Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:44
Static task
static1
Behavioral task
behavioral1
Sample
68e224ce74fdf7766f0942b8f7c8461d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68e224ce74fdf7766f0942b8f7c8461d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68e224ce74fdf7766f0942b8f7c8461d_JaffaCakes118.html
-
Size
1KB
-
MD5
68e224ce74fdf7766f0942b8f7c8461d
-
SHA1
b0b4feff28f12bd20c7ce8b1dfc0dce263b57d63
-
SHA256
14c8fdd5824eee37dc410296d12b7054df7a5ca7f1556adb55a5c579e14b4d38
-
SHA512
9bf89c432d8a212fb40ea670e2e192524583cf85d80bb217e49dfd3ca43aae35fbf42da90bd253f68f1713d0db99328ead7a62eb13f3195900108a30e00d5880
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c688673a479ad4bb1368b0ac37facc800000000020000000000106600000001000020000000411b70749ce0d9e9d5b1ffac38dc41eba910cfa88b1350eec0fbb0ca92b61ee2000000000e8000000002000020000000e9cb282d224e578af82bb9f304c77b6ea5005184506c23c11cdb6cf005d496e320000000dc79295d12cad1edb12ca76111386d869322225b7b23b3a5dee1ce5bb4fbfeed400000001231cc23bf8ab959a515053d6d641f8f7b9417b561a4ae72593b23c346e7e10c777d3a388dfb021de0eca13692e229438a35429cc9525290e4e81960f2c9e1d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD691C21-188C-11EF-8859-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003c688673a479ad4bb1368b0ac37facc800000000020000000000106600000001000020000000479bc0470ca39589a1518b896ce912027a3dbd9f65644529523883cfd45781e4000000000e80000000020000200000005b792605e0e39eb8a9200376699a08965b22055979b80d9585fa4cbec4bd7e2c90000000f4c1cdce61dc1ece57656ae7e0b20f2c0d15bb31f01fa19e48d60e355604c5ef62fa7ea587f52644fe5c921b7e9875cd7c615fa25b2da8355f2f0b3481fd441fb52336b194e2771d76485b5ca6a7ab78a117799cb82e8e2bb0a71a109fbb790fcfdf780fe546708202c08d78cfec8891c9545e10d6275494e4e8625e5f7f3f24b014e91befd30682fda3acc03aeb03fd400000001ed06447659e5a1584b608f1611094198c59700288571c854ecb270ad092572f7c7b6ea880c699fb1506015325997321068fd0ec783c73901ff3509ad5e3089f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422579745" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108063b299acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2908 iexplore.exe 2908 iexplore.exe 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2908 wrote to memory of 2768 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2768 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2768 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2768 2908 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68e224ce74fdf7766f0942b8f7c8461d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5671e5a4c5b40aa1f88010b3d2ea2ba7e
SHA1d9649094718cf4a68fe363735d6a9b682c504673
SHA256b0d2da64204db4424f54ff9bec069b552edd9fdba02b69319531f4274ba98600
SHA51218e168b0c997c79c63005501500c5b6b6969dd19d1ae33d624ae3c0a11a2af7b7d8578824286b6f7018db62dc31a3c13761bc05ee3a313da9b7a8803b7bad2b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a711e1d07e510979659f2c039d303dc2
SHA1917cba837a570d88d141089b09a87048bc68a098
SHA2565e3cfd39b3d3ae09d51d76fd816d4d790922c330da93cd45bcd719369250dbd7
SHA51273be8c869cdd37f7e0e8b53da4fd8b6ab3dd2ca874c5e8666a08e03dd2c9434bd041d188d56ea1b42b9d64a920aaf875766421b0719e69c431a5d48259c37a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecf4a2784655a0187451eb5d9cacd261
SHA1bbd3691c255dec088817c25f40e0ac046619b353
SHA256a84db2d8653d670427b9ff41fc61e10c06058b6fbc580e37444e1eeb1ce3d29a
SHA512e1ec333e4dab41ee2a3a054769541a4a4b8b85cd8ac4e3cc5b665915198783446055d74b34c5d42579458853052f2515e9505af815a0162e16fca68af495a18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506057b734714dff0b910bd381877e681
SHA130c9a39c45b37b0825bf276d8016a1b44d1bcd6e
SHA256a6c9786accd2bfe3fc757d6b36e9d8891a649361ab60ddb32b1ce29004d04ab5
SHA512b70050e924e52a9f15de381dd4792b7c268b5f36bf183be0982e59ebe8983e25cae87c1aa21667406d80926dad5552da6da00523c459ea76dfa57d0bd0a8b792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa1f2b0c210da2512ca6a70228fae8f5
SHA1c4195b6c4f48b90e8e950a11cb9d92fe8520db78
SHA25655853919f223d1dc4cfd33513f28f561b1be703fc27bc9b927627e65ebe12f93
SHA512e45a1f37139ab063b6436f2f571ce8af64d3a579bd8c64e61bad91e57a66d8496e848f40bab4bd14b9fb82d8d16e2ae36b08949de108e1f70dd7436aabb27e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525c444805687d06c3ee665e05ec2b976
SHA1f2bb2bec710c28afa546fd53ca46598623f61d1a
