Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:46
Static task
static1
Behavioral task
behavioral1
Sample
68e39ee1f9abd779249ff38f96ebb0e8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68e39ee1f9abd779249ff38f96ebb0e8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68e39ee1f9abd779249ff38f96ebb0e8_JaffaCakes118.html
-
Size
213KB
-
MD5
68e39ee1f9abd779249ff38f96ebb0e8
-
SHA1
1a305b54f7205250b8d3a3cc296d96bb70ad297e
-
SHA256
50ddd6b63ef7a4c54fb694b9dcf2c12034843578dc6d9fd84e268a7abaac55f5
-
SHA512
9b3421e325db2f186874f7ca9a93f20768e79ca1c67d886e50f54e7580f0ab31513cccec5f01033e9763311e35220a713213cd47ce10aada6a0cc8f9959edeb4
-
SSDEEP
3072:Slr5Ap/Ynq0wVyfkMY+BES09JXAnyrZalI+YQ:Sl6JAsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422579850" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CD744E1-188D-11EF-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2864 iexplore.exe 2864 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2864 wrote to memory of 2620 2864 iexplore.exe IEXPLORE.EXE PID 2864 wrote to memory of 2620 2864 iexplore.exe IEXPLORE.EXE PID 2864 wrote to memory of 2620 2864 iexplore.exe IEXPLORE.EXE PID 2864 wrote to memory of 2620 2864 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68e39ee1f9abd779249ff38f96ebb0e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d4e82ef4bbd075edbef71406b40aa5f
SHA1d8378f6f1980305c3748300fa6554cd5f2bd9a05
SHA256ee8572cf2ed722734fa8a7c28e3cb719a651d5fcb3023a721ec562f0b0191a14
SHA512a65f3ef041a2f6064b530804e27bd32370e7d92cf6d7d20437fbe426a2a897b07cbd5bc07740da9b54ca11d86fa1598e951a36eeca5f38e19935dc47c394416a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd94e8bddd1224b6924e5db4cabd0565
SHA10b40dd9654c26e18d7b38300eb92f7f71b26a179
SHA25684a66b2c8dd718ace01599011c3df5dd8c388fc824d9d1527b0b48622ba5dfda
SHA512c5dcbbe107a4d336bf48144c8423d6ae5c21bf81a362de597a87d0aa5162135dbac5f1fdd2c773a89e9518941aaf1df7977d9adcbbcb744e6dd6974286f18717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd613f7eb69ab6a1fedd0aebf1f18b48
SHA10e1106a390774f98dd2a2813958eb375cc9b2d52
SHA2560549912d07cf9dab7faafb631570deb090c85aee2e0ccef32318714407157ed6
SHA512806a784bb6118b8907b3f722ecc40eba1ebfaf9034d2671260411dc759ace878f69276759f61e64762d11be98c7fbc24530c7e2026469dfb1fb2adbc4c8b186e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590392c413df43a3351dbc7f60565d19e
SHA101465565f90ce98c5482622ad1acc3f2f4c8fbef
SHA256846b4abc0c2a1696408aff4b73b9eba4b84d6553737902bb91fda4bec53ba1cf
SHA5125227afb6aefaa986ab8eaee8eb0dea442e8e2164f5d2f3bb8f45da9b5fcb0622075f2500db0db5802507467c61890fc28bed33a4dabe476415cce5d44785fb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db39db3c038f05b68ed427e18e9dc1c3
SHA16e094998c9f36697c024c617064bac0c0aeb59c8
SHA2566e63773814ebd5a9e6e60eb91b3ea40ffaf0da1def50ad87769dc120ce47726c
SHA512befee20453027056be61390730f2b4b7d75c5c4d93930dbafc22367c1dd01bf7e36f0dc816a3ba413768fc3fad1efbeab37d9cd74e286273e0105c990effbc50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59342678a3c6171bf619c84ea5ec309ac
SHA19d443e6572125bf2ca699d9fd037a6def971f256
SHA25631f3b3d63f18a711f4e590a3e903fbb81a2f8210c5301d4436de14b3e2de7b8d
SHA51272546be531c50159c0f60e82db7e8c8e4c8bb84b5ec0e1e6bba14763d447e8c898924d42170cc9fb2e0e52ae73bdd0d9917be6eb82beaabb53921e9a09bf2387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518aa7b37492d9728c36675c09dfa198d
SHA1d4cca03c38db10b017e71c7c8f1191b1b21a1ca6
SHA256859c0cb0ee86bec7b5f39275194f03179b7dd0078cdec5c4e7d966efae3d9fc6
SHA512b44910062d7dc284d1b70191f8add1d1ad33105439113b5796342d859769e212396d12a10cd0ffaa1ae136e0e6a4052d101abef22e34f22d717d8a8ce11d5aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5400b0602680bb73e53c7dd885debda0c
SHA18b9abfafdcf3f0c23b406d13da56a3caab8f33f7
SHA256202706fbfa6bdae5d63f362bed6b73cf0460efc4f5ea4c89e19d77e7935d33d6
SHA5129d4c7588c34b624e0e9ef592b994cb779436c3af5a460a07ac15bf11dbf5216110bf77fd79789ada4bd5c95dfef4555e1e6288145074947e418f49c0c277f0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511d172e6d12ad9df66e6cb4a4c01e6ba
