Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:33
Static task
static1
Behavioral task
behavioral1
Sample
69282542d3376f7ecf13185e4e8c0f5c_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
69282542d3376f7ecf13185e4e8c0f5c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69282542d3376f7ecf13185e4e8c0f5c_JaffaCakes118.html
-
Size
4KB
-
MD5
69282542d3376f7ecf13185e4e8c0f5c
-
SHA1
52a3d7914702286226cac317f615f4ffdc3c490b
-
SHA256
20f0085ff32f3c725639ac5efc10c46811a32f16174f65699df49c850cae2d6e
-
SHA512
25275dae7db3090c503b334c22848736c9688d594e8605c3b6bd3059ea15ccbb47c32c56820960fbb92c31429f356de7c5db3148799fee5f9d0e15b53ca492a4
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o+RC3zd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDW
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586285" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000390eccf066a6e74d95cb4ae9674e295d00000000020000000000106600000001000020000000eb66c1a4a166b35c62f0e73bb0212a4638d4a9f98cb14cb3c4eed37974c985a1000000000e800000000200002000000088e9d113a213b07d579c0e8ead39549e31f88d89aba36b1b762c8b50df9f044990000000bc8e69e59a2a0b4b4037b91f5d3ccb1b600d5a8c3b17aa1ad2c6f60ddbd78b73478e9a03fb67873551f7cc2be037f28c13fce3067db861f1ff1995242e27ac6f04604321edb570f539667886f1f5d51ccdc950b7b5aad88a5406d47c5c68d7f66e315a13732d0fda21e966c2a6750cc43768282fda34739cc5aebb4d4d5086a0dc1e4bba9b0d80c0b748bd8d730642bc40000000f8d0b9369f2b5bff49db887074e87ee90ccef0bd91ac4fdd8582dc80c19bfd08f6c33f93d87e9ffc803dd8abf3e73d2fc6ca392cc84723fe7b0838df6112d248 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000390eccf066a6e74d95cb4ae9674e295d0000000002000000000010660000000100002000000021794d19a390c7dda3eb0a3b5bb19474588eb6b2288437cac14cfae02aa624fb000000000e80000000020000200000001866d0c943c773d77aadc9a33728d0751bc3584c6f8d8d9945325b7520d46c6220000000da4ffabe59f7440ce47644a775f78d8849f463b8e0e2310d8c9158852b13feb240000000067224e362d5b97e52d9a720e1d36da98360203c3f8b4938ecd9b3bfee2afbbc7f22d2ebafe98224e0b9c29c34f6651e3d345a0fd55fe3424f6611e4576dcf7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c097f9eaa8acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{167A47A1-189C-11EF-AF73-469E18234AA3} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1200 iexplore.exe 1200 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1200 wrote to memory of 2944 1200 iexplore.exe IEXPLORE.EXE PID 1200 wrote to memory of 2944 1200 iexplore.exe IEXPLORE.EXE PID 1200 wrote to memory of 2944 1200 iexplore.exe IEXPLORE.EXE PID 1200 wrote to memory of 2944 1200 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69282542d3376f7ecf13185e4e8c0f5c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe93639b558bde3322ade4bfbe4bccb5
SHA16cba7f5632c1379148db5a762df3b4496e17ad3a
SHA256fd46d0fe2cc6cf07d9efff296b432befa11fbd3d3ac25d05941c464eb00c9894
SHA512ba6381d617f012a247fe2c0c6d303166f9e9388d34d1ab6250f15cfdbcbbcd8848bfda23949b6697965df63d95447e3a96243c5fa87bd153fe35831412a0cf8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bc26874e085ab54e2bf8cd450aff668
SHA1aefed3610bfbac041489f4fbc5bb14f0abff5ef6
SHA2563ffda3444a1906e2f77192728becdf802da4c34dbf9862fbcd1e41f1a24fe6ff
SHA51232d59c58a60abd6b97c5ffbf7e6099c54e335c281892de33618e311d221368300b87c9c3f13745d265f140b58afcd6040a1cf4847bc21a3b7496d4ff396f282c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc5a46892a4e1dca38181d85ac3f1e0e
SHA1e784420e3b060cd40b8e7aed2ea12b2dcf1cb3a7
SHA256d73a9803f05aaa51308ffd9b10c7dc9d452b9e5880953594cc33938fd368fd4d
SHA512101a11640621f1efbb256c092dec796856a86ec2eaa033e5ad9405468e929a74778e504f3ac8986451be09b5175757bdc259a0f855cf012c1bbc643fdbc05084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d45f13b294a767757fdd3c0f810b1d3
SHA1200621b341715f4b10cd385888ff7ddd7a9019c3
SHA2562650a577bd5ad79ca0169028b6de23f1e94ef4e9634b6778634ae278fb12635b
SHA5123cb09bf1d3417dfa47f938c2177bcc75fbc7337dc74cf2f900e1bd378b1ad4f0e3238969b23ede88b3907d8f6a162dd59494259c1f1217fe9e010f86d3468878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb185e72b938966458fa7c45ba0a7237
SHA1ce31e73ba6e024f5385294002506be8baca65dad
SHA256274a22a505cfa32cddd016fab9ebde8e91b60bbac3126b5c38ad9cbb78da4b1f
