Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:37
Static task
static1
Behavioral task
behavioral1
Sample
65e06a2d9edcad757450278d03015c39_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65e06a2d9edcad757450278d03015c39_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65e06a2d9edcad757450278d03015c39_JaffaCakes118.html
-
Size
139KB
-
MD5
65e06a2d9edcad757450278d03015c39
-
SHA1
f13baf9b0de1be0853e76bf06d8f1f96d61657e6
-
SHA256
560169c5583ec4421d115263f2f2736bb9eb72f28dde1e2552f4e15ae2f68d28
-
SHA512
69e748ac0cd95730342faf6af8f0a4182dfdaeee2c3047cbcc0c7b19ec952b1fc01ac063168efccce2a4ffad3143fdfdb337b492bba00264ead4b116d7bc63a1
-
SSDEEP
1536:S/P2lE7hlJHuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S/FdOyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409aaec2f9abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ac42d5ad302ff46869a59e3cdd17cb9000000000200000000001066000000010000200000009efd3dd892d6c9741df2e22c041fee0d3c68ab6f58f6296b81d8e9ece8bf88d1000000000e8000000002000020000000b59d9e3b346feb0efbe63d9de67c5aa1057b06392b8bc39b21ca48c616b7f89320000000fe35cf956ccfbe44f44e423f53e0bdafe12b606a191cab5f8fd9e8c7d71dd09340000000caac36369d4ebdc695b987bf2ad2f97eb5a222cde8782d134d3f709af1279085fa8b281fc29a22527c7dd9df2e5a724e44cb335e02c851e79a45d603aa84ed9e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ac42d5ad302ff46869a59e3cdd17cb900000000020000000000106600000001000020000000b4dc9bb64e3f1e4a85c2371c5a0fea315718aa286a2db45bd3db1638d4fefe3c000000000e800000000200002000000048498ca54f52dc8cd204f5545413e98475b88855c6349b4f071c8b6a976479f090000000d0fc576b25ba3154b5d9a06b9bd06392a532ef54df2826146a1c47567c1d2aa7502c3b8e5db8f0d02fa331aa2be4646306007de0df6757829214d8282dcc6da18ebbfd92665e38e86b8fe7bade3f793be033be29292d7b3906f5e8a52a77206c18bbd8a647a3e9425120f914ceb3abe7253fdd4ee7f4cea44a1e3b1542a8960d5b4c6edd8dc270d78e1eaae5196ea73040000000c958b706ade32bf33ec9bf7e50a8823afaf6e0b10ad326d81b25763c34fe3854ab42f8777d686d9df4f43f2764205e8f935527a615ae1ab0215603dee3b5ac47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510943" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABC3A871-17EC-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2808 iexplore.exe 2808 iexplore.exe 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2808 wrote to memory of 1392 2808 iexplore.exe IEXPLORE.EXE PID 2808 wrote to memory of 1392 2808 iexplore.exe IEXPLORE.EXE PID 2808 wrote to memory of 1392 2808 iexplore.exe IEXPLORE.EXE PID 2808 wrote to memory of 1392 2808 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e06a2d9edcad757450278d03015c39_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aa0f45c3ad4407196f875b75b97844a
SHA1d2dfc83c87a71d2275fc5ba90010972cd9f18a5c
SHA256721933cc09eb7e6ca6ce75274e8c91cb31595d6b64117242e6df94e8cc17f6b3
SHA512c579618ce34397fe2cfa734dcb8f04f347e58be23c3ea1f308b73ac1535602a16d792c731449a3f616f05358964c5a0b6edc45b1d3c99fdb29672f47e118af88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fc77df9843120035c67661f4fedc253
SHA1c859f09ef943765957fc96a42b0d43af95fe92ce
SHA256f7f250cc8fb64a5b7fde5bbbb50b8b5297be70a6f606a7456314356bfcba0cd4
SHA5124e3f233c04fcccc91421338de569d976546b276a8b474d6d44ef7dbc3b1d6df884dc4e389adc315659d51ce77c0b8fa8a59a3555cfeed47708ce5ae8f50e5c4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f32a84c603ec8eb5f80c1074058d309d
SHA13b4643d8040b6bfc112d1b733f603b9905c2f6ae
SHA256e817adc06c84dd142b0508c732aa67c2c2c24ee7141f67da54a32990410dcdca
SHA512f4e0efd8b80c015391b59f08cbf31648d6ade83a64545251286a922b744564d50bd1ded09b3b90be5a22f27e671f03d512eee7558ed58d695f6a2e19c270e099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c13af20203b9cf4cd7ee1293cf8b5ded
SHA1e9ba7e34fe105681b298b1947f252743417c37c5
SHA256c77ed24d23469867b978f9f49fcafb8d386af7bd60745991062066d47ce7e0c9
