Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:24
Static task
static1
Behavioral task
behavioral1
Sample
65d7c47e2444b6a64cf86f3d27022391_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
65d7c47e2444b6a64cf86f3d27022391_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65d7c47e2444b6a64cf86f3d27022391_JaffaCakes118.html
-
Size
461KB
-
MD5
65d7c47e2444b6a64cf86f3d27022391
-
SHA1
7cbfed33ddc6375f9c0aa242f2f71dbeee055d4d
-
SHA256
28dfcc0b3dbadb7826186caf35a563c478a8fd483794a7d9ca8b45b1e6d7564c
-
SHA512
6182da831fc0e2915681c154056c70ba97865307d5eb0d32b4682537ce3b226d3331f2160f6f52ba835e367a747c0b33c7ca3c54c36d2578cd1ed44b063ecf22
-
SSDEEP
6144:SdsMYod+X3oI+YHsMYod+X3oI+YosMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3V5d+X3s5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAD1EE81-17EA-11EF-BE0C-E2E647A5CFB6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ed5db3f7abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002fb6d15a1431b14bbc446243d68e858e00000000020000000000106600000001000020000000fe06b0420c50714ec9c7cb3cf0401003c4f39c471ac85327f5d44e0ace533b6d000000000e8000000002000020000000e274bb5def51a15add1236bb161c0ec29126297606c8fb0efe369d891d9a12e320000000114448086b47049e38fe59d400863fd21bd9207a79ec074b4c73c6a994fb23184000000088894a238015f4056fb99dbf8aaa84d27a194971a442e4aba633e47289b7c21ea4e1608d97bf535a8ba8246efe4902c0daade9fde4e5ebe56efec68d68e7280f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510160" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002fb6d15a1431b14bbc446243d68e858e0000000002000000000010660000000100002000000076a02afaa2f621cc093111d2f17bbb7892c142ae73f217d8f69d54fa8d191a68000000000e8000000002000020000000439b67721c89f1d2559e5312aa3ff0b17ee316b68e87272f1e2f75f71b03d6a99000000085f70d29d3eeb8c2536c28c9a6ade0fe9a6ade3ad191e6c1fc1ce7a50d31ccbf627a9224aba337c758b406cd43cfd15f3db5f310f07005436bbe27a9340cde8e09b77374cda0097f46261e11c39a26680933a57f7b421f6e8c5d7f7b3d417ef85f465e4d3539dafda20cde89cc42e53c9a1a01d94cb23fb02d1d2a568630409426c2d68b1ba7ce897d91aeb9ab366d0d400000007507280d484abbfed3da015fb4daefb177d91bba556f12e96229669cbf1644962f328bbd9aa93eba894340907d1691e491f3627eb097f9d5cebe4ee66f2e06a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2876 iexplore.exe 2876 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2876 wrote to memory of 3024 2876 iexplore.exe IEXPLORE.EXE PID 2876 wrote to memory of 3024 2876 iexplore.exe IEXPLORE.EXE PID 2876 wrote to memory of 3024 2876 iexplore.exe IEXPLORE.EXE PID 2876 wrote to memory of 3024 2876 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d7c47e2444b6a64cf86f3d27022391_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533fe26037d96b4b8d4360e9e6898edae
SHA166dc29f91a8f88a617eae2b3b83051f4e4ac9946
SHA256eee7f2899fb82a74975ffb7ec1928a84eb82dfc26acd661e35969381767cbc95
SHA512d41a4af42f781b465462d31ea7c0d9ef4e75c76f3c358940c6f2353be2902ec353ca088f288b189c1288b18754c73934783a2288324f9862968e56c53cf42c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506295979bd54ccf5ff462c6020357d80
SHA1dfa968a407384bbaafcea16d2c6cad3d2947346d
SHA2562e720e3f8da2f94c2c6d1f0f99c212344754da8d350c6b9c4d3ffaa542c4a528
SHA512fe27b9d107177f924cd2c68d6c480ad643bb4694d54964ae01637f09675b92698b871de76d94d17635d6108512af4c4dc703807595ca8afb6594475afabf0fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd31874a1248524a2dc1345fe3b213b
SHA174e9e9e1dc15fb281f352b98bcd216e924bc908b
SHA256c29ddedadfbea2a98ddaf6706d6687c070c80f83a422f4ccd89c3c0cf616b10c
SHA512fdc8eab985467afa6b81bccf783cba0c1621bb4e74d5f6eef84f5d8e63d5aaf49d89d0d974ce6104607d908d539f14a60e4a3436442cd8cb6c0c2e910d592755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a166eb5bf64cc5d721e7f561361fdf2
SHA1b5ac21a043e96465743c9d44b2ecb1286b088d99
SHA2561f9d7c9804d4067a2a8504951c31a04ab3dc670d1ee49e9086cfeb72079497cf
SHA51200d93415d8682a27ab2a6146f78da97eda97cb59a4780f665e225e3b032bbc8cbaf91ce4fba0c7ed3ccc14244b68f02d6e7f19fa9f1a45b498195a1aeb733156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5167da674e62c56ec1e76a2c5ce9d87d4
SHA1ee8650dfbd7860e6f23c32c94979865fe54ad4f0
SHA2560178a6b6661c369b672b97f81971078d6d4724ecf7a63003e3535c861d5ecc14
