Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:18
Static task
static1
Behavioral task
behavioral1
Sample
68d3fcd3267e746bc1290ff34624aaca_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68d3fcd3267e746bc1290ff34624aaca_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
68d3fcd3267e746bc1290ff34624aaca_JaffaCakes118.html
-
Size
20KB
-
MD5
68d3fcd3267e746bc1290ff34624aaca
-
SHA1
d9e73cedce38759e058cdf3ed2f0857627626225
-
SHA256
1d6506f9cf62f21274376dd2b561183101d46a175fda5d69cbfcba62bb88a31c
-
SHA512
c20c04c5a98bd839088f586e94d865f4723412828f2e6f5e93101c51a0ed65f111733f8b6965591c7335028df0132be0540a9dc616f8fc5b47432c9ba50974e2
-
SSDEEP
384:9pUlxMlC5IHmPlWsUNRUbg63Lr6aIFhbUGuOMf77W6F:9pUdH2Sh3L3iPa
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a7580196acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab00000000020000000000106600000001000020000000bfd45cf2f7674e8ad25edb87d60dab22a4101248ce912aeecbec147dc4d804ac000000000e8000000002000020000000a43f84c8bf2e0b37919c9af4f99cd979821ff01fc302d3dd4f9ad21f2afa9e6090000000a804a3638fe3daa53b3b344bd83ad543368293897264b11a5fc537b39ed03053ac77104d30c9784ce19d6abe66980a2e0ce3951191058530466716dbfe8335d4c2b227578978bbdb219970c5c47424fafeea641757613c3cca6d52d629ee79431d0267c5e6394785a8ba157f2898ea832d86c2957a633f3e0e7d82a4856e7c24c923fa60d5c518570e8fc5dd0ff6b6bc400000008ceea478b73d620360c19a627f6ec2d67c294fca7767e24dd6cc0df927fef4ef084e60006043d2e56fac6c2ec8ff5dfe1c315246fbc829b7b19f86646470adc5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422578159" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CCE9911-1889-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab00000000020000000000106600000001000020000000f12ee17de154c97d632e88be97a043535f9e9c6b8dd7a9a4f6d3312973212546000000000e80000000020000200000008182ca78269061d41048d9e6b82323d7178e31a4a9ac7de8a8638e044c2d5dc920000000c3258d9d3caab37916ecc0d6347b6fc4d7f2accd5ae4fd3228f035a1387d9b4840000000dc55ec3c92c2947f7b8f47f2f2602eab4b6422e5803bbfc5ba7b89f4767d885292375f0472752052e2b769cea9aff8a73ec6de3c4f384adc415f9e995d3d1865 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2872 iexplore.exe 2872 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2872 wrote to memory of 2800 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2800 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2800 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2800 2872 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68d3fcd3267e746bc1290ff34624aaca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527ad4d5e42453b0aa2449c711ac51585
SHA186354f536854fb5553c9eba7d586e786a4ef6b4b
SHA25618ff6285a5f9c40452aa0979136d67d04557692103a51ddd788a47489a69b5a1
SHA512d642b3cfac9ad138013d0faa3bcb9be9c07ae75803fffe8cb232a738d08878cb1147a325f7a852460341b7785d906ada4d394169aa11d2528bc222db6bd5f1b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd87a354d32f958d53dfe57fccdfd17
SHA1073481b7fe736e274eab0927a27d6c516f25d8d3
SHA256b1c4aa9d209c8d4a550c14b0425e6bc7583197a15a7d25f6b2286e6a47ed0580
SHA5128d626db58e9e32fdaf269a312e781e7584190e73acf34cbb28cab6ab22859c558b1e34485504c6bdccd43ab3ddd0d1c88cb1d6f9b08a2a11c2bdbc32f8f63fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5707ccc67272a0e6ce2bab333c6ddee59
SHA10d95027f3e175330c124761d5620f411de7bf992
SHA2560d7f64e0e8aa035d0b736ff0fd40d57baf38aa9ff5af2160a4f37e863ecace90
SHA51233565ef6e4df1341d0629a93805da746e72c218f3404ed1febe6be709405d83c047ed41cd90643e7599c908a6772f1818c5891af65284c7f7774cd09144f5c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5472cabb4e9099cec5ef6ef03e27dcf67
SHA126abc43d4ee3b154ae883507000d5b6bcac8b264
SHA2568397f6fee44d926e4c417057e63f1f1c9e32941ed1a3dba9d8cb1d1674def4b7
SHA512647f3437e94f6ad8a5f2d410620c21ccfc67dd8cd998a9711771b5eca99f5e46341bba3b0ce1a0b2d4f597371c2ad2355fe5ec6c45a781ca336ae646ea317f0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de3ea9f4699b2929201b1086d7362115
SHA178909da9a4d409a2085dc340c6211b7f89f26f63
SHA25678f6d4e4403237edbd840fe12201ea32ff6e0c0384b249b84ff12b765397d47b
SHA512a0e9e7239b1b395aec0d1691ead2ef1c7c3d3ddfb0cc8a6cadd15d00df5545b187bfa4188131cd6451441d035c32d4134a36c4e33887a360f6afece4fc583a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52612678bd45b6e60f5c913eb69bd9bc0
SHA1d9638b358b4cbeaf36ca4a5370cd90885fa6d011
