Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:48
Static task
static1
Behavioral task
behavioral1
Sample
693162fdd3cfd7f12d1668b77fef24f0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
693162fdd3cfd7f12d1668b77fef24f0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
693162fdd3cfd7f12d1668b77fef24f0_JaffaCakes118.html
-
Size
2KB
-
MD5
693162fdd3cfd7f12d1668b77fef24f0
-
SHA1
957f50c79feaeaf1c19cde7d30b627510894e123
-
SHA256
2f949147d031fafb99d1ded1ea0cdb85d65b16d0de0ea17aa0ef562ae386a492
-
SHA512
47849cdd2dba0ca4429c18cfaccea35ed70121cac71406b4f413418046862d3cc30174d1b2c1d4dc43f8c427f1a16af29dbc4e14ed65e1998057972efadf2a7a
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587174" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0ac2df7ffe16e4ba96f11c28fad926000000000020000000000106600000001000020000000d4dd199cdf795caae9377bf37de7fd9ba0166a9664f586e0612c99a799ac5394000000000e800000000200002000000072416c6a622967f808fdde3af573e6e133c56677c501a62f63ebca835923ac3c20000000c353ea88217f207f31d368fb0429695d7a1a554aa84af1c0793b5e6d5cd2063140000000a49d45f4cb346bd0f7d455585ca3f203ddcab6240c11e5259fd38c35a83e89f283123c56927e0bf5425d614f5c712a48f7b0bbbf67c096606d2149392231981f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0ac2df7ffe16e4ba96f11c28fad926000000000020000000000106600000001000020000000c43924dcd99a9cc6233da03b97b84b7cc4c1a7bea807fd63701f7377012853bd000000000e8000000002000020000000404c8d0ec1ed12525d941db199fbce8cddad76c25df42d971a6a9a51c0055fbe9000000062e27dcd095745d5e757d37e79bb7d34b29225171695027855e26c59060551e698a6c5a2bc8f3c095c8dc7fccdfbf660b5e8531cc66fecca3495f7bbd5d44b5cb3b2faefe21a97914283646314440bd6ec21245a8671876165afe978b677d6aecbedbc2e7de560b984f5b4fd342741e86e04a593c11ef67bd410aa9dfc242b70ad080e50e198c1bf53285d99ae2acaed40000000b63ae3e95c9b87238e6e7ba615b68645f9a6e1f40f31bafed507bc30d9c717d3c8429a60a85e64bc7a88fd29720412e814509b33145d948faa9db994fa4db129 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A31B9C1-189E-11EF-A30C-E60682B688C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c059eafeaaacda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2168 iexplore.exe 2168 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2168 wrote to memory of 2536 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2536 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2536 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2536 2168 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693162fdd3cfd7f12d1668b77fef24f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582f24962a3ab0a03a33cc7d9643bfaa6
SHA1e8b8400e2f0f5922d22286328f394b697fdd9e3b
SHA2565a91a8ac851f0e0f604d2f6bcf10a175e60f9acefdc3c7bd90e51d04d1b8ff21
SHA5122a12c7304dbd32251798b4b80783101e4c86a241f554bbe56d126003876dcbe52ec0c759c829fd3a25c909675fe25461e3f2afda7c17ec56b4c82cfd7fa67fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578febf04bd41c3d37857e9cef0f116f8
SHA1b5c05c1baa4b9e28a0586f1a1fa46febe388a0eb
SHA2568e508d2344c7f853d19737641ae54c57503ec9aad3689c5f613a8cb3d99095fb
SHA512c8b7163103f78e69024a485e6fa649b550de8b10c97b84959fba9ce00f058cab4bcf15e35a416bda22640621f1feb971ef02c784cf99c0301eac4bd41cf50023
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f347229157abd16e2d19c0aa89004c2
SHA15eec4e843b339e76e375a0285a280cd07a19e395
SHA25618aa35f63ecab9c08998169656463877a6a8f61e5f020aba3c301a89adbee92c
SHA512badbeeec90c46e3557cec8aa99896c2118de8e6a3efe6b709b0b6a41dc7eee49c52d8c8676201756f112e8c3c049f0c81c8d597c833f5e4148f5576a905a2f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2ad40e2b7bf946bb31cd1d04528ee0
SHA1cc445747bd4078cdea21bbb734527c95dcdc8b70
SHA25622b4069783573cf17a2f4e898946749719bb85806c6689716ba3e5e2cbcfd5ca
SHA5122bd97ccbc45326c473ac403c4abb65120a93c9fe6c91578dacff92bbf40cbf49db6fecc4eafc20b900080f871b71d05d5f2a00afa02496ccee2614c6489b623b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e88a89ca355f9647ed1a74d2bb186d0d
SHA12841c6be2a37432dca95aa71799852d44f7d6d6b
SHA256fd29b6121897bf789de66e30b8c2af9601c8eafcbc753c52045a2099b4531048
SHA512048516c36526ad222bdc3b9a2712e9f70d0437498aa0a40ee26397eb939e6afa10963412340f00519285d075fece67d499608458b7b5fe72021a822a5165e8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95d7d88f8bab964036fbbf11e427226
SHA172e8fe4c4cbff63b860e644017882e1dc76f3568
