Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
65c41a0f11d7ca5f9ae185d629acc5dd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65c41a0f11d7ca5f9ae185d629acc5dd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65c41a0f11d7ca5f9ae185d629acc5dd_JaffaCakes118.html
-
Size
213KB
-
MD5
65c41a0f11d7ca5f9ae185d629acc5dd
-
SHA1
cd870aa4707fe58beae9c563baf51a8c6eb5c4c3
-
SHA256
7113d4b9ed04ee0630754d915af4eccc6632d3f2540d6da4898286e1b94f9031
-
SHA512
ad2995630401b4929d858e218bda5ff41dcc020da9ac7f1bad695287ea9b88b13ac1e52f25541dfd22fe73c1f272b87ea61426c4d228db82dd4e59b495d05027
-
SSDEEP
3072:SlMKYpnCr5CRyfkMY+BES09JXAnyrZalI+YQ:SGx3UsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E7A97B1-17E6-11EF-9201-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422508343" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1540 iexplore.exe 1540 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1540 wrote to memory of 2940 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2940 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2940 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2940 1540 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65c41a0f11d7ca5f9ae185d629acc5dd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507704464ca59ec812aaf166e28eab707
SHA17ece253007e358f402608aa5c902bcee6cb90152
SHA25645d384eca1ea329db189ff1aa7aba8b345cd4f0d9d9688b556f94960be5a1181
SHA51295e67c68126aaaeb751933091708222c7ac96c8d16ad4440f5102910e4be3ce5531fd964722c283cce3c5a41ac7786df95a5b84750a014b1f744f0fa79a9df13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a199506c88e4bf4a3bc00de079c8db7e
SHA1cc69861fa0ecaa2d161d699841b4998afb37bd22
SHA256f3c3490d220163d48e26648d6b76411134509ee86ee1aa64508f569f8c000e0c
SHA512fdc4e8123fa9698da705ee81b98fd78a0ab6cd9fb045e24e4de754f1b2a6c44303a899f7e0a1dbd27101d6252845f81de82dc8dac1f48cba8888da53bec0f583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540c25cc9da45c166b4175d0a7d474ab7
SHA192c3c66cdb17ffafaccc081fc73035c7848779d3
SHA256e80abaac3f8a86cf2f7e037c44ddbae91978a5c30cfed51d7115dcc09ea1bc62
SHA512f720dcdc0144ef47915fc8d8e517f2402f9f6c5fc2affa3c8e880b37c51fc404a08082f6f19e7b029a4c236130518dd61f232d5137af5e58f41b10023fdc0d82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fda77aa6d0afe42208abc450d305c1f
SHA190b01f137481f5b1c4e43841d856135ddf3e0d71
SHA25699fcfef2046acdeff1c252bf1b0de53f8fdd441100998fe65d262265c39cdb5e
SHA5123243166063b2edd6113950c7f7eaebec42340fc29f369c514dea7e2c4486a315cf06bd866dccebce6eb5c9506b92a208496decbe0c6c90961c08489b696e5c7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c548f7ba3c51294f5f1e60e1e191ae34
SHA184bd9aab888ade790d56b87a4aaf6e5087c864b1
SHA25691ca75e724802d7484f47195194e2a4af7e06f19483a537fe448155f800e2d26
SHA512602bf7be4dbdf22d7f083f71826401f5c2ceed0bb79680fcae67fbd629a2bc0ac0b4ec2967beffa21fd350b98f1e5be747214d0f9d1bb0ed87e7922ee25bdf17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59009b2d4d5d09eb3ca713a20dfe6d18d
SHA159f75edc9e5921939bb82a95dc5355c2a0fa950c
SHA2565d8def0d54b87fbc07580c021aa42f415fd1984da7f8d09c83cf2385a056c324
SHA5124982db08fc9a90524874200276a604eb47128c25f1a6dde43b6b0f6f45accc2bdb18ecd9cd841e5ace0776388d1305f3c36cf307502780d294433277fceb5b8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad0b1b935264030f927fcc87a4b2bc1b
SHA1402cd9ca03712214da65c7ddb8d77ca2dce585e1
SHA25634664c7c1d2929a04f6661682387127426caf4b9b63230e0eb3198365839faa3
SHA512e2afc0250ef780cc8be687e52f0b246fe64cb481f426ca52a1efea8e4978dca5637f6501733a6ccd7739dee6e2514bcd51615faf4d2ba19bc2be746ee969be6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5306d946877b080bb4cbf1d4636d6fe
SHA121eba6d4fe27796c1de5f23ad187aac6139218e9
SHA256ce7a2cccfbaca02bbbb5e6029c47f094fb7be6d31adaf25b2580c2b8c8e52a7e
SHA51295f74e30fac69a5081fb9d219bac1901b13b4ff147c6f19d88c0e0e6e0f835e27b9fdf04360ac317613cf47d8a6f804726cb436d12c3087022b0752e195a6920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d26b508441df4edb4d0f71e4cfcaf624
