Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
65b5eb46bbc40b1ec06bfe7682fbc651_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
65b5eb46bbc40b1ec06bfe7682fbc651_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65b5eb46bbc40b1ec06bfe7682fbc651_JaffaCakes118.html
-
Size
73KB
-
MD5
65b5eb46bbc40b1ec06bfe7682fbc651
-
SHA1
a34f587d84fc8540911adb2065f7fb9ae0f5a391
-
SHA256
3d021e8281e5216ebd3c6f5ffc39d0e5657b9b0cba7648d41c4055b16e7192a1
-
SHA512
45aa2ac3505239ddb669aa8157ec08bf835755cdd53bba724feabff499868d29c9ea2af428e784cf4f8cb683e36f0753969edc705142622b31c521ab914cdbc9
-
SSDEEP
768:JiagcMWR3sI2PDDnd0g6uD6ZMDLcDLuete0oTyZ1wCZkoTyMdtbBnfBgN8/lboiW:JcRTSNen0tbrga90hcJNnspv
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507182" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003211563db1c0f64fbb25074f8b3e5f6300000000020000000000106600000001000020000000d0857abe04a0ea3af9915006a8e7d37be5dc86cb5b2021287b66e3524810fb6f000000000e8000000002000020000000c3d5f56702a8d7ba5d44e5aa843ad79ea85e03450fb25b2a0e8b9494c6a859ea900000005e855b9afb029ebbba1f493bd7bb39673064bd82953c59c4f970ba0828015d00fe395d9a22d1e02a7824da024c0e7d610fe0fe8f41b2c77c9d4756f05e9ba3451459ab1c21681ed647fa931d9c25947fd151ea0ca5a8e2e0e1288d5b4d03b0a03e400cd2d9f02948f9f0ea11117917c32836a56057964a25919d78bcd7fc72c9c57876eaab2f627fe32960e4a9aa31e6400000001a66d60ef1d0ba46053721920d810202be020ffd34c978df0cfd2616c62a51480adf6a984e31221af12796900b32030c422e3624fcaa008994d34cf71d210dcc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003211563db1c0f64fbb25074f8b3e5f6300000000020000000000106600000001000020000000aba97eced07b8fe93bc82bdb3eb1b23d11c11df7051fbbc81842ba22315b673b000000000e800000000200002000000071953fd9178d8e50c0fd567695e5e8d73c70c4e603f86d415fb57731a7280b7f20000000d673f7346548d6ba45e601eeb67e6937a55ea688f7b2e0689624f739ebff38354000000090a9024e16b27f7170e90e6cd312029bf64cc8cb8443ccd4eb74196c247aff3da3a37b0c5062853d51e8ba2c162d99cb65b53598d60f53279154787ec3767e8c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c135c0f0abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB33AC71-17E3-11EF-970D-EE42DE2196AB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2004 iexplore.exe 2004 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2004 wrote to memory of 2944 2004 iexplore.exe IEXPLORE.EXE PID 2004 wrote to memory of 2944 2004 iexplore.exe IEXPLORE.EXE PID 2004 wrote to memory of 2944 2004 iexplore.exe IEXPLORE.EXE PID 2004 wrote to memory of 2944 2004 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65b5eb46bbc40b1ec06bfe7682fbc651_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5919a2a771bbf93af821297033a981bdb
SHA1b5ed37a6ef7839ba3e72a729eeec30c4d3be2eed
SHA256fe7bbc3e912250451d501edc89a0f8426c90e22b12b996ee081b858fa1d96d80
SHA512265fc90078c4309fbd41c61677ed38c14c9e970c0d806c46bd9d7b32a8dac56f44aa0c912060627015415f17cb49c6092e8b3e25a7f23bcf7101a242d5c9c1f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac91e51b1b9e4cf5b1391393ff9de533
