Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
63a263351e3152a9d6090992baab6c66_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63a263351e3152a9d6090992baab6c66_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
63a263351e3152a9d6090992baab6c66_JaffaCakes118.html
-
Size
213KB
-
MD5
63a263351e3152a9d6090992baab6c66
-
SHA1
7982f49b92e92f9a900be9eb2eaa8c7b7f5b25b2
-
SHA256
eb629d5ea408f0401ec04b1ae90e774ec5968cb8d3fba8bc428afa3b97696a52
-
SHA512
d4439d7b1506574fa5932a9181587da8de7e14d585d4fed4a4515a4349c1ddea596c59e64efa1b361a735e040243c4d88f4b6a76c614159b74cde1ca04a62f0a
-
SSDEEP
3072:SiDodURlCJNyfkMY+BES09JXAnyrZalI+YQ:SidmYsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35D677E1-177F-11EF-B238-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422463928" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1848 iexplore.exe 1848 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1848 wrote to memory of 2872 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 2872 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 2872 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 2872 1848 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a263351e3152a9d6090992baab6c66_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50162c7cb8134d6a855285d5a7ef5ecf7
SHA1b4c9c88807615131c88491be879b58bd75cdb4d6
SHA256f1c487be843fa1f885ccf1802081fdf8cda04ad0cfae5c47ed25af74a68a309a
SHA512e8be126cfcd2b1562cce036e1c7ca11c893eb92804235286e1da9691daefca7de256437d99b42394c2a52921dd0e4a0184688017e1e9079c0635c3b2d399f17e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526963453d6ba3f81acf49cc6ba31d50a
SHA177b570691e430d322e34b3e79f25b7d6558ed016
SHA2569ab369550e1fe60375c7d79bfa45d20da12a12bcb8e786379a6d632fef0a9795
SHA51210c1a14663f161affea36d616daef3a8ec38482828df45c23e0f0b48a0bf8f24a26d12dea78152272b7c8ad8f4fde2c7289b506fd5157d4b2e36bf1f58dc218a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b4d4a5ce1a495ff897df15e1bf90a64
SHA130741c706d00dbb210a06a510b0d5d82bffbe432
SHA256608c0e95ae61dcf65f8408e4a1b6d3d1f5148f73bc9402b07b7c58820fad55c6
SHA51219a87cf51a8d96810143cadd1d1caaa9ab486a6a597f7d5ed576b6d73a0fa131020450569c274529bc618979a42bacccf1ea033ea385d98f30b2ce5a5fd79ae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5871a0f63369afe5e2364c42b1a368d2e
SHA11ad3bd79e441a9a1f065eef7657d4c007189ff54
SHA256fe4c00d58777f9a1d423d85f7ffb7fe3e2b1ea5ca7902eb998f57726fc4e8167
SHA512bdc1512ec2ba2fe7cf2e1c10676f74506161944b6de66cc3ebd28e8e6c3498bfc08fff8521beac41b3c062e3e7a4bcebc9cfc49c89a630d3130a1e66bc527115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596b4972bc34f90556385a3044a271a0c
SHA11fda4d4354135438275fe2e33673179add37d1a9
SHA2565e795511ae9080061592b28bbe10d4e67cd4a7cf913b3aa1bcc3ebe4d6adadbb
SHA512779173d71ffd0bdd894e3a00e7bff9662924306cf55d49f0cd3601758208dbbbbbdbc6542ec679dc19508f00b791654d2f02755019681f1eb8547452715013e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531014e3e8e32eca2cf82a20fd0a5c1d7
SHA1e7535d5cbe826a20d17b984ff71ff5af5cbf3a96
SHA256d281a37341ef31b2eb9f2cebe9d7eddebc96f2a0d56fbbdefbe889fa3c21c14b
SHA51266a8ea65333256d6f2818e376b0f4efadb0e9979b68ac86aa1f2c20a3a0230f6d4207dd3a5b2647ed46b34a1399b7f6373296176df15c6879218514904654115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5906ce251109629d9fd2cd54756bc456c
SHA10a5c542249fbaaf73fda719a02387c3946526c87
SHA256d97b9cd5c2d13863d9599cfa73b3c4554d8ca1fc1e4709e6cf2ee756cd24af6a
SHA512143f6e7b62fdca7aca93dfeaa0e24fc9e612c64a32272cad8676a2f553d107f12dd5023e63f809f9557edaa20d6a88126502497f4ed941ece5c363406062bddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3b99c9ffb8e11ea71f68b642739102f
SHA14547529ef7b8b27a3d23bacddd717dfd375f78aa
SHA2562468a51609041ab408cbd20b778e9dff64c78c319fc935c66dcd729fedb1d2eb
