Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
65e243b3b54c2ef2558cf883a2394972_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65e243b3b54c2ef2558cf883a2394972_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65e243b3b54c2ef2558cf883a2394972_JaffaCakes118.html
-
Size
72KB
-
MD5
65e243b3b54c2ef2558cf883a2394972
-
SHA1
f02d52287021cfada92e6964c84b25e75f62a3d4
-
SHA256
dd22309711cada248884e79ab0eded060206a05c0e182575f9ee205f6ca47906
-
SHA512
946981ec5a316e04c931e994b500351b6eda39d2a6f51f4e8d597a4bb992bb80bed697b9f233b734f8bdf7be7bee311774a960af31782c5095c37fa796699d81
-
SSDEEP
768:JiQgcMYRdsI+mInDD5BLd0gGeztq7IxoT2jwC2aZZGMdtbBnfBgN8/lboethcRTd:JyoT42F0tbrga9nhc8nhVW
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ee7df8f9abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422511142" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{239424B1-17ED-11EF-8303-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae15280000000002000000000010660000000100002000000049cec2f8b5dc1e1bef6b16d06c3326df46fef04eb56587350a63c25f02dffe71000000000e80000000020000200000007a838ab1c30ddaa07ece45f56eef5f5252cb62c40bad0810a2453fe9f34ef39790000000322e9736ec6b0a27f24bb83659fd8fad4e4ad554983e53ded53dd8db130959ad96037184489f12c541aa652ca142bf547c76a5d13ec11887e6036a121827caefdd0ff44cefa6b01a93c6afc6d987b561f9807b34a776ed955aac6e5c1ff81e4e67c491006ead5682d3c84134964a19a379c7f2a8f84f0c64e55d46014079832fa5b5e83a0d0b022c66e7ca5eee98f7a4400000005a559bf9db2a9bbd32c4a64f492c9c42c1e647fa6258bf97fa1a1f0fd10f3a6880dee1a7f5dbcb46657ef3e21d0d58b7cf7cc143576450fb2063e0eec276e34c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae152800000000020000000000106600000001000020000000d67aa8472b39f55e68ac2343fbd8a27d888c7cb82e2778c78c8c3ee2dc1b116a000000000e80000000020000200000000a77653d3036221d3577c8215a345c07022e8f481b139ea3edca7df29a1b9eb120000000c95f0dc5eaf63c4fcbb777b8e8433176455795fcb8a08e77245ee913451f08b34000000044e4b1dcc6423a8923bc426d78ca77ed64d67e9b58047ee9e1abaeb981e7a918efdbeeff6d35b2f52263f4ad2eeaedb53ce27fecfc874f601d61c2d86b80c5e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1948 iexplore.exe 1948 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1948 wrote to memory of 2336 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 2336 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 2336 1948 iexplore.exe IEXPLORE.EXE PID 1948 wrote to memory of 2336 1948 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e243b3b54c2ef2558cf883a2394972_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5192a69c50bf1c9f1b19c336f8af880fd
SHA1e54ff2488b41a5d0896dbbad38d9181889023748
SHA25689e4afb415c177754f9ad4344bc9612a2229a1186340396bbeb44c7bac66c270
SHA512c900f55090e87b87a8ced9b7f036e45933d655d2cea15cf5fa05428a3263b17e1f150fbd5fdbc5542714f784a016dc90b4b3c3ab055e915d0d2b81950982c7f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5741ba0874a9a82a56474f3b9a5ad4fc7
SHA12780d1fa966e61fe7d41bc4eac023998a8359779
SHA2563d284cfd929ebc7ab870a7524c12b6b3b22aa4a2638a6d6b9b089eeb86a054e0
SHA5124939442d1cc79364b6968972044929f3a49df660969b85d7c7f24e3a930283ef072c9857e7297448d4f8294e1767f55d980aa759be8c95ec38fe0bf320e84a64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56273ab5c8da6ecd83468eb05b230be13
SHA11ed81fccb3d0f258e66b6bad12d98833da459acb
SHA25663441fee93959715b9bcb23a00e90cd02c7ed98ce08a04c7b29859585ba20949
SHA5121b16f7c5a88e59354e1cd7f39de09593891749e9eebff817f25bc712b1f5fea00406942ba7822a64810e0c20d6519c4ad73e1e0cb7f9ede8995ac35f02c99407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57b3a1738de50b93732e6acd6cc9b07f6
SHA10ee327600f8922b7a357db44c043643008138e49
SHA256dede452a8e7fb93b0767410283697ee3781caff348107f61cd8a92f25f13e10e
SHA51211dcb234b46fa312d2b5a708249e2acdb77e33f3a1c3c1671ffed93e189e5955400f613338d4395e98d761b0878844137f6d7c946a3a674ad998334fbdc20aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5706a79d88778402396062cdddcb5930f
SHA1dff92c0a55ef9efb2aa90331233c522ec20bdbd3