SHA512b6f4ffec8e3d879bc7cb028eea1d2fc0e44255525fc28cd95286f4d8b9489af6480ad6eaa2328d7b8ad07825c784cfd3e7152cf051c2325a9c44fd91827d272d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56290c926122290915648461a5a26491a
SHA1fd89f2ed1c68bd79b6c89ce4942fe91af742164e
SHA2569a9941f2eaab24be2b264dfd85961dbd4de98c14879534e993eedca8d8686128
SHA512a9b42fdee573bcb255c2bce793760abd7dfa40d89d6f7a293d7ca27340f9c51bca68716ea0650608a1cf1b8cee23760422a7b7b81c640aaa020b336cdb709bcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5105ae6351258ccf221868291f90f808f
SHA1b3937c506e29604b1258bf49cf82caa1763402e3
SHA256f6907dbc112b975a94804b5a65b2f581475bbb611450bed70a2d9d91f9061f7b
SHA51299363712368e995432a77edb524bf2dcbfdfddef4432da90a95ae07975e2edb4285c90147750f4f32a2a8af74bfad0b6d0ff6fc55aca8f2af5c241fd12fbffdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d066c7b64b4bb6a5ae9d7f7620041d96
SHA1c4ba4b9f1c1bcd76043689c9ddd5db92109631c7
SHA2569cab5f92a339fc06710e4649c8720a07d35c225e90daec14d930ac3c73705a91
SHA512f9625cab2bf7e67c0aef1ccbb539da79cae291c8028027bcec5a81677bf3bee6a183bf60802c902c47c8ad3f9b82939703e842f3e14b921ee20ae5c9a7fd3bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537c74fa06873220b7a2068d00d8fa3dc
SHA18bfc5cd228bd4434553b8fac18cfc681199de6f6
SHA2561e3c8ca5308fa630708382366c86111729708ce66ab1b49b5bc5786c0700e128
SHA5125ef1f5a205e566cb262f7631a506cfa4839956687a20b972a187c3b99026d219443b9f0acd58e53bd9a2a0425b3d87f44e5cb4aa9b7764252bd83edec71c1fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527725aa98facf646456d1239193ed0ab
SHA1e20dceee6edd17a7b9d2a2ef7c15045e300e0fee
SHA256c68d387f2725fbf026782e93dc69f71154a685eb0a1d35e38b7176f3b1c9f3f3
SHA5124f6ccfb5d2d2726898e921cc2b6f5fa51436746b19e07781d7df33706d4b5851626da19fad6e74084d4c970e07e5a50c0addaecca38ea194431978e7d5e4283e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56121d1b04f5fa61d760750f01087ef97
SHA1e1b13d420c30a37129f2336b9ef6bb802510e01d
SHA256d5c9b72a3be58303e73aa0a6da145e531315115d593957ef6f8bfe8c04f9540f
SHA51264304f333698c32d1ebfeb4dfb6932aa2cfc3645327aa69df5e4fb56bf2a9974edceabc473072d1e31a2ae70179db9e5d0d3fb334158a8bd34df7548db590654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ea83ed14b384d5b84f805d8f6d3efb2
SHA1619b5b2558e8945857546bee7efe7cf77b2cb7e7
SHA2569f5f1db9d0c2a927cfa576a3eabf3a8e3396b28e2bbc3c9db101fb110819a093
SHA512ad76058938f2d3903a883cfa6b827ddb035f59243b5a5f7f7606345b91965c000b3b4973a245ae3e3ecbc2c10319bd25c1891acc561736ac218e542e52a7bb1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5173db1a8c0579a20c2276f7646c61851
SHA1d695b44d49a600421d0ccd9039a31ed75901a4d0
SHA256812906e0154656a8f36c1e8ce3d19356a6b22e727d377d3aa227a3bc2b407b15
SHA5123e01eac26742a7d860be2b59a3abb408ed378b995d2019488f9131aaf3ad352f850ad84ac32794f92e56bbd9e828346cdf5c6f59ba581cc049401f88c5148d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f6900492fda347cbbbebd00e20688c9
SHA1a9a910fa33a151eea1a67fff46a0c9b11fa4af90
SHA2562dd486358c1392d3b10f131b57351a53828cee31b5b25e7bb610576f6edd7a72
SHA512434e4755b53b0dde4780d0e13633367a4aa8efa106b12d2ce8b6be761e9084b91962fafb55d8910c609fdeaf145a35e501dd0c8f42202b4b56911a398b94daff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f41f4d3afb25ea77717ae20c3545fea2
SHA19aa1f9d837963a5dcdfd1d350daf33512bba94e6
SHA256318b1cdef55ccd87bd8a8e7e10c684dc054e80f02ad2363311cb9cb704fe3c32
SHA512021e03dd1032b27fb8d8d75a472175f4c63fe15e03eeef0493b832556ddb2243aac980faf38e3dd369ec809dd39307af51e96368340f27227905387c00df9fb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551a3c22e89c71a75c165ed9c85b82463
SHA16b80dfac036dc386dd7cfce47f69f91c673d124f
SHA2567c7ad7e09587a75d7ee221f445a9cab6accb841cead788c6166ce923925d863d
SHA512d34df84e6c3709502dd20cb44540fa01fd9ae30dd0da8329d31f05bd5a0b195a31a74793f899ecc902d448a74ae0ec126efb1daf67bf7ace826596a436295edd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a