Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html
-
Size
213KB
-
MD5
694a9d57b7103f739786c48d7babb7bd
-
SHA1
d8c273eb0451e8c7543ac30f4bd6ae21209a20cc
-
SHA256
23fde9fd791be30d70cb9e22cfd1b10c1a14347c67fd046b2c7830e308e77a2b
-
SHA512
c6503174119352ac43877f421a577e524ee6ebc6da3f34acdb44052245e08137f8701940bcc876146dcb2220716c34ffa766aa0c00375a086e20d3e63fc50396
-
SSDEEP
3072:SGmwAxjh0OLyfkMY+BES09JXAnyrZalI+YQ:SGclusMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589674" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC529871-18A3-11EF-8F92-565622222C98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2908 iexplore.exe 2908 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2908 wrote to memory of 2340 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2340 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2340 2908 iexplore.exe IEXPLORE.EXE PID 2908 wrote to memory of 2340 2908 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a17a96ee327ba519aeece9f6084432e
SHA163eb6943a13e4f0919386e622ca5a84525bbce16
SHA2562581ad3830034a0e562ef34ee81073d33201a815a4a960528938c33deff2cc07
SHA512f0337ed93bd0b9de9bc8f84172c9b1b2540df173cdce87bc4f8cc161719f26c79c4c8ff23edc32864b3dddcdb4c65800f266c4510e0dd363d4e36cf97c867265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb139f3eaaf442699da416d5d275cd08
SHA1eb3712e1157d1b9c2ab197dcd26ac3f83dbe4f50
SHA256313db52fabcf763baa6136dfa4b60191e374bbe34b1988f3d0e133feb54d37c9
SHA51223542e1b2afc4179f576200579f4526d60b874a3794c2772e723e82c24a3daa2240465b6d3ddd27de33952703360dc6151d0679bbf3c2015d428de6ad446853f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52301479b5f4e332268d03916dfdb107e
SHA1aa83db213018be720a8e9ba0b31e7b4ff6567050
SHA256d405efe8c6a6ea3e9442f6da7a8d778aacdb66ab2bbcb0269a3a44417ad32756
SHA512cad552b13af83fd0cf91fadbaa12e4ca24ea1b5df5ba5e1026177d1634d4f1b4057550290e87551b25058502add85a5fc80cd5acb6bcbd2f5a0d8f8ed38c58a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e496563612b332b8f294b712ce6ef1c9
SHA1488311aa7b0ec08856c6a3e68724f605a72f9e1b
SHA25653fa09e62f89db730452448db7178fc1616a95b686f3003bac9033f5a8fbff13
SHA51235aa46f54e3fe9337b66d67891ee48c3473a3a34e44a78d350febe2033eebd272dc26a191934e579bdde15a61093dd3c4719d4a2bb557f49926d4a95ffdc9d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58969b95b5d749db327492f09ab7110cb
SHA1f6233c543f74e0bd577945545e9d494381fe3fdf
SHA256644a64ede97d74b317b7462de7791e5d16117012a9276dcda71ff80bf1e6bf2a
SHA512ad36f50920dc6fa0464e1c9222b66ad6b5616e67407103b16f5cda4a2744ce3df350bbe3889a3a1bb9bac932c5842e7204cf880dd2d9bfa85f72cb2a76034ce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c576743b554952009cc297204ab3240b
SHA16f24c368bee9013d2e66f85ec681d8dc305a6fce
SHA256845f0a8bad49e5d181c39877d7a30ef7444cb9df83ee6ba0bfaf4751a583c10c
SHA5128f4cfb8cb76ac97d82b1fe456247cc36c9b7ff1589bac7070caefc496f5f1d540ace4ce6461ea5e0b323fd8eec17ed1e7cefe7f2acb547cdbb01fbf25a4d6d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fde3dd57223021459c81397b70029f7
SHA18331815c070b3762ea94457a029fc8e42d29ccf8
SHA256e81f1c03354c507ec08e751aab5fb29726716d4444dddc2ece3ef0f5e8445798
SHA512838ca3eeff48268b34cb9bfbce92730abdcbc716ddc23b8e026bf96141fdd840bd5a64c1e559a866019cde3d93626fd4808cd399dbc7799f9fb9b6320d9cf318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad4e382047cfb88b89462f920038e87
SHA137d515603d1304471b4a6a9c24d7fdeafc12f570
SHA2569e7e564a43ff38d5660f7f3c7efece11b8f274b4ccbf4b3639814ff9d40431f5
SHA512da352b2759d8024168611fcd47907891c91ee900c6b65ca81aebe9d83795e576343fca6b38df290e696028e95e891d95f3e0ad30ccffc43742853e698dc38e08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576d65cebda447332d3b6fcebc9380614
