Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:05
Static task
static1
Behavioral task
behavioral1
Sample
63e5816b9fa66ba6b256043d1ab5dd86_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63e5816b9fa66ba6b256043d1ab5dd86_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
63e5816b9fa66ba6b256043d1ab5dd86_JaffaCakes118.html
-
Size
22KB
-
MD5
63e5816b9fa66ba6b256043d1ab5dd86
-
SHA1
c17e85e0ab44567865e033a2497dd76991fcfae2
-
SHA256
0d4acf012a9d16bcd127d66a533679dc4697bf83ada580d5e8f3753a39049a14
-
SHA512
c4a8532d62d0fce93ca347a0def3ca49afa2946a204095bd887a88981c81cb7f768466a2ed3fe9774e951510c965a26349b9f0f30d3ce68f0fa49d4349b94574
-
SSDEEP
192:g83GVwYzel5iYzel5+eWnLzyw+U6lt9Xrn4babDgdvJfHVp0Td4/zJFZOGXpsEBw:GDiN59CfDgdvJdt/ZOmpTvuZYaKR4/n3
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5ADAC41-178B-11EF-A40F-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004fa2f8b6f35e944d87a639ecb950346a00000000020000000000106600000001000020000000583dbec499f22c68a1e568571ec60ceed3f181c36f8abbaa673c0cc8f2242409000000000e8000000002000020000000c243eaace244f496dbaf10fbb82c1d7920afb0f09ed2031427fae8aeca8d5f4490000000c0c6db87f8f8a31e29ce908215f031298d14a167cee3b872d9f93d705831913c6b0fb8ab6eeef563cae7f7dff0e42b490429195b41f0d0200ad01de5a4b4fd194df1443c8c72a33c5dfb7c4a805fa959411616c0c25324efbcb13f479dd9f904c0509132258a4b81a9f01608a5aaddb3bd8056be6118fd19e9c21cab6482e19c9bcccf35712f3f77392a42f2e8611f8a40000000062c6fe0a0078f35135af1ea48f68bd6cffb4dffcf25d5ec01f794511bc65aeefb677d40b45ecfbd9befe50e3989951faef2100bf2df1460cc54d29196f33857 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307958ba98abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004fa2f8b6f35e944d87a639ecb950346a00000000020000000000106600000001000020000000e7fa55b8ee46f5f08b1ac314605d444099a19d08353dcda9f03dd1ac14e5f9b3000000000e800000000200002000000019b2c94679a72bc19006fec590c36b73282b5f55df3f0de8da4d738d9f327f3f200000005a4b934095d3666f2a5e150d21180d65915c50a837cdec3a89517ca4b6043f954000000074d11062409c04350ade9337b8f23e2896a30af5c7026fd731a86b2c5c56f6ff70d6d951d24d99853acb776b5fdf828b6abf0d1a8679c2ffcfcd560991956419 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422469381" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2984 iexplore.exe 2984 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2984 wrote to memory of 2156 2984 iexplore.exe IEXPLORE.EXE PID 2984 wrote to memory of 2156 2984 iexplore.exe IEXPLORE.EXE PID 2984 wrote to memory of 2156 2984 iexplore.exe IEXPLORE.EXE PID 2984 wrote to memory of 2156 2984 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63e5816b9fa66ba6b256043d1ab5dd86_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bf79fb1ce949b030e624e9ecd9c09f33
SHA1f345545a2262a7a7e36cbf35691fabf8c91f3634
SHA2563bb13b9a14e3b522340c898e2016ef8780b57e570fe0a35f1b7bbc49b8ab54ed
SHA51225cfdb2711338f9504571f1e552d0af9bc15194a43877032216d28a99188a0377b5f7c1035dbadd9941192f71a6526d78ceda040d294e8cd44a514d3e324a766
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ef3cc65f4fc2dc9f05430d777769f445
SHA1717fd4442fa9e7a44d21cb9be1fd6e3c2d0258e4
SHA256de12023177f74965413fc00ea8768870d1ee399a5d55816bf9d2c4993d2e70d3
SHA512aa1e08fa4e0ecfd6d75cf025f6f569d8f10b6775ee7f51ea99a13fc73af738ff36d02a74af08d87f75afea4de47f9b9d376c67a075c867e75849cd789d9080cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ecb2eb4e74cbff41fda5dd14ab742cc2
SHA11ec8b759c654d896bc696decc6e3fdee81ad6a4d
SHA256e703593a506190ad19a02b278b280d6f6286f3c9904b430b8b447891a9e4df85
SHA5120e8a6095bdc7d520c5ee72e6a98530882d1c3bf3b521601bd1c477f55689f8b12730f985c5a917bf2e9b8b3faa29bccc5bb892136fe92a98277cedb899852311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cdc7a016f2892b8c50cbf8838aabb23a
SHA184b7bd8e3609b17381e10c99f6ea4e174ba0e053
SHA2563493b4ab6e11b7652d5019e44a6a1f8a451a70b1edfff37b840fd1fd3b8fd612
SHA51286cc096f6a490ed5f0899199b09b8d5e0e0c40877a17fbe1961fc7202a792c7a6f42cd75449af119c70c6dbafe0a4ad3b7460dabc4420f6b75f5e6cbd485e8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52b0f5d982e9d259516a6b3290f80311e
SHA14ab1bc84e55d842e3bec01f63661070498dd8fc5