SHA1458da9d3cc8757a8ce0cb0a415ed843072cd0f9e
SHA256cd4bd40ae681b346beb68e26f9cf82ed4e72505368e039d01450c6bd7807275d
SHA512bc0edb5c2199d0b8d47f1e3637eb3856a075601efa0f9190ffc29ae5b6f2006c4920c729f76e09155b78b5d16a1477e3ba9377861e01f36cd4a3374d6365a70e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52308c4a32baa5b932076bc2a5bba9c82
SHA1c5dab39b45fdaee2102a109155cb99f7af4e0849
SHA2560d23e2b567f9d959cfa57176bb750f9c6762d60652b38a2e754779c730c69981
SHA512896c0857e3742e8d2e038a864576e368fcdeb5aeaab7335cced35648b307be93318c7bc76b1b3c92ff493aadcf861120b14b3ec43ba53f04ca6c222379378447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6d8cac595202aae23503f72d8e11d48
SHA16bd3ce8dd03688afc701800765dabf0ac5614d87
SHA256de7f7e49932e0e2de10fce711f1cbe762402ff627c48a61c99f6018f4f8f7ff9
SHA51299f1db4fe68adf495a97cab15a7937ccd9ad2487efebf8c9d2cb1ac5a381c0c58656d107adcf12579b4556662f20accc44b83b2356decba1554fc2b967a36c8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f47858ea3b021656bc001cc920e29b2
SHA18cde915774e772db10783a5fcc8b5088e28f49d2
SHA256566198e359c8c0130bb57d3f67dcb507cbd2e1732df7b40facd1db891f48843e
SHA51217a8b3143b1dc967d01bd13bf4b166efbe01a0ea1875901432bcb95296fb2273b96588f909d755a2cc8968e7a23f05682fa530cd2593d8c8eb5ab85caa20705b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584e5c4694d141db8b80172d0d06ea3ad
SHA10437d11a280c18f26d9c22c47f4cf5e3e62e2797
SHA25637df6c4045c50844f8f48518e5c4a9da8727bf71acc0e48400041fb6377129e1
SHA51267ecfb60f5948d0742e3ee0bd128d507064167a04cd3bd4096e5f1d75d90059d5a55a42cd83d003d73cb680a9aded5cb0029c7f5d6e734800949b6f8717556e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580f9896d1dde3d39b1d4d6971139805a
SHA1388706c7f12525b39864297989030c897e340d11
SHA2562608500a5ad9e620f5b76ece464947e9a04d71dc860fa1d94b885c4adc4042a6
SHA5125c3041ab7b2524adc6c38f3f584b402ddba2eea9b4527d64e510bb87ed4125b01a739d34df43333042157c8f650569b8f40010bc00376e8dc6fc90702755cefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a1d5b6275108c6a2b429198e258b531
SHA18d1b92671be8656ec5fc843799e38c208f371b90
SHA256931cb759ee507b2c849ec2465d531309f4853fd1fc679ff6df0eafae2895fd30
SHA512d786a2bc7161c7cfc68714e47599285e5925a7c3c87a2f09d79818c5f92f6eaec2331d41653a613288ddd4d03fe3873512dde486aa315aa476642c93ec0635a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564a8d397047ce8d5c0388e6695e2a528
SHA1afcd2dd0a8f64c6a345cee03f98bc7070933d5d2
SHA25637e0c131de659c7d233d5bde57f0d40573b054ca18979ec277cc88264b499c18
SHA5122c617a26a0d68e710948dc8c8840b1dce94b8c2c2efa78665ccac9189dfb1a492845ffbced3c6ca3c46381fd375d4ab405d0e4dcbd07cdbdacd0081d80287b77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eac616e1bff5a48675ed28ab27adcc44
SHA1daafb5c64fffff1f1070a69c968a65e349fed9dc
SHA256a89ebdefea08b432a4138c3689bae9cca74b9173488d206c1ad8227f33f3a386
