Analysis
-
max time kernel
135s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:21
Static task
static1
Behavioral task
behavioral1
Sample
691fabb89d1471ff5ee3c109b099b253_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
691fabb89d1471ff5ee3c109b099b253_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
691fabb89d1471ff5ee3c109b099b253_JaffaCakes118.html
-
Size
4KB
-
MD5
691fabb89d1471ff5ee3c109b099b253
-
SHA1
1beb7eb0619f3c57c3638bd7fb0aad060d9129d0
-
SHA256
a301b5b5570dc5690540dd895bef38ec40873fcc48d6978ca7cd492cfcbb7cba
-
SHA512
5ccc25b4139f80fea98205f5c35f46d92eb1839a2e8490ca7daca8c9a571e3dc6ba6f7bf380d3da67ff0f572ecbcf63710959a99e774443bab55c74f7cbb8257
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o3vQuLTe:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD/
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67900281-189A-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f9887962ecd4340aa3defff3761060600000000020000000000106600000001000020000000af503c901ca904aa7b32483243cdcd632e5d45e7f689385bf6f55392de4514b7000000000e800000000200002000000085faa96f75ac94f23e99e3104a129be815bbf72d13790daddc736c0b866885f7200000005e9ad0cf43feeca6f374f941a8e2187c1f7ff1c0dec83ed32195623343b1b61740000000324bada3a1bb4aa8d6e3413b63def92fdb8739b0f49822bedbc4814b02556e509745b4c7f1af440ec2a435ae690be6623583813178d04b46491ab915b9b1cea2 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309a143ca7acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f9887962ecd4340aa3defff37610606000000000200000000001066000000010000200000003b309f88512968c0fb3adf2caa84532bb17618ec0fc0b2dfae47fa3cd11277b0000000000e80000000020000200000008fe0f51327232512f3086f06520b0a930b899915b7e1011b3f49db8546e1c7dc90000000d6e0837f6a47471ba1ab0794ceaf49e2400e600e28631cdba64ca1062a117b97c1de11da7b3ce9906262ad42e42ad2942e5ba5d1da44b64d99cb0f38a8e02d035bb9fe764718a7906976ec5d1b42ed883bdd7f7ebfaa47ba1793a3e0a6500b63d3b566fb6a32a62a37128eec079c4116d413f4c94c3dac46dbc5d9ee139a956a5fa7717072cfe58ab24b09b4d864edc7400000006aba25ce6116da331955219512cbb000ef3acc303448b99fc12e051132cc22c9f2f495b992f0a9f3eabc86b99d83cae9b6dcc935529c285397f13eeff430f48a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1976 iexplore.exe 1976 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1976 wrote to memory of 1448 1976 iexplore.exe IEXPLORE.EXE PID 1976 wrote to memory of 1448 1976 iexplore.exe IEXPLORE.EXE PID 1976 wrote to memory of 1448 1976 iexplore.exe IEXPLORE.EXE PID 1976 wrote to memory of 1448 1976 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691fabb89d1471ff5ee3c109b099b253_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b75dca319e25544f82cb5e0d055d1b1
SHA1831ecf5b60e51583b2d6396cbb75c90f35ef73e0
SHA256680a13cb4330873cca66668ab2a265c538971efd208b9c02641fc4bc9a5f61b7
SHA5125e820125cca68565a6bb98babd34d044696ea9940ad967f26f16d66b5234ef2cc393836bb6f324599e31796f4100c0a8949b9545de1ed78b4af102596ada9dd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569cad081147bf78b6d3a39f8cf871f60
SHA1e19c8085403e65b7825e1a5a5c2c59db83002546
SHA2568b9f3ec9c631d0bc737e37be1642cb7513535ca6e94976689f2b6297351ebe78
SHA5123a331eca2721fae0872fd777895c9cdb9c8a7a47eaf7e481c4adaa821176ed7f4fe376c34e6c474d29391cfd4af28c9759d6eb861df63a51ffb339c596ef517a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557a23341e7f6957e9396846f8b4c4c21
SHA1a55ad5d94fde35b68991b2bfe178b73b275eed3a
SHA2560489cdc359fb3e0792f8d5edc50dca572f16c670e1f055d682290822d07aad50
SHA5126003f0a1a9a9721f69967285e046385957dfb4d3221a63f7ed711a390d193263f712d3f9146033f785e5bd6de34a0e51b4cda508ba80f5269eb8f1c2697d21c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5328524947c82bc2c1d36a0ca89248cbe
SHA1fa37f5d4206c0c7ae850e39e6bf0497d833651ab
SHA256f7e8a7ea1b43ab2584076d3034f3c528eb24ae7b652d2513de9913e4119f047e
SHA512660372b24743d610f855ab37aab966c24fc9d1ad2cdfe71cb77a05564f05aa40fecf31feba7be7eec8a17e9711eecea8857feefaaed2589a1c1f1ef1bf29f9a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a77446cc1edee589d68de6739b3841eb
SHA115aed5766e134916612afa462318b05ea56d84ba
SHA256695bce52a36ae885259fb0909e9be6ea8e6afcae62010e013c7af39bc9392436
