Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
65876b533210f76fb95f8eee7b82d0e7_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
65876b533210f76fb95f8eee7b82d0e7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65876b533210f76fb95f8eee7b82d0e7_JaffaCakes118.html
-
Size
9KB
-
MD5
65876b533210f76fb95f8eee7b82d0e7
-
SHA1
8ec18924c52d9d8cf0d849d9bab1f776d86b22c2
-
SHA256
cd334b334294bbb82ee73ce3b22dc37bbf1798b002adef5bdf4af5f9378b1736
-
SHA512
35e41ed5165ff2f284ef6736f656019105e306f2619b42c2d4f802b61a7b79160b2130d7d6f53d36c27ec2c0fd08a3705ca2c76f2f50f1ddb86e90c00b5057f7
-
SSDEEP
192:UZ+ndn12oR4/Euq7EKQ213mAsvK4nZ+ndvcGG4w3vkiUM5/CD:/dn17wEucQkNdFHg9w
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503281" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D608FF71-17DA-11EF-910D-CE7E212FECBD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2232 iexplore.exe 2232 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2232 wrote to memory of 2372 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2372 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2372 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2372 2232 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65876b533210f76fb95f8eee7b82d0e7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD563d92ebdfdbc22079b572041ff0ffe09
SHA12fcb80b27ecdc82df8db806a2596bd68126bc9c8
SHA256b7f8668515c76208bcc1091dfcf6e93a7f152300210de2df3cfae62ec540aa86
SHA512108b31b0421b976fb67d1642ce4fc31ef48a8bf0a95e9ac87f8a9205023ec061db8ab48b71d6bb6df989a9cbba269c23333f4be296e1b57919a18cd502bb76ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571e8e0f1243699a865846ad5c290f7cd
SHA110ee1250f5612dbc7bbfc81601c04ea6b6049b28
SHA256a2501ee522562ed00699fd2d94ad1fdf07bb97ee6b1831c9353430cf1c8f4271
SHA512dfde1875d9078a82d5f1f33f58548aecd2b4da42e36455848620b25a31f4e3df115d7467dff7a00c9e069d515c9c6bad008d202c7b306d0471b0818fb4a83a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c1764a8b4159f4fb047adf62bde9ed8
SHA175a64b5b5114cfc1c29ae9210e3067fde5efa89c
SHA256a17fb9bf6476d850111303f473ce0e568abc6d1f549408d639772baebb6fb6b4
SHA512f9d7b3789d26c858367c17aec565110a00cc4768eaee9acd8c3debcff6c6e7528e313f15d78ef8182ab83caf96ba6b840e3ad419a47242571f027a7bafca24ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e2a4082437ff681a2f85584327a3661
SHA11ef10e027ed8efd05c36a030e436ebe9b3ac4319
SHA256eae01400b3a90a284f730c2496b98d58e57bb432a7c6a4b3aa965684cb1bb064
SHA512837e969db10f9b2272d1ac8816530cc79c2a0d6343285c978933e657b30871a4a1eb05e9f89cba58451505f4c6aaeb850ea9ee8bd6ec8e9f66a54467fcd21dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5560e42ef19e717a15a2c9365551e0a85
SHA1591bd4bc787909fb815f56a8416a615fa70cf8a5
SHA25640d292f3f17238b7b280e68f10f1a306cec4af84f1bcce3947dda2482e787e62
SHA5129bda2025a4c963dd9b5b63f3aa78dae85c4386298d6237185bd3cc9172b0c13c982d3d554b50a5cd5f427018385b19b4190e32cb132caa2490e68d3cedf37ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5810dc435f5b601a7131caada2d0c5cbc
SHA100d9e952adcfcb7386a98ad1b4b03a7da5b9c7d5
SHA2564c4e571adcfe518fd8a8baef4798c73ca7037ce68c15a1a3bc1429d7428f5278
SHA5124536bed4ec12b1f946f54a269c80d6d5cdac69d622f0babc51047eb6715e42c3013f3ea047cb2cb41d1ebe5510524b120d6bb1b6d92ef7ad9dbead670f3b2e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583d90c590f5867bb296e851ce324f6bc
SHA1120ab5692fbae70c260484a56ccc56529e680a27
SHA2569d70091198328876fbb09d96cf44460f6ff41d66e5c2672d91ed3982d1eccae5
SHA512fed1fe6926c4764dc33b59da96300fe5359ddf7a30580fd1cae0957490e4326008946124e92dd4de7092fcc236401969a5f1aee5051562b043529fa6873e1b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543d0b50883515840d73c0bd53e29e5ad
SHA10d02ab8a48e023e5903c72736866c42b94179114
SHA2560f8f9f36aaa131783c54f20e31da19639637d0db829653558f40018da0f1b872
SHA512d3c6cee11290418214adc5dad750ffc9a43b7d8629dbd1946b7225e7ae9a7e8fee8f267f0d18fed1844338a254c77b5c4dc9d58f283fa97bf9513e0e28386293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a82080ccdb82652dd83f83b3d1b1f84
SHA1103d9f4bc1b3187f71e7cfe2a2b5d12ed8c5fead
SHA256ec123c4a1354f2a382540ca52815100b6912ef5873cdf3a954e4392441a6ced2