SHA512a730abcbbcd755c06e93835f7e3f20b3281970201f9c08bde9fb3b280b0cee8dca026b5a8390690a12c271d6d533bb6a8ac1a780bd3acd6aa5a205256e6df65c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb5ec5259c89bd9c3338a944a6dd6433
SHA1c1a2cee2fdc47f7647e2b790df59c469f9e18b4b
SHA256228f5fd9116980e86991427d4865d4fb00d42b281db96702f483e3795b350bad
SHA51269e841b28bf10f42bdf4b0f8e0cccc37e72d2a1d72e6d9040a2bea1f1220cd05269fb79d63c12abef25eb65078118d1ff946c0478a326016e4826a1fc8076aec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7b7bbbf16b25e49814ab00d92d734f9
SHA13001a870244cedc3c8b0c25c16b42fbcc6410ae8
SHA2565fc21b0aedadf684bdc4c4ed3464e6fb1e8c3d03acf7a692184be0db552b7177
SHA512d954ddd5f5d242c4cef8493250b3b66fe3354c6fbb51392ee26ee7c2e106b901f5b2fbfa11ebe130da1b2364fcebd4c8837599fa7a4b85d33f8db95fd6ea79eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb7fb40666e7b9a349cdac63b1aee548
SHA1b2e429cb63f98c57dd9a990de7ac5f63cf9eeafd
SHA2567719b8c5fe4826507f56fb6e70c523f1db69ad378f4e82336f9e548799b346e3
SHA512fd6e6ca3a4ee209b5f8d6690d7729e640c894a2c8fe9de506a4621fa6df30d0db3d3429d27bae560399b25f41926c0a37f3fc00f1cafaf05b5e1e782ad16d283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a956fc7b68252676d2a004950cb5b7
SHA11aaaa6ba38731f9db03f2ae8118167b0d8a995be
SHA256400d34be18ae8d3bc599faad7086b323260cd6068e0a395c5684ff5232c6e36d
SHA5125d6c7c5c0813086e6c97ce9766f91055598000a30a84b70f3e72df0b14f35981a1dd20cdc0998a7814fc9f1c0e35b4e3f91c2548328a023d04eb009428fc454b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50748c2ea2ddd29c06e584069a6c287e4
SHA12217293b29f2e2b70c1932713755ed38a1a0c3bf
SHA25661ec0cb90267e59eba64c9ecc25e867774aa2bbeb9f26b43ea982ecc67a8e2a3
SHA51289f825e413481143c101cdc14c37a751cadc0d531b089c547d9a19d1dc8ff49a75a43e272b45aaacab7697a2f16bdcddec52d98da25c0cca43b54f1263dd8151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ce93512a3be57c8def2559b83602bee
SHA1423f2821f8f2fb00f9f78deb756a8791ec525a1d
SHA2565444413b56c56e2d166b4fbbfed3921acb7cc3df504050b014fc556cfd5a78de
SHA5121569fc7bcfda0489fb28e4886a99b444a038ec27718fb39551d387b163d46187b3e4705abc4a0c77edfb8ec9cb28e656748b07aee03a11dea68484e56060a817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d5207df26083be23594c95743bc6ea
SHA1dd817d51cb099c3e04c28e31ad48bafed230f6ab
SHA2566fc047a9f512a24ecf6cab55da8d30fc267b5bbed9e4effbc3d2cbe790461801
SHA5125d94c6a24d1bf3673ef300df6c656a2528d67701b7b5eda4c1f7ae61ba79a3bc94dfd4f1803c23fa52119a6facf46c8e62465833a5a0eb3eb8fd427de3dc1a60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e25bb6c216a604b10b500ca664eab600
SHA1fa46e6c6fb6ee267badadc428d55a5285328883c
SHA25649495d0bda2b2173241d57b2ae3a279ef27130ff1e5b569ea76b5f44377ad46b
SHA512e60625a05bb0b93fad62ac0253f84d1259e690f2066b0ee351b43a6c456d656d4c198ccf3fae018bea8cb23f69184ae6f05f0168dee77ecb9e106ca404e7aebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1c5c01cbea07710f8dc5083876e4909
SHA1916c0e143fc50c5c77880c21292a5864125f7a50
SHA25672f0e71521d5857409bded3b2afd19c32342a7541cc3c65c8664b722d400c6ca
SHA5123575fb1f9236ffa69c031fa8ffecb34c367309ed2ce9b05de75efcc00bead00d69c761300d65e1e6cf3e42f817cc5291f18883ca5bb295aacb62033475c2d8e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5143d270c638007f3939a8b7df3db1675
SHA12e493c6d16cfd7ea83968021992f33b674a7095c
SHA256e3350de8c448ac096e3175115d4090b58d68a25f6b74ce06b089bae6cd3ac029
SHA5128ce3949306538c0628121c6aeb853a0dafaa12eec94f970d548565f981bb07c9d8458a419c70cf9d3c6ede788c4c4118f5ce0bc062066e0c6fb40692e5481c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d402ebca1dc8bf427b7ed0a201613228
SHA11fd82656f4ae8fc8ef0753f5222f32de397f65f9
SHA2563cffa31ecf53a957a105edafdd65a35705e81e235b0a002e07b9150fc0b6154a
SHA5123343bf7408dd96c92b9bff9d5352ddace3f128fdc2b60cca05e4510b98cdfa06978c74e28d4ffb78652af2f8e87ba0e9185200acc199a821efa854ea40cb67f1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a