Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
65e3a23ef6e85a8532042535f0916f58_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65e3a23ef6e85a8532042535f0916f58_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65e3a23ef6e85a8532042535f0916f58_JaffaCakes118.html
-
Size
30KB
-
MD5
65e3a23ef6e85a8532042535f0916f58
-
SHA1
628e7a54900ca7bfbe24784571abc9c9c9b8da44
-
SHA256
a48a6c520c364562827ecf03b3f2f624bfe1706418f8c7b9a88359662181ea73
-
SHA512
a42bfadea2f0cf755afdbf55c4d683f733b1af7ac2dca437be3abf1fd61365d373aa1ab20738c398501ae17b83120169b0f56f127cac55042849e86fce3efb3a
-
SSDEEP
384:Y0/eaJ5TcNM/u8dPbKBXemRum0BvPMwsy6I2aCHak5U3ETzZ5EncWSgCk0M:Y02azTcNUBb4m5jAHavCzZ5En/TCk0M
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73751661-17ED-11EF-9966-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6821153f82d5c4fa67532df8f852b73000000000200000000001066000000010000200000005e76aec1b52dd0e2e84b00b6dc1c3f521894438d09d58c70932a8fb7d2b2a92a000000000e800000000200002000000001c27ac09350e57e1c5fc8ac44ebcbd79f8c77d7110c262a3bbb756d627f9906200000001d99eaf9eff71fdc09b43e3d3eb9c6d14f68e9d27c30c9dbb645a9e08a82cd88400000000538d70bd2a5662a90b7790b7ac2d0e818314f39b2b2d295de77f715d35128b8239fdb4aa04d607199241b9ba2883bf3fc16c3a523aee36d8f6301cbf8aea460 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6821153f82d5c4fa67532df8f852b73000000000200000000001066000000010000200000006bbc01753553ddfbf13fa403afc82658675e5b253a54509e1d7ffdfa721a72cd000000000e8000000002000020000000d684caf6bab2c1b499be2a115af25c651a6734bb099d88883c6942c59fcdaaa49000000008ac9b34a9990ebf3dc1415fff1bc3b4f2e8b605f0306e08b83cc9ddcc3647bac1bc2a6b38f22782c2fa1188da8ce3c6d24bd43f3a14aff84ac8d0b2d304d0c95b2375a61022c91db831dc0f2d8ca1c3e528bd313c0e04ecb9013e447165a255fe551901c9e9af294c7a046255921302ad2b1dfc71b3fe600c31ea39013d3e44febeb37d3b90bbf3358f62281974b205400000001ce41ab7e0665cf666a4fca2c5a529bc32fe2b2ffb84ffb257c9ce965c2263a69ada7c41ea17a5b6ad31a89ea0a99b2dc11f8f60e7fd2da964692a13b5bba365 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fb9a4cfaabda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422511276" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2164 iexplore.exe 2164 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2164 wrote to memory of 2528 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 2528 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 2528 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 2528 2164 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65e3a23ef6e85a8532042535f0916f58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f402baffd0c2013d8df1745feeeb50af
SHA13b912cb2a8bedc8c0e12ed80af2fb806aae0619c
SHA256a6db258aca74e4138f3f5f97745b91ea110fba47ca60a399a59729de62a73fdb
SHA512713741a00716985ef46c1a9781ba95bfde3622126933ec0f697483b1f26b6f090b102f2664bdfb69c0ce80c317653e80267b69e91f0d05b1c88ff4084ca417aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5843c7862e892d8e97a93cead02ade954
SHA14d966a5e916d4bb524bb4612261b08e4b06a15ef
SHA25655fabdd0b92ecf82ca91a6f548b70acaca9fa8b8ae97df7119277071bc0fcb27
SHA51299e614ccfeda138fbc90d5ec9dbb9d6eb53581643cb7a61d9a427e70e70d316dc05b837e28ba7062840b24770a27721fc3c33182bce30b8a64835ac018bb8606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f4a7a7f2f45821d7f85a68b8ea5d94c
SHA1837ac915e98c11d6ae1cbf8968313a97f30b3e4a
SHA256eb671f01e6bb2537d72f80331353dbabfa026920391941fa723a7ae07944f83c
SHA512d4c91b14151048874cf652fb0a41d096c3b70d27ab6bb5fd0cc362a33acb7b294b96f56cb1dae385fc410d5b9cc14c2ff14750c8cf14ddfdca97ee309e1dc8cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5429a636714628a08b695697d795d5ba6
SHA14542cf6f48ce6f20900ab014426b3e6748f77ecf
SHA2563b7d35048b21e434d86059169493ba05390b24c3f5d2699042a988707e4d6889
SHA512fa228c46de91a2c0ba0526949df573e648bce254a2d4768ef435b6eea2c258514dc5b2aaf18fbc7f59a535686e572f43ae86dadbb829c9fa804eeb1c482d2e95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfc114b758c7e0a3db2945fa2df8acd7
SHA107702f56e40f0107930f41809f35deabc02bd466
SHA256b27cc17e44df6d374cd3ba603db9b573c03d54258cc50ec41d4bef474b223bc3
