebb78
SHA1996cea0880d859624aacc9affe566de197c2ad00
SHA256bd2d20349e83d085898992b0ae68be3eb824ade256b22e3b041a33bfdd9dd32c
SHA5123c848145146f12ac17fb8ec7784c8bf5534335e06979843ffbf03e805910e7f79734c7a23c425131caa540ded6bfa699e2364645451f34a6ceb911f90fa8a2a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57543d07278357b17089baf4221d270e1
SHA1495dc991164ca3ce9378a617857c08d455680e7c
SHA256301d9ec18c9d9da2b13d9720a41dd2e8952baa6618f8a9eaacaf5d5066ec9aaa
SHA512d07b7a5933f25a509f70cc4e59e413434187b9912ea479621d14f5bbea1012e69bd698be119a4cbeb0e80540011876c61042320ad05c025f6b59e3202d5c0e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5def1481da74bc3104b702bb80cf74e1a
SHA17f4335148461f843e4c833a7b90c3bfa8ddcd748
SHA256053a1e253debf39c53f75107c00589c7aa43407c9f40bf683cbcf4b7e1a78b32
SHA512a504381a232e70cb38ec9cd1537e245243ea0f4cfd539fbd3c8c81d95de7b6ddf1c464a820f002b249e75239e758441702cfa671bd8a78749ae7f7b8a740139b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520d86bb47b6981f67cfb8cac5be25ffd
SHA14cb35d6c0b6f9f98702cd3d7d01f5e9a47998039
SHA2567b2368aa234480f391f2945b8d4d7217df4b1abbdecba235de664d7cc9b7b306
SHA51229f4ab9737af9b993320c1c43ad97c5ed102fb2972748597d1692597ecf4fc7b2f865492fac9e3d1ac027acc4ed1d51817acd7a3d14fea92d1ad8b859ee15705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52644fab296a99d680758331d82bed769
SHA12096fef57c887c152034e112ec4691c191ef9fd5
SHA256f95b5633d2a34490dea56d7333a6a0a6681f42556e9e2b8a0694a3c0c74a9126
SHA51211d2d8d7bfbccb7d31377162e98c009f0c6d8a9c9410220a4bcdb0eb71bc46968db5be6fb3061aa5799554e4af9cbc87daa8b0830f1150b5172820ca813cd9ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a3c3aa6463adef92f9084b496186fe5c
SHA157bf31a7645319750463472ab0fbb7a15f2bb91c
SHA256103a9234fabbc1d86d659198a606ae0007c24a5fb69aa94a7927642a566d7dfc
SHA512c3f74d202ea96cdfd67be4680f2211b8d996bc2769b4d75b29d9cd9d09371c8f044991e341d9131047735a58f02f5ea3bb82007bc0b966a7976e8daba2ef7d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a