Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:21
Static task
static1
Behavioral task
behavioral1
Sample
65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html
-
Size
4KB
-
MD5
65d5d34ba3d2a404aa684ac673549358
-
SHA1
64d4d62ffe7db59dfa199de51cf736dac25dec39
-
SHA256
0e8456f2c2b6832d8684133a175d9dc58b4d1298c20c7c434ae7f596ed4f775d
-
SHA512
0fea69faf39a4de1fc1c17b0693d804c192560f812597908bf146af1473b9b56c246564d89e4b1af2948634a25a6079c665687b804cb27ea13c54ebc20b0b162
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oVOAxd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc61d0af811fef4baea79c05ce837a6f00000000020000000000106600000001000020000000026f261d1f36cb51a79a023ac73c3e5491e5ea28d03606086980272b3a0f20c7000000000e8000000002000020000000c9d0372717129582a9f3c9f185a37e0dd7b4f5ff875cd4f5155c2536d4b2ff4520000000fc6c34d738158cc5d6bca14c59f5fda742afdee8d9f66f514ec98522b27ff9ee400000004cbfd37f14f7cf5158a26ba7a7f7a65e3cb1e3609a2632eca05ef29e6bad042f124c21677337770535fa1f015af3ebf671cff8bb72b907076b17ad8251fc18aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509973" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AC2A531-17EA-11EF-AB41-FA5112F1BCBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f14c3ff7abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc61d0af811fef4baea79c05ce837a6f00000000020000000000106600000001000020000000b688c71e02f84a84b1be332288ecd49b61e3ef2e0b5c38b19e09c59642a1f834000000000e8000000002000020000000c8a667fc5d60e4e95c3689c044b56bd680cb96af11a929887862f047ee12c91890000000faca93f005d973839f14193e4a6a5dc4529317002a759dc7bcad170a9fc89710d77d0c027f1a542b5ac22967f9dd25379669b5380fad764b9735001d21e8b2bdb745e13c03c7ad75d2f9f920d122f4cea922c04f2ecedeac07ee3baec3c4a30b40561ff3ba09801ae87a8de6cc3e3fb8327f65162b8976dd28f17c29f6d11eab199421440a6b10dfa9fb549a9c5b4eea4000000039a07a6210cdebffc32fed1c8fce9437f5c63794b532cbf437f03ded5e3f57dc8ed8e91796686ed3eb6870e002ecf4fef2d9df80514a47bb118993f8e705d131 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2284 iexplore.exe 2284 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2284 wrote to memory of 3024 2284 iexplore.exe IEXPLORE.EXE PID 2284 wrote to memory of 3024 2284 iexplore.exe IEXPLORE.EXE PID 2284 wrote to memory of 3024 2284 iexplore.exe IEXPLORE.EXE PID 2284 wrote to memory of 3024 2284 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc95dc53be0bc0064a6e85d7d30624c2
SHA147322a2f13cf54beaf265f1ccd912768f6dd8aca
SHA256c35c0eb45a0d444c946220baf276068e0db1a141df134e7aa021d80fefb276f2
SHA512ce0de5693d578898121d06cebccb71be0303578696ea854107a744f29c4e65cf501e48f052d50fd407a0bcc4e3735766681feb5e852a75f8a662226fb23d08d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5598884462687c0798bbb8294cf37b15b
SHA18d52ed5dc5eb9a9616b92fe7f3e56de9715fb72a
SHA256d76d2ff707dc35cef3e555bf48a2d1b81d0ff2a58f69f5390a3ae7f5001fbb51
SHA512e4e6112ff5036149e47e295fa1d318fc6645871a322c78faaabef9c53eb6f7b28ec81de940ffd85721530f2350b35eb0308664ec123c58f2790c2a13e82e13d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596d7683d4bd2bac029769ded816e060e
SHA13d56ea0feb74b5f5bd41bb55cf41f660c75a39b9
SHA2569b4762bdb13494bb9cbde9a0f23236b0c63f4ff4f3a1a710c29b91a3ac0fab6d
SHA51221aa39cdd67d4c645c762609894480c4c3847e7467ec9550d1f4a1a65bce6b43834907499b7b2cefe14bd88f390def099edf8acdffecada781b9d7cfde5d32c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505a0602add8cf98bffda05baccff1aad
SHA1badb4162f9141423d9971beda3125d228d8d66f4
SHA256cdf0cfbbe85eb99bc348e0c1325e37e67a6cf1d160e7a3e6f1e1bbb4d489ce7b
SHA5120184c681f3f78a55554cc9f7b48e237a96298db5010a30b2f613337615856c19459ecd475b64198149712b8d24fe78f31ccf17ee7b8925b6c4df0f3b1dc276af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595d6072d031ec24873bb3a034a9f925b
SHA136eb8ecb3a4ec7284752c35423b133bdfead7cad
SHA2561d939634b67bb8c4c86e143664bf22770f3129d0ad8ba7091d3ce36c25f8db29
SHA5121d1db155fa59f7cfe6a37436a72a02c021f9c0c368434389ea9341266f0b7e4f51d4f7fa79b5402abe7faa90549af633f5225324f8c74f3d58687e9568e1f634