SHA5121be33324f3bfc77806275e3dee9c0e14b84c31661ed05cdc4b43dbba1b64faa371757107344d4703232e6cc13a6fbb6a0829bcd9735fba0b2c0b966d0a48ee41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e36a6e9f342e86539c032b9e8c7066d2
SHA1d3137c02ca0af63b2a4a2e9d1e79d411429f09d8
SHA256604461ff7abd882ac44f47114e223462847cbe677abb78b7a6b5ffcceae4b359
SHA5122318a73cfc379f913671fa26cb198e00c97bdc94adeb44d973d9f2f0e499fd502a59e7dfcbcdb7d080186f158d21db8cd8e7410e0f6c1a8f607d4bfa436ab40e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dcaffb0cc7ec942e4e85489b8721cf9
SHA18252704d695c98df6c9a490f2b7eb81b7e87a22c
SHA2560003fc8980999c0b8eebfc47229ca9cceed65729a3a351632f961a3ff1907f83
SHA5122c6ac7f474061e86af432f1c7ea800374ba10ccf8708c4d4f48a9f1ba0e1fea18de5c2f38b0698b613828aac7ea24e22e69eafa59f55068e64d0f327e9409e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5367302c0eef0804b74d1672ffde5cf6f
SHA17bac579b673103256af1ef9ca70305ac66d7bfa3
SHA2569ad319b6c52836e075d1b973f4ca846120b313380a1faa15920d70d00566aa4a
SHA512beefe2403b00ec0d0f94e95475dc9b5d2862bbd73ce9996502d40bd3be9ab63286435544caeb9b430ebe7dbb8b106aa5388f2086a1aa6d14ec470d30773b23a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520eea7d26052cf4f482768e3e3a421e3
SHA153e987e5be9da367e48985939e7dc6823ad33702
SHA256b49e85745d9c542cf926b6b1b10b256f51177f7c129a7b2b490d7152beff65e6
SHA512e12a949fc768a235a655d9011a993ee8c85d5e2835303ce30bae8d380e3af2239e6049dd109000d95ee1b8ea7e10784f1bff29c18736a42535edc301a765f71e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5776558883ad4972ae0bb6333fc99d553
SHA1dd397994dcc2e945c5a1bada041b4dbaa22b2400
SHA256b4b97f469a5e3c71bc8d425f5d8e880b1986e0c211b5d505546d8a71e0f079f7
SHA5121f591e7fba564beae5038125a966eab965f409c063c2c082e034f47a0d0a095fbd9d49072e901d0c37a7feaa76867591aaad195037eb211b02f04c88e86517cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548b59ba358a172245397926484c55d5a
SHA1724bb562e7fd01f7a7dc94abaece9fdfdea1f6c4
SHA256820c085127416cba42021295d091a911b86062a1aea730e3c156f8ba45525c2d
SHA51270abce4d460cb423ac55725df9883013be0fb5a32151244fffa1fba3f8283b1301414b57cf9b4b46da8390521a2ad5e81bc03393b3c181a596c355a647823868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5460d880c95d0498fa41294597d0bb373
SHA1370b0950da0eace7ded440ac985fe33fdc933ce9
SHA256a11e305bd25849b5b4b5ba7b389f652fec674d63958f95952ef073b1c3b0c424
SHA5126769befeb950fa6415dd0d738c55c7d7391ad966d650e95446e9676ca677e50977bd208b9fba225e8dacc770a9bbd7c6f2f9cdb729c61d02c642f9a4c842df3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b77bb7c85c4c4472ccc1ac19c6d123
SHA19976806c0adb3c53f6be0d2c33bade0db7281892
SHA25686acaf66aeaafb49276a60b640922179134af73b22c4ba7d4e7c950200ba6081
SHA5123a30cd7a68df635afb197aa510d14b834935f380699dc9b486edbaf15a6e90248d6a397f1cd49a3aef9b5ba6d1b5cb9418a243472bf021adca73202016cce0cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f063d97b4cdaa9fd89d62a872df903b
SHA173c6b54f4d2942782fce5cb28090cc19207575c0
SHA256de982b620a3db6ac20bb4ee92fe229362a69a06efb3825d206e9648790016b2b
SHA5123ffbb0d57187f4e4637cc51c585a8d6dc1b73aa2df21ee8b6d1fa72d1a113c9685fa13dc040ed172c199cdcd3980f3230bc487b5e0232511194ca33f0bfefe60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555cbe73dbf25ac20a1f766b4d9519710
SHA124a8918fab7fc480bcc7fc581ab04a99120180ee
SHA256d7ad7d283913ee675ff315470ea35e2d1a5721d012b5d4d2a34a02e57beb1f3a
SHA512dcf32cc733ca7451112321ac3567f3e4f9a6e255919f5c408c782340fd7165a9dc7acbac671f37c671d0ab87c7c2f048fa1b217a13e3350afef250bea3239eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb26a459d746d0ade5683f6caeaedda1
SHA1056a59eed30709ee46817c649e37e7d841bd2337
SHA25631af0e78420192ad606dbefa567b9f30a08deb6d674fd5c9ccf0b5d23587f00e
SHA512e95946025bb0e176601e7ddff27223ca0991979c6663ce2f0a4732d6c11df23927a9dad8710ac2c8ea242a545779c7178f6931d9e98f7eb139622d6e695c630d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5773e3c9045833445f3d60f0773e4da1c
SHA16ba89bf28130d67ea5492fb1376af5a91513f894
SHA2567d3652b5c724df3aef11909871571c13c26098f4dc2ce81b91a2d9d4dbb29f0b
SHA512c47f5119ea5000ff6d372b0b2147b99961c9df49e1a7c958fa1fcd7e7919514e57961516bc67d6ab0dd5a507fc7e07b158cfc908a14c08117d5271cf2eccdedf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a