Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:04
Static task
static1
Behavioral task
behavioral1
Sample
68a13e809414d29d2abd4008bd5c696b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
68a13e809414d29d2abd4008bd5c696b_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
68a13e809414d29d2abd4008bd5c696b_JaffaCakes118.html
-
Size
217KB
-
MD5
68a13e809414d29d2abd4008bd5c696b
-
SHA1
0a679b50ca013fd1b539d4c047657805531a71cb
-
SHA256
ba0baaa81f5edf69de7940b21e863ea263c95a990dba6994d4a6cda22cab26f2
-
SHA512
614aec9d4e869253e6e8cfceeb3f9ffc90b94fd09a7e54323ff1e1bf714278197b631968c38e4b2523500dd68c68a54839bffedb4071ff700cb9547f1e444208
-
SSDEEP
3072:SCk5m8Kk5OEPIYBQIyfkMY+BES09JXAnyrZalI+YQ:SCwm8KkYEHAsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000332c09580ab5c41af9867938e2139780000000002000000000010660000000100002000000068954c514a0a1bf48a550c9f4fe3391016e61d071e177a6ed9fa2ff387ad20df000000000e80000000020000200000002fde4a669d6d90bb47584d91770893ba53ad4986b05d702157d025a993b9dc999000000087aaffb121c787af388d22e29fcb87259c857843e4ae251c7a3f2a937c4f98ddd2df35689351c7df55c7f6c85f27555c9f24097f33c1abd003c0ad3d718a3a366f6bae57b4b84c007e5bf98bacfaf0926900041eced55fc0bc9bb7d78e980bee8e41d9b4b7e559b5822bafb13017117f899c64dc62ad09efb371e36f3b67885be93579d95e546240a4b7c16b9ccc3e9f4000000048362591d6b7dd84ade8a7946d268e3e63cd67c45584b83ad705e2a3916bae5bcaa50b1537c218c3b11a8faab687036b9ee3a6c27cda823da9d7047927e69493 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DEAD54B1-187E-11EF-9DE9-520ACD40185F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000332c09580ab5c41af9867938e21397800000000020000000000106600000001000020000000cc42c0f9aa91e3d7635affd9d7ae2ab0d3c1db8833c5e7b891c1f4710258b1c2000000000e8000000002000020000000149ca3630be89c7dba1eedf5358ce4a4413e132304d4166b7e03c9e47256847c200000007f05f9e437451582247c6aa83ea159c6fad740b4129940b2e86d3a80ca01e59a40000000efdc1b7e3717c3d4db369062fecf7ece19972d2a053ace0ec7fa5ab9b87bac52b71d7d2bba4807a711418cb783c319cab7ab0e788603a4c41dcc77e7f19874bc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00f02f78bacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422573733" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2944 iexplore.exe 2944 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2944 wrote to memory of 2052 2944 iexplore.exe IEXPLORE.EXE PID 2944 wrote to memory of 2052 2944 iexplore.exe IEXPLORE.EXE PID 2944 wrote to memory of 2052 2944 iexplore.exe IEXPLORE.EXE PID 2944 wrote to memory of 2052 2944 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68a13e809414d29d2abd4008bd5c696b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5112fa49fa7689b316d86d9a6ebaa4a54
SHA1f1952057b31f5ba1477ac8ca2e304ea4429e1354
SHA256e8895c7d9ed1eedfe9cab11a79d82c5998ecdb976fa53fd764cca8b8f4026d43
SHA5123ceeed83acfe7bdaa214899c09df98f38e3c8ced2c8e17dbc783fb0408508b584d8e25f0c5cb07b43051fd31b62a0c67b893c8470e1c89547ad12aef634e8e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b978649255a9f96658030817eb0c33ed
SHA100f2420e434544286c5520c40c3940ecb4d252af
SHA256b426de97b7878f82af5b596d14592609df44d1e07e1bca1afd25eef6071e9010
SHA512ea9d216abbb01f80724965478ec27378345d5585cb058e7cc46916e7de6d667b6cb193354d8a6f872d85a4e24b0ba3de62f29cd57bd85dab2afe8ebc5f6849de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e7aacebcc26845e7d759a593950f2c5
SHA16ed884d6af69c82c2c34b35b7c1ef904aa1017f3
SHA25648d469209522a1f3fc9d000e7e714535cc250ffd63dd246ee2bfbfad9a35320b
SHA512041dddba008bcafbb7cf76505e1168015740fffa57f544c251cb0e562896507bf6ee1d799126de55012ee732abcf7cee9b0936fb835358785f5cd4552eaff36c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581a347df308ef72b68ce43ae6e14c187
SHA1639760de4431402b78974506853fe13882e623d6
SHA256318669e56604af14c84e1d7a8d840d7bca62d64e3d30d4166a80501ada9c1fea
SHA5127c23df6603b87e998a64d04122a63e30d5574778f4c36ba6774ef73ade67b069905539d4eef855246e927f1c5409fad0226821231ae5f282e3ccbff93c9cc7fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5614de17a00ebd2cb9b93b62a8723b524