SHA5121a500c4cad91da8df4bfc73b841ef106ca1e21d1b0eb5275b9576d434a0c75f7ee1f6fa704460c9a747e0f3281752c31e0b774b9b652cb65b6af464377e57a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8158044b76400c0085dde210841d2c9
SHA1d2591c6f732117d895399dd77ad174499f7e95c3
SHA2568861c41268660f93d8c76fe291cfcaaccda658d8ca0322cb8bff4dd8bf1c38bc
SHA51278aa6878a132a15045064e10b8e6b66e437eb8e1776ab6d6d41ee7bb3c1a27028313cc5e7fc71ec08e9f10a8c86f2ed247acd5ddf002d0de0ad0d81f1b9f048e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be0c22cb44fa131da4c42d757cc43332
SHA11c019a3996bbc1ca752523f4ca38c90895385a19
SHA256b1b90420131701e3c4347dbce79e5ea7bd2072b923c737e11695db614c6ca1cc
SHA512ba48179ca41305d6d149816e059d9123e6b90d0b65654e84e3139cdf94f967e454f3a685dabef255d6d84521e174cf27e6bbc40e2a2c73dcc03d93ce65d82ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a53037fc81b44781e43d5b1bfb1605e
SHA18f1e73a90da17282a76c1c1c94399b5145bad40f
SHA256e6398f717786e6f8a34f26f55dfda30befbb150b4d0dddf72ed9a582fae3945d
SHA512347d681cfcf8e441777a57f9a52b5786644760c2079bf880475e342709ef8fe8398b62c5d873f4619904be1a035feed478962e417b54803d7e607a3bfb9dc0c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d208ec1d3e47250e80ef6192cc736b7
SHA16e9db8dc794ee8664e1979ab1cfbcff0cc4f1d87
SHA2562324b1f63bf1058da0de81a8607e55ec4110b5942e86c1ad5e860dbd97f2b408
SHA51257229399598eec9e5f122913e9da097c90638b4386d05fe13f3e3d73debac9608431913271ed0330cd0a6168cd7f90d17f25edabde5215b7439fb9f10d14fd54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53480cd23feee261df852aa08e6d3b63d
SHA1fdc739aee56170f2cd70ba98bcd9862eb1f01743
SHA25620b07ca8edabdff0c91fbccfc2e94dbfa8938d78292d6e0651afbb5832eee90b
SHA512519ac7f507194181b6c4c99afce10b1bbd38455825837aad6934f898059c8986724f9567322b4bdbe39c015ca30e67cfce3a3779f879469a31a4688dd801ab46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0fd836bd2ac6c9504338540ff460757
SHA1e719039099e75914396e1383f36313990730ea9f
SHA256b2f350ee85a59ab5d70fbddeb3f822aeaab40be17743c1d6bee02804e0f02746
SHA5128eef363043fa2f03e8dfd9703673ead9fdd929823d809da6e602b6b3d1214a900512b401e350be575f85e0a768b91ea304d15292785f89610a6beeb162228f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532ceca853959f1d97413ae8b81e66d6d
SHA15724a3c3a7e82e26dc9c3f2bc6836fccf6398748
SHA256084ecd765a18bb040cde99077232514eea6448ae5843dcfd4279c2d79e1639f8
SHA512934f58702394e9fc76ca945bf71c115af2e10c1c77096aaa9c5a746c895a593cbaee748e54d0456d0c957e9357d36a68f01e5a63efee7d569c6781d88de5f37c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d805d19134b4bdd7ef780d2c16df3f33
SHA1219c0470f858fc73b36c4806f86aad028b89c1f7
SHA2562faddc38c2ae812b829ac41e1fd7879308b9cd90d55dcafb11df9abb40ce4651
SHA512e580ecba482a09696678e03c832f508332edd66fdce545c91ccce4cd7669e151d94c84e7864d1474f6a5546e863d47fea0119ff64704ae48452c3aa2f6a7c8da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52140b165e3a1e97c6c8832c962372c6d
SHA14036e6121bd59fe204f52a7f288eeb46e537de39
SHA2562d9de0d0027d0d244095e0c51f982d427f4d69e62dca414838c04725cdc6a798
SHA51247576a12f67edb35d68275284fe99df9fd2503cd2d2f9b28acb3e08a06f94ca607b2dea6a89df7cf8a395bb56c9809334f4e24bf7c49957c5bc127cb90e491ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505f9422077bf2e28982ae23b594f4d59
SHA13b115ae03b96900cd0b0b54ab85d17ca057d7bf8
SHA256bbb7e111abd16fcdcd173696aa938ef807e5a6e1daea9bf46e06f8910b2ef64e
SHA512ad39093dabae57f0a5c135f850fd146feeca2947265a5141428d0208d43579615757a665a338ac22aa45a54e5a4c265a16eeba8fc9603ac9e42d4378e027ed7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53141651f7870416873640e6aa0dcf353
SHA13fff637f95eed8bded63747322b734be17fbc855
SHA256293ce28cb5ff9c173c95830035d4522452d9ab913c57dadc0c019bc4dbf10ee0
SHA512363aeedebcff01adb78de7d3aca265889cec7549435c5292d686a39bc123d7148a29fd2bf53b429668a14e028a210abf104386e05d78a43c4c436cbd922f122c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce69879054ca56c8c1a20bb4ab17102c
SHA1c90adfc3195db026bb6e169ec2da9d83e3892e94
SHA256c32d09e597061d461038a5513b16704315e8974c5796fed50186a94c58f45d61
SHA5128e025c3470b07f9f017db2eca6cc988246aa9d7a8904e9612bae9d564a2a9045997fc3481c70206c553b07cbc7e90466be090c3d84b7207561b3e70a761fed63
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a