SHA25645d93c5cffb9012f890e8fe12b274ae7f0f66d37950932006eaeef9477e58c7c
SHA5122d875459e3e6c9640e4ce8e6cde92f69443dab0698b56b5fe792a95bf90ab45f268b295cf387c6ad4b77308be3248a18a69d2887ab70b010ab29d5643e09c163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52041ee48eefce393ce3f6a7957fa6dc7
SHA13091a03f99d434baa558f04b1cf354ac2e1f08a5
SHA256ad6a25ddb10edbeb092d42e07ac68388c1e6e89802eba8f547259bc6fd09f203
SHA5125bb725145ef4adc7caf9625ed922d0112d4199594699186c568e8bd188c97d34f6fe34db9fc82653ad11ce1218003bfcf2f989d755c7f5894a3c3d2185496a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f7554a8860a786bfc20bf53943fa4d6
SHA1c0fb6eebdfb486fb9424adbd86997ef535095b28
SHA256ee31ddb93048f6828dc77673fbaf2bea3172356a73771d0ac2a8bb7d1c9c109d
SHA512265b7e62bb21e3b76efa03d11b8e882bf41e3f875b745c8a6b35587913a516289967441a07478fae172ebe5ef9d8ac20a5965674dda8fab67e3f24b432494679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51514f1c6019c6e49dc3f3843dcf0d45d
SHA1bec2fd2a1f04396c5e68342d586d1139100bb935
SHA2560e44268e2c0e1f629c23685b932197a7f6cee5da1aa58e0911a84184752630f8
SHA5126786cd1506ba933d72cd9fbc5ef5f236388174e06d4c05e92e2f340133304315a851eb6c47266f9a3f7f68f7819578deb8edb82a4eb1052a8734ce3cd63b3f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa91071b08d9b9925d64f223eb1b820
SHA107f5b67f31780956236037403b1f77bdc2750cf9
SHA2562f438ed97886743e93d60440694d2d1f3a378da8dcb832006b3ed51dfae38e1b
SHA512a7a94ade6512dd75e0076c29cd53b1e188fec108bbcc548b35ea932bd3388402c2b72bbb2332661c78d627b7dffca3adf1ceff905cb75654c499c43ea05f1da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b451a94c400465705b8362b2184c0ebe
SHA1d63ff4000e74cce3d7db1afaea11fba6fd4d1d77
SHA2566617244404635b472b0ab551b3ed65e827fbc5bece12fe2bace6f2ae986ae565
SHA512b350a5ee247b673447aad0bf5cbb34e2fd21191ff1f4f5fe84e3f07566ff66afdb188d4e9f5f5b5ebb7f4a3153a47fd9d029e29ffe02b078b0150b953920299b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003ec8de5ab415446e9baa39d1e11f83
SHA1f5cad77973fbc36d1b6af2fb5500541e2a785bf6
SHA256615479ab19771189d9b275de88cdad0e45d83280364be76f130b9b03f221cd30
SHA51247cceb0134d93f8e34b6468a0f0bf0057c1d682d9f3a0acccdce7c8227cd03b7c436b44a10dd94709fef3cc846a22247a397ac3d97a02556ea45c7e241923ae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8bcb68aa4a3d0aa20e3df39df0955fd
SHA14dd3f1b52dc1a42db28566c2fb2905522e091d6f
SHA256f3915460433d3c0618d8dcbf2392db1f54e3f4bf0c5426b0a83e39d5c15705a1
SHA512def7406db34c7d74c8c9bdc72eb234c4c60507fabae5af4337ddc0d0cfa4b4dade67fca0f0f0efdf2ddb647265940dc0c892d658ca072f37486b993ab52447e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cefb82ed58e61c42c2722ac9bd969f34
SHA1c425d473202dcf7e528c408be2d828c0ff664ad4
SHA256717678a345ffabe1aefb46408134f4b740dd41e0b27f3ab2d05ece05371dc2af
SHA51296e57033fa6511eac48241a48b7022335679a9e4b675b12f8bb7a1a113c2619faaaa8b7a49ef6cb49b3f65ed9a62fa0c974822e7d41390a13931e973aba5cab6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513c1b729130817e5e8a2ff9583814f00
SHA1af8cfc75cc588ff2ac7ff05702cbbda3609e2e5a
SHA2567095124471611ef2d9e2ae860b4ec3e991f2c29aab0c558ad4e033542f540b93
SHA5128fb7c16d0c75aa4ff426a34db2a62dc45609a7e599341bca38571535d69bc382f81f374fe9ab00587e7d38928d8ecbe2c89944d5cc1eeb4b3dfccb435e06a1ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53374ba9e9b7cc8fe84c054902a14f379
SHA1aabf4fa50bb6f0eae53bb8f25fd5970d0a394ae1
SHA2562871949d63f08f55324dd45851bad6f1c275168a938c6339580efea64bad38f4
SHA512d2d45c99bf0906424e9f2e2c378a63304972a4909054ec92b8543572d2c7fc474a9abe5b0cf750dd6e38ff26c2ee29e799c45fadfa00742fd19deb64166f8574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e075b496e96d0cc8a060b9f9a2b4c0
SHA182df8a651d34b618d88f3ac760ae0499a92ad293
SHA256b3f84e9121e9ba38243172978f2e762fba36aed437610ccc69477f733820cf05
SHA512c3c5f8c0ce5b371c6772478fd2d0cb9beb464d74193e2fa851ff44c8dfa1c8bbe56e81de93599417264aa0190c9fd32d507ff6066aa36f8bc9a65149a6e1d2c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a23131515345ed6e5d5cee149b74553a
SHA193756cfcfad5d8c6e33590943ce87aba8ab42baf
SHA2565ab8c394ebbfb421ebba7ce82215a184b3c16f1a4be2d917962a83ec01eba79c
SHA512ec69e68ab12f9be80c914daef50ae05f66a34b684faea2d7f49fd6396822c33d30eee5e646a4cdc094c91aa71d694e2aef41b1f370d4b2c99afdc6dd98e9d5f3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a