Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:18
Static task
static1
Behavioral task
behavioral1
Sample
691de7ee07cd1033d65f0958a2ddfeaa_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
691de7ee07cd1033d65f0958a2ddfeaa_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
691de7ee07cd1033d65f0958a2ddfeaa_JaffaCakes118.html
-
Size
462KB
-
MD5
691de7ee07cd1033d65f0958a2ddfeaa
-
SHA1
7ef3b900fbb5fd1366c5cd5155d3acfc176db88e
-
SHA256
7e85c0ad63ca79999cc3e892fc9275b83f53eaa85310a5440ebe8133ace1ffd9
-
SHA512
c0e45f78e9dead9f7fe93ede908d8911c9c011e908ca0a70488a0c89eb039f4f88b0562c6aecfc3d07975b05bf74a3e19041f6bbe32aeedd84e8153d0bedaf37
-
SSDEEP
6144:SfsMYod+X3oI+YnNsMYod+X3oI+YlsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3T5d+X3/5d+X315d+X3+
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000214fe0803c007949a7803d01da82de66000000000200000000001066000000010000200000005fe139d5ea2b0b1d67ce2dffb7ba197dbdadd541f3fe38b1f14c4644bd86bfd2000000000e800000000200002000000012fdadd75787d916ad0cb0969a8102f4139b927d5c898778419815b29091b6b2900000007b137d4a3821d3cfd38e691bf3b969ab7091d222cd0c8b3089b010933d12901b52ca892c1b778c739a9f3d947263adb23258e034c4c5cb41419cdf813402068abaa050053d7b24e139794b0250583ff7732dffe093acba2a9d9a71f7fd3ba0927bd00317911bf9ba605335c23ecdcf3033eab0fb24c1185d5dce1483dcf9fb5fe3336b0227a7718a37b54f2ce4b5f91940000000a17156bb15bc14c11dfbbc9c03f94078c6cc22ed7c5f34d69e5766a93be8d91219f6943847c2583afd1a55326f874316137733e291cc9838539cc39652dd8af6 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585372" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F81DBC81-1899-11EF-9AB8-560090747152} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000214fe0803c007949a7803d01da82de66000000000200000000001066000000010000200000003504de0fc68073b49289b652bf5398b6cdd1104a23e315fa7fa78b83291d278b000000000e8000000002000020000000b024cca4175fbd5998cc7dad18e9cab7ded853066f7dd17e8e3a328e837830f620000000e1e6bf538a834c3e5b3d9c05ca91c179ccadb8dba0e4e2bc41a1243d0b0c40c2400000001cbf8bcbbd277163bc2f436667b6ad57908bda8e0b0fe56c7225e3e96fcdb8f1d0924fc46ff491a364ae46d139258e82a7cb69a9c3983bfd69acee3510e379c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b043acd0a6acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2832 iexplore.exe 2832 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2832 wrote to memory of 1996 2832 iexplore.exe IEXPLORE.EXE PID 2832 wrote to memory of 1996 2832 iexplore.exe IEXPLORE.EXE PID 2832 wrote to memory of 1996 2832 iexplore.exe IEXPLORE.EXE PID 2832 wrote to memory of 1996 2832 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691de7ee07cd1033d65f0958a2ddfeaa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c82cf5a1dc97035bc5135c69517b8ffb
SHA1013b214d7740ea61e7d5098fb397d3564274d973
SHA256017d072337de9957f0f27a714c21530f1bf99b46cc2f2a072a7382c2fc213147
SHA5127c1176fc638fcf7620ac8d0252d8186fa5a3f872c517919ad74741e934ee0664b236dcf2ad1bde7ecca362fb45b6d5047298f67a41b99e936b3c4e79e884fcf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59708a10bb75dab104deef93e05bd475b
SHA1263dad5329cf2f23949a13feaa6517cadeb8edc7
SHA25698d32fc2a98fbe928dcd85828bdf4a00db06a746faa836ae0f57ddd4d2e3a645
SHA512f96b2a07a5bce7cbfccb66edbdcadd2f6694dbb5cd6bb625addf694d32861638d053bdcd908e7861a3b0a98207d271bae2b53fa4599819512de0438cc8c379bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e1104c37d8fc44667bdfb6e4f6188ab
SHA111d67cb2e6ac653de8066b2b50cd57a1750727e0
SHA25622edf1e981ef426481d7aa1010575f97cd3489f8e8e4cd9a91814f0f418a41ae
SHA512b82669642d44e0990ae7c0d5621398e47dddfee88a857bcf64de87c2bc7905af6a13574bb2954b8cb1d26add98af6cb63735b2fe3d21affb0c0de6138f43682a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5212498865c122b49d014fa1f0dab6453
SHA107fa8e1431162109bd26ff5a47664dccd7a0c752
SHA256871b7da63046e8340be2fb2d9482e6b22746c419a3851261efe7a1fcc51f2694
SHA512b708d6781c5130e730e1f4d2486152714f84efc6891bb7d26b0f466d26c61120ba7459c261e620ac1fe7467c10d8bbcbdefcdd10bbc7116a11956e0f8053c897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ec710c00eb116fa48bf23c57e7728f0
SHA124e187971bbd0c06fd74e043ada9ba008d77ef09
SHA256061d08a4e2961d6b7c2f4ec218dc0a4e01839d42f60967bd346d9b253fd3c599