SHA256f3671a85c717ae0518ec20b42e47d86f422d1cc30266d33deebe329fb143584f
SHA51268ed2774b702b8cae65fd2fe03d11dee0aaade30ee0229ac78f4162736ce959c7d9d22fcdf89683ee355f383073be042943a6fff1606a36d3df4ad83a33d4325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51e6f172634d7f17020d8d11d15b3a59d
SHA16640e69c65df33d5f3418ae8e66a088a15c4a812
SHA256022f1acd8a6bdc1f74f9ad433dbcd15f7c50284c5888d144525d93d00813415f
SHA51297f0b072fb903f70ce54040ec7132c16d7235eafa01390e2e5a0be2db4972c1a9f64828a6b91aae31d3886105a72167e963d252fa22a133004b0d8e43b313142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54d4d2d7a7d05de0905bd4c077b114745
SHA1200714eb3a0a4841b2070f35f5825f9a39a0c6f5
SHA256883a0689099436eca39f6e251bceb049ef6b08793ae91e994d0b2e7d4f9c5421
SHA5128f934e3c71a392e2c7ee4002791e2ba3d2ec43d27a7d8c1c1c6b7f95d98ed09c88f608a184d87abb78a1c60497803276e454d6717312841313f0438a6cec646f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54de604c0dcabfff858ec605b87971d9a
SHA10e082e3989f7e57910a50c1188fe2f70b81d6094
SHA2562d33b1042718d8a61a441f8d6455a5ab527eaaa6fb8d01d99409807dce6dade5
SHA51231ecc718843c5becf3196d3e52a76e8e9ecf9bf7b97bdf86a14e5f02ac811e13a85afd7b98014a974da75e2c7357823f8bc1ab2910dfe548b3baa15eda9b2910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5919b96c8e59b731c2a90b5468e90e79d
SHA1b360058889a7bb72d5794333677170c7b6a459bd
SHA256023245c6a4b22ba9db8a45783d6b29938fb860235b7a2d91adc5b79244a3dc09
SHA51280ce644fbbaa82fcd262c63528d1a615d529f1f5f95197a28bffbf3e10b70b492a76b853d347ee1479c9300efcfe9f67b57cd2746a7b3d00d7a56346a610e27b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f308ddf651ec8902ea0b64b1a3aaed67
SHA127360dc8723521baa0bd96fb7ebdf0bbf3c74066
SHA256d0b6e0189bc926598d107acbdff20c0c5c7e429d1508cbc72d9ce3984cc8729e
SHA5127b5927eddeaf46a1a9df7e88a145cb8b2a367782899069a162c8e1b11bcc31361adefbea4351e3f9aa28c07bf1fc00076e31e7ed4551847e8293490c1d9f471d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5be8ea1d5457cb238c62a2fb89773104c
SHA1c3556d15639f359e7d74ae3d14a58c801bfebc2f
SHA256824ce4078be132eadcf4704c6ed013e949be2dea8466934ced8bf7bcf92e95a1
SHA512dd2d46cc9c03ab87003201e42c578438ca41a63eb45ad6a8eba8d64fc15e4da8a3f77e3576054212cbefe8c6990f12de5a80daa76616578f7b5913ec5b953b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59efc40e3728ecf9e39d5e7d45273eea5
SHA1931359e193ebe9bf7524a1f6937cf268dd067e19
SHA2563769867cac45d877dc8c4d428b3327386be37f5ae483e6bc79a672cdc8b38c75
SHA512b8c1e98973e2e04f3f795c818df100ac1f8a10331e28498ed9ae55369699ee83165fa87c98dc7438c015dc32d7af6033e542ba817f82ff60258049d6147f3f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a2aed8c69631a0200e26150a0e07bcd7
SHA13e5490948e39620a36df974f506f40dceb6ba167
SHA256bdd7bc0ce286561c5ddd6cca263ce2cfc2ec4a9b43b57023b2bf0acfd454d7ec
SHA51237c54f3ce468f63aea7fa61d09322d53bf5466ee85524d82b29575848bd059b2ff577a71026e66f98dc07cd22890e3c3c853e6d2984a23f6d24dddee99b30910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d4b247510eac8bb907b968d55b31f070
SHA1bc2cc4ec26b9b6271beba6b197f046ca11dcbca8
SHA256df2edb05fcdaf8b59de3f5a6314047d2b02b0143dde5e1a6519ae09e3b08e844
SHA51297dd36881cd41c29aa6c4407a7f923c3aea73e7e0a2e36e80ffa8ca51ee338c80c72a8c73c82a26222ec3c7bdf08cf10334b1ce28919b60629a798e9f5ca0825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD521b2d8e4c2d149040aaa794b253e82a3
SHA1597aa9ef881381bc241eac415bf7196c8a26e84f
SHA2567a7d3f14d3b63e57717e935debe4aff847eb9b879dd6c49b0b2c2f1a463c5ccb
SHA5125b22f02edb68fe0d981297cbf3161686e2c3bc30cca8018c7aa712113b8c98b07386a46cada957ab4904ea032e7f89db4182d3063cb17d6ef5a85bf9071774b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a6ff7b050c7ac1e5a789658005ca1bab
SHA1e32643f6a8f35f9a6163df8d24a031d0f7fb1001
SHA256342c98794301affbc6950b26463106dbaaf2fb75a45918cf8954f1b1325a71fc
SHA5126a4f5465c97359a3466c1ae887a909a7e51bd116de75f74361d39937ac33ef6057387a0ff6b373ac1100eb63fa263111544906d60e6b2394cb056e801ddf23e8
-
C:\Users\Admin\AppData\Local\Temp\Cab4203.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar42E4.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a