Analysis
-
max time kernel
136s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:39
Static task
static1
Behavioral task
behavioral1
Sample
65b972fe97f87325d078a1bb64207a54_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
65b972fe97f87325d078a1bb64207a54_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65b972fe97f87325d078a1bb64207a54_JaffaCakes118.html
-
Size
214KB
-
MD5
65b972fe97f87325d078a1bb64207a54
-
SHA1
6e3bde8dfafac6c4110596e00790959d1be4c293
-
SHA256
4d755ecc0fab90a429ecf69a2dd5cc36a37657ce7fa2457087bf06a1239b7cee
-
SHA512
b5431a1e2128d299eab4bfd4dd2c1cfe8649b965142054ee656c2d1f3194c49c449195ebc41228d9cc0841509c78db5245d267688fd71ad5780170381a6b7a28
-
SSDEEP
3072:RrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJG:Fz9VxLY7iAVLTBQJlG
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507430" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e626e95adc39544b07750a829485af500000000020000000000106600000001000020000000cfdd82513ad0ea108288ecfe75960072bed84a85f79057665d60387046e42e50000000000e8000000002000020000000a7f7ef99e1a17e74a3257e6a860777ec7b28e564882f926a4960789091f1d9a8900000003d592e8513decd70089cda91654f5de896ed693e9ee22433473c6df5273b8449cb841ec2876a479666644e231c5f2b024ff1e6bac00da0cfa68cb8862d947e516f0cdcfd8cef8f3c9d9e111d891e4aea7f52e4fdc254ffd4bd72b5484104fd1aa0bcc663b04e8b59bec2b87bed5de5fcd65702eda990c0dca15c7639eb4a04282c72c1f3b799f60f4404fcd1ea40897240000000f03097ae3a6bc79894fc75a234c569c8be9ddf4ad3498d06dca7940befbd293369ee55a1584823378b30f51202e61a283c50dc9abda150b2a0785089115ecfb4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e626e95adc39544b07750a829485af5000000000200000000001066000000010000200000003ecfdeb8473e84933d065067e51708cfece35f43bf6d4d6c1242cda4b9127783000000000e8000000002000020000000fd368922325f9f6397ae30c1323b3049d607d5675417fb3d4f9a984a06377e3c20000000e7c6648b4bb3a40a5c3afa811353c3518d0489aa539856e457fd6aafb0eb558f400000000cd6811b253a46ce0752e7b4ba0ac5d60ba8d5197dcad6710580a371d93a34c8f0a48d4c9ec6fa45590234ac5bacf2a7fd53642ff49eb9cc2a87cb5d962e04aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E6E8FA1-17E4-11EF-9A4D-7A846B3196C4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03eb891f1abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2280 iexplore.exe 2280 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE PID 2280 wrote to memory of 2480 2280 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65b972fe97f87325d078a1bb64207a54_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d40120a7b90a1c3e38bf7382d4a5b48
SHA186e0bd3177a594c650fd1f5738d26eaf519495b7
SHA2568ab4d08eeea013fd3bd9fad25ff551901d3713ff281b4b8c891843c61a6daeb6
SHA512249c88bcd1652d73f76e2030fbd406a3c869d3dbf2920bd03a84d95b48b8e1868e8898e5ab50dcb4df444f0b1144bb01ded2c160530a901d010fd1860deced35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dde14308da33c09ad31e6c1bb240a3b
SHA1c9b3deba021d0464f3274acbeafd40e7d55f5567
SHA256ffc88170b73b7f734b7c14cc17a56159b9fb60909cd1244fc5df85b23f41256f
SHA512589d1529fdf0d54a35d0f77a3d223c4a2ed88e20b27cbb1146bbfa62023618d3fe80f6af6320ec6f10c6ee0134198f722d727630f2b0e91ca4ef266be37b14af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53022d756161b12ebfb3def7b60535a6a
SHA106ee9276952b90d79c1d07b914cd9f32b55aa984
SHA25631d73b975740b3bafc218797a339eadc53aa59b5d6835cd1a28922c7baf576c1
SHA51244cf865780ca0e27a1b9853e5fb440155a4ba81764a2ffd3ee3641f8f1969a33ba1e4a1aa75170d1085cb094c311fc53833f76c5aa701a1001412b4b300b8a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d897a5ae6629e510f2cb77a49020c330
SHA182fe88a78e95dd0ab8af06b6e2c1de07ad1139a5
SHA256a9aaf15be5d1d4e11e2c2ed3302355de295065a809e6258d9e4b60e54ab0a064
SHA512aa4490f9091505b8d55efb8e4a8331c15663ffb91d825a62c5410e72b7d2fc8f6dcd9e33e21cb6b2d7f441bbc5f525eed6415c6e60cc1e13becc94870b6351f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc91a73fedbfb2a0bb10199dc69eed19
SHA1c10439efe85f32697d67975107e973eb06f3c9aa