SHA51203a379a86ebf82b85027a6185c0f656c2dbbd34719a3bcd9bddd626e3c123a04ddfa3cc33bb01ab5aae5b7a421980c31b170d50abfdf685a724be8c317c1411f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae032587c6f5adb9b649be3c8a4e7db8
SHA19b79bf285c5c8fb24748828e49d7cb7ab36b9ded
SHA25642ed75631684b9b1938302182db482f5a7b6b45735811dc52f69082ce418969b
SHA512a252194ee3c3d48e97b692d19bb708336a597c9bff2b08b4c4a6a9248b0e96bacee9dc06078b0861e598208f7f3278ad22b882cf804e9b94f6c3581493809012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59879d08efd964370eff04ac77f9782eb
SHA1b222593e0c30331ed3ae263f3e6342cae137a9b9
SHA256245f40edad1841c2bb7f342ab3a61a961fb3e293cb417cd722adc8cfb64d4894
SHA512ef3e3d23a0d582a4cd660b49130229a16884c972d77f453aa22fb50149a041487f4003dd263175bd27b81b90e880bc981fe64cd8a601ebee0a5146a7391e2e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8db67d67e308cfca2fa03e3eddaf54c
SHA127cd624b4d770a06aac4c3e7960396d709bcbe21
SHA2568a2f6be1779221ce5fcd59746945c00669088325672a45d631b139232a30d3a4
SHA512e279322034b8276c81998a37b78069a862a76aa542cfe20766c2d4881ac040ef3ce7f0ffdf0b9d388fca6cfa68821587a6d094308f34870fcf17b7fa51f996f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fc72920650e35975249eef047792831
SHA1ce932c9d7519f874a2a2528b6ef34b31a73a9613
SHA25601df6cde1ccc1256283129665a31db964ad9159d05727c7d50aacdfcb617f160
SHA5126631beb47607ad22acc6efa4d1297035978280568ea1aa2b7c4769faed38c520f726ca1db4c105049dad38e50d2eb13e72666385a55cb94cda2a59eca9690a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516d5d4b9cb91e4027aee2f16669eff17
SHA1e9fb5788758bd3eb6593a62a688eff8a6905f5f7
SHA256eab7c9933be91d976ee46e8571e3053a59d070acc5cf41230e9caf0aa1b80bad
SHA5127b43aa8b121d5384f4f6931ec58b8f145b32fc3f6e0c40bd55c171120f5a1d4511283a620b169f797f7b40a5fadfd85db5a826cb53b72e43124eaa198fb24eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51090f178fef1e2f070d93901a1dc4049
SHA1d401b78ef4b62f9d9c002c78a164e2180d7c1391
SHA2568a2002ebedad74c9ef9407969e5ed0743d41412943e5cf3756aa06840d564fbf
SHA512156ab2b02305222bc837ed0315318bf9ca44e41323790f85764878c4c48fcbd828878708e7adcd05ba40a767c51831239fe5847fc8c1e2df0cbd9f601c597450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528f581d056ded2abc74c439e70dc50b9
SHA17e97800c836afd666120c9ec2737f2ab21dfba96
SHA2564a95ff238e64105277fabdd5bc28bd11adcf51db4b51036f2ae138789469359d
SHA51288c5481cc618b8f0b31933b2c6a84fd3b6667a69b16acca06a9f527e8b15c9e2b5ce7d5bfb4a8302e4687718d6466ddaf43030d8c59573c3e958d9918f4bd135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d1f5501114500689915a783fa9dc55f
SHA1685748ff779a1260c804365baa7c47da01b7e26e
SHA25603fb25cb9efa870b974a064262f2839510564f1623457a02ceb89c423a31a30c
SHA5128be3a9ab19695c6726af28622950852983177c09e95307d640cf7ae75c02bd7bd15afb0a6d949f89bc0592a4c675f1aa6b73d144f99f4a89e039097d258c7d9b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a