Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 14:49
Static task
static1
Behavioral task
behavioral1
Sample
7977b1d3d11c30b65ebbde4b26350c04_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7977b1d3d11c30b65ebbde4b26350c04_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7977b1d3d11c30b65ebbde4b26350c04_JaffaCakes118.html
-
Size
460KB
-
MD5
7977b1d3d11c30b65ebbde4b26350c04
-
SHA1
cdbf4d6689c2292fa169e6c8e0683cd82d9730c0
-
SHA256
57c0301b77838cdbb432164e9ad7bbfc67ed9f4c50b41ae842c14ae4731e2caf
-
SHA512
1f8d57229b512e558b950aa1e7bacbd5504c2e8f2d1d3638f5adf6e4f908ea29fb498a67f57101fa2597c3846dfe903cbf25bbf9328ed41ac8a35851326f4cc3
-
SSDEEP
6144:ScsMYod+X3oI+Y/sMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3h5d+X3i5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{547D39F1-1C38-11EF-83FC-5267BFD3BAD1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f7fe2c45b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d01181000000000020000000000106600000001000020000000af230f96436391715ae24dab2ea7bc0dca15a109b79ccb53ee904a5dd991c4f6000000000e8000000002000020000000407e63fc5c2e6f03e5c3600b12608bf9323420b8b7982a86dd1f69fce3ffc68e20000000dbb16e54f36a9ae38ae3bf721665c31538f31cade1a4a90412cc105757f8d2cb40000000c96d4b444105ce69d0d9c53627dca2cf8d472b3364441842b6821d60094a6e833fb8c85d86558696d99d571a2e2d984e760bebbdbca6a89ace8e12f4d664feed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422983241" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d01181000000000020000000000106600000001000020000000c22d71bb0c68550096cfcd3d0248a3d40fee9958b7889cc13b29ee570f83d65e000000000e8000000002000020000000839a109364fdb15ac4d8887311947fe9c4cfefc765f88de8b26ffd0929669af290000000880f432278c1a6a45ee76855d52d7fbccdc618e38efc9656a4f56d509861258099410c0d4eae050682e1bf156c2cccbc6c59543d1421649ab344dd8f4908f07d1f83080a72b5ace4363891981153aacffab7cd9f6faf231c99bfb7556f290877bf9f92b80ca9ed50b18c90b98a6988f883c313ce1ad00bcf56cc5ca89400769349bb79c711bf2cd8e8b5ccf96722e811400000003a2588198e3eb2984122dbe914492dd2c7272ff8717efc65d06cb266a85b7a983c61e8932fe1ccca9e9f3892b1bfa38055d13664a4e721b0e0b03cfd483940bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7977b1d3d11c30b65ebbde4b26350c04_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51472ba6dcc97dc68cb2690663d391cef
SHA1f0df75259f8f7cda4cc3a91fffbcf3faffa54026
SHA256d11e3d5c7f84173c083ddf4e73422ada679383d16c0adaaf473570d7ce876c74
SHA51201a0d9c0435461fdef58e807283e7f8bcd6badaa08c653e2e32937ec59d2614fdad685ff781a0c3852c631aa13aaa59956b043c1dbc38a2fccb9ccd504019d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3a275e2b67616726fe7f943e4e076ee
SHA10cbaf0fc068e78cd64d5a8b2c5ecc669c29fc15c
SHA256fc514310336940828fe68300751f4b934b2453ffca5192ffa63a3711d583d95d
SHA512e6fa1c30f731e4bc576ca5a09bf355f978e7b640d88aa94de35daa8550a5aa422dec0376e05f934de4af926f3efb7c1137d4ba7b8053dfb52c458cb65398faaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5615d860dd3b6a394a160e2d46acb7147
SHA1a253791e8cf171bf4d5764c166b926176ed00c2f
SHA256344e06d4a6fa4bb86c2a2a58191f337e623dbf277fa764aefa0643dbe4f29458
SHA512e4c9b5895248816b22bb9a0a84e72b3db2a96a79bb9a6dbcbbad7c0437507e7ca738280a4aab26d58e817c516d005a7ca271473f7ff7a3a65ffa795160bc1540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ded79bb6b03bc86a66088412a7b4edd
SHA1df3791bc3cbf04a9c302d8912d15d9b38c2e0173
SHA256acd88c82102210ff71fe320d84c3221ae4e7cadc73186e0e881a2cc0ce5bf5ee
SHA5129113e8238904678659616fe2f831e3cb8d43594f0758b54482a07a718e31bc87fc4957a01300e8318d6394577bbb32713d76c7500c012264f49d7834c006f886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576811d13dda9322291ce4062f0056fda
SHA192b33c2f29da58c8d5d60d92257edc83333df323
SHA25648a209483546b556fcf5c7f24b70c60c4e515470a4f72b98c438ea781de96f8a
SHA512f488be0e133f351971ecb2cdb4d4ca554166fc93d8d4a969151e1c07c2f7da0d79e80ff85fee1624829e60173fae652e329b415c6211177e895099a1804d71d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52244b2e5c6a2ca589a8b47a201caa840
