Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
65cb9bcd9c20d12d2b449c4e9c6793a6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65cb9bcd9c20d12d2b449c4e9c6793a6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65cb9bcd9c20d12d2b449c4e9c6793a6_JaffaCakes118.html
-
Size
75KB
-
MD5
65cb9bcd9c20d12d2b449c4e9c6793a6
-
SHA1
0d1540224506432ca4444d3ed5d33343c65c4490
-
SHA256
9d9cb1e4a3fe9d118f0bd454d0f639c7bca10030aa3969e4d6e6a908e2110114
-
SHA512
4ab5477e23b9d3a3bc8d405715704c289b6c1fad5b1fc35165327fa170c2d4eb6092a8cefb353e1e24c7275ff48156110bfbcbc2a51627a177b22784d4a1b5a5
-
SSDEEP
768:JivegcMiR3sI2PDDnX0g6s564G7oolKSzoTyS1wCZkoTyMdtbBnfBgN8/lboi2hX:JC/olKSMTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509025" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c0db63d5847504aa1e8518a94a3ebd000000000020000000000106600000001000020000000c9220b82a872f94f121483355c0b537e03dc26976e5a2c7af791f50d2b12f204000000000e800000000200002000000057f577c6defcaf27ff46a8b9848580eefd70e2a6a1525215b56bc3830686c43990000000bd685ca50275fe8450e6d5e434d765575f67fcc339372889171244ef67257abfbd3e6949375856fd180105ba863e057b47b2b616aeaeff0674ac8dba19e36f9aae78cba50531a0ec85dba9b5db41ca3c93630725866b5c4c3bd7f85e6db094a4b53d7a2adade1d64a2fa1f29d9dcfff97a97e4a70c89875fed06c15a904771b70b4cccf1b59e239cbd73b698fa285aa140000000e88f257a55c2526d83bd05fc9f612ec2b16435031aed8dd85a4957b42767c1f271617c9e3923150442aaae1723701bf025b34960e6cce14d8da15da2c4d47733 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c0db63d5847504aa1e8518a94a3ebd0000000000200000000001066000000010000200000001cdf5d2c434e810ccd0d4d5bef592cb85b83e7cff8a905632c0cfc9d5374b950000000000e8000000002000020000000a54b69597307205bd304e265f48f7736717dbe3eab628dcffd7bfb63e057beac20000000eb7ff9d7552d202b35b9fc18effa95aaec3fa34fd3bbe09d7f83d92682a426cc4000000053c9ece37fe3331eaa1405120be3b7866155e43b6f63935db0c427a8636f59363f84bdb5d82dca03f82cca66a48dfb1a5c59816b01d1744a2e08ddcd1fab7550 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32BDFC91-17E8-11EF-82E1-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10946d07f5abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2168 iexplore.exe 2168 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2168 wrote to memory of 2508 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2508 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2508 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2508 2168 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65cb9bcd9c20d12d2b449c4e9c6793a6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5125d3a274df622705d54386e67b8cafe
SHA1db4946ec72af603cf3bccee04c316f74fb69aac7
SHA2564da60d7c3395ba171da089396fb32de40bcd03a76b02209f7a4dce92417104f8
SHA512baa2d7027100a9b4ce0757d223206198fcca3a309c434a95618e5866f68d41ab8782334df4655d993b71ef9c1ae02f1fd6fcf93638638b70b437387b0a741086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f4c6a6beaf1731a2ac6d7dfbec516b9
SHA15f4763503d82a1e42f30fbe5e7b1171050f2d5ba
SHA25649827ece59fc61ae94f397a70c1d1078b017356e78358c1fc1e2bcc3487ec788
SHA512c3395b537e2a1f9681a1ec4fbacca795b9dbbee9af0933457a0ad57c4eb2267a1c6e7f8c7e165b3f5f22cbe51c793f9bc30eede92b369ec61b4bc645ad5941b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567ce6347ee0867854a92bb0ee23e6c5e
SHA124deb274bec6dc9fbf316de9ad2b9e39bfdedd3d
SHA25698daeb31599f3578b53a388dd9e0408103f235c459c9a74f6aed0d6f1cd9a38c
SHA5124aee1183a6ad7b3a4c28f8c050f8df0539ff36e2920ac92f60880d14cb837d4e4b9867e92968c684bfebb728faf9d54fd36ba8bfb1f2909a9a02432b1fa94b6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a180354930e788e1daa4468a0259761c
SHA1e59545e74ceb6754b726bd0528ef05bdf19f0ec5
SHA25688a91741d27d2b3f93c058e0717431841a96447ac378ffc889cd27aed85d115a
SHA5123214a9d87ecb7913ccb3d9983df6399761b642267be50a3ef5eacebeef32ad88cf29da76ec4131da80c21e1085430f5a03304aaeb5e6600410e359886531a285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b2157192799ea65978c0dc79bd33910
SHA147e27492cfa8b042252298e931f7bc2d6960e837
SHA256e0c7f4908197cce8220d8af4ee447781c9928851bb0482c642f607e0f3b9aa97
