Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:26
Static task
static1
Behavioral task
behavioral1
Sample
68d8de9d31deeee7b787c63b48d07f86_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68d8de9d31deeee7b787c63b48d07f86_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
68d8de9d31deeee7b787c63b48d07f86_JaffaCakes118.html
-
Size
9KB
-
MD5
68d8de9d31deeee7b787c63b48d07f86
-
SHA1
97c71364dac7e01431ad69b97fe50529c5cc99c1
-
SHA256
9b694ce19c33e80da101d01c08ba04436f2bfbf725424d00526d3c54e8504f63
-
SHA512
6d81aaa48ab321a1f6573c837fa2e87fd98cad20daf200a2f396a5963a02042b461a625231ee518a18cadfc08783f5bf8cbed74e5281d453cfcebe7bec79de98
-
SSDEEP
96:IdVn9EUC3hYGuwTkC1op6r7tPZQ+i0/eqZyfHTHeBiByDL1F1kiGIjwxQzHJNQKH:IdbELO0r7V00/eqsmBlz7QKB9H
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422578664" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b27d87d44dc2314aac5ead3f49d67c08000000000200000000001066000000010000200000009b07c1bb50ca562111e65ac11f484ff95480551ee2c368bda467797f80b9bb38000000000e8000000002000020000000421136c6f710451ce77cb709305fb097f8a9c0b972d618e3d89560c04d8e215620000000318d277ed836f5b899ada9d54e43857de8f84aea1aa05abced0b1589ebf8037940000000cad0eb6b987a5139895cd96a3572f50108b550c3bcefcb8e79e1d839b02c1d6ed9c0d548da097df86bc377d55db9bcaf4102c18dca2b496763915339febb8384 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bfb45197acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{590F86F1-188A-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b27d87d44dc2314aac5ead3f49d67c0800000000020000000000106600000001000020000000ab686afd16126a59dbf5799d15396b51a74e2a7cb154896d410d113044d1c7f9000000000e80000000020000200000005ea0cef0d60b07b9d4f944fe6bfb7704f9aa924f6d4f4806ebbf589c62e255ba90000000d15600cc2a5bac93e5dbfa2b189a804d91f0bdb308dacf77e08a490e13d64b0ed39d3cacabc7b284e4e6c7bb009e6018f86d18a7449effb5eeb891ada0c5d33be45a11e8c9006ff2dd049af3339aa43c0a97320bd56711acc56248e4f9229eecc9b40060c0d0331e1cf207e6550d9c932cfb3a5dba2d133f9ad4a80565afb3d0487894b712d54b15f649fbac3ebac91f4000000097093696bb807121ffc0bacf97ee3701b1c7c5d2440fb5e129386e9bd88814e791d4ed91027dc78181658d09925a6b50747355fb686d9d6077a54e79d580ef17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 856 iexplore.exe 856 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 856 wrote to memory of 2744 856 iexplore.exe IEXPLORE.EXE PID 856 wrote to memory of 2744 856 iexplore.exe IEXPLORE.EXE PID 856 wrote to memory of 2744 856 iexplore.exe IEXPLORE.EXE PID 856 wrote to memory of 2744 856 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68d8de9d31deeee7b787c63b48d07f86_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4d886392c558f40d65fd1b843a10d18
SHA12da716661c1f75a1c7784acd15b2a06b30952176
SHA256f144857b71ff4fbeb333b9bd8bffff4eaa7ddefee029ff47055ecf0355bb076a
SHA512aa26c8ac8faaabb49379219f413bd7130184edfd15750d17e1eadbf30f4733b4041b9ad51ae899d700e2095a9b21a52beacc193d04ae640f8deeb11c669e841d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d91196708bc388093cca15983f18c36
SHA15fd0e9056855c2a683370e39eb03450533b484b3
SHA256dcfe14e615b2e30ec7db63efd31fd234b743e623b2a8d433efb733d00eed7689
SHA512c757d7db205394784575a18c807a534d4fb631f66cfd999cd09e33e74f8506c7f0596efbe6d352130eb4ee27f8eda8b5fa414983f666f3232c74837b7b6bb91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ce86621f355bae09fe9729217935ecf
SHA1bcd2c35d56d892eda4fab9dfa29541ea0398c47b
SHA2564f5dab4a927c3ad7db5a33ff232d55ad01763644aa519a960576a03a3924eda4
SHA512070aca554ae629ad41a1dc6e8c87fcbfe6aeac9c988e23c11e577014794f13d7fc2249cb3ed8267cdced9e55e66a43a28dc3aab4dd921d4b0bc1ce414cfe9f32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cf8d5b75abff2058fe7b0c0cc62dcd1
SHA106bb01cd89bb933ffe5d123637481fb1e1f2e842
SHA256cdfbe3926711357c0b2024b07a99d0b71c2019958738ecf89e24aa8d9ba0a64b
SHA512050168f5f7bc2bc9a229cb73bf82a4b562dca03c5ed2be89f62f3b74794837639d383817df43fac7b812ce2c60cd1742d907360df95444e679dc458ff31ffe1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52baddb6e00178f7287874993877d7ef0
SHA179fc154ef5eee6c25606993d7de7220d9f0f105b
SHA2565f24ada1e77b4feb011d299801b595b2c97f7d37385cb246d81cbcb383e10b77