SHA5126cece9adcb7ce7027de9c0467c1f6065b80fc23ea0a8dd171b8cb94fb2479251fb3ebf7153ce5edf4da10e335ee8dff1209d493d468831d29af3e7057a0bc032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abd7221b30dbc4257a3faa29a3ef1d61
SHA1308f52b1fca5fadadc622781da936dbf309359b4
SHA2561215b45f6002b70e6fcf8023ba09aff573f26b634b80403d596bfcec1234e58c
SHA512b7d8b66a75eba25900c398c8bd3492f11fb091286aecb8aa2d94117692ef9655c0bc78e54ec87124c011743787904dc342ad99cf9607c295edd3595a97994b82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b00c29a096fa32f9f920ad3739c9b543
SHA1207fa2a0f5201de60f241dc060ef7e86b3351551
SHA25688a4b33c6a38eae4ac46107b68f2c2705ed14ef8922330e68465652317916b94
SHA512d9877436f91101a8ba74326333b96062f5f6723708e9a966f91b9782989df9ec2842781c0e1bc0b38bd2f23da56d0170642fbd726cd11a2a236e0c8b2e8bfc53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa637d3106bdd266e2142a3c824a1d60
SHA1cdeb3fae5663a08e7fdb76bef3a113abe01708cb
SHA25650d35bd7f1e6e040624348c88342e20829bdcbeb922b26ac631ac497e92ce2e8
SHA5129826492aa6f5acde1795c203ae5f5880497204d87344e06bf89e8dd0707582e18b814b382bc11371a3e22824e7dbf7f16cf079a5beed74fa073c5ee3ddad76bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2bd16c50063cb3c9b760d3d78655f14
SHA1c03a845d346b674ebecd8029d73f269ec3144515
SHA256cabe20c28f24dc9003b16f31d0a25ebb075e7e92ad02428002b81b652ca30975
SHA5126eefd827b4f4b1613fe9bfe95405484e0de1b57a1d328eee8863e17b6e3a4d5b3b9b1470518c48a19ce6e2ffaf6df6b3355dd251d9ddff247f85a7426a0ff3bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528acc25d58c1ebd97f09e9feba49a98a
SHA1b8ba805a6e4cf54052c83059ac58ec915dc3c456
SHA25650e5be5608bb950317980c883ce06777ba8f27e8e83ea5ccd0519c50694cc2b7
SHA5120050ee6cc6dd329b5d4509bfe7dbc47d1ed3d48d335342d1f4f2f46bb77eb0f67af3a3d103225069f02ffef6fc650a7ce17cc30c9c2486fe751027ae784cfc77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d00f413a9394994fd0f6d8d5ea56b8a6
SHA145f2f4b1db69284b3998f869d4de1195e46e97c6
SHA256c347d88e07e6916e190fd31cc65c833e5e3512491da9100cdbf780922abf78e7
SHA512571a4daeaa32498a5877b4496e1f2165e2e22e40b3d48c78cdff7581a3e99334b1e06fcb7a7166d6a7d0a564bc993d59d87e8dddd2aec647a6a1ea3adb4405c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ec030ca165e13cf0c56520c2f8152a5
SHA13895a23d85518e01cba779728f3bee4683a8d504
SHA2565c5b6ef821cf455108413f95cbce8526f69900534a0e0aa315ea7f987f2d077b
SHA51288d25c86317d2ade94493aa3563eb9d2f545492f6c5ce4d9ec24e65d7e6201f36f9fd2112a0c9ef236fbe3d690519c66e0835dba642d9b89035eeeaae6beaa86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fa3282fa651452fec4e85d0d18639e3
SHA1cb4ebdaf7dad4cb53a9dd33c6d3d4afc92f3d084
SHA256c06bd76c288c22ab483382e57b3c532aa5983d4cfbbb70dc987b780362e42a39
SHA512cd04f51c11c0dbc5a8a29b5800c68c093d4576b14b775238f3d120c795b91211ca44de78337b178f7492cb5c0e7c3dc4f9b1edb6eb5e8685398332c6f2633e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580f7de0f5d3f147e81d035fe75c17e26
SHA1a1d2b717d326f441d59f70d17d33ab64411d858a
SHA2565d964c850e7558beffc9b3cb888edba3d423ee18e9caa7b65944bd357dd58978
SHA512cf65a4ad44a2f8323f3e2432d247e4c0120f3d6d21730e737905176db1efaaa15653a733a355a8c34b552fe179863c7fd0940c108a3ec68a510f0c900a8cab9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc51e26d529a0f3a637a836cb47d615f
SHA164e46c7b65b4729d4713cb83426b3f37a5d69a72
SHA2566a8f6e23bb06ed5000f1b4f8147ca6aed76344fce0f77201942d44564847a75d
SHA512b609f519ecc5f105d5f5522afa46db4e1b94016e48e55af36a4047d66110deb39d3cdf230f88f1a9ef103512f764d2a50e4e0b869ce6b0444000c83ac088db99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5093829e0bc2adec846d0ff365ff46284
SHA1108c72425e5a10ce960aab0c5eaccaa22751bcf7
SHA256345059ee88e612abbf2256e0b58d99c256802a4b35945aaf254bd34905e26498
SHA5128d5301c99d5bec6c8fc2eff72dba3931229986f11033cf55d42e0d3369a30a9667ad1d53cfc2824f6b1a1f4caef9fc7f247ecd8925cb1ca03d01110165065e28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51d28939520f5de46be3288ed71670eda
SHA14d49cf595945a3d0bee09302d59176a6fc28c0e2
SHA256a8eb9bfb49e37dbaf4d599488eae3c07c873bde048a06581d88c240c9bb5eace
SHA5125f54d60dd8897d4e815197a70cfef0946eea858b08f502396f90a42d6f61e82cde0671fc8027b7d53106e933151cad652bb7a2a2741112e1ffae723749c6ee6d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a