Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
69408c99725d83caf7bdbbb1d63cddb7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69408c99725d83caf7bdbbb1d63cddb7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69408c99725d83caf7bdbbb1d63cddb7_JaffaCakes118.html
-
Size
911B
-
MD5
69408c99725d83caf7bdbbb1d63cddb7
-
SHA1
bda61b9a1827d73c045a1dbc4789abac3197a9e5
-
SHA256
9c31bc7f1281dd9a8a82878da03167cc63368433ab834cd22b22c2dad7dcd882
-
SHA512
ddf83802cc9abc42296b75bba41e1b5da50e5729b7fb6a2002106427277e01e54edb7a09c6ee0e98670e45dfba460d2ecfc743a9b3fdf181a4c998d56512e3be
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b054b5acf07f24d924986b120ee8ff900000000020000000000106600000001000020000000621ab40ed9643acffb47adbb2692fcd461edaf7e81df47c779e96c687cf46828000000000e8000000002000020000000469f2e9e123b35d584fceae1d61715c88a0c62e0552cb3f954c665af2cbcf7c890000000889864559557bfc2f7427050a0c90e43f1a9db7b17e7a73b6eb7809cbf5a074ba1ff9e5aac0196cf16773b1141145eb4aa8e2d0889dd101d1ab098c8dfc25e0aee889976233110e25c4f6a1fc159048b9417d548605bcf92c54613adfdcfab7a2bfb6a1a05ddacf78a418947c1be9cfdf909e5bc08602e38dc922d191615faa576b3134b577e459f6b681d9f5bcd87df40000000142aa4ea14dddae85b2423a3029889ef2aa769b56c4c99e0a0db7087ad177190e1c94fe94944ffd719d0f620e2c396455f6d471c0545fe6d150ee26bdf75c774 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b054b5acf07f24d924986b120ee8ff9000000000200000000001066000000010000200000004e31e2f5472a7b2f24ac40d9ea16ffe59d8a135a40730198773c24d7cc8d5efc000000000e8000000002000020000000c2927cfe12666a6965d7f317e478b931bc7ac6b2039c05578d348a85b35878a220000000fe4d02d5eb9f6860d2a99ec674b3805e5eabf833c8b90b92024abdc5d6212a2d40000000551696994db3bf0e5584039086d0988e1e5518e84b668ee4d56a41441582d1530265ab0d7c67525d536b3d6f50818c4c00830cf41a1dd9ea633852ebf0689f14 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608e9887aeacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2FBEA71-18A1-11EF-A293-4AADDC6219DF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2164 iexplore.exe 2164 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2164 wrote to memory of 3068 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 3068 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 3068 2164 iexplore.exe IEXPLORE.EXE PID 2164 wrote to memory of 3068 2164 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69408c99725d83caf7bdbbb1d63cddb7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dc8c52fcdedc0bd5fffbd2ae4ee0371
SHA1b1b7395ddf4036f9f0c5ea7f485d632d065b4cfa
SHA256abd4088387ec7a861f7fdeeeb4845fa3c590abae6293780a69a0ab68c0f67538
SHA5120ab86f9577c9e8d1c4d076149ded3d84a58276c33076fd986c3abcc89026907cb01a18e8a1c55dd13708f4db87d86badf3ca3031fa01a8e8cec9de65801b6205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7c813b2d358fb7c76e19ccfaa9259a3
SHA1a8b6df52a44c9f8c51a245dd6b5cd31ccb0bcf01
SHA25681ffd0ca0aa61c3ee4149a4d1712b466c6ec9afedd6b9a97ac9d456fb4e11769
SHA512b73c4562e92de2987863d6322a08467ef14d48ef0e01573acf2fe6934a9f997de82fb99419b01e7e5f90cb7a0e795cdb22d525ac9c1d090575afd84d066b0ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c86d28173f9524035044b1d2327bb359
SHA1c59604a0bc66a4856057e3a61404d2f5f2e8bfd9
SHA256a4ab583a5dcb06eb3185348fa51d5a826ed4ab9cbd52167012639e411c5203ee
SHA51222c329c1ac8f1ea90d4b045311098de74374f7a70055aebf44ec0a7132e78a693515af6bb6e936ccc5fc16e79d65521560fc8fe7a40ef8eac2fc4889e44f591c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af18f3c1e5436326b316e175d78bf9ee
SHA1f1db2fc6be78443886d90b203242b0e204e1f76a
SHA2564d1d28f1f681cbd3dd89c79213bc5e14f62f88fd3b4050e344e93a664dc114b8
SHA512cf6301b8a1e0faba719c4a993a2589382befc477131e58f2a8d1e4177e34fbb6730e5e5184a2039ce10087f7ecb5964f6117eddf5c1d0303e060c4bd4c0b6955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe3e8597416ffc5c41fd41aacc5e75f1
SHA1adb897ef6b292c55fe0294fff087912276196ab6
SHA256ef74cc579e9fa1f0f9baa44514ca4c505d07c339a89d138061bbcdaa2b944091
SHA512c0abfdcc90788f48f5aa72e22b2226d3a2cbf0b27043ecbe47924edc8697ef2e216848dc862218cb6a8120d78ceb565a388831d7bb114b316cb61584bc19c823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e5ecf4471f875208a062906759aefd8
SHA16a15ddfbf70bff44907884fa09fbb0b67cdcc7b5
SHA256e36bee279e9758ee3dc3c6d76c2af865c4913f3baeb469bfed646b580a1c5bec