SHA2565f44adbcc3dd7c250224eb827937b378cc4800111f03554a6dbd54c9ea12c8a2
SHA512e85d120e09146d8bf10dee0e994d57d5166fff17dc6d25f3352ee7af3d850ac73fa8915918a80466cae6b39689a1a4a6db552cf625383d3f8c8268dc6608ebaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbfab4852e6fafcd90e393c6d0602682
SHA1bed23d07d6257106732133444df2b509aeb23ebb
SHA256e31064dcfc1ff3caf3a5e200d1c753496517ae4879a797f5b91d8cd477b632c7
SHA512aff830da3a5a68bf29927760c394574774c9f0a7064094e62633a4ee3cdc319431f103f4be26f88dd76a477e4c16a40f9bd67c5336e44478901da19c0024c2f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aab41b2a25759fb81efda858e37d3e28
SHA19c59f05b73fdd33336f01bc2077bbfff83a509a7
SHA256f0d9df3412f3b854e5d0f7ada1ad66484cc7325530409762f6048888ed07b6fe
SHA512d0ee31bb32e55f5ab910128255c2432a5ea8fcdabe5d0b12d43690e9bb6da8065dca3bd666074125303aa01f085884e74bef59ad648aeae63a7430fe839f4423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8408773dbfddae856ac570038fce25f
SHA1ba83f80473daa4a9a816c8b561328f6455193664
SHA256b09e44ebcf4468345e5c598802487d55df0288dae63f157aaea103532e548c3c
SHA51205fbbe87ee27231d962bfb1414459f8967d933524504624252524b601f904ffd98301fe959f6c2f21249212e925254449dac7746bd5e73cc8bd6a681a3bdcd1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6167fa0b2b7b12f7e19335a25ea065
SHA1bd54b5063ec30ab937365c07f1f9c4c8bca417bd
SHA2560256f2201a7c034d4550e6e339166245a5d869810856b32cad15c5c626baf093
SHA5128770d78cd2cbeec3a08efe3f39eb5373462ff58d788a9e2209c29fa7414ee1b723af1ded10ff0523144c2b62fda10c2b7d4da3787b656df7abb200095eee509f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af34a0969b0e211c4cf228dc4c2fe8c4
SHA1e41d8384775dc23145637d5d0761d974a3f2a665
SHA256951446c497a192a6d1a8c707538c88f8fc2d09597f8e27013608acc099da49d2
SHA512c7fbe2fc7b55c75cd12a74148dd1cac93e1a4304df8be2bd0e30fa9f715e7a89835a095f7631244f6be5a58280dfedc46d0137f68e5658df4f4203e85881adf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523b09a8da9f3e26e7c1954ec6a086abe
SHA1445441d3d61484e0946aa444013332d5bdeea592
SHA25601c6fe52b24348e5ed167d3664a230b1b9ff8480c163518f7fb2afd61563fae6
SHA512a7c47dbd462a1c9f1023074f81035802e852157a60289ebbe1418f030dfdac6b444b099faf77f89af6f99561f9cc0d724230b4088831218018564345d6cd8ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c72adec39885aa82dedb087132eabd
SHA10bebffd51f52196194d1ce54f3162d0940537c00
SHA2561b43438f6d3553aea74902074802d69c6d59608671c9b6196e7bc50c0cdbf3f7
SHA5125f8ca337d6aaa664c4767d334eb438c653cea92a772f4b17ced2054f92256751bcfe073e924d489fc843984dcc3b6d1a577e3584fe22d13cc97192a686d70874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f134a3c83a047952031e3874728d7657
SHA1e891209fd3b17c1cdaeda878186616a0d661214c
SHA2563236dddd3bf33bbe36f099e8170680023314641ae7ec2f29c7913bc432037c7d
SHA512ec9c409b898d4ebf6141ccfecb934a6234ed81c3bbbbccda375b96aac6af95dd8e85d6087e141faa805771fc7bcd099fcdcf3aee48bc14b31cb6f80fb15e2a4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2d600a6b5daf4f876a5ad4235fb1cbb
SHA14c21bdaa60c56ef34130f0e651e09551d5556149
SHA2568b71d77cf0e0deef517d9bd28e295d7ba5739c7a136356934aacf424f5f10c56
SHA5128d909e64835ae0a97c32815879a214086773584085c882cff60b0626f2c4a2fb574eb79a52a0216bef209107ecca847a152e0623d9362f18f1010208c2a4c5d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05c89144fdc3c4df4066ed5178bdeb4
SHA1b86dc01c1aa6e20ea2594a6fd450d52a5028ebfc
SHA2567eadf75c71d57e6a07ce38f540ab6b8f2ce45379e224816994ece554aa5d42eb
SHA51222e5fd740be8a974a90345e53ecf9a1cbe9a1948091a4b33e83d33bd75114699c4451cd55e33acf6b6eccd08db0638babd9735eafd598a98ebd6ade3fbd275d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5675d6ec3e68fdfebe8ce71fb1cc0e50f
SHA19959b10288bf5d8554378f826fc3d9538afd10d0
SHA2562480b84a96db5a59db35e08afbe250f410efa3a410c93916ae1f7b3cf5cb86e4
SHA51220fa8238c69baeaa7420330a956d30171242223c050b7f204e09ba053ce69a7c414c8d265455fc1099b42969fe0dfbf952efb97c8a5229c0b77aeff5161aaf26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5252c681df731c79caea6f92f5461dd60
SHA1663f9f76db0e9a5bad639c14dc73cbf63cf1a55f
SHA256094db62d225e6a32677b9fc36efb926abe95ee1b013e9ca3ca953a761837d3af
SHA5129260b8675c4cdc588e067aa7194080b1f1faf7641ce207e24ae0e5046604f9a933ce5aa3f5b7305a9965203ae4dfb95ec4efc71b37c2252e655e482ac7500ae7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a