Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:04
Static task
static1
Behavioral task
behavioral1
Sample
63b83966bd88969e1252f367f9a3ebb5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63b83966bd88969e1252f367f9a3ebb5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
63b83966bd88969e1252f367f9a3ebb5_JaffaCakes118.html
-
Size
214KB
-
MD5
63b83966bd88969e1252f367f9a3ebb5
-
SHA1
b3f9cf2d98def4f092427fd0b9c5dbc28fb08788
-
SHA256
5c8cd6ecb01c064ed5c7c055d58a36af6058e707a3f9ac1508de7e995c7fb80d
-
SHA512
1050563f63e4d8cd463c8d62bdaa99f087297617d78c95150a74494e611633c69cf3ebf1334b49d0f0eea46efb4336b6afee02d6ae4daea410e2070667beff5f
-
SSDEEP
3072:qrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJe:iz9VxLY7iAVLTBQJle
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465734" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68F34231-1783-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2812 iexplore.exe 2812 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2812 wrote to memory of 2816 2812 iexplore.exe IEXPLORE.EXE PID 2812 wrote to memory of 2816 2812 iexplore.exe IEXPLORE.EXE PID 2812 wrote to memory of 2816 2812 iexplore.exe IEXPLORE.EXE PID 2812 wrote to memory of 2816 2812 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b83966bd88969e1252f367f9a3ebb5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e891d4fb9af080e6682359807767398
SHA13991e3761efd27bec8646a585cc88653eff5a3fb
SHA2564cd748fe6cbbdb2a88bec711e74efe0d3e20ef0d3537359ab2677c6632b3452c
SHA512becc680e93d34f026d0718eb80967c96ec822b349d1b125a38c250008370a4d2f281a078af160544855226431f3406f784f96c8b12c80c5d019f606791751f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d63462dac6d873fca430aa409953158
SHA148cb130dc2ef3fc0f6517fd4580abec8060eb825
SHA2567f4aef5368ba520a9528f505dcbc3a15085fc61d3755f23982316bf6431c0c8b
SHA51299ccc0b90ce1d5b7564543daa889819381e803493722c251b4852c73f048bddc07629d53538414e22677a37d4a411c05d517f506d6ec0d0e285245c201b5666e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508c6b76b90acf7cc3f4ff9d466abd913
SHA1d6a78480210c54b4e7aa4b06761feeeb9362803d
SHA2566317d1a84e4615e2ca01dbdd43d29f18ab12dce743544bdd80d02dffbc6895b4
SHA5125e59e20cae7e2cb25768a7b1c6c10ef7650c5ea7de298c46f10d1dbe6c8fdf27efc2db8e2a1f155d1ccc08d8b369afdcf5e3bcdc7cb106400772f1ecd1a40cde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae71df340bb205ef0347887633fc5dbd
SHA103fd79c4576f3a90cca9772ebbffa672be159d51
SHA256bbe3d0ccc6fe45e607a0d732c88589266559adf794456df5763ae1e02aa2c6cf
SHA512a426c28155dd24f6bc1d1ce5a0527edbd4ca414f53a551167371144a91a65edf5ef637b428e53cc43be5bcc712e068261ded5624216cdb01b55af8c10950e449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54669a56009e5d8961f96504cc5d6834e
SHA10b18d43645e639b2f565e3e0ba506ed8b788b8c3
SHA256ddfed90d77356089c51f215693e7fb526e734b14f726dd30226824d85c19045f
SHA512d144ba2bb4f85c4b892de2b4a36aac93eb85db549b5c03fcbd844a5f007d314b4256dbfb6ab8e16e1a797e264cc6fa6df56235d6a02cb1aea467dca11a7270c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c0373c928f448550431298962231849
SHA16e6217fb62cccac13ce92289c8b8af481b59de4b
SHA25641f6c7f453c688b08c4639218cfd30bc891929ceed0541120c1374912b68d515
SHA51222853cec2348f992fd5ed9aab136380309c21f2bd0e951dba548a0c0301e49c2fc89dd8a4c760621cc6bd0ab7ed46e5968192f21165dff0e0246f082d2755274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3e6bada22e3c0dd0ae7c864bc8d588e
SHA11c64d6d13e8c1d680f4092a7a5d00f36bdcaeb61
SHA2569289359c343222bcf7159066323f9115b0780f5dae4fdb931c72618afa6ff312
SHA512828f0c395ab95f349de712b75d439e959b68b96f102275f34a279558f0834b712020de1c018d72b248d44657b7e7793a407db00a9cb4e6f442460d36e8887197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1a1def9f35d0487fc1bc9babd37f00a
SHA12b3afd32cf5c1f52f5c1940e193f49e75da41915
SHA256e7e5ead45c222a2bbf73a01cf733486c1ea0efd434cc9e5463be785381d085fa
SHA51203566597f06db6ccd83b67628a409d788183c1c6a36b06a2c3254cc9b52175d923a835959ebf06231e9f7b76091aed2b884e9288e3d663db89a4bf253e56779e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529864b8cdd39dd149d0ebe41c8fa8c90
SHA1a4361d52d67114fa9088d41a11f9e9cc2797ba83
SHA256872ee35c871f7b483cf267b3313f981dcf3b91f5df055c677f83a05760caa90d
