Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:52
Static task
static1
Behavioral task
behavioral1
Sample
69337f873c468d1cae2feb30c65af20f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
69337f873c468d1cae2feb30c65af20f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69337f873c468d1cae2feb30c65af20f_JaffaCakes118.html
-
Size
23KB
-
MD5
69337f873c468d1cae2feb30c65af20f
-
SHA1
53677720fd425d61075d57650af1a9829191be64
-
SHA256
0ae94b8fe4300e54c5b0be0406705855396fc0c68640fbaa286092e4a9cc186a
-
SHA512
6383c981be3e3a598b09e76385864b22586b5ba329f1f32b5aaefbe8b0b0331c019cd5d263a920cc15c67b52e0fe85dee2232ba663cd71745ba625d716260282
-
SSDEEP
192:uWrsb5nYGnQjxn5Q/rnQieSNn5nQOkEntJNnQTbnhnQoCnQt4wMByqnYnQ7tn6Yw:5Q/dML
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0492880abacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000d163d3b52d48e237b359dd312c1e4121dd5efcebaa2f47e24e656ab3145a95d000000000e8000000002000020000000cccca1010fb5b44a9421d66537553a2d879b437533876fd0d9d10d0d90b4ab3020000000f053dbe683307bda515902c566c80bc82faad8f6a2a94b5e99f4b9693940e55940000000be9c133b8f54a20d8c8cd972900efc7e5233b08d42aad7707e790c40b5661cc6f6db4cad2c7d86a0b680ff8adfe4e97ad94e551a445fea8dfdd10a84e7c4e75d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587390" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f8a3a2503bf4739fc643b65e002f10885a93eb434ee097ff4cbc050bab234070000000000e80000000020000200000006f4411a8a9f19d043fd9d9ed6a880a936cc9663c11d19a8c5d485a10e62f632c9000000080858be5fe19a00e67c2995c7b7d65b464e0bab91b88fa70996aff339f1bb02da4899b802a226445cca8230248d674b1201f99502cd2f03f5e7c48076afd0e5e956c4292db48440bc1e55f5738c95b1baba00aa4a0c2d0514fec12ea559f8228a816e28d9f07f2b72b238eae01ab975fb8686ab8b7cefbdd966ed0a6fe5f404bca3abaa54daf37f0c763ce494fd2bb0840000000f249dd8b3b6b7aa30e0e46b78adc90d6fbe856134206ae4f3094cb212485032622980319e85fed3dd820e05360603672bfa864e7a63563d56931af3d68774e7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB817471-189E-11EF-B390-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2228 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2228 iexplore.exe 2228 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2228 wrote to memory of 2492 2228 iexplore.exe IEXPLORE.EXE PID 2228 wrote to memory of 2492 2228 iexplore.exe IEXPLORE.EXE PID 2228 wrote to memory of 2492 2228 iexplore.exe IEXPLORE.EXE PID 2228 wrote to memory of 2492 2228 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69337f873c468d1cae2feb30c65af20f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5947dcbb4256780ff0136ba64e51b22a2
SHA1b98b37e64515f53b24b4d88f76425c4c55b56ab2
SHA256ee79bd1ca2f80f0d627854798d2d32b2e62bb00d4948f6ca9997b35c3f3a70ab
SHA512c78d66fd9ac3a3c7c8c22cf0d7773a4eba99b04380207fcf1103a0deddc82a05de32bdbf2b38e6bb500b7f4d056032ba23fc0758ae2486a1b40c9f61917382d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594729c3bc164c998507321fcb8b9ef8f
SHA1abc7ac8a693b632bf436e0c095652a204bf10f0e
SHA2563ff8f989a7e8443771061f2e83adbf825662be29e169c826af23e796c0335e9b
SHA51210e3120dd616e4172ffbe98860bb2c825a4382a0bba39649df4bf3f0cf168cfc4b81cd9660ff9051a3222348fa4c77b2685d0d8136460a2adc56de9ccf27f293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f99204f768d490e4527027d60014bf23
SHA1bcdff6a3536049bcf8fc3c224360be29b78a2a7b
SHA256f050c2e100835f72381f6f755e46618443344aabd0ef2eacc8ea42f12b9826ca
SHA512f3ce08971246a2548ecd4b1d8eafc5cbc7a5a980842a75bcb961a0c3d5a10004b34418dbc1488522eb5e1816478dd9276eb466dfbcf057767decb4c7354378dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4a1eb9c408be9c3f50037f6944075b0
SHA132bc45002c8f5a67ace934db7d5bbca204b02434
SHA256072fc1c3cfa567ef24d756562213f1410c5f0fe3d0fb75308f10c54bcae8ce1d
SHA512056802357cd7d36d2e202bfe51858f5bff19e4809088d1487f2b02e1f990a80c668ee52f20ff2bb1bb0f2da57b252c183159162325b517523f698321501478d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57507652aa628095efb35531b33d686f1
SHA19d37a2bdc6690da979e50186bf9c1be30e361be8
SHA256ec97224078fbb341805035b39e196a26049bce6d7b010090cc38071909562445
