Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:26
Static task
static1
Behavioral task
behavioral1
Sample
65af5b5aed128a1ada0f5bc95e2540c1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65af5b5aed128a1ada0f5bc95e2540c1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65af5b5aed128a1ada0f5bc95e2540c1_JaffaCakes118.html
-
Size
11KB
-
MD5
65af5b5aed128a1ada0f5bc95e2540c1
-
SHA1
844241bc840f7606827475b401a9461f193a8902
-
SHA256
b347914a436381a5d8e13cd5d49fb9b637bc1369c2aa68d865adec02061585ea
-
SHA512
a07732c51d21df54ce62cf0fb898cdc06aaa4ca8931f272b23728c40a8ec26dae8666d5a92ed14907c9ed639d6be84160a14974616d5b5e849e559270f744e26
-
SSDEEP
192:O0kOyBhhhhhk5WhbSMw2cC8BBWohGJmGHw+Ighhh56+64Lg:ObToWhOMw2cCW4sIm4w+ICLg
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007495990fd4436a488edd84ecc2f81eee00000000020000000000106600000001000020000000bfa6ca79bcbcce64a1f5758d84ee540f6292228549027b9663ee78b731da1b96000000000e80000000020000200000007e7b1719a34931b278154f1b09439d19cfddaeba3b6c470e85fb8164983a9a3e20000000c36b996b75d400ed6ed1ff14a1731c72767feb4ec7a10cdec39b784193af4dca400000000addfd6920f9b4efa275f86395bef7b09a2466cebe2355ea2c1026fe2cab7648b3d45ebe9d560e9a927e1754fe0d914eda0b0504ce06dc3ad701ae19594ccd3e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007495990fd4436a488edd84ecc2f81eee00000000020000000000106600000001000020000000289acc9bae0f578654655cec248591b60612cc602b6fbf7033456a44bfcf70d5000000000e800000000200002000000013e33c670522210b5dba2d2af46258b6a9869632c4e4b5ef3361df518361241d900000009da3ed4a159bbbbf4cca23afad16933a7e79dfa213bb95bd3d64937c94b147f562bf25c457c817e5de98085a675fbbee2755ce24f1e237b12907a6b10929301cca7b611d57b6cf11dd07319eed705311469bd96c3f479c3970e942bfe92794d8f6a88424ed043730f38006b57b2ce4df16bee7222d4d2949003664ce7729f38814729f1ef07a9bcf008fb3a9f61da7ad4000000003e19cc6b65fa4397e97bea1266b8c4d6e25c079758710e6fcbac29546a221fe7ca4cb917a4b97f26905037b0e98a865d548aa61baa19f234de814b12e190724 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0232d9fefabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C134B781-17E2-11EF-B804-569FD5A164C1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422506682" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2844 iexplore.exe 2844 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2844 wrote to memory of 2524 2844 iexplore.exe IEXPLORE.EXE PID 2844 wrote to memory of 2524 2844 iexplore.exe IEXPLORE.EXE PID 2844 wrote to memory of 2524 2844 iexplore.exe IEXPLORE.EXE PID 2844 wrote to memory of 2524 2844 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65af5b5aed128a1ada0f5bc95e2540c1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d3dd14d0f68e246f304cff665d1f5d62
SHA140a7502edd871ea8e17417359c295abe7f9a525a
SHA256ed20df0c08d07f6f994ea567080a568313d453a62166f4eae2f89c0c712265c1
SHA5126ce379254d7d33815a306023a6bd5d52b114fc58318ed29b79a198d279ff1421dcce9582de5ed7aa4e87dd8992370bd3f9599b7af3d6e8f71e4663f58f528c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59b25ef606814aee1573aac7785d6993b
SHA197e9fddbb9bb7153f192c6dce7caa432bb0356e7
SHA256c6954600696aa81752b037a6d96aae55b4be79e4bbea2519b5f9c4dd6cce0043
SHA512376590f82fbde7d2465db4cf8427da1e4168606e6f037ba607799cd7d97fc34ba8b5b6335443842783bc8461cb471abca60543a31c4d898f6aec8fabaafa5942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5608044f0c317910004d2cadbdec61a39
SHA187744f1d0e15afcc3c2866dc13a4c26e4f4ddf91
SHA256333deaecf1a648b361cf132e5836f857578de99247f46d1a49a5262b591fca6c
SHA5128b60f732334ef2b5f667108369fad4d4a86ccd9db9d80b3ae963930d15aed63a2c937273be376c993d9a860c00ea1fe8917067faae4f8462c0cbe17d6a83b418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51e9d80d9765e8727926b3ee7072ee017
SHA11ecf8439684c573234cdf8e57fdc2f8844c37964
SHA25649d348fc9c9f299a37cd747c93daebe034abce30ca01efd7e777a0db1fe86be9
