Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
658557e28e5cc7bde0cec22461951de4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
658557e28e5cc7bde0cec22461951de4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
658557e28e5cc7bde0cec22461951de4_JaffaCakes118.html
-
Size
23KB
-
MD5
658557e28e5cc7bde0cec22461951de4
-
SHA1
929c9df04e242f239b6809acbf39cf50437b1bb1
-
SHA256
fd2006d6e6f4df0b305547005f55ca646bf51dc38fd75ac39d86c75a2eddbb59
-
SHA512
a2cdf3fa9a3233be3e3b7111eb368b382e96701d11a48f94986ecade4b418be9e3acc772190d5db038d9fbc22a9b3f5849b3ba58ee80e3163fb19a189e3bf8b0
-
SSDEEP
192:N68g9Vo4GGgb5n1DMTZArong3I4NnQjLntQ/VanQieilnUptnQOkrntfqjxnQTbi:63ocXQ/ZmA
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015371c472e90c34e89daa711018c29ca000000000200000000001066000000010000200000006a4a299b92a955841ab9ae5e641a3e5059ede7e462a2f7c682d7c43f15dc77c9000000000e80000000020000200000006aec51a61b64b162786da5cd4271530c752f3060f78bcdcf5bca47d0923a94912000000068e7d627f80d2d828a95feb85dc35cb02123f6c96d11207d77e88f4b353a28fc400000006d00c1cc257cec9f68570f87437329f57770d194f0067b7e965c728a165563f6df59baa907ce91054095d860397f5ce1c9ae4751b749e6a7c6f9b129311171c7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a39f40e7abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BF49091-17DA-11EF-A965-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015371c472e90c34e89daa711018c29ca000000000200000000001066000000010000200000001ac935041e533943cc48b450f42668624fb1260170c1cce33298af70a21d5664000000000e80000000020000200000007ef4ce51cb628fbee0bb971c57500b73ef20db77b8f65a3f45969b5b2efcbc1290000000b8845aebddf46905d0fbb0c9d59e76e73044217d34941c8e651567516b1456caf3377084c924f4f34453dd0c9ccc49ba42d0da143f295e56df06e65286be39d3d0b2e75457c2ec25fc34002f54f2705f830856d0fe27fc79fd2b6382de969b477d489a4000ed0a27be5fa8e74a2855de206e5ec1f8129dd12277a3443a114b0eea47f7ff9119fa6cf4b5f8bcb0870c2e400000005f81591b6e867a1e931042ef8ba777709ee2c863645b760bdeed3cdca8c3d13c94ee3d0fc425e171ccad34b0b7e0347bdad79fd5f8ca29a8870667fbf6b29286 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503103" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2860 iexplore.exe 2860 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2860 wrote to memory of 2940 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2940 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2940 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2940 2860 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\658557e28e5cc7bde0cec22461951de4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5711ec5084a779e4a45f5acf1faccd0bc
SHA10231a643f625c2747b19eb663265191f881018b4
SHA256f5639bb8fa626b01d79e5310bc9dfe287fe7e2cbb0d4d3896aad8ccd43737dbd
SHA51269d06d2decac998b544a15a18de4520d742134ab4965857c7b44f858c780aaa7739bb108d5ede5a5bd188227633544aa94d8a1b96893b22b83dbff34cbc96512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f76e39adba1e3c35e253738e09aec25
SHA18f9df42f3163207628ffe7d8e8ab94d7fece5ab9
SHA25627a54a5210de93f4f89bf0cf24267434626cb0be5156499b24b47e63f9fc5e8c
SHA512a7de016705b36d764d80600ccb8125ace20a9f51a67e4dd45292c415eb4d10c76a64427bf849ced72e1c814f7ca9802dbebcc505d4c353f106b6ed58217968ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cccc3d7419cf7e206e4d6ccd13e17e0e
SHA1a1d17fd8b5829db4ab1eb59123e66a8f416ac6ec
SHA2567a82c2ade89a456bd1a0ba3719120fdbf3e885ab71b3946bfa4d85cfd3ec6755
SHA51272b22f91607c1ae15e2bf0ed654c0b0ed7e0265174401dbdcf765a7fade8e14630a508d0da7d8aa13fa28008e3a2051a93b521cafb8f6f7f075f9d5b8f4cfbd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567a0fbe62fa9896186eced7c38677dcb
SHA12195a50fceb9b4781abbcff46813075ff03af0d5
SHA256b40b937226627762b067b4ae843135e84d01276c1f40728bf83509639ecd6e4f
SHA51253687c252e1deb2dcb796904b9e358e28c2e63895c116c1ee450834c3e5df31f2b602954b218149c8cbb9c94297d4bd306f598670683b2e2719087ebd34fe44d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f17f3421c97214b960771f1357582b9
SHA16c7ed60941af3fb9322d6fb83b0c93f1ad25e32c
SHA256b86d3c86acbf2a640d8d8de2147effc1062c292624bf9c0541135ef0e6cc3e44
