Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:30
Static task
static1
Behavioral task
behavioral1
Sample
65dbc12f4b2a480792e46f1cb0d8dcc2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65dbc12f4b2a480792e46f1cb0d8dcc2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65dbc12f4b2a480792e46f1cb0d8dcc2_JaffaCakes118.html
-
Size
220KB
-
MD5
65dbc12f4b2a480792e46f1cb0d8dcc2
-
SHA1
0a812b9d2d8384511c98738c5307b3e461ba2da9
-
SHA256
49ac92c562f4626251b591ab479592f53616d6a7ae995eee1a8fabf267a5fdd0
-
SHA512
3da0a166fddd73a23a956a5cddf090977aee6777e907de33cb1abbb4c1ed875aa9e0fcfb3af5be17ed1b3c30a9194fe0fc2b779a3e7a212ea674dead020b583c
-
SSDEEP
3072:SFVCKkJay+oSUyfkMY+BES09JXAnyrZalI+YQ:SFkJTMsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7E123F1-17EB-11EF-8303-EAAAC4CFEF2E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510505" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1460 iexplore.exe 1460 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1460 wrote to memory of 2340 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2340 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2340 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2340 1460 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65dbc12f4b2a480792e46f1cb0d8dcc2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d7fd6ccde0cb6544b6b12dc597de27ad
SHA167b277bc0d6759083ce3bec8e2baee436aef727a
SHA2568e57719dcc0ebd56278d4151816a3e1ccd74af13a7fd36f86a1221d5fbb2616c
SHA512565d7a0b013cef17a9c111742667d1c6a484d243ac5a8e083b3e36a8b9caa675ea379aa619c340fa2f1342aafe00d3e4c66176edb1c44849f75b6086894da7a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d459fe51ff0bdd0c63517957ada8c70c
SHA11b79b5f0b531387ef21bf2fb23b21e2d68e1cac9
SHA2560d1e9e61e43f855e6ea83605db5198c4cf94056172f2bcd3e1900e1b5601c39c
SHA5120e801780dfca1cdbf401c04a9cb72355e0c4d6e50860f5a91b3db84e39206bfbdf3d94217edecc55db68beca9f045fd893bc9713bd23e54c63923a93e9dfc9ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c2d2dfc9a654beb7f341c7442c02d1af
SHA15881cde0eb322213fa5a76033985a9e32adef863
SHA25601b5943b905fa863c7350138813a4ae28c5559d355499c1ab6e276136180a369
SHA51235af295866cbb4dc5ae8e12504454c68bcd9ace3dc5aaf4add29c6288a8adc5a73d27937b81c3c6fad2d11e0d2c6f9cc4a62f373a5505ec1e223f2ba5895c5f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e6f5ff89d17fabdf02c59982a9af139a
SHA175d54c95ff82b83249ab709a3642fbf88c4fe4c8
SHA2562465d15cf0460435a737af5b080c5391aad1c1ca431401182483d1d472ab9354
SHA512faef852db9f9c5caccbef7df92ddee44e632ebfadde21b71aebeee1a9bc6d6f110236cd370d8a743773a5133c756d867932615aa78c4d8c9e43fa838d9b464df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50eafcce57344c88eced3cdc3e9bd12d3
SHA15b9c25cd5e80c812af685ee4de33ee084cc8fcb2
SHA2562554b46ced801268b65170971300cc40a5a5fae896d8b14aa184da9c838f78a1
SHA5123fa3e56154af63f4994cb4d27aabe30d75229995d6d27fe8629f48c70692602cacc795011adde1cffcbc6591223b8924bd17a3566be6c2a165002195ad219261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d1a40149749d05968f601d149030c727
SHA10be38e517ddceb1cd5d60f7bbd79062f298f2b3a
SHA25642a0233adb5a59fbab7708be8e41c05e2cb6a0534154b9038e77037531bbbf2f
SHA5126ec14ccd58ae0f6effe97628da4ecc7774bf52a90736965e5fc5db19da6a2664266a77015dfd306f0d93e3924d36ef6c1e5df99f03a5629a8bfff6e8250b5853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD507fe3bb8b1d14f37a4192f80cf72a7bf
SHA10347d1a95837cb8f74c7de0aa2a6318c1ec0e805
SHA256056e9fa8aaee920f971c4b9033fe1b74fec57473d23fc8aa33b64e4b530bfe3a
SHA512d346c698067537b49a6a157185cdc2ce2e1cecfae8984973f92b4da1cf381678f5d2d0072f0d23311913f8400a8be3620b62dda9dae332470df18240c2888ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55c24104ea01acc2162fd3fad072f284a
SHA151411db7dfcb29b68718e185b22d4e7f3a84e6ba
SHA2564c47a847d2fe3a1e0aa3e6a547802663e7b3b216f3d1191902256ca3959d596e
SHA512f8aee88e5d2ec259d7cdb8b00158ad088b712fe352f02ed259458cfc25cf836305b4e774516fa62b8fa9e498aa4992db96460e18c36c484868dc7bb6d51a3088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5784467622c57ab7535c7c620b314da5a
SHA1b09ca6ca9f9d19528cb2b9756e1f5320af3e79bc