SHA1e004201554589f2bea2f8dcc506d1bf63dcf8e27
SHA2569d44366b8444825d2a6138e7efc607b00fa75ab25000776950ca62d8d0cbae23
SHA512b7cf2a8a61f2dab666060f64b6ae89849697a77a8c562592d182d51c9ef3e7bf1d116bc33ccfcaa38460a2ffa140c77e81302fbacc77c475655e1995e1106db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a938ac7f82c7be9e4f72d562a461697
SHA166ceb44b4d0606a7ded6349e684feb175e40a059
SHA256d0bdee734d7e47aa8372f229aff965d4acb6fed827fd0972271280168d83cbae
SHA51257b3cced555a700567fca5752be1299bab29232451dcba62dfff29b87efdfb78e7af5525aa145433b6cc4e8f6993272d813d8b72686bacf18bc5319528dfcfda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdd381d0d65145419b77f36ebadfa965
SHA161d6a23aa48728cc6792d214ac31483d37aaf1e7
SHA256f18f48efe1776d1145c5a1b5678d743a578b06231fbea37344c0280d0c9226da
SHA51205e1c3db449c6b9aabd895c1353515374f2145b462a65a7ac27dfb3409527f267b7917418ec204af6ccd97bedb1673b42982d00e38f9f025ecca7f1f8f0cbdd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1f996c4837ffa17d6d5ca2be0b96d80
SHA14342b795ed9605924153d8fa36e62b66466ac0a9
SHA256dec511df8bdc1f208bbc19140762c202a63934a1c3ca908ffb2c4a2bc4b67e16
SHA512d10942b44dc6701a9feb9e5310030afd66a038fbdbb30e2a469c1f4f4b0aaaa85614fb305dd83af21e13897e539124302174d8e9f56717b65c7c00ddf54accd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4906d154b2c390eb67a0d809096c7cf
SHA15be6b12cc88f753591d36f9786794583704ee8db
SHA256c86ddb1a59dc13cd8f6d2f97d60f583e252c1aa986f0cbe17c2f18561b5bf813
SHA512d06db54cdb50db67c48e9c352037ed1f0af3e92ae32caccf3d25bfdedfae60297d4b125db1837bc7e84f6c3d9443e983412426a6e5a3ead9771746f6061985bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579c26d35079012a39fb673c4922c25b3
SHA1aba274faeed6d02afa05cbc2c509b0c002a7415b
SHA2567667e44e72406b379d4c6ebeefe7a1bb8f8a498dfd3d17c16ee651ef9d0317ef
SHA51291e0e97673eb751996c54f1772b5854ffa6f0136f9601a0229209a094fb71f630a4a34efda70997dd80d8b578f2fbde282734e0f59476acb5b167a7e457fba31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3efbfd80664d5893ba473ea63b5a64e
SHA17718f8f9f0e69481167fba6080c6afd9c2f36aba
SHA256f86edff7ea912a99bc243077c39acfc48751201ba2d30febf0ec44ca2102c8c7
SHA512f92e75cfdd84e0de52938bb299e7fac053fd63dedffbc353d144bcd976ab4324b0991a2a0ec42343a22a12a75ec32164fb75e8cee49c1d55db77285c994cf8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe95da69b414e46fd694d6880153dd68
SHA1fac4ee6680188d92fc924e05d712d5e4c9ab08b2
SHA2565ed2880013564afcef332002b05d613a531d77cd49737fed900e5d0c537165f2
SHA512cfb71c1aace611ea9bd1b1cfe2bcf67b0a7f0537734eacc42888395d4e9cd646943b8292e8473a49bee67b2b5480522c5ae4d1e00fd6a35cc4cb6c3ab6d797d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5882f648468b1792903266abe12e2c72b
SHA1d714246e7f481bcfda383f5d1411b421d435fb2b
SHA256c46ca49a6a9aa5bc7b86f3969a419d08f469d05e117a32c3340e2dd55075d298
SHA5124fd3bf1961ba4f00dcbb20763b64e26f15aa5226daa1c25cf980b53c963616286405f21ebd6a4ade558cfa86451b3719a367ea75e7fe139ce5a1764cf7ed69c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568ddc08a133fe0c3a44e1c63081508cf
SHA1c278db16d0cdc2244e4a8185f6d3aa490b9b4f69
SHA2563c17b16049ccd4b95345a578def2a078d6ed83a3a74bf03262334daa1547eafa
SHA512f85fe16f4f5c845f288b929e4a4fca04f6364c4d8923b8d1d8fb306a284e2ab5e65f1057258113fc9d4b666c85ede90396a05c0d24c3da7f9b7801dce1d2b793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50007abb20aff85cca7d8084d7baaf6e3
SHA18bf25b5921be181af3eb92a0a5c250df15b73794
SHA256e9471340c44ab4324558ba69e01354609041aa2ff9e9081166da919fa7155438
SHA512a4c7098db5c6b90cc66b173dbbbe05fb54ff1ca6563addb29ae1507e64cf219d3b28da8319cafcd2e2c1f0186622ee0745e09660c9a69cd711b4879bcf2835f0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a