Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
693c7dbc94c5fa81e2537d5f0a3e33c2_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
693c7dbc94c5fa81e2537d5f0a3e33c2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
693c7dbc94c5fa81e2537d5f0a3e33c2_JaffaCakes118.html
-
Size
88KB
-
MD5
693c7dbc94c5fa81e2537d5f0a3e33c2
-
SHA1
1abac0b33179e8977e0f678646d5051ef1d7df3d
-
SHA256
d14785a52f31834a59852549a74a2725e4bdd7b3b10ed7d1e83ccd74fb0f6a3e
-
SHA512
dc176600f0b7cda630acabe8249d1cf383385e83b48d8339b57160fb2ffa2694adc4f6e8b45b79f6080eda0ff95568e2470b2cbde3816f88eebc5a0cdb44e8ed
-
SSDEEP
1536:+KFCaJEd177QRuyYvtEYAwmZJTefe3ejeCele9ePevuGffgowRefsD26uUiP//T6:rI177QRuyYvt/Aw8JsuGffgoBuiP//T6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588252" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC24AF31-18A0-11EF-9ED8-52FE85537310} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2700 iexplore.exe 2700 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2700 wrote to memory of 2504 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 2504 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 2504 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 2504 2700 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693c7dbc94c5fa81e2537d5f0a3e33c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_0BAC44A25FE4B71E5FED50FD9F1DC6CD
Filesize471B
MD5b3781dfd24c79d5ed5beb254e3ea1004
SHA1429411fbc5f707bb647bfbf4cc8ef4e640994a44
SHA256d16a4af61841aa88128f862acdfe626a3a3921a8d307c55bdd29d65dd16109b5
SHA512b9d2c891eda8376585bffa29352db5d30459593e029e9bdcbbbb2315a5f71b3e15bc599c318ebc51dceeadc57454ac798c78fe7dc350ef805a285fd39023fb9b
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
Filesize471B
MD552b13ccf1e25504fdc6ee25c4307f279
SHA1d9bb99891d37ff0515d44b11ddb17ad10775106a
SHA256e5d2dab6fee576c0a72cbc7bbc0fce70169eec504a6e446f057331ff89724410
SHA512d3c1f193768da27be28bf58d2b7da8cc6a063c1505e4257c318f1f6acf9537b2a9ac8c0826575c707ee3b550f442ccb3bf12af29e4957e3310a309ac7f216e72
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_0BAC44A25FE4B71E5FED50FD9F1DC6CD
Filesize408B
MD518001020f23fba1a755b39e7ddb71533
SHA159417715905abb09fce0eb68772dc5a74ebfc705
SHA2561ddb488c64a559625c201756999df96a68b76bd6f9ce780965890132c5738227
SHA512a2a63824391053c741d2eaee9024082314b9fdb4479d8d870ee6bc8c36cb38f56e1d8c98fbdf1c71b2db53144dcecc806b7dbceeff89a48f10e87d48335784a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD50c0de14867fa55960cc6ef4d33624596
SHA195d15e73ee88d68e7320072e4032ef816cd66aa3
SHA2566e09c8631044163caf7a7aef981f34fed0a7f5c27dd343caaca5c804d9031b37
SHA512ebf9ba9dbba53a1523df41c080a94094620fa174f611994c8b50df8cef529815da253ed6b9965816598a7be4ed09f2582c4dc518e38c46290437d2dc8ecc180d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed6da3d95a7f3d8749a271f5b767dda9
SHA152832c5a690d8f5a40113abe9b45b1b0e5c474f8
SHA25661a8e3a38322a1265a738f3de8631b8e358a6dbf86e4ed0d9a3c5c20966cd0f0
SHA512d2d66b13a861a8b03652e6df79e7a15d5426bf37998afd38e0c12902ab1e532ad1bd7cba1f1c572d8c75b827fa13fe5548138efa141b72692552d2d0fe5f86b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5726adee7b9a230c09761f8aa47999f
SHA142dddc4ed60d0ce5a2b29b70be912b1dc4f1119f
SHA2568e53261e8e052eca79cedf77f8cfd475e5a7bb18c59e75da3e676215692f8a14
SHA512104fdae9e04dfefdc513a29e4f01e663cc1865450733c52cafe0b04176938df15eaee2fb6ccb654515c7ae71aa91ce86512e1431278315ecc9cb581d0ad84ad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543e100da8af2f8460cc0a62d321806c4
SHA1efa62f99aa528c5ee165565666e4632ad1591d26
SHA25694f5d006808a3ab515cac0cbe33d3f4dd0aa8311d63e1c615ee20a33d1c9f3b4
SHA51283ba39f25220633efda3308757f7a5b7e83306c722574a864668d4c4855504e6c4a08224100f9448db7cbb5c8651d7189489d8e22f72133b58bacca696a24a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5462842312c7e5c521ca366804a594019
SHA1c6f11a4d2aa208bb24fd5033993a65616d56f7ae
SHA25697c381cd148e8387a2b6c1479b7cc65e8f1b345ccabb14a4fd64a9dee1121c2a
