Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 00:57
Static task
static1
Behavioral task
behavioral1
Sample
656e63509219c1d9dc36ff81cc7605c6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
656e63509219c1d9dc36ff81cc7605c6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
656e63509219c1d9dc36ff81cc7605c6_JaffaCakes118.html
-
Size
143KB
-
MD5
656e63509219c1d9dc36ff81cc7605c6
-
SHA1
e5d9bb62867eb25b3ddfe56080f9458540db00a2
-
SHA256
7bcbd20ffce143d113b4339bffec36043c09b6531b076393387ad3ed2c908473
-
SHA512
af861098b92b59c3b1c74d91e27190fc7533860872097f3caff2769e1a6acd57b8109a91c629d0c238cea331a6906428c14fe1909c58b6e439212f241080e1bc
-
SSDEEP
1536:u7A3sJ+sufFBIkNGNJy7jws1Y4lXWRl7SgyxOOt1ABb11tH120fTvq0yUJGrNmEN:uWDCi0bJGrNX40
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048279bbcb107c64d80448bb947548081000000000200000000001066000000010000200000004dc3fe990f9fa22c74594c8177df0270b6298af83030b2aef5f3084f7caece3c000000000e8000000002000020000000e1803e0074c7fd55eecc31282f126709785b4dc925945b7c168228b60a80356820000000e5fd6ba914b2e4bd5498d33e519911ae94092ddc3d4fe432d2aca4574edee9ef40000000e1e75b58bae78cb488b37ea8745a2a64333968e2d4ff7e57a34540a92dbee28fdf32a471f240f99c410fcdd5d449d67fda29834d089032fdbf6322fc489a9070 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a000b610e3abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048279bbcb107c64d80448bb94754808100000000020000000000106600000001000020000000142b04567a1e78054bd560fa0ea773210862690bd84039e542fc8004ca17a280000000000e80000000020000200000009f74ec5299b1f68103c4b3fa8cbf40c0179adf1d66f82db31eb58e9397acb0a690000000a1c0a45b9e15df39113b981b19cc85e5e2e85bcc361785848a6b83ebc04fd6f39031d7417a7c3ab8aa0005a6d9b34c82038ad026d4ac84eee5c213495a55101eef1dd10afb24705decad27ce9211fd5a5624b8c9bab73796338267df54fb632f1b92f2094e6e5acfd20b7212fc3a0671adefc9d4bb1ba404705659d03ce2638d6dd7d6069783a8b40160a3a03e1b13674000000044e86970a01114f10c96695c6bbd993e2c475b285fe9873670f3f4797c6d23d813092cca49f5b381518c06432db7833724a0c92803e3fdfc5c19c5afa1d0b044 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422501303" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A1C6BA1-17D6-11EF-B35F-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2956 2604 iexplore.exe 28 PID 2604 wrote to memory of 2956 2604 iexplore.exe 28 PID 2604 wrote to memory of 2956 2604 iexplore.exe 28 PID 2604 wrote to memory of 2956 2604 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\656e63509219c1d9dc36ff81cc7605c6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f93b4c057ca02e190f7cdeb2685eb0e7
SHA110676361da50567074df70c65aa6bac652b3d4ea
SHA25662e07e3b2628f4cc859bb8a096c286a89583e80c2fe8558f391909a4b52149b0
SHA512f5aa6cb4f133eefea2bac3137779ec232142b6e4d5167250f3c07341311662d0c178538fdf284e82a4a23196e77e04059cfa283b000d01f4154adef85fb3bf8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d1b3d03e21a455aee974805137fc06f
SHA1a2246b121b090b8c8247b556a5ceee946fb0a4d8
SHA256b3c9600b4f166bc4269a2a2845cceb09ebf3e5259e17c84fa75b548094767073
SHA512556beac5079872d2e202cd3c1acd54a6b0f88dfc2e0538cc822e00f43c03cb68136a153a1a84939e237a41785b1a8d63bfb8559a1bd43df678127a788a056790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55db8a8d8ac3ffac8b95b01591bba3a4a
SHA15b78599b01ea190740274df9dee5ea3162bdad2e
SHA2563bba1a738e453784bce3b125564dc719cd630f9a59dfea4881d2c03769781e2b
SHA512f005c5307edb255aa677dbfede29c732a4d8efe72e30a9a1e16889c6fbc02044c12a364fdcf5b2dc6f8de1786bdb6dbe87cf59cc1c1e21fbfdb5f8030239675d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af7fe6f8a72320b12b9ebc9f26895f5c
SHA1c64039fdea105c33bcd6198d7c2971854e613698
SHA256f2d666d80aac21a2775d90df60a42b5804107558180527bb6b0964a5c84fce68
SHA512ef52552868f3ef936a38ef6d1b0b7aa5a0911652c16a60a6c949cd1568ba19e60952e5d3d1cb230bb321369ceb2de1d24da950f6bfdbda618298ec0b295f0032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ae32ed374f0e0c7df913bc7d453ef8e
SHA122dcfbd6d5288d3ccdf88d85ab4621226d52004c
SHA256879f8dd8392ad85377f71dc33a58e0f9bfbaa1cf02615fed6272139305292b07
SHA512ecf05eaef52ec0a0b2da9e1e159a068d38deca98cf87448cd5d9d47bfe0d631690ae56dc8e7fa93fc79a1da37b2159588194f96902c3b7f7c73f05c679e8aa32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5eceb29b758da1029f93266099795e0
SHA12f0dd040928265eda2d89ee533b25fd6f12d3c10