SHA512780bd3cee59eae49637d2bff2b0732322152fbc44a6e77ec49594d4e559a87466d53e375d527982148687e3fdbbf4a8183efeec02f181e4a2d4af8f47bba00dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c263b7aeac1041bed71e3f65c17e3afa
SHA1f2bcd1529aec5131e355c67106e8f9bd885ab736
SHA256df9c4e7653b6c00aa36767a7db9a968113c94c5a84b220384fa43161a4b812b3
SHA512feb26677faacf2e3495231d3999654a782f107bcfe3a63a61805fcba67d7e9348681c888c29ef3b85e67d18735c9cd173ba5ed226877364cddd94e08c0a1ee42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58397c0d2d9e4fb2b0289f9399918542e
SHA15820119b49f4ab98fa2a3415921dbad739bb49eb
SHA25605514567071153e999b8c7046840d7b65454111040cbeb079465ee2040b1d46e
SHA512dd436721c7bc808424edec412b8e722316c92c6ad4e3dc8f46204ba8967215dc273be39ba1f8d636c940d4c599c08138de9500094e11ea818e64363e89948a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fac2cff786ea76d41ba0282e92b4bd42
SHA143fbab00102b04068258ee6a3923448702e7cd46
SHA25672df2b34e952a45693734d428c5cca2b9f520f095c5a2deb0a28bf6420f1dab6
SHA5123be12bef76e39acc806c5edf9f9cd4807df1864e9ad0737ef2c070d05e5f1960b7e67f42d1deffcc0f31d89fdddb5ff21537163a5867f2f24a0c668d2aaa72cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f815270d95f39b4f40fba55e760c8738
SHA1b3e6be066df739777e600d32d0e20dc6b02f506d
SHA25683f37369e50e9b8aabcc7a8a8671d0277d2a4dd2830ef72557f04a3acdd273c9
SHA512355f7c30fc13ef02d8a3248dfde04550347362a70b2caa7081243a851b0e5ac48eb258ec37f2eda8ac63bdc85e8c4ba0d7e7b95e01ede213aa53773c03403b03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550384e5c54dea615d8e21152fb16afa5
SHA16d225986821fa401b97192f779216276a6c74f72
SHA25640feef77c6481e153ab1ebd12654c57b1ed1d19bf7e0b335b0a66159df60d5c2
SHA51268b301535ee1c1ab89fb4e8e62d0d76cdb1fab5172a3f12ad34770f231e246deaed1f1ec6fc86d379e3a79b2c92ad9991cb7a789fb9aad8e65313af63d98a9e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee83bb694bae8b2bacd90417f4bfd450
SHA163fb664e605322a0ae8f617b9eb0d7ed85fd9c2d
SHA256a3805718665b6a58e0df1c8774b9987c103f4dc5188afe3774e840f4a043edbd
SHA5121632df9aeb6d93857685506383a0f474e8083800742423f94c0c2237710f0c720179a8fc4a2072681e5c2d219ec0b6f61628207a92b3ca6fa7cb94de4708e162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518698750aff2c98779e8d3acfd6324b4
SHA1c100790a350246d3d229d603bfa8a5cabc355e6f
SHA256cad50a36f47bc7ab33693d5a25a4867bf25f820011adf9f98154d38fc8d7fe95
SHA512216cc336bf00fcddbd8e3137e094471da40828f8e2e2b7ba183adae3eb4ee82fb85d7a21c72075b52f46f07878be79f07a5252df61ba6ee8777b0371312b37ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e23644502878f488dc78823dcccd8a
SHA184d9e8ab99b8737ab2bb0763f73f5c8dc499e034
SHA256dc47d493a4de959b51f8467faa5fe6e644559f92f1cae6f82452993fa0209827
SHA512d90bc451ca80b963e5d6f6b950b494fd092c99c9218eff046abd460f8ebb12b3a4cde66f8da35295c4d58e8d9dc13fcc2b8f79a8b97a8fd094c6f2881b9f0f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6c78b659f47bee08e803ead52b5a8b4
SHA1c8b17c00b168b6a29bdc036d6d466590b4d2197b
SHA256e540383500eacca5cdd3a394410e2cf367d83102baca2473522e827762e31736
SHA512358a53e3fbef031732d3913424eb6aa698da27a8cd0e60678f1ef998c4df5ce25486e3b83751e26468fc3f1424fec15fa4fb55f8df8e92c37171082f3039d927
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543169caa4089ddefe1841b287fa757f3
SHA1c21a1d0fe9c2c27a7322f82063b9eed88f74dae9
SHA2563d5841e77c2074469a5f50096d5345ed02877f8afcaaf425816768aac6461f91
SHA5128b1f7c6c49d2427cb645f410e71e6abf2c5d28f80689b23304f9395a0a157f8b7dbb8a1aba2d332dfe0211644f98ec0150b56e2a88f2f34db1f5f6c7c6563e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcdf23a3cb2da815d6fb1738e55a7e63
SHA1b1fcf15c9bdd56d587e0412002cefde49cc80737
SHA256c3c95b51b2e5aff51e3ce9f23a0f6da214a0a7aabf6f029fb00b7319f3f5dcfd
SHA51266ccfc862599c67ab31750fb22c34028c78d64e4888df6c48305f677cdb21a8e6387246fcc84cddeb3525e953fdaf892a72a2085840fa16cd60daa8d82688182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e64b653fd32f71da39cbf29b9ed1b4ba
SHA1ec142b494f6b2426d4eadb040b5567d78e5a56c8
SHA2563695e9d33a27edb02075b89ae23f351eeb4ebc97237682a8cc6a2b2fb706f96a
SHA51226fd716a1f1e1f832194943b3db5245dbebd0a555b149231c262c3e2acf23a2e23ad90f15cd8c51cd126ec174bf7efcefc768d1d239369784bfeab3c9f1ab107
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a