SHA512502a79bc1a1f8c1c6a9900580061066bcc566db33a4476f685a0f91c2ed367d0a491f7563cca68734d50510fb4c80e013ecfb9c7a67328e13210bdeff70d6566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575ece1a5d1948138622826ec0108ff4e
SHA18cae89e21316a0b6952190ba1f00ea354526663f
SHA256b5429951e52a4eda0b24f3d285d7f870541fc546f9e99d637eb816596eaf09be
SHA512e03cadfad7d03d743d9b476758871004e52070500f7c0f84e153a421f5678914d3a4d13d9547246df8a391646c3ece69c9fa2c8eee5012bc08f9127233fcfcaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599f036882afcc26414472367e16a7f71
SHA124a3718853abf38911cb39f6b34f7fca82d94c5b
SHA256777b197ef711e65bb14b85eefb4076f7ea20fa14a0dafe8f745254c7f036571f
SHA512b197cb5ec5f0dd17fa3a89053bc1eb274a537ae14d1ecdc3e3d88a2620bdade040c905ab64a94ba2c70f7453542785b09741e7901e783a26e8c5f13b0827232a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d12187a5eeccfda5a10d583b39ab58b4
SHA114bbfc4f8998f15f3b65a6ff762857fcf746d44e
SHA256a8424299cd13a6a870b91affc8e51c0ca722c330e2ece58dd17a47809e097bdf
SHA5128e695bcc29b49a7defb62dba11abd99a0ec51cd10b00b34dab9d3998357749f2dcd9c57284226070c4620c6e750d8e4daed2f22f1f2f59b850fc040e631d67c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbd10d79a9efd1ac046e46384d69555e
SHA1afeae4fb9c926fe2926ad822112c30d8587b57c1
SHA256362d7af7b68bf71cca42acf4ac5f131310b0f320bb6d7db11d74d0be43e649b1
SHA512d1eed9ab83c94254c63195b108db1613c571249fcb68e18617453a1311f844f55bc057dfdcf236c9be5e3bf106c70530983ea01c101a320f3b51c5aec5c5a682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552fc868681a3b9f7727666e023cea8e7
SHA11472cfd715acca01834069b7581646ce5593ed5e
SHA2565aa6e7fcbbea314e23eecaaad5e32a920b0b40f070d43c4156b774fec8590d4b
SHA512e67bdd7639996fe9054add680b24b7a4d6583833335a6f8c103a4550f217f1a3347ff12672df960210b139842584bf3913990d08d29f08ea152404bde9ff371b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bdbd8f33e8b208349fa20f0f7227fab
SHA12c1db1be3bdf711057a4e45f54d62153b5eda7f8
SHA25636fb5ed91fc29f892881a0d87a87e080765f957f0371006066c7d159d0a4f660
SHA5124dd8b730347aa799252f2b62dfda63c84c25cddacdf25d9dbae6fe2da60bee54c80ec77f2167aebadb6830dccb6fae483a1a9dc1aa9ac85a9ee0176ec4037572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4439249cbdd16af55aeb6728a94bbbb
SHA1f386baf02b1662ca192d43fe7f5dc11dd99f48ca
SHA256c420141f83ebc5659220ebabc53d57b57aff3fad36df72116879ea88de956d23
SHA512c2684eb6db58a9618960d73e449e5324871bfccee714b6331b4b81985cec5d3df5acc03c65540bb11edfe247e20332f74cf05aed670f41fd0d4200c91ba30df5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965827105f1cbd155d6fcc0d887a5272
SHA1e8d1afc2b6c7cdc8d9f7f90a042c629612a35214
SHA25683ba1bc963750c0e662cc20410fabe3840cb745155a4e6c3ba9fe19c4b12f92f
SHA5128607504ef7764e87a0dbc9471d48b6a3c7da3a02843518895073c98b3666c44dac5fcb8a08abac31ecea230928cff5999e773fa1c22585143b33dbd33a70966e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f948c5c37c1623264bfb65beb32d2e
SHA17ef29a61883fd77a592c73fa322d3d57064f0976
SHA25655ce364177615175d2f167240c4de5faaa3c65ddc9c8c034d193ac8e34bdddc0
SHA512a5692623d7cb629be3ad03a3b44b532ddd1642540c2de99d4d5e1c329cfc9f1749bbe3f9edae97c01ec96b67fb0cc6bce45a1a3dd66cd29b7065625136226919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
Filesize396B
MD5154bcfe0ee578bbea2a8a6595656f90f
SHA13057832614c843865ff006635df4fca7f645d555
SHA256b1b30107bd20bd05fb9a8ffae084ab45f25119921b61af8b320ad02ed4e1e721
SHA51270a90c91e3b63dbf4adc8386a9a484999d2d3fb9218ac296839ed14f6dd2384828bff0b72afc7e460fa810920a72f4b97c15ed261f0629c57d6b7beda229dcbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5b9ecd8eac205851b89ad76dc8adaa355
SHA10b10d8337a298f44da3ce4309bb3a3add2330c1c
SHA256709839a4cf66b73469fdd2a0244ea8d70e2257767180ed8049052db8d946fc60
SHA5125e8f1ba4a4b2e82032baeccb84240b26419af57b0be4080c9d4dba846a487b9c84afd9e8509e216983fbaa43262453ce582a7bafd9f02e54d3b550447c9e57e8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a