SHA17fb3dffdbe32ce1fb5bbc4f6f6531ad168f552f7
SHA25696fe37f50f3c305051d4103c8f9d5fb54b46f3f18b2dda15c01f9ba1ceda4699
SHA51212f2c8c270c509ff38e8d71bfd01190076fba532574620ac160577d227d0121f8a6c2938685912c0f06639698db31ca88ca6576f555e9ce84395a1c12172d03b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1ede17cf90db8ec0f378c5cb5e81d22
SHA160ae1a838ed284ad0a2ef828edf1182b0378f84f
SHA2561beaa8d6383f099700a1df395d5fcfb19482aba0c056a90169ed0f1fac88c3e6
SHA51214e14bf18670e88232888edaa0e372bd4c5b729008b25ed08708d9fde273db5dbb54f3a613730f62a07a05455c71cb79d538db4c236d3e859fcf850471066e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577f9c439acb519b3a444e57662a6689b
SHA1d837aed99452c905782d925a70ec540117e2311e
SHA25611b15d1d47d49b8ca53af4d6da5d55e1e2bfad0a0d04b7068512f9973a085d13
SHA512b1ba9b8374623887f5aa50b0fccc43c911ee25231cbf6f8274900033ef54bd2d49f03a3847bd56d4d38736a0651d90e4327a9f542531ebbfe92c6aca74b3744d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbe6015bc7c271aaf35589d1e0698fc6
SHA1c4dda132719c9b81b48b12b80d669eed6b5b1038
SHA2566def1be73c266bb3f7bd970c74e6141a551d3859ff38eec7af232b326a3bbd57
SHA5126a133988b2bcc1848637c9b11ac7ba38e3e3746428d644149274a0253557aa42bd2e4fb26d7abf8179054d8c5dc60b7abd76fae7d6ebcd3e29090d59534221f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533fb3ec88cadb4a8c33da58f5aaa13ab
SHA17731bcd4ed91e0d0ea06f16acc5827af3d385122
SHA256ef1b7aa8dfd94531aa7ca09ee660227e5d1d4de93bb66b05c240f33841467945
SHA512691be8b4784932ba7d0ebb3f4134f7221cb0e7179a698a9a7de5e6608ccbf139ab530ac927e6c03800cdbc659941a29f4f9822128dc3693aff69fc5515f74dde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efa153e57da0060a389fbae1c83f4195
SHA14ccc32bf8b0a9c4940c72dc98b39e9f491f41114
SHA256063da41017379cd6ebc3bebea32d48f15fa7a35ab2d9369d1bc97a45ba1206b1
SHA512e85a168e04dd121bdfaff65916bc1a1dbf30f3658e440347c6c27ad577b977b6ece521eb662cd86ecb8d8b9a31cb39f5d4e927f1259dfd5225b068a62ffba05d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f44a60a3a20bf228c5561545214513e
SHA1204c7f76d5e0c08c0dccf74034509ba082d5532f
SHA2561c2bed65bd965577f51fdd8821f0a143b0a524ff53615717d2e8e4567d526baa
SHA5124ce9ebda4922a4a8e378d6c9340821b8e637a2b7aa7dcb02beec86a251115bb9a4df9506792be118bf010ca352f207cdc5db28327512dfd5e5002e5d2b21c3ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d637050f1ca318fb600976327b421a0
SHA13314584545637426688db57a53457ba557fd7fe4
SHA25642fe8260df3d19df35c58ca59533520ed3e0c0ceceb823e8ed166e1707df08cf
SHA512d33367f555c3765e562c9257303dfe6217426d36b23e082ec61c10b94cae81b808bddd57ca8177c8e3a1ca81951390ffe277a9ec4b1b0cdd0b39cbcbf72defb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513bb62bb9f50e92cb69878842b760460
SHA19abd3cd58e2278a8795db0a833a37851a62c2109
SHA256a25ad2a5388e3ee7e430fcbc4cc8ea987afc25b1419c9e68222f744a9617b167
SHA5124876898f5222eb55e3a8ec3f06e6114c764ae39ec8fca2b9c5a150616efdb6d82dda230c6050b70da4aba2067badc8cddf6fcc9ddf6c0fa0b67c431dddd6d237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5992e31f18c1e661fd0ecb3bc9a1e73
SHA1396a54569dc028f126dbb350102a29a13177d18a
SHA2565e2ce298ca18a5b3ef9a4158fb55f1372f69a7956fdf7aeec0655491c16a2907
SHA512e1e85656e07b8a202f0f1147a07f453429969fdd90fa22e8a9ff04edb9f46b9d0ec6bb4c696338836b1a02b8635ed057335f47c0c06ec5c7781ac5ad17f6eec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52eb302667967795116d4605725759e33
SHA11a2b2874dedffc7b9ffb197e06e283d01273ed76
SHA256296b8b615d12b3b35953980d130f9d162ff9636eea0b659cba5db7c5804bd745
SHA512d6ebf07584cee2cb665ff96183359a0bb7cc636c7f52f3f3f467dbb375bd78f77c7b8fa0aa10b7e25357f424cb4c72307aa7c348261a02360ec2e2f06b09378f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e33d8ad3801855af3923853f35e88c80
SHA1130bca23c5278bb95bbb00a86beea6cf848ca384
SHA256b6e19aa7737be3b7026db40690ce3e72dd1fee3e460f9a5268c7b290cc1d0917
SHA512ee56fa04893771731b78a4d2ef72a408faee7f79db61ee10616beebefa96666b5f0fcf8df7c12ec1207755c59fe2683739e0d7a6c74578f595cd1788ee23600c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a