Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
69f718cf1b46a61455537d88f6683e8e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
69f718cf1b46a61455537d88f6683e8e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
69f718cf1b46a61455537d88f6683e8e_JaffaCakes118.html
-
Size
4KB
-
MD5
69f718cf1b46a61455537d88f6683e8e
-
SHA1
ed4e572235bb74fdad2531548c5a7f3c3a47948e
-
SHA256
7594c908daff13f612a46d66994e2545f74eea95e84d69e7292bb626c86e4b80
-
SHA512
83df5025c774b667b9d5103049bf10f3781086268f214fcbf3beef16ebaef822ede6923020e6b71a89873c649892113e8ef460281c482a2c74edf124fff1267e
-
SSDEEP
96:SI/dJIYnXNJu8akjpB9vUFUltg1a2e4mD94DDGqCMLJ7JS1QgE0v:SIzIYnXru8R9v7tgKfbsSDEw
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422605820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d05402cbba2c14188766fdc5d76215c00000000020000000000106600000001000020000000a49290fae1c9aad54dc9206dea34c6b459592a5051c1baecee4cfbd0d1e87e06000000000e8000000002000020000000684cdd5ef08540bc36597de5a688eb53641ee935198dc61157576be9e3e925b620000000fbb32fa51e5d4d58aeeccfb5e856e96757be395a973f9604c64a9c2c4c3bb87e40000000120950aa4922451e61a00908df3c20ca034966a9446638e41d5377bfb171622f2deeaecd2821442db71abc5a5a63f4cf73e099a07bef96d0598c24114f2a21a0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307dad68d6acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d05402cbba2c14188766fdc5d76215c00000000020000000000106600000001000020000000a5a4ff653c58d9138ac6bed399585fb890aba3d78d039be0b40b2f27e46b91a9000000000e80000000020000200000006c9f677aba8e73587d897810f18c255c2d98599242b665051e34d15ae6cd907590000000abaa0c3d8902ece232ecf01d2d1b0056fadbdaf5436018d686fad73b52036c9b9c3b4ebe5f948dda0b658fdeab9a1d94fdaa51e454ba06443485b3cb0c2d131f55f50cd7f63b860d20093bc0471e4be0de0f2d2d2b05ed503d2ac74ca9fcba320a90a30102089279b29818689a562c57fe0cfbd549228f06d2d94282536711b7eb04a5d2f94d59a1b6fc0f1cb74673b5400000004a8fb8c41f691ab7f97fd728374e48e40a0b08ad4d681f341d2ffa042da2aa15d81394954b10e30e9a2b951f88f9361e42b90db044e1a90e709a573c083a9057 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94129E61-18C9-11EF-BE0C-E2E647A5CFB6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28 PID 2924 wrote to memory of 2560 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69f718cf1b46a61455537d88f6683e8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ad698b4b39ba52b3ef0d05433267c8
SHA1c609012950e95c4b3b3d874771ae24f4096facda
SHA25674ab5a589f3b8acfc1abd86406ac455fb54fe64d6eba8a819858319dc7baa0b9
SHA512940125e51811284365f7fd820d64a6fe294d720ed889ee6ebd0e3f3ea19443f63842a8e7fa76b22494a5c16b5e6c4a4c3840f1402c987598a5bbf010b75399b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc02aff57a45ebb5404e10eec1e4f217
SHA1ae8b1c804ea8006cd751df37311c7f827e5eeff1
SHA25603ca38cc82ed2675c767bd3c04e0a2eb22922c1680051ea409550149c6f45ba8
SHA5120f72b00009d4caad75ac3d45a4b457e5713864f6abc34585f56229d97d74c0ca1382da79280fb81f52797c7aee63dd9223df05a84f582d169176b07328dddfe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51c88b76fc3dcda4242442f504cfed5
SHA1d19ad7849e7a7548f892cf6b0a072d767823888d
SHA256c7723ee2fe75d0fb849c6ed005ab0e24168ebe1623099a792cf93084eefc481d
SHA512907122e7b47bf43df9d29a25148fcfe2d8b911f366c3b867f9ebdfae34ddf0104471320c068c2c8a43b10cc5339eb4bb8ef64a13975bf836790979029ac9654d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc59e3e8758012186e897f37868d5fcc
SHA1d023a5147f5014c07ab02ba97b4de825a8308dbf
SHA2567c55ff90f909b044c3f0ada92c3b52ac520fdfe588e9e7adb793161d07a878f8
SHA5128c38afc231741f31fd2d0bea53d0f9c2e15031a657ecc12b1fad674d5e3d4a747bd4080e883f645748394a107dc9043d845e923d91e574669b5f215a37acd138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5578ea2b2fddccf66fe4b3ba69692ba69
SHA1e5d1395e7549595a87179fe390c2c68afc2ffc6d
SHA2565fec55618ffe7262744876a8f07cdccebc467ccb077a0e472db6e18361ba5072
SHA512b1869aa75401b13aae459728d5f166df8cbf22a2b101209ab8cca945d61092834927c13bd5563d6546ee8802ec0dd4364a9d43b155b5ea7d455200e418efb856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5388660f29c5176aadcc76be6660b2a97
SHA19369200cbe979e3102b854c438099fc587df5a0d
SHA256f1b23c4378768284d5842be3cd9f74499aabc3e65a9f85403f529681e631bd39