SHA256e45d86fe3e20672f5468191b71f54137675a7fb79b226a529fac35d3b88a68cb
SHA512a9d66be14c31bd4a4b8e03c0f0aec6147d4b64cfc4ea3c70b216e55e89421a8b33fe5d338d81b9d08ab46ba36f8a5b9613ec7f20b76630d2fb684a10335f9a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d94e91691d01d3278e9e7fc00ae2404a
SHA1b936790cf7b2d959c59dc8c3dd3b9720f23e0d75
SHA2563e29e93a8c4785f2bee2de3bcba53c265b63151fe5cf8234ad2c6a9ea306d1f2
SHA512f6fdfe991493fca6a67346816abddf08aa022554fe57dbce6da60724fabe939fe0bff6701373b4e7933ee79d0bc36903c7d58802042286211ae0398b4f3cd6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD511a3bb3701b98ea3af026e912086834a
SHA1203feb7710bba049e9436297dd38e4dd8e76a805
SHA256f1256a26a3eddc2671572358ab70db149f9a4d17664e56ebd074b5a4297be7c0
SHA5129c716ff80409d783c875637318a4fe3015179bd37256ecbd52de3934cc9ee82adb4b68a7ffa9b549b3e1c9efa276bdf30d6437b2c4c1ce2deed44718e09c7b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD546240e44054d25665995d1dc15385f42
SHA1cddd5dc98bd018cf935215f2a91da5c4905a3f49
SHA256f01a4a2e02bbf436118e5e81abadba5b4f63a9f7ad5df3330e74529727816c8e
SHA512b5842d6e218e4eaf5888e063a881e5c5e1e4f83a6f99ffe3e270fcce3c2a2e949ae11a6e66e79c49874b89f50ff63b61f82c8b701ccae46a676f0a3f298ad55b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d00c0d2e4a386872edb0aa86922b8d4f
SHA1a635a0c5263ea03a50553951a43d4a53c04580b3
SHA256a570d9d25fcd8545e89e192a74231f59a7d9fd0b946962773964e8bf06c16c5d
SHA5123051cfc5fd5305a203f3039ab932f0c15fed2aad12faa33d765d90a9b706c135a2eb35e0bbb7bf6340f1c6c175e997ecac7bb6a3108f84701a5e820df5e75ce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5581cd3343008d89489eb05bcb1e3cda4
SHA1e90d028b022c59722cbe6053da7e11d178a0bef4
SHA256b313d3996c4a5ab62fbdc5bce363a869619fcd418f4d6f56245b58b2ffad70f3
SHA512a0913635fa236bfa3e68d4007ee984ab9111ab779f819ec817687b0fd4341242234d514d13154b5d341d0502cfeee2f099e087663ca7825694da7ef220e9baa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b0e528e78a29b8cb252862407e11af06
SHA1223666ded22c7c1e3f1dd9b42e87d9b873bdb16d
SHA25641ca98e625dc6a27ba2bde73512b30704d8b8a82badcb19c891f2a409f84a586
SHA51234643755f64184bc1558bff94bc633146d862b90e3ff5fe99645750b80169c3f783719fbb867782194a4defc38793ea3aa631a1df75fb502f06ff93d2e996805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d1657327790e657a33823d3ad7eee998
SHA1fa54f35fda4e6177bbe90e61f100244d1189de2d
SHA2568257fe935baf99dd03067fdd518858e828a69fd665974ddf01baed7d4ec336a5
SHA51260e1d247c4b6cb79478c6c0d6a26091641af388dcb39982b836b677ea903d3e83c9c53060ceb767ad6596eff9aef81650a42869f79bdb0e0718f87e216c4c262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e850115754e29e0107e34b1fdd748929
SHA18020886062ca1277cdd0aefb0b38d9fcbff1b486
SHA256c3ccfbd0964a4b13a4ccece079e7501bec33ce74d7c5bd9193909497bb19940f
SHA51239d661664422d6e9d0b79a6888d61898c133e7c5c7113251869e80b7569ddcd1bf794f6623933d676c9468fcb8eef2faaad5d3cf6a9705d2ebf4ddc8ad404c78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a058fe904798887183445560e023561c
SHA16423245e9d63a8101475d78f2174206c177ed0d0
SHA2560ee6a496e1099916d8831a3fde7765d4cb0bd9e17110b8e2f0d7d235593f3fc1
SHA512bf41d51ef213b95b682d0831bb0250006422927988872e5ee46f3ced2278a1cba7b95ebb312a4e2e2b4a5cb1db2d4eed9a12b2cac22c0ef4d63fce3580aa4ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aac59a62d22aa2b85fb0c2dfb1c4315f
SHA1121fa87f2ff67def860ac9eb00c214eb40dcdd80
SHA256057ffbb723560a2b9ef040508fb1973e49d784343d56fbb72942c2d02b23ce78
SHA512f00af952e7db6aa81916a6cba72d97c74016de766286706cae9b4d2d008e2f53179deaa6df0240ea3e5532b90dfeba4ef13fa60c270208915646479cb6083464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD524754904ac75724ca092c3e24f3eafb7
SHA1d859e227c3e23fff103331412b442bcfd69c9fc2
SHA256d7934e97e75d37bff8e446660acd83d4a1de367dadbb55176cddcc9b2abc4ac9
SHA51209c3c06fb1b1e2095d534ca4902ad3c592b0ddec648ee5ef0ac6cd29d9aa8fe386665e718e87e65de58d3a520a6e5ddb48743ca28fd26f225ee84ab9eee630db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a