SHA512a58225fd81a3769580b78b7c594e1d269225a16731ef44976046cbd348bd7624b3d26945d9c4120ceb75e4acdc3ef2dfdc12962bd5b937f0079ad21d68d9c4af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523a6bc344988f1f6c5f165357a6ca083
SHA1be7f5f48eec049109bfb5b2539c3367306bc5dab
SHA2560b88367f9dc1c8fbc4d105af8933842d6d658582673c6060d293518f695a28a8
SHA5129b4b0e525982a1f8fe8f345baffee0ac8a12b3fa400d4ee578346dd8d37d33741da9ecf65f58da66905827eea0876165b1086757277025643bba663dfbe4e200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d673965957cef21938a7bfd161548d6
SHA1815c1b65154ebb6aecf034c99d15a6bb5b5fb50c
SHA25647a55b2877bce4a400595633197d474edc43a1419ec3ccc92da8c6c0ffc2bd7b
SHA5126bc23ca8c1902d49c8cdc6452df59499b3f38936f9119341b402be51c50e86c66d62a41e153fe0590d3d1cf3d9dea5acf10458ddc5d79be677fa8de16ddf5752
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eeee4e8f4cd29362396a936f655e6d0
SHA150bd3e17293431e5230e99cff458cb1471d4eea8
SHA2567affc15c31af1e3dbc1416e61a7b46d1a8689879a58ce1c5f7e44ade1905fe7c
SHA512f17dcb64bb72e7cd68ef8f06472d38c95f6d6752e523bd392b820af5ccc181ebe4ba7cd486e9b432eccce61009b956a41609f1e26fdea3ade1b22abc3c235798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a048d709fb8cb7ca797079cc8f66eb66
SHA1c808520da0632c1bc181b2a54c9e5cc70bb5557e
SHA256e42f34a470c769c80e8e5a72fd97d9a53c4e4ff3b2a951b9670183cac11a14a8
SHA512cacd4ed5764a7c8a81c45e12ef17fa65310e709a45359682399609a1a04bc554f350ecd381bc0615af3c980e66d623953733ee833f94178d87e2b330ea473380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52be77faf5c5b3ba6683718fd8f1a318e
SHA15d0932e7a4a3b32d05de50b746bda9dea52875a1
SHA256cc64db981a7dc00a2d22a51decb9f1f330ded088d12a21a9d089e12821254bf6
SHA51248a3a26d6478b13a4135b0b18012ae3a4392e15ddfbab07f638cb8bd5679205606942db5d9f2b8c42b25f5c63c13a9ee100a08c093a4366d5b1fcdf77b70d513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b261059c536962461cef8431b012ef8
SHA1bd92995d6207044b2bae202d632f4873a9f4352a
SHA256fe2112dd6b02729937b1e988d9b470ad0d089d46203d357cea0db7de59f3e9b3
SHA512b9d65826ca1410cce1a8332701157100812e4f2a96aa71c30eac604612fd425a0bfeea889669949ce7853b601100ffec85891015ec14b0f13a257548ee887443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab34afe5724ace2bc1e6961b022ad8e3
SHA17be8312d83efbb1b869dafd036b18520b0174cd7
SHA2565491f32c97c59c98f87cb7b48642f65e4833d09a70ae38215b989945b0ace84d
SHA512a79efa8aa338a9d092894b456271eebb4b865802c66c2abbac8bc7d430d0a4a4143d5d18a1cda1e19f9085c3520d1d40426858adbcc03538676e4f9f67759b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57722d003de72e072194d06d4fe1ea9cc
SHA12bb4dcd3296ccc18a83e4137572b675ecb4ccd4f
SHA25628a8bfaf0a10bec063162c63b7061abe1c2cc965a76e7af077367f4e9af8decc
SHA5122b440536cfa58356b1cb2f68a41dc47ef6b0e5a2b8d99a62ee7478ce3b53029358b2aa92f83e61cc00165d1bd0eff95966dd5905bc258f5bb25462ef5e9b2eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af880fe106109ae7eebc61bf347433ed
SHA160ccf960964ced4d6a93951c048bed17242b27e3
SHA256e1bb75b7c61c2a73b5ce2ec31178cb497423069718db4a50ec622bda6ec0b5fc
SHA512b34a39e1c57f23d3d8c6bbfe5e5070da3b6b8a1b1d14979df8ddcb07ac22650064f9dab83e0ca8fad7252bae9e7901db658b6f53852d301029d41fd826cc8c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd4adceb31c2f515aa1eb215e9c4d9c1
SHA18561d6b37231029ecbde22b1a2de1aa6970a9a69
SHA256412e9ab22ed6f6067a87366177286977b7b6c6771186c682df33e7972c7996fe
SHA512423cf7b37aaacc112990a371148c1ae0169d7c6ccea4a6e8b1798231245829652c0b71f1a9e128c4b84fb078ef7537e04a1515eb9766bbd4d3e11c9bdc3eb007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57610ece07e51abb5fb3aae71fd7fd202
SHA165666ee6b4be1fcbbad3fca273f12aa253e5281a
SHA25625e74c0aef4250992ef1f77c71bad4812db7f84afd1e9a3f2b5c1c41732a5fd7
SHA5127436afe5ffdf46a95c0defbfd5a909b49efeb47d2e7445ca5420cb208870a70c3b97552d9b18a91f36d89052741cbb809f53da7f8bea3dadd5f40a0f8defa719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d6a0d4a66c603d24430aa5b8c4b108
SHA1f6f23e6ad64a7f9d8dd5cc25bd19d330b1927a69
SHA25625ecc27a0ea50780ddfab77016f0af14b52dda940fd22e5d5177264747f7aeeb
SHA512b0d46460c07d37e06d34768447dea6447ec33c3213f03b73d1c1a6a8afb6bf76c40de11c7f5673a8d2d330318e198667804f804305f3a25a4b04e5a79af78b1e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a