SHA25640c6b2ec18dac4b3eef81459b530ff94598ef02817cbd87ba7d0422232bfcc6e
SHA5122a1e18a4dab8948f8361eab3599247aa8bf7e497ad7bbb9f821dbaf56306f57561725d42fdb9cab50b3a52cd599b6e3f3d71037afda6d4f83d9a77669989369c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfdcb13ce891dd5180300f0e654b625d
SHA1e1f960f769556e2f2a68662c874a97de3ff93293
SHA2566253b6fe627b5997484c7e2866c3c162fcaba0d0ce937947e4b41020b98127ff
SHA512c6c77739becddf44ef9b52ca74836f0489bbdb0c09f816228856c13b7ad6d345c38a25b9f3183b6fc84b59ad6204ea726a442d726ce24bac125a99fab617cca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5605cf5694ef7c119b00dafda63b5e2fa
SHA1d285c874a77b40addf27e08a086cad29f98ed9ba
SHA256e8cf3a5824eb332c37df03f3fa1a287455a9f958c3e79149a6461cf9573dd8e9
SHA512aaca0756031a9f3fc2165a20cd9c3529f8bd361e1f73c8d1147b838c3926b58759735f62c4cc3c0e6e2d17b5bb07d75f459e2722324387dc25a4029c386ceac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ef0a0fbbfa4d3bfd501411af9088303
SHA1037c23e2268ea22c78a864ee6d64ad4def4be019
SHA256f5f0bab30afad1b11fa7fa0f6a238cd468aee9a334c2bf46a4448ff13a596785
SHA512d5ad9e9e13a8d73f3e6e3e05aa7d95f8a752abc2c478b52183403e3535a7103370cf6fbed756d322398fe2d8d7fcd67d8b9cca47f5e0348197163507356dfb28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e645f1c267f9c52ef223ca810c29f93b
SHA1dff3f38dad10f5b67e436315be5a4c911e0e257c
SHA2560024280597b4cd1c7b1e73f2f3bfe6f3a11189838a17257c5f726d980b40a5cb
SHA5128246ee5bfd17b2844292903f3a3d4db92a96f30cf0821813875bcedb1c582594b10f2d568c97fa29462b71f9b93cf6b397577aaeb45a4240474b2595895ef067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cae2a4f2a17521619f1a0457e01d2b6b
SHA157b977b02c99288728a4f6d8c5d85b67b90c4cc5
SHA2565201c45bf0cf5360c02dcf37873e1987ea88b6b6d9e47dce5ea513369540bde6
SHA512dfbdb09ec6c9de6babadc88124360f74634f212b01226c2c14f4fdc6d144753b88bd155c0f74cf70f5e6e4a81e7aa6d5e8b7a5049e1a1334dd59d3b149438e05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fb3c1097aef87ae27d20278f39a6d9f
SHA1998b37d4d797643bb858c73d9313169e4286df79
SHA25632a08bb26b89bcff874a63cd9914aaf8b65b525463ce022241a2c86a5b838dc2
SHA512c54e02109fa7b6a6910675bd2a462699c8a7868495ef0948ca1ec31aa4c50f4d17a83fa25cafc8e7926ff05775c0b218a5e647d81fb198eb44a4dec46b506664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55099daae48e512342d28604868382b31
SHA1064c8473f93d09d6fdeb5e49e5ebdfa3d0ab3ff7
SHA256f31ac3177668ef85f515df0a230c136773cb1d465a7d7d67d6a37a0cefb2258f
SHA512b340f32e37294184284691794c5f0fbee63d591f1e4a3fb4afc0fcc49ddca453486e1d759700340b7cb137914632bc3f3bc738cf197cef4375d6b3476e423b89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a179ccd16525c5d14843017ea85092f6
SHA1a63272811ff073c25f25c9595fcb4fd67d66a02e
SHA256add92aa9488afd3faa3836f549e8f3af7fd7894420dfde1ca8a232d42856e686
SHA51253c536d8a5cac0f07e4864825ccd57fd2c493e126f058906f6bc9e3c0239ab337bd810b9a2998604e029149a0bb00be3f5fd50290d27f1cda3886e467d510245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5008a140b8802e294df056990a4957f75
SHA10a2e1ef2bd25fc241bff96f0879f3ab18eb8c734
SHA2565f88a64802ad767c6bfec28cdc54c4407ca927c52335e26ed6c1688f4d354411
SHA5129bc7df0fb91df1e7ce55a4062267d9b72302f7fcbc1e19b840c96ed28dd60ccbd37756137629c4db8754a7825e4b9c337460af9425c0e210d583059e07354b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8735a1a78c1d5b03afc5ff5ebc4ba15
SHA181538d688f720f57c6db9cbc79968c67b054c5a5
SHA256146fec2f9d99384859b0968f72bda24f6241e8d1a2c36b83f8dcd000b89dbf4f
SHA5125ff4935cae17e9fd14f07c4056c7c8e8241e66c3b89ba353e6c8464bbce0f4f537d047e6ba9734a386e194d92068a76009faf2c883828c4f411708c849f7533c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50545dcdee2a9e562974bb15cc505fc57
SHA1bd38ab170c620a3303a4816f41eb54264888192b
SHA256853c35d62382ebee98e87d703992e46d2286634f06f07f592bc93be17f6bd2f3
SHA512c31a10b8a2acff117c3c403dbbe0d6d4c1bb642c29088f9b32b70c8d0897f195c125a59d3ea4dc3586c7ed02ff582b79af024f1b8f3a5d0b4f4711dd46631abd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ce1b83769fe06601542c000ccbf1928
SHA1fe93ff552cbe200c2868ae8b4f4cf6a058868ab7
SHA2567854bc4e6c8c978681b5fd008e5aeeecefda8a20381d13ebb957279bd19ab778
SHA51293ebf80f70a38ff81c31260a8caac144187ad3d60669329658338bae473f5d1faada45a1b5e13c5a739d068db7b478ff5f58887700e48cc5da46acae4830d088
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a