SHA512b1eaab665bb5c591e383f58049c943190fb90ccab4e8a9280d0c56f903d12605502df8d4c3dbe8ff071b2fa5d2cbd5757610ba5d08372f97e02720c0dd9417e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571d46000492f877928642a04111844ac
SHA15c5a51057245871dd3ff89fa02827c27bc9647f5
SHA25684d65f1d1474c0d50a5a031c87b49ed8143e03bfc958bb7fb1ea6161c6a925f6
SHA51279a21be725f992254bc916258c05acb88fda8773d667103ac5ad3505247c71e50ce4b37da89183afe47eeb9b2c907fcad1a4fb76b35aed5925a2f83357b1fb04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a702960591c3ee57e42ac55beed06beb
SHA1f8e7a0f2cc4339384e0c6dc94c4b13a7109acc64
SHA2567d07daeb94df369b524698048b80c330ae9504f4f964c038ecb120b6b94b0ee4
SHA512e24f452ee52328c59ded8c7e8f5ff64bbd8380fed8a55777c78eb82b3c33169a7da18b0e50ef29bc3f6e42e05b239b4af6e0977154612d78981c9384b6b7762d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bae6039b67a0d39476bda75bb1bbcfd
SHA1bcb1b2035e68f39f5758ed8375f9017fca88450e
SHA256498ca2e909b27a7442c113c55ec8c4472cb4b867025bafa05b070cca6813aa85
SHA512bb6b2b2ed9661a50de465e9c62d04b83b231bd1408f650915ae860b56ddb34f35fada9efb90412d9927699c692bc77661135c50718613ba80d894a6b76722c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5301409b9e6fdf4625a50b079d031f067
SHA1495d8523c263c42816a52e07f7ebb11086a11d95
SHA25673ba1be2d0f121a047f26a8661c3d246360c1d558bf1fbb65ebcc3901d26bf2b
SHA51281f41d119bfd9752c945e370eea9e7f6f4b59638c93324bb8bbce027fb005a22056a0a2a2609d046e8321c29207f3f5ec59e05f21cbadc8f11917fe804a08f33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9e5b4252dff17aed74e0d436868b29a
SHA1cbdef5ea5c7d41d29cd5ec3e35af3bc2b4e08274
SHA25686bbe8cc5ab0b0d17a198ca20ebf1a6e5c6b097965e9ba47be1c9a8339a70488
SHA512e37befbaac47dce15a95c1eb753e395e3aaab4f851a4afda7a078ed5b0e33527442bf0c449591a8756de9c80de77373e74c6f38c6de4e224a1408e0a7411dedc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fe8362df20913f36dad6d2a1108dcd4
SHA10007644dff3833e12261145467766efc8817e0cc
SHA256504535003735053e56b496df91a5f2b22c772028cced2c7da61b0300c7f6177f
SHA512ca75508bf0ceda2dc505f1bfd27c83dd549b7d473182e001b6c58453cf8ba08422f1e254b7f83548c2b7b36ae5d02b9da8ee3b03db607d31a9fc2907298f782a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c5afbaecf00c551673d6230fa685691
SHA128e682085f75ddba4b17c62022649143c6bb1208
SHA2562b84dabcaee11d5e33871dc4313479e22be27861a65f17dad1d896d64aa27513
SHA512ec502e7a68a7e49fbccc7a237b7f96110f4080b0031ea99a62a3cca55fcd078f7e194a6378522bfb4d30d5aae1b5a64360fada71cb20445c4c37733fca6af208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1d741f37fef9432144f175b82dd2742
SHA1d854b099d00359272c758b13a349bc879b38813a
SHA2562295ad1c512c3f6d49e2e62326506de227916b65877e55f65a55be47881bc06c
SHA5121f8d46400c706d516746f66dfcccb52b1dcf4dd3be331beb853c0e41f3d2d57522d119f8da6396a0ad90059e762baa4c9f0a54f879b7afd80831f9df749f13bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f83659477f21621a81905055f8daae3
SHA1b234e157d12bd64a5dea25c6018267ae4acfdf4a
SHA2565c7fa8dbccee186d1e65dc28480df96873092a301437bec042e9375191525f9d
SHA512e157a6a4ba4206307608b2338d423f26fccb7b9086c2c6f271ef163b09c326476ae5ca17166d4bd5d9d4ed699e6afc734f8611655c49c0c3d3482815a442eae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6ecaa943c2342d784560fae8a0f085c
SHA1aad3580fa0c59399214f54ac966051a02b153b11
SHA2567b3842a42b78ae722637d2153e71a4894a5382904103575ff81dbe21a9f1590d
SHA512f59cba63503f4a72c3693ffb3b43bf642861e97374aabd8d746cb82bee0f85a1decfb9459a403aaf22b55493ac8f8557a47117b27bd7a60e77e5b286dde63bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5451004536141d2bdee3bb86d561ccf36
SHA15035e816e2c945230558eaba0da3ee5e3bd9be19
SHA25672da806211629174cf506d635d78f92d8bff20cf59cd472bdedd4468abfdb3d7
SHA512f21d669f469771b9b994eb82b8341fb5124f2f4bcd0b25bf05dd7cc4122d406adcb881eeeb503569918ebdaad29cb11aab1d5ef1b75669c9b3870a3ff0639dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea8b172a0e7eb8c2a6227dcf7ad04a73
SHA1dfb065ac3bdbbaa840061a86622775d41d9a4e71
SHA2561a46660b0d69a621cf2c213024e931824c76b09fca96bd46331c83ace9c45310
SHA512dbcbb96b28562e28ea4729a8392eac7b6315095ff06eb186ba964decdbc6b4803ee9292aa7453c419bafb48224cd377ad11a9cd0c0891a4f3fb1f2ee28fb69ad
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a