SHA512fc8e8f22513a3e9ca5b79e9be3880b4d2b86a16fb1feb2edb26673bbba3eb5c6821a7250a36a139bee279ad0aebd9645db8f87f5599daae6b9965f814a7c52a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5deec15271e759ef76a17ebaf80541fdf
SHA1877c8ff2858cdb9300e1130fe2ddb84171be3271
SHA2569426a1a237e698dcfffd9c3107cde388eee9d238c250a4c8da11bef991792cde
SHA512701214e34cc9d06927bcba9051fb860252a01d1464474a37afff184627147a6aff6ee99baf8efdc94b93d911345b9b1856d0339ea8acf301e71610a006240371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53765f39b0c7248f251a96c3715ff54b4
SHA14c5b204b744631502e85ca1b3a0a828118dc57e2
SHA256e00953f5d33916852accef80adf968e2af13dd7862c21f4cf2a1c4cbbfa8623b
SHA5125e9374449b8bb2d14c558905af0f6994479207ee2f0a0f8fd10c33a0295bda9831289e5895d4a492fde9e162ef5a81acccb8ec7544e540cb3773707e1f7e0a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599a7bb8caa11b2e66969c67a6ac73744
SHA1c776bd3f447b67d02b695180b1d886237d237d22
SHA256d7c1e5c8e8d56302fd09f2332e21245d832d081d39bf7b73f348651cc9ba7b5b
SHA512ad10de18046cef073eb0ac7edc39aca940e4ca6f2f019ac898f90a58a7153e4aeab49fcb92a204f2fadf7358a83ca353d7d1687dcd8c85e2eb6de3b4d79e994b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5082536cf95108d6c5abc6096bd85a3a1
SHA140781bac2873b2514c92d23935e776d97dc95d8d
SHA25687cbbf394eec5b830a4ea71fcc159e4c26a4f8132ab5686ebbba270e11d8983d
SHA51291b3f4faafc55f4d3ea5053dffb24127b36b21f2789ffaa4301c1e241b395975a4be25d96db5a3c0bcdaaf68f692286d95c291b2032b5dc786a25a820ed03848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8a2b9e7f832ccdfad876ca91a142275
SHA1f8f6f1d007f3a9a35f846cf6d7ee564b287c0bed
SHA256870f9e1e99ba5a70ea067613738057fdcc5149a23cb5e3a95ee258da6c58fbd6
SHA5128d1071b097958f00bc180e93e75d52c543b4db96457056b3af295eeecf9bbd10eeaffb96befbe5c12214fbfd77ea07ea32720d0d2a3c7abb57ee5e44dee8ad6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ca7d07e84ca73dd75a1307fd42401a
SHA180853dbf30486803f8d0950d33425479c9fdb9a9
SHA256486f811fdcddd75505dc0a02103ac817b964c5d6f4ce1cfb73b50c6f16b52f30
SHA5121a7e354673c3a781d5587e83029cb6579ce84f95a3013fb320567601403a6c76000b58c72b416cab43c158d603fad5de9b52fd195a40fc69f1a3adde6e9c635a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531ae462002887e2ae1d89c901aa328fe
SHA15aca8b1610deffe7d5b9cdca85d94c314e00bd9a
SHA256c2c9e7de6b19e50719478503413b0f3b5a30a00c67090dbf02d54fc634c31834
SHA512eb4cb56bedba3f9ad7f4629144e0e16bbb807711c45ce04ba490bf68bece663871471c7771220648153d8191ab891e1934e14ae9bc762990c25946369e3b3de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595212d5569553cc0f5319668529eb93f
SHA104a72de4a18a53127be015d6204a21543f621baf
SHA256fe5b3a6a1a268610b4edb057763ffdee35cce9a0ced09a6704bad5b631447e7f
SHA512b73d0fbd7b72701d25f6d3708acf114601a23b89958e2db5160dcc0c20fb9ff7719ff34833a5be9e9f6a20db31514d4f7882d2a1342e1f1376fa208464fdde83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f25280349e65b64c317b74ef64bc771
SHA1dffa40fa47fd67fbc9763b2d9c61832806a80124
SHA256f4e51d0526190e89f58025d6a09fc606c68d704ae2aea52f216315fc7154c56e
SHA512a21bbb24cef1c0d9c2a9a03f7a81a51a48c6e9d9968ba8419b867ac80caf966de1524895f857f9f50dd4d938c568b1403baa69d777e86084d2dee9397d44e4da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593cb8a1fa593e8cab105289f8b0ee635
SHA105137b9e543fbafbbc8e4cbed6815500c822442d
SHA2567fbbfde89bbc378281f3e8b8b4c2272214dfaf22d9ad688a24730d240dccd521
SHA5122fd8ea38184e317c4eddd371951a17a2ba390036ca196b9407067923309c6fd3b2347cdae0a5711e1fa00b58108c7814927cbcc3ec840a31a38f4317c6343ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a905ede59c6e31ee2bad757436e9eb
SHA1889e9f5759c12e7f8a53aa29514a5818ff75cd34
SHA256b77f3a2a8840ad5940323d581e69a8c8526cf1e4fd06acbae527be60eccd3921
SHA5129860715d35582c1830cd5e9b62f7bc40aeee5501b7cba884d62896e84b7139e088541531249be4c83f4f521aab66c6c73ad5a67852c48cc343ac965c90f37b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5e44f20c7b4d939a651033d1d7575be
SHA18cf3b22add1e573df067e2c951f3a52b10186c2c
SHA256403d9f941bbd5927d0115bfc5de0fa96cac0dffca4c1550776b0969cf0ddb657
SHA5120a77a1b5ff2db31b6b6b0ceb006785bed3ab69b5d8d53671637edeb8decdbedff65eae0d99606e7aa6214e111822f03274c8f12d2f5c3c660b5afec5fb5c3481
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a