SHA51260898ffde1a04771fbf2cc2f4ff194fee759557f3a73fb676fee84be54069610a57ba3d6f4dd1d69c762f1a2dab6711090d35bceb99ac71a421e902c23ce7fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515da29af5db8df259412a128da4b11d5
SHA1b6f1e5ea812d62e4f90967d15d5e649973e98f15
SHA25682b16ef9f571aa53b1541fe7606a942f41a1e2ac98d2990c57fb47fe2500c51e
SHA5125a50f8a239b8863cf4493c6c9969e272a5104e81b073b69027749dde2a0047325a78772fcfb40dbdd39e98455268101c26e19bcc00c04ea98da309ca2c81cbcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae3f7232ab738790d6a9e28d6139b2a4
SHA175c5aca49d4fdb55898daabd9db69571623445fc
SHA256ccb85c968511d0b03b44b993a4d8fc76d0c71a5b8408e2cdb7f19d682df680bb
SHA5126dda214ce81e693152c26ba8f9b189d6a4ef0755fc44b6d7aeeafde72187215d84d998a1d23f3f85153388f6e124c3aa6ea1163edcd1fa715557ddc86527902a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbdb2cc95f4138d38a9375c79b85a5cf
SHA17811ac413990dd7b85414c9e0f5efe460ceb83dc
SHA25634422ce6b5feea5b129c2a2c5c3e8ef028806c4d5501691eda76e8422d1fbf14
SHA512d2c36169994a0589e2ab4a7b2c00ca38502ca87510d3ebee9ad6f074191040ed6d0a750135b9ebc5c868ba6aa9e3fc0e800e4efe2a3a85bb0114831cab762236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ded67c800a0e5d6c4cfeb937c61cc09b
SHA1fadf97c97807bee9c00c5c57f3ab17097142b088
SHA25665225eb168df692bd1209a4610131d682aa44f9ea28b522d55bf3e6448f100c1
SHA512de89c8650ab7f89b34036ba9da97b2028c7aba92f3d1ee29714a2e9fe5a8f9eb860a6572a6cbc2b22ae1ee66368335627260ba02cdb8289a6018efb77f910e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550802835815c0cc214162fd92e1b83cc
SHA1aa87fa9d28c4cf6ef562d39e9c98edb940c3c618
SHA256fc42ae2a6ba19ac7f71069ee854455eac240c279ffa4bab25fe1861a8f600dbb
SHA512eeb85c3190ac83d5818434001901a581b5715e134b27bde3791c71cd3853f20a3e54e4be14b806787a55a2cb2b6fbf59b80d87d3d7886a3bbbb99ffbc91cb06e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3d59a27896ea040a78bcfc07bf8d9c
SHA13c622924ba999c4fb007a492015b783dfbe69763
SHA256346e7d102165a92a3668136b73da77ce235c7d5091a10231e68804b0e953651b
SHA512bf194f65b1d286ae8b066a7568a0cdc4c12c37f0dc71228a2a3521bd3a1cf793603d89656e622930b5c646fdfa3c93e9543c36cb7c97d95c8bbed299a66e41a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c773ea4e1d53f38bc7cdc2008fd08a2d
SHA19dcdbeb62141af0162b485b90c900084d06a52a6
SHA256db58f5a4be7c8ca0918919649a4f4537704f56cbc2fbbe3911f7abf88859d06c
SHA512d0d061ec55a677810f2ec9e50e0cfbbd3633250e808796c2cb2f510024e6b34b1b424f1eab7137ee4d4d24adcc2e817ce87724c13fda954b4bf19cc6bc459fbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f3604497c9f2141c660154d98090958
SHA19cfd0ca03d868c42f88a4186130a7a58a3bfba62
SHA256df832e4c25b1ecc375ee867e951b7e92c8b06597d618d2e825561f22027f05ad
SHA512a1f2c792d5cd27517fa8e88cceb82773c79bafa2e5e591556eae9d049187d7df25021c446393a54e6b8c6568ceb3b7b047536d4c9c693340e40fc3ffc34bee51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6fa07272b59d135a6fc19a5d8ab0213
SHA17823a59360da61b3a4a83a26c8b993d948711ae9
SHA256c8ed3bead9059ec76c5576bde5d5e0c8703bf08bed24d052e6330ed2f5382f99
SHA51210cf0396047139445bfd43203f20b7ce2179839d07d907b78d43704666df86d11262449363ef5db2a91f29962389734793b529d88bf5fd0ac61c4d78d382c317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551663c27875cfe52b5e9515115676656
SHA1db9a11d34807b3099fa19435a0dced44e367dcba
SHA2562f141541b89c7d7b825e06423195c7cdff4ea0011a86041b232f6fd8653680ae
SHA5124e66d9e91e43b0cdadec970f247cc65cf90c0dae5895e79ffa60d21b0cecb0d78b2c481a5f766080dcee08cc9a985df8997ce594f0b425149d0dc5af54120872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512b93de4c327424f3662444c40c3335f
SHA1a42f531f491d886c2ee11c485030d1ce214746f0
SHA2566217e1f830d33ba15777748aca9f57e8a1601729564f408836d1b2fdf38c62a8
SHA51214f6d5c356d3180e34aa9df7709cfb78409daea5f0d7cd2d4190459639ea1a1f91d65e8b9af69dd527b0a6287dd3fa7755cd0e3999a65d08127bbb3cc264ef7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4054a1918465640e07cecdc550841af
SHA1a4d7bc039f96ea4a3ed66cac9216a4d8f2755eef
SHA2564f9aaf7d4e4c977137e3a65883df0a8a40e545abb42aa460cfdd15c8405003c4
SHA512f994414211d7674cd2a2e210d63b7019d0c9d5b56c5382b7d0d275366431594e698f48c52e2f90df921c3d440fec69704eab43ad3b0937c8f0bf5f1697bd41e6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a