SHA51241198f8302b106b9a6c78d370b742383eacc5b4165ef38ac6333f02d3d51a4af0b626da1dd58f4a96094901df7e37b1b24cffa4217931ae878e4b4f6a419784d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e15073bd312e260665ad85717da39f25
SHA19042d34e515901c46368fddb9a8455912b74ee6b
SHA256a12e997cf0ec842c738e8313c9b41ad5c7bc3aacb941ffe0676022ab3f790182
SHA512edaaaf3f36fc76e72e74bc5d1fd2356dbc9476c444f37891aa20d6e204f0ceaf48d6c94c06dd781489b926640ffc32a8bc232c04203d05c8adb0443aa89a3efb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5179f7b7d1f5eef3f8aad1facd3973a93
SHA1d23cac364c73fc6f9d17a357376f00c9f4b8432e
SHA2565614cc643cfb8432ab82b2adf6a1db771a2f47dc7c2df00e77d9a59650365c21
SHA512a30589384846fa09a2620e47aa275f902c38781b0daf41b32abed2165fb7b65af639c7943b2b80a919a4c15e6be95330b455f8b1f0d6871649cc4013c466c2f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcdeddc821847524674232acdb8604ec
SHA17f044a9c6a8fdcc30960f21ccd627552bb6bd394
SHA256aadc1f20fc8a8e655a0645b52213b19d2d78e44b1a8815ecd22942dcd3cb912a
SHA512947fa5b3a2dee860ed6a7edb6c581169b3bf446c2a80d8fee4889c995e58295289b2e1fe0debba9aba12a58c3d9de22beb6fc3d28ab6ac3020221ef0af4da146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574bdceb2fc0ae083e4c513a367cfb0ba
SHA1da572cf9aa5deb42415ebe09d6ef4277badd65e3
SHA2560a83007948ad41481d009d551f3a14441a8a7a27d62d862cec8146a1ef2fe664
SHA51201f7df9ff1467fb167a15b953d096fbd0df8c7208894e5011aca22cd1636dac29ae9a5f994530f30bd7d630861c5aab0cd3cfe396afe573ea2d3b26ee912c1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5798463d77be9527dee9b4d1195194d76
SHA1714b690ea386d61bb2459c6630f39ab891631408
SHA25647e56d0db0b572ca6c348753c31a0fcd6b4acaed5676fe5849534cae5d3cdd48
SHA512e49ccaaae5690642fe599e2c3a43160d3d33e1b447444670e43a4fbd05797e14d6c906c451f7ee1a47a63d4440ab475afb664d5e1ba5ac6eab64c817481752cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5843c429eaef4b5f5efeea1cf214ea3c5
SHA1bfe5702183b6291782fa5944fac105f07f5d0814
SHA256655756341020b5abd9ff10be26bfdeffe278a06e2c362e4308326f4ca5fc8534
SHA512957ba79eca2b1681ee2d6000c19f9116cedd209dc87143d4fc016f965c424e42d35d122e1095a8e11981796ed6bd16250067f6fea3b0c29902cfbbd18e04b3a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508e5af13ff8dc10875dccd6a4db6b07f
SHA1cd293ea4b8a6f084671afe450395a48f5d16c825
SHA256c224c2b1cbab67e890984399daf9d0f9812e35835fe301b555f838dba78d5829
SHA512725502b185956dd52a4a09634611f4098d5e292e7d487d91c7634d21076efa97f2d635e67e2e9d99a0dd97b196a975f57aaff250b9b16272f4c6020ccfcece8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9540e1720ab7a2756e5ab099c46f6e1
SHA16ec843d7b8738b0cebe593814fabfd8814056976
SHA2561b20d178b5f7ef60251f81891c0cdac2fc92870dcb411d641c16539938482374
SHA51291cf8b136466f3d716f4955fb3d31cdeadd4c02774ce3efcdbdfc6780b7f46aa98105aca2e031e4397b9685c0bc7785352aea124db50668cd3fe14707d551a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2fe9398ee3bad1bd87d091092dd674
SHA15d91bebb4093910acecfa58f54f2b8380d8e8a4f
SHA2560092e10d9ec1a2d63f4721b58bd41a3f6667a49d35fb76b272362613a5f00806
SHA512d8c648a7e57d4262af5e1bc637dd332c2b6e880f949dbc30a31ed662f776c0d0814270a494e03696d5e0ca040a85a1d6071abf2372eb85661af509ce9032774d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534ca89b32cfc12877cdf45cdf525b188
SHA1da6f9c311791ab4238849e9a635ff406745eb9a3
SHA25688ee462a238739cd536101ef90646429ef998d062b110e90f0bbd0ebd0673f6d
SHA51263c9246c2175ad8a61995efb7871a72a81eac836ebf8da71b96ac9e0d4204a81ffc0051de91aac312465ff40fece4169775ff4fdffb202d3c75d02e72371b3a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f8880f104f583f5ec37c1c2973885f
SHA13f27dfdcff5b8ebe3b6194a860034b7e5a7a9509
SHA2567927083810cca805bd7614d467935d2ab0eb81dd613a10ca572c241f25dc8207
SHA512fd6603ebc45dc47fbab86452c2a2d37ec2245eb359cd8b5c876ebed41f1a88f9b5d688140cbe5d7469f0041e6d40cce5c52be85840f6b01a2a647d8501a15511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e508b033d4c2403640eeb43f61c6d2c9
SHA180adff0a7f9508333ec45d768dcf61f0f5836e7d
SHA256727aaa4a30b2917c5184db113aeb8b6748dc28947c730be82c4624d4dfc9b52d
SHA512a9b948a586699515682949c45260825fd977c886fe8605b7c21cec91f25ce07dfd620adc07924814683c54fe6dfc4fd687bb9a718f70f9833e4ae37f9f738eb2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a