Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
65b0e03ab091b79b55c561e9fcd04189_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
65b0e03ab091b79b55c561e9fcd04189_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65b0e03ab091b79b55c561e9fcd04189_JaffaCakes118.html
-
Size
68KB
-
MD5
65b0e03ab091b79b55c561e9fcd04189
-
SHA1
e6808bb4483b8b9f7419afe6086ed0c6df6eee0f
-
SHA256
1bb2d86ca3248fcd24aef0437f603aefe38e9163c2f082f0c0c1d92cb143d5d1
-
SHA512
2ffca00643c7202e418bc91d4acf0a0773d054ca513c57bf3bca9d6b8d2f3add40613ec731e80ed794d0380db91d62584b8a827f78d4788d0aacc6e51dd84d53
-
SSDEEP
768:JiygcMiR3sI2PDDnX0g6THFm0mioTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:JyLdrTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a27ddeefabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000076e56137788739429582055bb1bf557f000000000200000000001066000000010000200000000a5b6c5920f92a0f03af0b113a6fc106aa1c558f80fe7047b879369b8e550b3b000000000e800000000200002000000029d9f3c7bb6dd186b5507c259a30c4b47a3fab159963a0e2f03adda1c952c6f090000000434aaadaf05cc7bdbb19a417ab9d3c97944c8a2cc9e0ad846909ad25aea706d250006bf88bd78d34559f80a1b1c956bfee8b1014b757d5b6536e22fb7a927e739f7cbcfc89eb2fbd659256d655f0dbedd728e499530c72b02c0c76950dc28c7a96ccf964d1440c20779a0eed811f699136036ec0aa7618c447227a123dcf5ccc89cd3e089d6e2225c85a63008c032621400000003a53ad7eaa791215dbca61538359a80ca968bc7e75476c9aac072b92dce63f62dbf5e4296f7d87f81c84c7cd5daaed0bac1705f9025a8fabe19903458218ca0c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422506804" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000076e56137788739429582055bb1bf557f0000000002000000000010660000000100002000000085065276bb0ec4db83a6b8f77b45faf38269b5b81a6910a87e7a034ac6ba3bfc000000000e800000000200002000000016c193c6294358fe2271366e1ae3803f4b9e836d8e549e3df97d4317965d0c4b200000008d967bbda00d50a2fd981b7de7e1eef555ce9a7ea3b6dbbaa6ca8c584b888fe640000000bb13911996923af8ff9f0c7c8eff13c716f55ba8fea586d03fff5908332a8c1f9a99016f966b19cf0a8cd87f6e307299d3885f63978f4425527823e315b4ce3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09E32981-17E3-11EF-9ED8-52FE85537310} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2508 2700 iexplore.exe 28 PID 2700 wrote to memory of 2508 2700 iexplore.exe 28 PID 2700 wrote to memory of 2508 2700 iexplore.exe 28 PID 2700 wrote to memory of 2508 2700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65b0e03ab091b79b55c561e9fcd04189_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51df477b94358036116a0dfd0430a31bb
SHA105d2918e2e589082ad3df458db37d081e057654e
SHA256bb398ab61d5596a84a93ffcb9bcd50e47689b2a5b7ff10b354c5845ad51197bf
SHA512eebc2844be305c7b45319dbf352b7c40c4b8f1f03970a6400f5225387e801636ba36564e87d60ca45f6eafe18c34bbca1ca6420b619134fce5120068f83f1b10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59702535f25d66c0e5acc1004739555b5
SHA1343a6fcf816050b9455a739d95281337705562ea
SHA256c8daf8f198a50a0c02cb9df83aafbd0f8a198bdea91f32346037a2e3a67ccf97
SHA51209bef4f5d666f11e7cf1b914decd17a5d9893b6e0419d7820b47fc2342b1a57fd10e1d9989459bca540ccb903567f75900699ecacb62f872069b97239ab9ec61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ef10b3133e5427d7d2095489244387d
SHA1622fc40b5b9b8f637244e88c1bb62fd980b42e7e
SHA2561c6496353764ec37934d8cabc12415772e32547aaac67f1c59416c8b27aefe5f
SHA51234c2f6cce78e07c6b75f1b5423900d5fe941a3473e7dea73d2b070a0d0b8774969910499a7ca1bb2f068379766797a9e897d057691abbc76d7f333c38f38abf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5285210533ed333e1fca9d175e0642b5f
SHA1a3ec75a284d5d845cf9cd6835b0c0f5aeb052760
SHA256cd838cb234c212200b0fa73f916822dbb5ffaf3b305e740a1e38d7819f920428
SHA512f9962efbfaeb1e75947502e65fdf0a5ca48c16d2217ddc77abed6fc03db7cfc01c24bb9552f17507fd23bf5457e305ea23ba781c6f8449116a16fe2780d1ed43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58557ba171d4c11e8975acd040bc291da
SHA10de1edad359c7a1ba1bd2a0d634e75238adbba75
SHA256129189453e7186ce7fdd5afd8c5c09fb6f31372e83beda33e9060aadcaf04f4f
SHA512e039f5446e416d13fe6db87b75139fdb7726d5ace2e297f5707ef52027a9c5d5cb11fb79f3c2b287fd38d39e39ce736fe24ad1760dab1ccb1dba5afa0d0c7041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b9262e234b4bcd3e9f32b194a0e156c
SHA146cc50424533151665f799de767dbec8f1c648ad