SHA256c52485b693981b7351ca3516a709b31bcc6307a918be4c3dae529e2a05610f31
SHA51257e02b16ff4abaadfe7717d2b056cf63356f41c35e71c3d47d0404dd8a0dd609edbe2a7e596b019fad52be8b3f443d21f25037fc0b6234ed7c4b9617f506fb05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5869f18a62267b3a6a19d659e6f1ea9ef
SHA1b5dce2e6d5e19cef51a84582474fab405207f954
SHA2563a71b9b14670c784be1c851eea9b9534a9967b71957b5740ea8a490786a29e73
SHA512031ec3aaa006919bcad7b8fe505831bf4382c93f98ebeab8eba91d0d459e65b2b0496a709c8c0ff8e7b8b1fc620c7b3773300b22768cff897c54c6de09233f1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd907c6d61a0f317f12704935e4306a0
SHA1960f6593606abcff99b561335cbb6b4cbbc24f5b
SHA256ea98819f5be2e67606c6e379c43a6cfe8b2b5c435528244f2c952897e2c30f8e
SHA512afa53fcc4762c5b828a5d06d19d07c7518a67e9be77f89135afe0b5930d9d59ebd2aad62527f0f4dbe05d84f512cc92f3659d85155f3df5ad6d191119ad3ac68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5537eb57285df011d0625edaf48bf7598
SHA110962559cf4ae1327735b3ca71d29b7061d2955c
SHA256bc8bac729cc4bf13ba9845f8e5da8161850b57c7949a85d2a669e9e4a79fd539
SHA51240405a85d19b52cfd5877785767b1cbbd695e601afdd0d34c10f633fe078464f773824a7c5f081f694956a0c396e61f829a30224efa964198ace48c10d08919c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd717526fd5c0dadc5824f0ce7827824
SHA1107563d8394ff4578d04becabd5cff0c9ee8b87c
SHA256a23f496026a7c7e2e66728c37c16c01f698b772999db35a26ed62d6201b5d9c0
SHA512adc8466c55597847d852dddca78d74e9ab2cec116d939d74be7ad8d9c217805f1e07e02ffe61b0afce2234c32d51b6fff167b594daeada8a0234320f1fa88719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f31a5946c0f9e89d29145e6ed81d1bf
SHA1512969b14d3bb32438433138bec38bdb472e2c2e
SHA2564b7e54e06f66806f7f5f619521432650ad52b53744b7b5af21dcab32dabbdb36
SHA5129030e59682de620a86272e8b05f29596350b2db661e3865d6cb89976c11de7f6f8dc6676c587cf156e2871d655a06a52736b21faa240206642384ef67cb49b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f0522a4c650df01c92176027c76f84e
SHA16d7512704073080c98c02c1d7c4231cb720de39b
SHA2564fb3f0a95143106fd3756c607ff388fa550a44cac65448db8c07bea763868898
SHA5128586f4af266053ea2a0517a394ab97461ada7fc7a2f681423dffbad4deb731653e3b5637c2c444ebb9a7abefd569ff03168613a2b370703485b4359b5a01b9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f3fbe02994794953216cc5d61114056
SHA1180abbefc0d812b91da8769519d87e14e3c603f5
SHA256ba7c8802a14ea53d963d1c209815fcce6d1478d9a566131b89b480b95248d50a
SHA51224254e9a6be2934d612311e8a403bf1c584d9fb867f8cd73351d3c1cd3d9f5af998b60c4f0a646f275ce1effe1d5ffde0c4059f0a984bd89e00f2abb8662fa61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53317a242e31d1f3bcb5855801f767004
SHA1be2cc4ab3f7c391a92c6abe0504ea9cda81099bc
SHA256438fbfb20262c524a07a34ecc409d3e43a9a8c66b4e1dfbb1a2d2f078105d5d4
SHA51281abb23f89d8292d8ef01efccfbbdd3ada018c694d2805719bd9134a45c3851822b2e57d01ce5ce7b9d8f2b958f5d8bbe0f252b1c7ba1c87be0db87bad273be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b51f3bbf0b29f119f3a77e8e2275d57
SHA162d8acdbe67e767eb6a5b89abe4612ebcb9eb38f
SHA25639f2a6ca4135100fdd8152b9678d3ac9ac3ba9b5c6c469a811be0041f3d7d6a8
SHA51269a309d290aed2a0f565772a0932c88d68465c000b6797d8c3929442c2e49195601f61d56acfba474be45bc16da810576497c6baf20643f9d45b6e5f18af6c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50997b1e238ab3a678943784beaf2176b
SHA15acef506206798205bcb64d8ac416b9535197751
SHA2563581fcc6b5f067f5eef1f37aad7ce8e32a57abbb7c7e1bd99a0e0047b5ec1aa1
SHA51214940c9b90f2708b316d81eaf33f8ccd19997316454f833b0850a90a4cd79e0a984ccb602c40e8da47654f1bab079b0f7c81fbc2e2cf7acf1a8b6ab4fb38aab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4086a64e6a63d8fd7c62b6f71ffdd8f
SHA134318e806ca8594752e7f5db3ed1228ae995e420
SHA256ebad71542a5dcf96e92ce09024fdc675506fa0de48064ce2d21fd30de748f005
SHA51285f0dc7195a2bff9d248d31f7d488d6ddf6f930c51b2dd9f7e8d33b71ab20829a1f68c8efd68ef32e2193719c65b58aa7a0cb76267c55f3ea1583568d4e3aeaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ae41330b2cf7ca69430a0f3a3aa872d
SHA17feb986618d4521c3038009f687b81db58746a98
SHA256137d8429dc64068cc15f556eeb09c5db3005ade722ce8e8ab17d6629df6fd6b2
SHA5126bac524291ff606f3004c3679bf73cf9f7796d30685e7fb89589ed59cc5276b540042052d099d01d8e82521237e2532b517f8fc53429aa6a3242ce7d9755fbc7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a