SHA1c2ebd46e4d9ea2051f893bacaa70db9f99f99eab
SHA256d8fb54b3d6d9f5f90ec0de1cf16cc7656c4db42b09adc4548c14d10bc6033048
SHA512d9223c728793de631221c14d78492b7a8987422ab0fc94ed4f5b13c3fb50195006f4a8fd7c1334b71cccc9bd693a06b8addd13ac4c4f7848fc0d272b626b54b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aab2551841a996eac771729a3c6670ce
SHA1ba35e471d438730904810019e9fcd671821c15a1
SHA256723e35796941502e07a6d813c60d9b3a1148559e54fa4ee13424f1ba28c49ad8
SHA512b73af90f658a0fae063d87ffc2a68089c81db0a39c6c83a4cc8a8697f9987437681fa0e6f84672b0bdffdfd3ea840489342b99d8d75df5ef8e656579f59039fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f43ecb4e8df99e1ee640ce285c300c0
SHA1833deefc765a75bec8b5b0416c7b165c635c822e
SHA256c9913a153199e65f5005ab7206f2fc914fa9384db4fd5d699a274848459294ef
SHA512b252ff5533298e2cda52640747b2479187e65a07d97ba6bae198ec5d115e6b62a796a4772f64fe252630ec69e004cb4ec0f405d84ed07279497f64ed6a5b424e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fecd9c3734fa60823adcdbd7d67a787e
SHA169023a9c6e0852a5acc45ec5678ba0e7337b0464
SHA256821ec4eed9153ec12501aab0839551676f7a7d711fdacadaae7075d4614c5636
SHA5126a4c6122fa618c46342adaa7f77d01c48344a6b80ed1c3cf707bdd87d96ef4737fa05fd086ce24c89fbccbdb3ef65161898d7ed82dc8a440078e2fba03c02696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2c424926105cc3b72a29d6c9f2af210
SHA168514635eb85fb4eeb238eb39f05491c9df14327
SHA2565bfb1f5460d0e1258434ced845ff6c1ba3691c708f6ccb8e2594b3b1d2fc08f4
SHA512afae888ed3ee1636b9c79e746343f4718dd85625686cfa447017df4670d494e09641079dba70f889fd2be2f1a2c6585b12175116865f17c4dd7295db6a4bda58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51968ce3190455d1bb8ef1861b1b699fd
SHA1b5f1f12816d83b063c8fae1c3c3396636948a5c5
SHA25652af4bd4a7f1a2b71b1bf567d903c5b300872e515d6bac9135d7b1c3153dc8fa
SHA5125b907c9c6249e5994bfb2c1c99c61e315126b8d9c54307886ce6e6afc4433b26d333791471d53f14989b5e4b9f0a9ecdf863b40103c8ea9e710e24d5c8559aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b80596d139eb1503feccb449a2dcfb2
SHA11e96739290607fe23c633417fd7458bfcd5fc60a
SHA256e0e7ee8c7ddc7395c874e8fb5bd3eec252346e56a9119d817813ee3a3725e5c9
SHA5122eb54c73200bcb7b88904a24a445371429998da175f0da13af9fd220510106d7da2ecabddc5c537aa355c108ff87eba8c0b6bdee40f1ba64a2f9010d3c100838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b31693bd836645ce1753c4f6115cd63
SHA16635f6c524dbf36c232cee872249323bd9f41928
SHA25670d052fd4773cdd67105254153e43aebcb179d40cf2967c8e168b4a0a64dd189
SHA51215e8b0b7128182f9505e8f5a196181968907ba26aa6e319a962421c5d8d19f8626c4be0a4bb394e5b1ea3b72fc10184e9a9ce2581b5c936915320221b85781bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9ac98fa0bc44dd8ba942076e45af6f
SHA13309d1ce6c4d2daefc87475aa7b10826e45ac551
SHA256b25ab06892dcd1686c43499974878a57a445c48b3176d4b94bb2263ac3396876
SHA512e3c443b5b5b4788c49784f593432a5d51bcc7c41afbdfb43b31324098b74d9b28c02cdd1f1f17d9c5e2db69635e602fdb819f2cd4056ac2b9ea34714b9e21f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5043e3cebbbf189c01881446dd835d5aa
SHA127900263339246fe22d115477bd51e5fbbe75ae2
SHA2567936436d03d70b8e25fae6ed25635dee527c57bf63df5c3e4e2f7e429f8d39b1
SHA5120663768f2c5e77741d64785d8c5efcdc3ee89a414f24a032092b822f4551c4d1b4b912c6d72ac0a1de926d784755093b669cae57eec2fc5cfb6f63d30cca279e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b6929cd83ee4fbc0c1004dc823fddb3
SHA1e69766aa0ebfaaf6ead5c06325346960133926d7
SHA256af90c9878655b8f03e32c291bb8ead674b482a2fcbb6301bfa620586badcfff3
SHA512285e3daad33688556e3a72c33ba6150e2279e4514fa8d46a4ce334928e771384772ed2ef2555ada0246c0affc34c9dcb2652d354d17b4d4fc81701e7539780c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0ae74502b5821291d492d87f5e8971b
SHA1902a7c5d24314e4e680c02985ce79ce561f1708f
SHA256a056a60c9e28585422bf85ba92b2fa1964b229a5f8c62e3ed01990fdfa93355d
SHA512b6a5c725006a3434423447e3e0471be1a6a69a1c1a01964de42871f9488ae3fd8ff34f6a21586597afe4ed91f971b4dc99b59c5bdec3f9aa331ed6842eac358d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a