SHA512f8890bde5c0e7588876f907ecd4da54bb41ca784a161997d285984c3e4f45419a37e4bab455d7d2ff39daf7e069cf9f6adb7c0ce93760629a445f9f8ba6ba8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553b6ae276cd03de7aa44e38dba57e4a7
SHA124475c472b11d653ca6e3739a972359a7248bc18
SHA2565030349912d27989bb9413584a0cad11ef7d80d836cb685eee7f00674e18715e
SHA5122fbd278dc8af320c8658bec2885835d160cdf1a50a32865e6773b98b999af0bc9e5e37ccd0ffff160c6c27a1c606a7db0a5720367895b9fd4771a9704f2f5dde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5f276c8aa630ad72d78c0360816d8ab
SHA1f7ed40bdf3d30cb2c2dd138135d48e360985b900
SHA256b1d75db9ea29a7b3a0ffe9fc09e4a937b63f05b87747e84b2e50a76fadc3270c
SHA5121197aebff13d28819bfb5d6fad7889637febdf443bca275f57765ffc9391a43ee77c6746646dbfd2bb76730727f4b5c02769926804317944a96a928483d2dc32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5467edc3d9015c860e0c80ff8d0220133
SHA11a3bd7a9632aae82439a284f825e4a18fd53da5b
SHA2563aadbea16c7b22e320c2fe5884b633a44042e53900862fe7a374dcd00a858985
SHA512417b98d1d22399a859c0f4d92fdb354bbfff59f23cb3b0715df348bf7a6f9bdb2f28887b091ff4f4e9d88508533a025b589e6858bdc0d3d2d2cc21bf79fce1cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2a5372a3b22261db3f367d4c014b94f
SHA1e2730520a731cddaec24b121b050faa2b21650b2
SHA2565107b4f7274c8335bac47b357014d026d7f6c99e66c2562cc5e33dbf46605c10
SHA5121327768517cc0c664a8142bcc0b3d91ed775b4994e94de8473981080e57e0791c4fccb2a33e079839b114c8bb9d77f9229fe93f2a22c2717c7dafabf6612e8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597bab8da6b415e52cebad0c9fce30ede
SHA1d3a4cdbc537c151ae8133ca840d8805c252021be
SHA2568f6c570ef9a47011a8dea80ac8b08d8ad46237d69d2584e788862c15ecc62574
SHA512f5e5b555edd3a493737859433d4c8eecac1beeff1d4f65fcad3076777e6e38dcd5b8224f8cd107e95b1e8dfba94fb3abaf948cf6f90e5cbd0c71fac870638976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf9e681b960554785dfa1958b5a93f04
SHA16e4b6c39c5bc65ff83c95c6265a70070bcc3d4d1
SHA256269e2cdee4b3ca9a4747395a120e7fda773e89d157d444a198d5fe84e24463be
SHA51297a7bf878e0085b487a687c2dbc1a02598478ca313260afb52cd3ef45c3cf4640aa2c854687aee5ca268b70d4c193e9de0bf9574667aa4a0c392a38e43b5ed33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552c44a4afa170cea4c6413b1ba1ce919
SHA1cbb3d0aaa5d15799da0927808ee3662783def50d
SHA256a2741a0cffa5bf43408c6275d55d5b262ec77d4b591257a1d6db2a6dd635b8a2
SHA512b02eca9e392b9644d935e8c6ac73a539840dab809d6a3da8948110f27b96b87ab92e2323cd264115cc5699a2cfd19f7f6f3d1e918884a9288fe7088b4c3ce0b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5218a1b66b05460573865fd26e571ff94
SHA18b3013caa555c8a04cd50d51e3c20d1b0a3f7851
SHA256709d84185502758264274dd7fba32e53093ffd5d7ebf46705cd9a9a5bea3fd95
SHA51262c387651787cc3483bb8f40f2851c99430e931caf8edd042955c4e01d2aaf515569d1a3c7b0c1e17e6a15befa39006f1079a360e2bbe7c1b57fa65725e335c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb69d4adaecaea63638612e769d8278c
SHA1cbe69e34e6b4b1e730f8602c1bba62dbab7cb4bd
SHA25653489f97c1050ecc6ca68dcfc8f920dd5d3666ec82b1c5594410b485416a612b
SHA512ddfe8c8d7471b3b9ece37b129531c3fbe60801f1173fb191c349ec6f127b60edd3adeb75fc51959b6cde9405336a44e8d85e5ff80d1c13537a66ed1ffe2e21f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526121a08de43ed7a65a9af2d9dc56829
SHA1d518390bd464f7066f24106fd63d6998856912c8
SHA25609354c60a9c8b5625c55ba95a3745e0272f1e27a6492714482c3414ba320211f
SHA512614c6ea57e0b8600621427c9421646c8b2ff1cfd2254782a43fe400d1bf1cc96b8e0aed7acdf9741b2383b019f73f963fcfad840bdc23d49d294a03a20215baf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdbec8253b43c31abda3e39c406766e6
SHA13b73fb6b37b745a0f858764f9005fd983caef96b
SHA256665d22c55f92869155f3d2dd47cd314971ae72b6bac6df437d425d1a7190a603
SHA51216318c6e13ab32a1d22c5f14853e27a9c06d446b102e46de929d6f8cc2b644cc361b270f28c22cec6f95a38de4b5db68bef7719536bad54607fda6c122266cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3f2d67565385204fe418902270c7dc6
SHA1cf556c8408f3deb202d7fc8b12b82ade61d0092a
SHA256f7e7e931ace420002cee2e9ae6153eabe098e5154520a7b4300a045c4ba29140
SHA512256a67e6fae2389752a6ea783cb47a00a513ecd111017af6b455345ae90fdbcecd50e2921244c25032d219a043953ef17dc014f1d0b9144267ad0caa274b48d1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a