SHA256d2717f6e331a1ef936e4d8efa2ea7d94b24b7eb66323a5e044d30b65039e9566
SHA51212769247dbc1030056f6310f4909c1d6a5fd9e16c544415dbf9dadc3d5f79776f68d12d3c1780d31332f2c454cb6531d16d2e5cde66e2d008a44bb8faee8b053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50644f33ace092fa854817c6f764f857e
SHA129d01cfe320e0d04d140afd0f1a9640fc3052499
SHA25677038764307edaf22cf1cca8bf5b5d2e0dd1290e8f4d66635c30ac08181a993d
SHA51274d20ca396a02b20b1e0acaeba9011589de491d97f4a88b32bda78c9c4b6bc26e7a82b60a79a113a6fdb4389bc86fc57bd1afecd81708f6235697d1f38e4c777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56820cfd17e50c208f7b9427acae276dd
SHA129296707ffa9d9ce27a45acd8059644fbafc1d10
SHA256aa1b957404101e1e5c7f65e9634fa64becc0e51686c5cda2f207635c36cafe17
SHA512886f244821c9430ea4b6a95754a3f8ad0b7fd62b7269369869e96fdec682b0d3dcde5b27c6a4cbdfd4c40e09c6b0b384f21ca7266f2a1a48ffb70b1027cb1128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d738fca4f0b2d391fa9262ec7275aa7
SHA1337cbaeb44e20011a50f113d199e22416d20cdf5
SHA25660b5eece4dd53983709c3bc8943661a1b51e2fbde10013690bbe6f07bd306e8f
SHA512e08abcd591fd7421c4d292951c1eec5b1bdd67d8bed4e69b8c4fe8c645cdc9ce94ae6bd6e8d4db00727988a16486799b50abaafed053fed32d3b00e48ac1811a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c413ba461aca6f4a7c8809c6168b4a50
SHA1cee93dcec8ec3f50ef12a8aade9ed8345d78b946
SHA256685d5072fd956baeb8dbce43db9837f393e131a73a087a68ab67246c3ba71e5d
SHA512572bf9d3197d5d91b9f8ec8cf2bbd5f35bb7d655fc1e5dd4f158369c62f63cddf8959841fdf6fbc7d9d264bf0e898f9583eb1248802a56401029ccdcbb92e4ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593263613a4bccae49fc244b7d0db108e
SHA1fdf9ad2a53175f7533e8b726c2dd09953ba0b823
SHA256353f54540e955fd905c82d6b07325addd6018d2c02055bfde33ee88e1e9411c1
SHA512d42933c19ac5099c3ecdf2359fc426590ed710b082a787c99cd70ed3611592d5af9561334b6af4e00e1cb8ed768183fc8b2815c9989145d2c8f4b620a61cb8cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c3696afe1adae8ea12be11d79649705
SHA15eaed66c5142c2f33c43be1e328bb0ed5f2406d7
SHA256edb4140f7a2ecad58ea6c3c7df62c27f74b032e250db92193bede61c138c8e65
SHA5120165ab6c6e559df14c63ddc03bd807f78c5197199ab90eda9701e5cf86d728c110dd3dae5ce12ebbd4658418feb04c797f96fd94596e742f5aa4c8409845d8a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd3ccac94c08e10d82ee69f119f5743
SHA10b3e979cb2de8e60d909847ce58dea5cbb2ce803
SHA2560e28ccac466cab343671d51247d8c9f6fbcea76d48cca45aae06bfed3779db1b
SHA5127ab89e298d8668ed15357e4e8bd968663923331b5104af1c9f7b40d82e6c27ca70e74cd8667a9bcf2f2733d4e9bf45f66e8256459ca8508c94f7c70fddee5321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519802c6144f6166f19f4ae93725e1706
SHA140d198bf19b10abc9c8678ba7db8570a4b256957
SHA256b1a14cd1813fc7db8cdf40c7e3c1db087469dcfc71f8505c1ff7ecbff3431d8f
SHA512bd3e4daee527717aeb654a53348b6f7d7c48e6c84bfec6a06b8dc3ab1935a349b675bded95ad7dd6f67baea28a1a6bf0ecf2744ec508b11a22818f4faaa0abdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf9c87005a2b933a89512d5382b11ae5
SHA1e3847570ceafbdad7ca47f77fd201eb096ecf38a
SHA256b488281d48a464095935b4b19d9f8ab0918d9ee74360fdd75fdb5461910c2dc9
SHA512006331bd71c426a4a769c29e1d56ce27685aa02e0fe3333975b06c01065b2e18dbd4aaab16c4eee4584debd4cc933c3cfd876953f8dc80b6e6d14530954ac453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e62a48c4feab97da63730ae66646fbcf
SHA17d74b5a4ee08e355a1c94ee521decc5a9b67c208
SHA256f0c517b2fd4bd7332aa65e904be1396815d7118f922676b48c0e90f45c0bc1eb
SHA512aa75f7fb8f4f51e6239f772e278c3a4dfe54b827a52f1799acb4e41e442ea688e70f43c60767565e69a955968c116e786f23a4f33af27cc12ab3c87b678446ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d073590a3d3badad2b61c72042547cb
SHA1f02869c7ead3fa422a958200206b980af78aaa20
SHA256f65927775e41eb63175aafacdece554a669752e951ab2ad9bb42379fa042d257
SHA512cabf94a882439fdb1890299f24d89018e48215039fb20453b6ee597974f33a40596fde6f82452e71b067630d0ca3bd6df9a47404b9f22a529918c86cc96e30ca
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a