SHA512587911921b370ee2139245df0e4d2cdf576d29425e51cabb5d33aa9da4fef35f9ca06f295fd7e02940c15ed387c720a0519fae653c9e48ea84001122ca803376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b958c91de8aff6f82c33771d065c3d
SHA1157078208d9dc98409896ab5575a8ff595886566
SHA2564b3795591b07be30be03d623094c21fdce242aaafb14ecd96fb8d878b4549fa2
SHA51214c5e3b8e9450183ba40692b2851b1c6bbe02ad8ea3ef11866cbb0911991a58c3ac225f4afadc42f84ac8142bfa47fdb51ea365d2e338cd810c7e54c242e1112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a51e3aef061320f98648eb4ccbdcb4e
SHA199125b8b4e89e8075bba68531cee23d6107df3a8
SHA25605f0678c5cf5662960bff352c19810fbb533f80155bfbb1429c13af509f7d243
SHA512cba228d7ae9513e1992660b91df64aba99a441b99395996a1c17c7a8a18393109603f17b212b97caa3e795e0afa40236c200b1e1e0b5e3d07f59c9f7865b093e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532b7d0f73dac39fbbea3d86914adca2a
SHA19b82f8d9f7a22f3c1e4c3c0e1dd3ebf9f2022915
SHA2563abf568324105dadda91576d8a2ea6d1726509c1ac21399235d6b4d2d1d0e82f
SHA51295a8d750db740eacb51e83c62a98a2d80628b5f1fc29a0f75a03cdcf76dcfb6afe5510732dd386f0732be810779f957bedbef40fdaf0594de2e0d9f99cc547d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548d533b94208cdbadda8489d38f4ee43
SHA10490e9afcdfb638632dea33c11864a6581cdfe1c
SHA256d7a44d508e01f083eea9c99f701b4a1545adcf45a0e7ca01f1988a507b5f2946
SHA512cc371d044a2dfd6d8d558433474bc6050abdcd5b8ec58bfa27ee884eeea3d72b2abc269b2190c4d8f308749089e038fdfe21eea3cb3414547230784cd3c6de0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57187f05f88d1cf5324ff3c13208a1223
SHA1e40a45dc9c9e4832c587dde6b927cd81b754625d
SHA256a3caf2d49b67b5376bcfd8e668c0c5c365da35fa3378ea4d0d3bf83a561c05fa
SHA51287823577b38c487b0945a25d3c1024922bf86950d9d85a2c51732dce4ccb549cb92e295e1c08851d6d5bba36a10bc6c847bf499cd71f370fbfa58f49b1cc6d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588d60770e13a5224c3c407f75d9e2707
SHA15f43e3a558e86847e557bb23aae8852b1bd30014
SHA256fa4241869f7d178175b89758016a5425e00d52a1fffea18f222e16b58bd48037
SHA5125a589ccefc2a687dffee2a47f9fa1d8a4650c8cfef888f864236087073235a360a8c30f6d05bca9776db63e4145beef0ee311f185cb0cf2807171b4909d42dff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc059253c4f1d62d1160f70ea43d8c09
SHA1deb98c375cc45c2fdd9880628dcb634551b31106
SHA2568d829f49f320ff4016100f7915e0d6b005ff4f67c31fe6419622db489645a101
SHA512cc0c2a85493a065cf2aef2d2de96be84f23e44c9d26f4978be83bf1e3aa2f462582423d22df8400867f24ec192eb1625211bcaf64c10a8b40211712531413d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562d5b693233c97b9e7e7b9ebd99046ad
SHA10687bbd50438e202bda2f8f2eb493b1155e3ac2b
SHA2561a1328dd73d20e52b1a2850d7671deec81fe90d823cc0a2199fa030e46a3e48d
SHA512706674e1936d29225d00407e4a617505d64c18c27a8ffe39aba8b67d6600d672fafd9f6c43ef86ea2adde34d6eda34260c052e9c83688a707a6771279e0440c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5046d7c0ec34bc17be44f8c4c55d63044
SHA15a981313feb73414ca9d098ccba0dbd8f4700b47
SHA256507efd0ccebd62cf44f4bfeebe05330956eb5cee573e322c5272d0e73772ea47
SHA512cce1488f35bc05f66f02c3fb8447b37b1a55960d388f5a8c7d934e5bf9282ecaa1e1077f35f6eabe61ba2e482130bf9938755132e6b5ef00c665fde79a9abae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a7e195b46e7cbabe356d6230c63052d
SHA167b3d8980450d69368e3eb831533a909a519fb47
SHA256eb234764e7859563f007a638af983790c0ebd20d636c03e65eb17aca555abf6d
SHA5124aeca8cec707092fc48e2039dbefc4ef39093b728ea6a9fafe9153e9fa7ea09ccee5777d6c3f7eadfae55c34ab9d93d6cc8600e0e089ff4ec22c7c5a157428d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599408f21fa59a399e3122e62a3ed5e50
SHA1ffb1285188a7c0028fe077c370b161094defb629
SHA2566a26860c0914f1389c7e2944fbf19f1d28cf8511fd49f9f89dc687bc0e113ec3
SHA512a9142f810979e160612188385d8cb195f7fb4608c2046b756eee8c2be1d3677b932576be3ac7fa3e57d2ad3adea7b0fda41be9919f4c5b3854fec287670f4e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c578608e39ed50a433dfe7a9b8978306
SHA1bbabde7fedeb33dc4a463b3e20f8946091f4bf3d
SHA2566ea6c194bef9c6316c7c994a301542861bf91ef264f7de98611e7ffd1bad15d3
SHA512601065c12983c895bf81af3e497a38df151d40045355c4d15c7399cd523209589819087d3fea98753e38ad711a8e16709d4b27ad0ef8d564ad110d82c2583017
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a