Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
69212b5c958253a81563ded409926c9d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
69212b5c958253a81563ded409926c9d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69212b5c958253a81563ded409926c9d_JaffaCakes118.html
-
Size
69KB
-
MD5
69212b5c958253a81563ded409926c9d
-
SHA1
f1207bbf35bb03035487b72a8845166c2cdb16b3
-
SHA256
f95e1392a0892c53068b002ed4a814d0ea4a6d73a5f4ea1f1ed87de8941e0a16
-
SHA512
a91e88a4876d9fd3d20c6c57419427fe6439a191aafd270bcdf2727b366f14ee17a502c412b2eb8b700a438ad8bc3ce32f4b5b3f63dff5db4fc2ca74ef79e426
-
SSDEEP
768:JizgcMWR3sI2PDDnd0g61/NG4CFNeG5xoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcs:Jv+TTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04bbe8fa7acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ef205624a77acb48b920041f7a4341ae000000000200000000001066000000010000200000009dfabda81117f8176101da2e212b6c3f8aa128da574b61d1d58343f3164991a7000000000e8000000002000020000000ceba0dc7e5f130aa5ebe073a2f0e24096b9374cd781f0c28ddd055f2ba2136a3200000004f5b7546e8af832f7fe235217499e21873b3579fe48778c76597ef4758569f454000000055e01de18a5f3a911e482d5427f6debcd7b30c03346a38969b704d9611a846196f54fee3fd0aeac8714c243b44e27c850e3e3f3e06355b1ae8e2fd1048a24f99 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ef205624a77acb48b920041f7a4341ae00000000020000000000106600000001000020000000834aa9574577d61ddd0e991926880b7189b2147bd87eff58db21c2a0e7a82bf8000000000e80000000020000200000006c6231b37c03bcce93c096b880b055ac937e4a90f5f4f43c90b15cf1979b3bb590000000318e6a2d4a014fd1b17085d36a3ee695e8a4fa68856c4a7a1b7e7a09bf099c9b77198af2f1acecea780dfe66bf17cb3b9db4389636fcaf26bb40699673288d795c3967c72223e332a8bd8289f84b17ec639263bf57b4ec27c45e1c61e61f99a7fbd4891b6528f6bca9b8ea9059ef86c1e85cbeaec6129adc3a194a2cbdf2c845d25c577fac7bc9139ea7253c3c27baa740000000c2d8080792214c4308ba9daf05e071c00488b306121da94ddba65385c2a0f63f6f63e94e9c1ef1f115a230bc7d652fd511c680323cde2cd5a98272d07b1fa34c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAFFC041-189A-11EF-BC03-E626464F593A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585699" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1644 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1644 iexplore.exe 1644 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1644 wrote to memory of 2520 1644 iexplore.exe IEXPLORE.EXE PID 1644 wrote to memory of 2520 1644 iexplore.exe IEXPLORE.EXE PID 1644 wrote to memory of 2520 1644 iexplore.exe IEXPLORE.EXE PID 1644 wrote to memory of 2520 1644 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69212b5c958253a81563ded409926c9d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a307e9265cc1eb82a13e4f843a36888a
SHA191fe4cfbb45e73bc84ae4f828c75014a1bc4964b
SHA2569e7707322e981c5f855b4b66b5846ec7ae7fe3127e6ac38df9c55b005fd008c8
SHA5128df2e213710a4279120d1024ef6efb9f24eb744d6ae9352809222b4411012ccf5dae0ac7ad34bbec3fb7fc54f085b583bf485c5a4117174ec0d2456e32341324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc842fff06df96062e6449a0705de394
SHA1f1b8116eb31988a21fe34f769f2c93c7cccb7e1f
SHA256f851895126d1f9e1f4971091e17ae14a36c8f5965e783ddeecd97ab56a8b30a2
SHA512c4a1f553e36d5690d0a1f9f58e0a920d53061ba157bacf13f39dd55ee9901f0b645e47e40abde87fd8ee344849cc5dbe162d8d12c739e816a58e92bd9c721a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ef4d86193f0a1e4c7df334121f52ec
SHA12060b8b4f0f819a8104fe501ecca42e82bf3b79a
SHA256985f03e4b5f29273da26ce12c795c99614e55e397d635ba52f9f64e8410041bf
SHA5122e1c1266dcd27b05fe1660cf244ed9e38d4cda3daedbd273ab3c137ef647d647367697afeea78cc618c2050e0691df044323c3d12484c50fdf79a9398cf428da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59206eb9d1d86a270efc6506e2c0723d9
SHA1b6dd05217125ab8e8e849cf7c09508129618fa4a
SHA256f7433aecf34b932ca115034193bfd510c68330cf0eaf80d54617dde5385e2a3e
SHA512a0d351e161b7b4b8d9e4572ea0d635ab202994ba5905c98de4d643197f6ae324e288da05a18917c4a188baa267fb86505ed8a535634d84363cbd4a8e6151fc50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533a4bcab1521b2b275a5045f697da7de
SHA1de3578387a358c3ca1a095ec3f4acd7e89be45fc
SHA2567e7f8e027354c0c31ea99e87253fb374aba084ae6e449ac3bd1f65d3d48f1c31