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6393b619ceabfa187955ed2563ca4a4
SHA12c4d9b8abff4135dae0ac562a1f5c537c1f1b90d
SHA2560ea08831db55dd9a50d68acbb99e380d10adc5f466eb91d73063f3781a6784d0
SHA512ff1492f43aa4ed73d57042c852702941383f3a0a70b93db99e5396e3270033f8e9646b38c3a841f486513387449cda02da778342768d1adb7ccd67da14b53978
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587a0dde9af967ab87945fecc1d4ef6e3
SHA147e8f24dc6f50a912fabd3fc35688493f22c23f5
SHA2561978e49bdd99aadf8360c571e7149302af51bc91783b7a07944b2c2eada89cac
SHA512bb9662d6db3cdb812dc5d6374af34b23c2c670c3df9daa911c9be988a6188977c1456a87ed740837f09555cc454e69d36ea8ecb1001c16b6011c8a42a9b1336d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57afc639f861cb9f4f58fedf785c48571
SHA1261c63301fa0aab88fad4b9548b7411ba5e5b665
SHA256ac2a94763a2887668cd4314c9b1d530a68246f1a20f74981e07bad5880860b85
SHA512808c4ddfdc35576fb8758f11c6d2a773133c806db3eb737c3d877b3c351be2cd6cbdd7d35e831848db891aeedb97513f08a2011c553fbf55da53bb38febd9db0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c9f7f03d7d91b6605bcda4fd8aa2ba
SHA167ee413de61a7189dfcb3c5cc4606a24e7faf470
SHA256c6f3425a5c9c25fe04a43a896123d2752e95696637442c4f6502a63dc21a0d86
SHA512b58a52939200b048d217ec9f56563d91a2f824e5bbeba9955e894bad875cc62d2eda673ef247527261bda4fc4d86ad2cbf1f51faefa55239bf6f069908079d0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d83561c763386bfbeb10efac96d2bd97
SHA1a40f24104dcd5537aa43434805ba3927e87b4b2b
SHA256fe465499fef504386d03de6c79c6571211075968deb0286289c0772273d7835e
SHA512cfd97ed76de2c65b1be6c0306cb84caa812892e72f775f4cd811955cf56dc2fd0ae57474aa0c73ba276e8396ac4af9328571b1118afabe7d013ea8fa2806a317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf138f87dd6da10b6d0863994eb8f1c
SHA15e0548eb93011c3da084eafda0fdc1274051a276
SHA256c58209dbc8911069095becc647563677fd73145492e466b3a13897cb4e1d7723
SHA512c03cae8258d62271c611b9b2c86a789d70885baded98e0a978c5a42b311b90309ec0108e0d9e8c3f9c5e7170597110bc3dcee7ab555715b8d2b9d25ccebb6b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56642698c8c497037663b7976c435ab65
SHA18a2736f3e28346bc2b695ec1b616acd73a3d915f
SHA256f13b82d291b53e7535942b1e25d3a9526b663c8dff2fcaef7867fca2e244a3fe
SHA512b286b2d5e48a5617d25de6c8c7eeff3a7d2e433c908d8512c755b92cd161639d3b0ef1876d465e6529553d9e4727c35fc4a9aa585778660259e8006dc08f4a3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f38884b9008c67c570e28950eb858d
SHA10bff62d5733490ac41660dc3df386395c1581c2d
SHA256e2fef9f0391b459315339c281d0e73e457763d6dda5a6742bc9fe54bb6888b0d
SHA51246e731e15ea9e1aa22c75f810df675d2123220a70b60eb11612b99b8f6da4ecf6da54922eff20eaeed8df9b0c21c9ecf481153f60663323de9f05bb3471e57b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da8729cc5afba48347740b44d6ecfe84
SHA155860be18d5ec8ea6d863b74092d99a7443d16f4
SHA2562158bf46ab6b07801634f54f98ac3f9ac067eded0fccf53e5721e13c7bd04578
SHA5124c5ad1edb40f995ab9fe5d4a9af72dc92317b5a8a0a32f6e8316a3e3a2fd182d69e1f19c4d75a371e6431de88a0e8551ea1808e25e737562360b29c6eb53cef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558c6cc44bde4fd0cc6148d29cf4413c3
SHA168755f8cd72d35596042ee74f49ca71a8c7f6c02
SHA256349301d7c4469bb90f900fb5d097a386185b0373fb25ba4219bf58ebca9d2567
SHA5124c402210c1c16ff3e4f971ac1c28b77354313aa1688ac65f2b3556297a75052bd24163689daf49665ba5d01911a129f6c252a28ccef6e7d787a960e039f6e5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8b4bb1085826a288c214709c550599f
SHA19af430f68c8420b66ff16980227445e9549b480f
SHA25612ae29b97d5296772ac3d70bb97069c1af5e2ba448a6257ff3987a878ce86f99
SHA5129df3699d5720ab1cebd07b26431b500b7d943565f6e558ad3c437f936030b8b07084c502c646abf5f68521fd956259a7b0a8113e4433afa5ef0ab920578a0b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d62434ebea0060354f34fe70ecf26e76
SHA12fb24a4c9be5a68e65d04fdf5390b0de6c3cb81f
SHA2560658d024e014538b642811f8b387ece13aee851cefbbab5e9956c19a405e3183
SHA512635dcd65655001f362f871dd7b9a6aa81184b9b29e327c5a2911d3f7e6ece70602e70712fbd5f60632395d505543df0934801f530a2b01e91e1b6c1713ba7d24
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a