SHA19a6393bbf837fbcac88d18c46e69413a7bfb0e26
SHA25622764bab71490ceeb162ea4c4e8298d38d5f0347727fb7652b8869ebfc1ebf57
SHA512ac45844d466b6c7844cab6b117c112bd1de6b3a5b087103f9dfc6b2868dd6430c5773cbe786c48b82e4bc90b6da657ac11781b0c0b0663642d28c62c0167ac81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb49e05da2a7cd59566d3c4b290b1e35
SHA1c10e9ea5a198419c2f51ed88d85d32304397efa3
SHA256cbd1bea999103108e11dc183dfc1ae0e836d729db179725d166716abb65f175d
SHA512a5a980e5dcf05ec24eb6f5a02f483f763a8aefed2786a2066365eb451b0d7ddecfe682d0565b5851e2a2dc15f42fb97f093daf90c6bbcca027c8fa29642e4b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524e2aff86e9d8ab1a64592ac9faf8e29
SHA1a65bd0729091051bdb237fd17ea4a3c47b5a1147
SHA256d3ed88327e13e01b9090c692a120bae702a72951fa356c1c4db50ffffbbdda2f
SHA51249d9374378c586c76ea902ef263a7a2d9136fff15a79d4fa1e619da51686cdb415925a113aff9bbbb3ac5f98e9cd3dea7af4f2f5f1d000cc4b39b2dd1b052b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634d31aca1c2c45170e5f8a0498adeab
SHA113d5f0ad32127c374f332fd98e10bc1b2db26abd
SHA256fa3dfa0ba3df03f6ac9d59a0fd3b7627c32a1fdd359ce6dab4ed97423d5f2343
SHA512de17bbab52f0ff4890c201b0b4b9dd391644a231e9d7fa22c3cba79e6c1b52edd93b4e6a741de5c01e060b325f3d122f8b9c85322c786bac6928b03b25fd10dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d13159f4bec3de1ad721fde909bf9724
SHA1dc3e3832106b276d6ed28c2725f26136458cc925
SHA2560ca914f138ec66f24c84176d7ef43e30036e6be2b6cdbeaf7ee30bc0c5f7af71
SHA512589d324f497567218b6503ccee3be49eff5cb94ce641b05ad412161fa3b41a5d4599d99b482a2b9abcbc7d7dec2794124b2de42d675fdd95d1217b6401f09340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58598be8b26c550502cc506567ff7effb
SHA1993e99e26e450d351948fdcc82458aa8ab9faf6d
SHA2569fbe4603f7dd9db06262ca4ebdff98f94c6fe48a56866a00e386b601279fd3e1
SHA51263ebab97f7ac3b87a1e96eab0aa76b470248fcbf4a468e561260b175e19b1325b7784bc7887b070a5957afcd30d4b099eb8c7a654389f0421f6872df6efac922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5491aeca429789d5e18a48448f83dc6a9
SHA155ad276fe99f3652f73d7525cdf19913f1ccf43d
SHA2566c0765d996a5fe8ea699dd2e987c1def0652d14d3ac32a91fabdd37699fb051c
SHA512233197f18ab5f3ec2e6d2bfbec876781dc6d2161b82ae7649b3b0df124b4deeb65534146d25fdd794dedcc9aff34c94ada716129d0b8ec67984ac03b517a03ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59116216c1d8338123ca63065d27990e6
SHA1dd4288694713e0f70ca933cac6000d79ce46ab39
SHA25675edc1e6b87bd768a4aeae6c8b9868cb91cee90d82696cfb1799f4b290e0be1c
SHA51255da8c36a433bdbb96e3fd9aa1b536e33f2245ebf0d644d5463a66984806d185341ae8dc8ae13989b81723c66bfa1ffef12274afb36cf4daf8806d20a7885091
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b89c44e75d83efa91a30dd320acf5b3f
SHA10314c654958fc0400ba873409db968021cf6edbb
SHA2568721650f9dcd06d1cda966b7ebe315a1acf5d3edea97c79f15404e628949beeb
SHA512f59ff7a9fb5e1cb2ddf0967d54921c4b7ab008e8f24a63d2e2f637c9028c14f7e9c5f3e0bd187885809331a397db889c3b5b3cf32ad08b999e856d97b9b91946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abfbd404a6903e525a89614edcea00e7
SHA1a9fc17ec3a8dc3b68a4d42dd66baba8236626679
SHA25667e39fef720f8401d7f27b1d0708b97dce7ccab49240a0cf75b9f3c6024c1f4a
SHA512486eb32a1737073e829a515cd4e3dc339182355d3910e0fd951d79ae43bfd84955dc3af37f7357f7c5dd0f617e1a83a3706f8f4690bb3f1634fb4f97e24f7b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d102a4f4ce0ec7c89119ac31917b11e1
SHA1dacf92e4811fd3c838464324437d2325b95088aa
SHA256b3ffd193baa2f1ab9ad4659ff228203201545af31743dd95c85108d30c98c785
SHA51241895898df5ed9bdd1330d77a7beb8c337af47c31fb284e76b9033f2efc989d51b66dda40aed3610e752afbd022b8195a7fcf39474f18db6eb7fb313857836ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a115676a7384f337e7cc37d3414963d2
SHA1821cefab3ab1d3503c9e345eb0cfd7fce3e21ec6
SHA25627615f1b8a07c439105c668d5d801c1b9876a74dc2bceb984a045655c82aec4e
SHA5124fc50ef96ddf582c38f2c5a3b8b78f2e86e30f0647232c9fdd06f5543779a6060c646e2588733693c400a727da1b621289d75d00f8df1a4698181351376c4cb6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a