SHA2562ec9f494773a564d201fbfa6684b170188534e1241618d03e114098770e50541
SHA51255b382a04dc293d6cef58ddb033966fa127c26322ba8ac802865c7f74190b3f9884fc7c0c06eb43db4b8104d0b48124ec6e56ffa4afbda5b7a7f8ea861b4c2a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e61ce8a7094effb1468d4069bcfe1ebe
SHA1a82bf172959cb05b16d221ea3e7b4fc26e799de4
SHA256b2afdd8b7022de798c894b6ba31b9d3ffedf62085863033b7ac4abd3ddc4e41a
SHA5121dff95593b4e85229a2040ea3a7b7e85d0de0c4df5ade41ec1f592e65bfb7bb835cc20609f033d631d904c86a0adb1bd09068694fe087f57c97c781d77fbb11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD578c0f12e9735513b7e56c5571198257c
SHA15e85512e60a9b586c4d1a13abfe8f06e877316e4
SHA2560c066c8d1a348ca7a84cde33ca1e6b21007d0fad1f4b54a3be8749cfe3d6beca
SHA512301d4bb288f9cb6e7a3fc7e0a2370755a2e0b576b24dd21be15c144d86491a9031a59f91a1d51ea6d7ce884c881315b1fbc8486495b02649ec98f540c08b7d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59fa5f5bbc6151d2c5327e2dd58c137b9
SHA15cb29b72c4e3809e7f576c3e5eb11d495d2256ef
SHA256c9ec97fcae2971cab897b763bf69d328660ba2b9c5997b84b379dbb2027f2637
SHA5120106533cbb664a9586720f1f51ea797fc217378224ed4d3395d92b44591c9b5dfe12554f87a477aaab236eff0da47a6bfcfe3345c634a978e22fe478422e6318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5217e9813a61427166bfc6ef211d5357e
SHA154c598db9b38000fce3a49bd45265d4cbf86b06c
SHA256a76fe462dadd047b16b011b7b632c4ef3e46bfb79b5cfae94eecf76d33a32aed
SHA51256ac1f7e54415dcf6746add53b56048ed8c2e844ab988dc7b32a45bef3175536829e235a85cf3dd6d80c56dde4b1931f80a3181390b2de4ce71af5018f9aa4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fba013158d72d250de1ac19f6b1f8ce7
SHA127bfdb0f84eca5172941a673526715ec4311c07c
SHA2568f61dfc131bf9923bc6eba363926b4637a81a5714e2c97fdb254fef6d1a85655
SHA5120d43e69fae06956e1c326dbde7758d35c3c542093f61e24fa78f1b94aa570286d48323356d438f5078f1b6d1f97dab9e288da43b85659053a74b6b80a0d4ed26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD513aea41bf8f4ad3c5635267439e070a6
SHA13ade966ac59780a22bb235ed7b7c1afabf17f8da
SHA2568b3de54b6e4fd0c4594c37c1e5551c345ff65d9066ddfc1d90224182eb1e1627
SHA51225d8e5914f177ab70678312d58cb2a8c2a619c3faafea89fb7056dee120423516da2da2b22585c0d60868cf817df239bcd6ee1da43c8ec562d573f4d41220d4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59432cd2b0c609c55fd02f180fa2ef578
SHA1eacf2e8de066cbb398ed39bae5dfe7df06152f4c
SHA256138ff314f5086100f8d19efb0ccc51e2106316e2598d591a708c0e88c0304bfd
SHA51278c78d998f81dd281edbc0bd0f5da9a3cf3c1bb8587d837b486bd3170f1262048b656668ad37bc298bef7ab84862d6f26db31aeb4d2adb2281b87e2f6282dfbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD574eb57da3fb474d1e678a29711b4cdc2
SHA1cccd457b80dd2c6eddbb45a3f1ea952071ec3f99
SHA25600e1c1f22288cf65140b1a76b58fc2ba0bc09cfbcb1997d6abfe41305ea47420
SHA5125fb3e0d5ba4800295fac4651718a27274da8315504f69d3443274449bf99555075d0eeba0a8475405434342bc9be6448f9cf6e7584c106679355bf21952cef1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f2b90cfec1475c47bc64ae23630243dc
SHA1f0160d22d5232937ff32e5728beac579ca8e5816
SHA256a22d2e81b5753f6a7e4fb9320f9a4a7d15cf5702d51f2a8a078734944c567c4a
SHA5126f5e170945fc11fecf078255f589ad1bc23fe67b7c29d448a9b9f51efa4a0db141d01f64b0541cf6527b08f67e457ce1fa6a735a4e72274ddf20606fb635cb6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5058fa78bb4bca3421f96092c29e43c9d
SHA1a25b1562e9078bf0ff1843c9b5801db7f3a52536
SHA256b38331db743b34646dd2ea860b5a70908ca9518ce52d5ec38c1d89e48221d438
SHA51281315362cbc7175d7dded8c3243263075fbbbe27dd20f4a818363d036c5e3f79c040c702243be16892858c84f3b64d9f6f94dfe38bfb81e687aff18ebe241109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5897fdc8bdb1fcbae393ab34013e8bfb6
SHA1356d7b61883898461bee9a680901b9370ccb5190
SHA25644580a4a20528b87fe2045164030016f50564423ec85c7ef8b0325d30824a03f
SHA512d4891bcbe09434717858dd822a0c1208dc99694f16015fa9f8f6e4c37a62fbcfaed0974fb077b0f949a0d1a23dd0e2071543813f1c8ab979018149ad72508832
-
C:\Users\Admin\AppData\Local\Temp\Cab28D7.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab29B3.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar29C8.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a