SHA5121353667456cf5e4e300fcf04d4711cd2fe5d30e84eee8b1be3337e6d12ed839ca3da201eca1612573a053f8cb2b879657c6a47a1ce81c095c0f7e5fa366b25b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cd3ebf41930aef02c9a0b00f6ec78b9
SHA1872656e32eff08c0f513ff16276c7cca6998f7a7
SHA256ba857b8c484d574f5d174287b457f850aca31ac35f35c0a3c6ef82536e9ac0e3
SHA5126e19336be26caf9ef64f185e51cf0e7dfacd7d9b9145a029212cf7a7e02d54556cefd2fa6ddd9c8b4a71d0ecb4e8d8a742d29b4968ddc9076c51cf086cc13a03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5332dbfe08a9b742298c1aaf871d584d8
SHA1c47c67a7455b3e51ca8077eea53ec044344098e3
SHA2564b7114f385b6ff1f512d646dd33d52d4ba9eb40bfbaef7905f6925aee7d27e25
SHA51224fe7195bb50c8b0862097e05130389921ece8f51ee9cce3f22f055f170923ee94db76eea65963c4d7ff821c21372380a601583c1d163d59095269e8a9b3d8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5732ba45398f0d24e826cfa20400354aa
SHA145876c88ded6b958eade7f09fce57542a249dac7
SHA2566b6d84ffb2d5208f5dd2ce85d734456fddb89b83f801249eefe277241cfecee2
SHA512d835e85578f1680480219cc80d560f77018d098b6ac351f38a4fe5c1b6b87705802c240ad8769f4e449ea57a73cbd2b5599bfc94c891cd4cd52c5810d6b69883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d172f42b017196ca66750adc61a4913
SHA151949aaa743d3b29abf8b0994d37f2e5970302d1
SHA2564c7037dd42244c31f99d92dc0042287a584ca75b821dc0b62f07983fffed4482
SHA512d009a7b421efd5485772a1575e8c354d038212f8f6288cf47f3f13fce9b58428c30acb1b56d30953acee5e4abe7232b9ea550b0e97daabd9c4184504c3ec7ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aa5a3403cb984f58839b9ef906355b3
SHA161cc7c3c844b2385e2cd038a3ca05aa2a047e562
SHA2565b0d6624b54fcddb945a1f6b338a4bcbce9b79b2de4c9f6e39bf6ca4d4ea0321
SHA512fbbd657652932309768bc135280a29bac547935f38c3c377024b99eee8c877f9de3753770e6da42f8ddc1ad57868dcb7af84bec9bb77cf13e763d3421a349117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546530fea024045552bbbd1fb9ed2e225
SHA17e3738ebcc3bb029ca1afcaf060bb8ba422b4c60
SHA2568289ab06d356999ccd10a6ad9bfb29da455f0335189651b3bb6fe29be1f4824a
SHA51200dc81c73b812d8b389db4caa2fadc39d8213856cb8dfcc12f262874e23ebe319ccef692f580c1209af8634bb6d60cafda484ed093ea949908696605e733d742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512d374c4210491f2d38ccf56ee57c72c
SHA1fa821375445dc4c2d3dd0be02ec20505d3455008
SHA2563d719b930debbf978f67bc218de2683a4b4bd75786aa5a2a2e11f04a52dbf559
SHA512cfd3fae425560e00312eace8b66a62bc6ef5367d3c32ecc91a9a056a5f81c5dfe6836abbb107d1c2cbe37d1e396ca870e592ca19dc26e955cad3d144212f852b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1453ab145779021be5c76bfb93304b4
SHA1ced93aaae7669dba69bfaa10a3cb2f14cedba01b
SHA256e575e84f7274fedda5fecaaf9fd1bd12e3d61df6cafbb2102ca3fc25c4140df0
SHA5126355cdc9bb9173ad064d15c5229ba6b6d0d553434b66554d75d73614b7cd3deae7f26de744dced76998aeacadb2b679d0cc1d9976dcb6e7801814fe0c752aa29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2c242703038b950506fbe892cc9bd7b
SHA1e9644db2f7a479076729bec352bbfc8a63d1afa2
SHA25620f5d26f43bd3a52f28e502de84c1ffc16372235144ffeb641daae992894d4bc
SHA512d253b0094936e30702eace272e9ddf831a869546bc45779c9ace88e0ecea09df2391d51faba5fe2dca96c1bb848f5095c15ffd397a3b2654433205387b6c2f1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faee32f3a69bcbe5c4c534ab357a1cc6
SHA14712bad2de347ef4725425dd72b95c8a7af414c3
SHA2566863fc07d6883d4309adbc5aee9c12aabd785a94606ea84fa778cb63aa1542b6
SHA5126a33a63ac7d87af6618b2ac80963197fd6c2bdcc3458c0d819efde2730fe03c363174d11a6c10917de584c149ca902edfefaae1e97a12124aafbb18d8a6fc4a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b42aa67a41f9b7a9b2c868c75399a1ee
SHA1d4deaf4aa5db40474daf0947dfa61b7eebbdc3d6
SHA25600e70f29aa60c9ad2153cbb2f741ba54f93ba9f45db8e6a41858e82c608b4f58
SHA512f812f4e404ed6626d7a71207f3e61f4c724214777ee577da43c203757552885f52e3b83955359cad466d92f18f11b946c529d95c62729a96f415991b3b88405a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5350c10b5e7521b0e1e68f1af93ce06c3
SHA14e5a5e5983c107a68e6158ef0722f6a48e0588e8
SHA256a0522c569d7b640f7794c256fb7676223aef8224939538160afa1f34fa2afd0d
SHA5129322fbab2962cfd241edcec592c6fae95c7b2db2c073b9c6485a07077d10c7e76c4214d52a4653afec1866499149438cb055fb36ea3fe49dda1d3d9ad9ff2423
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a