SHA256b23dcff6f04b456ffef1e6d93dd7b89d2b807ff14a8836c7e4f91d395ff2ed99
SHA51212a770e48d2c025442f721f29170ed8195e31625b704474dc57a27960287c8fe6c95fbf728059d7c220df87d2fc6ebcb1220b53c6c4d6dfb21b40f7848c452ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af085e2200787c266271ca707301af5
SHA1f6171c61d3015c825f8bfdb35bfb36ec31405ff8
SHA256eb91354e290f081536090c7a67f0721fe1e660105a36f56f428152f4a4f7fbf6
SHA5127f6ccc716e91091da9e8381c7463243840ea9ae23a278093b5a9595fdd3cf10e2ebdfba9a1ff96111d40ef8bd28f0230c6f27319f1fc735d3644f8e0b627695a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f83be3f3867d1d1a2cbbc9e3ce456691
SHA145ede5e899b1d87d5eedba9e06cbb69071458055
SHA2562babe190d368063249cc402a71fb4dc568322c62ffa18820ec92414e2201f215
SHA5125c6b4631ccd0cf810a516ca821f68c0a5dd3cf5d6f8b893d5d89c752bb1b85b934aa8faf811f0b163df3b529317870b6ac425c40ef9b249ca2561e8ef6a2a5cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea38a9512e9e0990128cf758a4373f5f
SHA1cf5f9016839131b4838ed53d77752ec87a1ed754
SHA25605e09b7dd7f3c25d3b55b101ea726d832205380b4a7b324e1e18c90048c84d35
SHA51207efb18d7c82efeeebef304c4e3c8351982fed7a7fd8333c1ced25d9f4dcabf26c21ec30cd63164cae165d3952cbea2c3a38d788d6b48ebbaa738ca6389861a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5919ebacb1364efa2a316b7d157f8f98f
SHA13ed741c2361e573fcd03627c02fb401377b356e0
SHA256ad40fb7a70da332ea7d0da5c82b03da462fc56ac1e931889b6b7847640caffe5
SHA51262faff9ebf021bb9dc993854cebfef00b64acf012fafcf7ffaa989fa20ad045f988ff843c4c141ed21909c387fafdd6c6ac5e6e2c0fc3273a8bee122a290c5d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c9903d805b8988b3559cb56c0a76841
SHA1bddaf30a18601884c3eefe6bdd052911e595255e
SHA25651a6736a5a3c7b1432eee04e37c36ad1db2ef141e75f369b0d794975c573e545
SHA512cd7aced08aa9c8fb72113f6c021195c646863e50f9be477d3870dd67617a3fc953f507706f182c46aa842cacb45f4ba4a537fa753b293a7511b550571f918209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f671555bfcc9cdf059c679ac89f64589
SHA1d152bb7fe6830bb17eee1523bb96611c2fb4b43d
SHA25635d029663de4ef1690fda976ea85baa0be4df852d95c7e586ddaf8b35c7b4d2e
SHA512bf2c55ff7765e605e8ef9a752b9ad74949811592522626e3f6e4dd1c38d744d61efcfedc4efce60babe9f42cbaf95c155bdd6ad55ab09a84ad110a76def12dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560e3c001f2f01692a5f8dd8e3781e6fa
SHA1750f88edbdf4fae72f83855d2c88514756b2e111
SHA25663da8df61f242c57d70ba2d5b282441befc78b1f2c2060b8cc8c23e766b5b00b
SHA51208e8ab77b839771ffdb72f55ab975b09e1269c8748b38dfd7547d65b3a9f04f0bd6a4934caacbb1f6024444e07a46273b526fc3a141c82e3798d966b06e7afeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab102fa8c502b41fb70f6d5e1e4b64c
SHA12bad375a3638b0a9df0dda02d9dd15eb45fa9009
SHA2566e97c9635e9ce790fe12e18d184a43219b96da3e991c8f388740511644878d9b
SHA5120464dbe5d87539e1724a156b552238c1f3e94f1d4b19dda8cceeed41763a9691f5c55f9780798b2b6be07df7247217a499d287706ba5b80ed30fe3c8ec1b3c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5140ca69e2d85ef6b1005f0af85f25f8a
SHA12cadfa15ba4d15fb005cd63b121121101c339586
SHA25693b094cf318831e5cac16f02405fac97b596f5e44ce588805fe238ded3e479b4
SHA512a02e7a627197a9676a350386d56b8ac03399c452e525d85c4625b4170513a179d0a481ea4e962d460066afd9e90ad7f95016dfba24d59f853b4fdc55e7feab90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d53731ff61f15a54ed1be1e1f43a7b
SHA12974edae64a23f42c840cdc23cf040776d503507
SHA256505ae2ed08e0670bca1b4f6a59d1e5f523554e526c98a48fd6d5383aa464c798
SHA51274f13be4de2e3f3391bb0dfe9cb096d5c0d0de649a0c566f69e1fe95524e9aeaabda2651b4ccf53f8d378932e5eaec300f5392e800ba8d58ce8aa1dce8427723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592544526c146b407ca46728782157086
SHA110951c6fae716e52ca57da5ba785324b83732fc5
SHA2560ada26b8d442f54a26c3846580ac86bfc94a46913f69bd6aba79289cde833a7d
SHA5126afa065cb9036f3a9101fde8b1c7c1e050f88c1a8e7b2c0eee87c01c3765c0faaa362e09852a7554400939e44c10cb72313ba70c2492f06ad014454691377b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e645290147fbac6fa8eabe6eba49c3f
SHA1d1e6b5c75dd6edea65aa5e9f38b8c3942ccd8865
SHA25656df43ae36ac25a5f9c851c0d03b32aee2f9d91188c45115c46b016116ea071c
SHA5120b5cb9e56db2c21213953553fad5b0ee2bac614d04bc9152c6c653f0e1f91565ad9aa1c138f221e714a00c804f83ed69e75cec984cdcf9aa556587d62bb496ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a