SHA512d9b0e506f4e439adc7dcc74a8025ee784f847c64ee4f128e4251d802f655563d94bec24df3506e3e135f694965435d8fa813bfe5c53a569ce8755a2924184c7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7eb431e879dcda37f12cb35714eea19
SHA184c6f3f7cce7868b46950d13823a19689d06af14
SHA256614830b2d072e9d82017aab4e7121514d0746762c366a1570ef6be0541888961
SHA51226fc87e66dbdbf5c7f08184beb039f0a022d9eb9795978f13fc81835e0066be3f41b95f8232fe4a5fc1a9a974068034807275ed6ef89b05967345af5365e67fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508412ce219c35e08b03f70e7bab5e5be
SHA1e7e4caf8dd2e702035f48f300e11eb575fe16cb3
SHA2568d2f8ab32e006634d350f550539c9e156d921e8668270a8c85bf23afc9676ea3
SHA512bdb0eaa8fcfaa98c046a3ce2dc55f208dc5fadb85e9517ccc84c5e27675ea0345aea4e8b556897b050af82c5f84a0eec0ad8a605e0f38171017cf6128f273bd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5701dc1f8322bcc7a0196c95e2893d0ba
SHA1f3b4e090dd975fa3f0019e85905c5d49984feabf
SHA256de9a68b8a0cf98d307d64330c621e311c464bc8edfcf1601f1dea3dd68191c3a
SHA5120323ee4fea68a2f40e56040200faf36ae670e355a85114a71ee6af6c4d77aaef352035be6d986087e251bafe59b8dac165f185b5b6354b92ea5799fb83be8534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5684941c3319ca065a483860b36fea3b8
SHA141881d367bfe758edc7873b0978609db0fad0df0
SHA25658a9152c06f74f272246525398897f7d194fc162771ff776077f005c84605ff3
SHA5121d8999756fc4f570c67e13a34027a85f7538b72010fb2bb8a605a103322877692d6a0e3f1ef2d52076362160127be6300ddc8c9a9d81bb6cb792770c76163350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e90aa38681258f97c47ad6c3cacccff9
SHA1b1dfa4b9147df7f672c3daf4b11615912d4d75c4
SHA256a184d148f4c50ae19c7e48343121eef5efe91c029a24e13db948f189fef4acc1
SHA5122289521de958e9a1915d8484973481dd3b96a8d69e27f2f1c6825e2dfee4c24952819113d31fecfa38c0bc2580f9e5b62fe5a012d24dde59514ba4e5099b3297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507717ef02f5cda5254f5a5d356173d89
SHA1b3a3b5971c54a6d5ab9b954dcbc17520975027ba
SHA2568dc986e907a7fc501695831aac710cf998b056d5cc1de0cfb35b42ee99408e42
SHA5124f14a649725a9edea4abd8ccfa03ce701cfe3292d2b7c1a4bb3406feaab3c507b1d5557f5a81a1acfd159cf73d3c33dc4cf09b41cc968c957424f78fd8e22192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514a1265b17f5828b7a551b447692db0d
SHA179e3d1186db398ef13c25dd717a0fa9cc0c86c66
SHA25642214b529379c41b3244291120d812710714957c59255c6f940c649f426b57e9
SHA51264ff139c5c1a2519a53d026edcb8feeb8960ee3c6a25b120b8bec6e1563df67199a8f4357aed94d9277292c9bd45e6c8b611f10894f852d1f77baa4889fb0884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de6b2a7b0ba459b2c8665616fd6eb2c0
SHA166d391828a413c0b88117bbc76a827c613c382d0
SHA2566674277d7f0b8c4f97ed68c983bf68ffaa78f4a04b48ce02d5e65e0f0516a2ac
SHA512fe0803a819e71563ebde19e7df6cbb1bcc8e9d826a259839020bff1389ab1edc4078dca9b2686745dfbec67effef007885ad7836213f2fb02edaa42a822d6883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570db22304f170871e45a71d415508949
SHA1cbf4898fc02225fadc3d6de658df480e7f7ac5bb
SHA2568c68fc377bb24d1f8e3369bdc0e91fc4e036daf7f9c9140f29c297cef01958c0
SHA512e2967d3097d48f8f553f43255fd371db879159aad728e50653b838f58789be017d69c572bd93a9682956731902be2d6e81af8c0c30d2a9f1f9e5b4224029ab53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2e1b922bada120f17dd11dc70b7816b
SHA161078f3f21eaeddd66ec48f895f8af6363b0b85e
SHA256f4cbec069631bc6fe789f6fb4678416bfd9c5d31c750af7873f63b09566900ea
SHA51270eff179cb9df708c32d51fa0813285eecbf8efefe487f08bcd6f2257850edd376875a03479464c875090284ec07c620f96a848f9bf5e1934735f14717c0ff31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545a542e3dd114aff0b4dfaf9d099d86a
SHA127ba8fce8849f8feea05f5278a6d5fd819d73362
SHA256633cd012929eaf5d5cfdadfbd773b69bd15087c9010d3c82c8191e1e0c50210d
SHA5124e61a58b7a481a296829abc7af0adb011d9d20396881b5c74e46e83cbef0bf8777ed481fca4918f13c4e775dbb2dbb925a1b8cba5c81ffb777925758f4920660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a195207a715d4fadf83f409a6a7c8a2
SHA1fa74066c9f05343ddc1b9155d9c9f3997267fa28
SHA25666f4a3c1556e17feab11998bbe110e22bbddef0dbbbfff31827f366b02552023
SHA512d8b4da60668d4464e545ec2c461b1760f6ead4acbc435d0ebb6b6a4bf0d9248816c5616b934b574d993e0e04dfe29ed320741688c2fb3768c772c3533ef816ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a