SHA15e1e3d5d99811b52f9f4e18f9dda83992f37e825
SHA256108f7f1948b2ea70e095998e632f51fbc44a84428316c60eb8421a832e3de77b
SHA5123111b665da3c6ff05f09287ce912d5af2eb52670b1917135c77bc95d2ccb63787ff8007c38ecb359a16e0f4f21be4ae0af38367b7ab53dc178ab553a16a31389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f418b48b539eebad8d00c77d1d27d5a
SHA1ba30a2844fed51a9fcfffa1a78d19d6c566a3551
SHA2568ec6368c6168dad45bbe55f6f633cb32e9efb9338412cbff3851f4194a385a3f
SHA512dc5c2a89080fe0b41ed52d120ace8a8769f504bd005f93a34826eb6560ed4eb50740decc6310760d41caba24aa046f969d58e618cda4177f4f42960ce68ed42a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56287ab3381095300edaef2cd65245142
SHA1740ac4cd2a54f59b9056c56cc76688c8636a22dd
SHA256e67df09dcb37f313b6b40a78f2749c2d82182e74f0026da28141ba20b612dcaa
SHA512bfc3839ed112c31c2a8b450542a00dbce4c3f6773a7f5d84ab9ca295639c28719540ce3f72bef0a40ba8efcd26669c1a3cafce5d92e3a9457daeff12595b1f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541e7b03756620fdc3d593c164ceba6f7
SHA1632d5bf9b6c2eec0fe2d65c8556f63a743a10ce0
SHA256969be771cbedc640cda0b416f0cb1b8a3f3fd9c81fbc4c6320d0467345d7f185
SHA512743faa841b1f53c9989dc7292e11f2d5e28fac689a9ae3fdc28dcec5f9ea6d02b7c69206a9aaee113ac8733df366b1204d7282599fa44f124a1fa27cb1a2c378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ec906f7e010953cf9f0715bdf76225f
SHA11340f1fc51b239a723ee256bbceeeb1f55714ea7
SHA2565a00879ca79a4e5fb29aef309fb604647c60e88652786cbb2cb845f677ffa722
SHA512a284f24ff50f61a4e1b67aa4861a34949e375594967493421014922ef813befacda1a0f7f33c650720b7bb79293787f6f99d05ff0e94af09a96a2fdf079c4ef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d89ad5b9954413790cffe2d1e6b4e55
SHA1ede9920fc581af841b5570da25d700c6910e7fce
SHA25693f395ff137f72483b385977c84eca06f6c78c02c13820c3d997f162056506b4
SHA512125eca4e2f9a85d8331cdaccf50243a208db309e7d033762621a89f68c0bca1ba254ed186112e39f1b268edbadca03902a6071f663da968a6ea26bec2f25fc7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520d3ae0d63661b344ed2df6f978e402b
SHA13803d6bb53a34a610e2ab27d61b40f878db27551
SHA256a6b29387cec82318686a1b106b043c7ca67595a708e6154cf9a9e48f7df92217
SHA512c6b20053ec844e0d4cc70b01943fd5bbc8d9e711f3e71ccce053f32976e207abbee74250064adad9e190bf028035f8864dfec47c3976291af924c5f877ee5ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c43c38ff98f9f821a15fe097902f5cbc
SHA104e02a6438e24c1b0332f0e730d501afb1599d0c
SHA256ef54af12eaf86c2c1546f3422de276f35343313d8da38e2a66e17afeb12cb15e
SHA512fe5f2ec2453913313a7e8e94c353929e232bee96943ca38732618bfce3483f50b44107950466e593cfb6f81b22f845b1fa22ae5c65dd55fe48b0f563bce46955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957b0807dcd02a80f79a5f02f3a88a21
SHA180c31068004d38292ad4e547e6e066252d51b22d
SHA256a65012d6fb1c8b91f857408ef3a0e01c2d40d5b98bbf04e4cfbcdc2da5319ff6
SHA5120c0f6e1da9322c28aa5b9c7f419f1824a039b306792fa85f902b5772af9ddf0166f71a7fdfb162ee16629acff0c4af5426cb563af79e97db015bd9e83c2d4f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed36011dc5afb8b7b646dd990f515c00
SHA18c94e4d36d971366712e78eb092f562709fe5745
SHA25601b69b66d037091670148e637c1df4ef2869c59ad51e7e0fe5b831c3106fb6ee
SHA512b80334e782818b68d0e568ed3b99b1df6fa2bc5f51b1003213b72451f909089371e6fcc1ff11cd0e0b4c02f03d24581e20f1340acc4e50f780a9ec30274eeb96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b875e261902e1339b50ea607843982cb
SHA17046db0982fd1cdf463ea67128d7322cc7c2bc4c
SHA2563223bc45f99adc3b765bb3861844c75d3b4f09bc0cfc999d0ba0a160ba39c756
SHA512a79d8641a8cac2691e56d1341978172f394c44f583e21d773d6108f95b44b6df7506c00160be9e0e3c87e0462d336c957d1087f0e1fc640862e23be3f65540dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5866a7eb462c012691b77d5c25130de9e
SHA17d91673d91dc97741f57911c7d1db55a5f8d09c5
SHA25612ac1143adc8d64aa0bd5eae9719385154a9b6328e5a313b45ff49fdeb98eb1f
SHA5127c9a8a45cda8bf888f33a1777e6e0905a0df39b138896662d0307da9594f7c3c6adda08f322349c07ea660f7cc8d64c979baef6cea479fc12a48d24e372d1e0d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a