SHA51284dcae25d626e040f75f3833eeb8f4becab23d2c6ea6e39f02e64c50228359558e3dee040f786cdb97ca5457bab08730fc6fb2f76f74b8dd017f5768d3ef03d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD513a9d96f50be5c173de10f371f5e157c
SHA155a3fceecfdb76815d114c06032ba4701baf01f6
SHA256210b2fae85bd54f191ffed2107870072576503e5cc539b7c037fc963eb80185a
SHA512402b208bf314815ed348ca9aa7dc87eff10f11ebc4c4d4782d1c46bface6898aaf67b7e76829aaab734b3a10f1ae6444e693b295cc1155d9351deed7f82b242f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57c3e269385ef1aa30de19f86fd8dfe54
SHA1da9c8d7f5c63704135e161d9dd241c562224fff3
SHA2564fad228f9601f67a126ec81b7b762b37a444a406abf962ce70d9c262ee225026
SHA512cd4db8b402e881d8048bcb4795a5f8092571a9dc3f133c1a598f27b77098a9304db1a21d02c34c064b6a2df6edcf77e5967ec98a5450f3f2a2b6b5620cbd1f57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d5567ae2ee351fc60229ac981104d31c
SHA134ca10af229a45ed882e78da3114c548daa9e6c9
SHA25634c4f4168c2493fa2e26ed02fea47b2fac9168554f051bced28902592ef1218c
SHA512a8b6cd9eb9da1b594f82711742c764668bc2a19a828f403ca63b22f64f43e90295dce0167cb8e487915e7211b8257487b12b7ee017fa726bb67aa5c88887b107
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50f95bdf556dc4a72155c62a6c1825c1b
SHA1893bb6f529aed807697e93283764dbca7471cfe3
SHA2564bdca642847c494f3a6811eaab015a027db7b572c74ca0482549ac75b2f40bca
SHA51288d7e92d016c5ca198174f48e73344eb2a65059a5ca6870c92508a029aa1b2f5d9086d72d553b52c9ad4868e312e76c9207651a58dd0de6f28387392de14634f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ca17be0963504ed505f4b7a43990147f
SHA1a87f66682011a66fc8d732ffab60b43eacc59d05
SHA256d11e739912444b24490b65a9c9c85eac253c0cd867c6e75c5c4ce5848de8f171
SHA512c32fcfd4cf7ffd3f697aeb97acee24d37d5476ec18ff91708037824c0d6b19dcad10400520c992496b5350556a1ee7a93e5d98fb6ee5a37db83bae026edf929c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD578bde6ee996d51aa0ac96c1b12db7e85
SHA1f0b2ca1809877f6a6762c609f5c4e7f1f846dee6
SHA256a0d18be326c95c2571a7344a9aef45350e6704161461d275dbc5fa8f6e15315d
SHA51226091c2b553fe903f2357639e7c058c7aa66e7b1324228986f0c3f15cf58e49415f879ac5ce6cb4784ba313d4d8fb6b1fd03118701e91e26f6694fecf09ff2ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e3dad92bed15cf0f13f6ad7340083de5
SHA1b6c8b84f921e1de6ec940e81786445b4aed85650
SHA256d180844218d26cafd2f24191adf6ecfce7dc67eb406bc873dc457ccb2a62815b
SHA51276617e2015873c6ff0805a6039237aaf7a69cd9be9e9a6fb99cda6d4a31a380ba13ecd2967ed127181ac29ac1c380044a99e6441fb4b996e8f64fec6974c7f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50751827a78eda40840b6fdc12a3ecc36
SHA1da7772a29035f5c821935e538be614b081340dec
SHA256a7906f64717447e9f915f701a95999ff6ac0e34753018d91123b38e291ca3492
SHA5121b84ece37d2688280872097456c8dbed06c020e01337a52fd463779698d4ae730e8e0dd573e2c46659b704a0a627d9185884713be9cbee212ece11c257cab0c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5786867682434eb790f71a7700f31b385
SHA16caea315e6f6d7cd0b52330986c87f3fc78264c3
SHA2561cf17e3acab980eca18267f8acfb81ec4bf3d6b75fb68744bcbab900a9d3cefb
SHA5125766650e277b1467af661e8e32a0a83df69c0728b5f23e4361ad29d6af3dbf6a7f5354767c49c484f30192876467613cebc5fe0ef5234c165242050d38988826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c2a93e848c2b0b785b93e9b8f2035082
SHA1966cfe790cbd53686782fab56a7c9b663103ed6a
SHA25626fa400a70f2079a9e477faaa10c7fbf74fc1e70ed685b36543f2390cf62cfe3
SHA512ac17b2e35713f73afbc50936eba820581089a007ba69d13f485a9b2f993b22b8e9fb0c0eb7bd0ff62a3083ea8dbcb72a3d65d3eb9c82cd81371ce5c23ac3ac8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a56a7cebd83053df30b0db30c16472ee
SHA120a357de6fb859ceb82bcca7f36aa394d53e348b
SHA2567cf52ee78ded710c242d11cc5721133a3204bc2056cd9d52a8dff5897f808e41
SHA5129c6b74f0fed97b4cdf438b9f54238dc499572f814970b65772c13ba5284df509604f9f21732825626955bf7fdf3fe2e160650807bfd06c721a28fe55fa084a7a
-
C:\Users\Admin\AppData\Local\Temp\Cab7226.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar7308.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a