SHA512bc6454a7a3e8a2ff281aa764c23ccd13e431b275bf8bb4cec3a006bf97eb810f2ceb7695cbeadb8b644d07d06714e5b9ed86945d82ccdf59a930af0c5823ecc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591e97c8ec0628aec4848c0ea6ed29037
SHA1748a477cbc13a0ad7d40ae29e87ee72b01c9f722
SHA256e4e58d63024eca9e9636e8e9d6fc311a619e3b74cc6f1b255bcee2399c6cab05
SHA512cd3b23e05b4e338f9264bc5aa75b54c3a1687198bef2bc8050b0a9dadb7af9142067c1a9e687739def97468b1215eb89710004eb1512f99169ebcc6ed508d9ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd7adc35bef63fa8c09caa7e81e62988
SHA11ca6cfc623487c5e58baef52c36cbc1a8a81a975
SHA25656d5cc744efa06f64d4a704f32a73b5bead0002308968473a5f0e6fce3b80170
SHA512afb116612282a4565ede4ef73ec1c0204528e494848723ba68c13adaf2b234c4be0c449ffe33dfa6ce95d02fd0b046ced6e15c4e07fc07bd2f3cf7a5773074c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9137183c0f7f6d4c26679c0a95141e6
SHA10dba6a9ba8958e92ac033331a4ffb894a1b8afc5
SHA256c0458a342f5d818a8bcf255ffb5281565e6f19c0263a0e3090851fa0820f7a42
SHA51249fe9257adbb778ed0486d1364de3a0a04f7720ed01fbb43a69e64aa9264de04477e5c41cbe967dac5a4320a25732c0d483141c62962ebf1d836cd31084ab505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5fb316c78a4b985b0a9332e5f8d26d6
SHA131352f91bdf17e97dae0e0904888f11e9cba7182
SHA25634f7247b09bc58844b79ef1b64ba825271cde0a85d88fd75bab51ca282bf6c65
SHA5123d4bdd56f8f071471644f427bdf65488c23216d309681fd877d6ad78cd1d04dccd4ff81cbcf8ffdbd1be70bee4ceb9a22b24b656645055e8924b46f45e321955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bfccceef7e4e67284d719dc53851bd7
SHA1a065de23895d2064e117fd1bf446e3fc3f47d6d5
SHA256f13d6bd0a9a3f1258552b1a0f27aa6d36433234a60ad5b8af36151d5c135e78d
SHA5121fbc8922833e3dd41892e04614bde69feabf50d778223c53271e48a0249837164aa189bdec4eaff8924291b807b495273bccbbc7c3597d41d1f5a36d0590a63b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d1e33ccc0527e74cae960f0e7f924b
SHA14a5b4379be9d0e04b40a9397f71103874b8bcee7
SHA25685b8acad278152c17388f2a82b06ee71020e17e25270dd7b26e16d35fecfecee
SHA512f7120c1dc4fcb14ce4903b4e0b78e3501220e71d5171ddbb75fc0f8ad1ff0795ce797c5915b2fb52ec1ff1bfc211d659b70782da9a09ddb4d1f8969d657d391f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3be25d036d021cd3148de874bcd5e9a
SHA15eed3c4966673834c3c10e415076fc4e088fec1d
SHA256baa7b064e92da5d505f44a7fc46a59149d641dda2b49ad05a042c92e4154bde4
SHA512af4635840f5051a352dc8ec873070226f7d6be42db55808686dfebf4f3cd527a15ae7df56f6d1fa50a7cdecfdecf3da59a0a8dd4f004a508597caf9d9720f442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a3a6fc4dedc09ad1c08e3af50acd3d
SHA1116f87f60f3dcba2bb0ae1481a9eafb79bbb9b5b
SHA25627374f289418ea8e68ea3c30117567c00cc23c4c6dd031de86371fc4676c5ccb
SHA51223429e3b8ac423f4989c30a90bdb56f9f64a3dcaa3000756b569e442b1ccf76b4571346c1c9cbf3735366dcfe050262188725e02e48bc2c4a2d4a2ec8a92bbbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dadc3c00566854e7e84e17c5fecdb0ce
SHA1f0c1c7622a855b71d7fc1e616e4f75a03aae0f2c
SHA256ab2769abe950c8b449005623f1bdfbac396323a08194c0a93c9f278bd49344fd
SHA512e48f830a2f56bdfb79aaf77a4b487ee2cf8b613110e4b41e96ef5c851aaaa99a1756f2301abc37abdf04e703e8d641576a224d46c411c51b28102102629dcb20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a23c3c8c9fd3b8ba09cd5bcab44903c4
SHA1642e2e69599095ad0ca7a868469c900270b21895
SHA2560feb1823c4c33b0f988a5f8446310e05523464c594bb99a0e5759bbcb31858bf
SHA512d6fff823020fc79519fbadb7fbcc04695f43f1bbf4db4a29b4692db44a1b2657ae51abcb8949c6d428c3ccaf1412e6a7863f977d63fdb5ec5bfac55025a973a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab055906859d34fc0f4a71440521bcb1
SHA1c7be5989ea9340dbf9cd482f5af468de8b70e1a3
SHA25663edf08a5e0dee02d82edf3a76ca729eb334e7192893f48e1b33bc42749b7679
SHA5127083a97864919f185d63b1502872a166dc8754ff89ef366f8b2bc93a2823528e8f836bc67913e8647ddc1989b036d0710f22d2a81620ec85750455a285fdf967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5314c3cdfd7051ecb6c92469319907a25
SHA170c041a6ffb5814a29a26660bb5284f9456f516e
SHA2565d6ae9033a1b630ea4a1a86cc15ed9057823693030f0d8dd1ccd8e1b3e4924e2
SHA5127c79dcebfd18425c2061292949283587ecf4db4a11b5f5ecfd23990c8c61a5221123737b827bc8254935a4e3d36992763e1d7832a2ce0b4ccad2813fa0142e82
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a