Analysis
-
max time kernel
139s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
807bbe6d3c47c13b3bf062d30b87a890_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
807bbe6d3c47c13b3bf062d30b87a890_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
807bbe6d3c47c13b3bf062d30b87a890_JaffaCakes118.html
-
Size
24KB
-
MD5
807bbe6d3c47c13b3bf062d30b87a890
-
SHA1
11b10d7f1d46c21a3d40862526443e9614e8df4b
-
SHA256
8600641ef82e9f614058242a772cfc97218811c840e7929ab0ba44989dba22ee
-
SHA512
b2ce8bc43111138e0fa3d18bde56b84bf2cfd72415e802313922e2fa8d0f998f6846e3b8ec032253d2cd4a14f5fa7557e39bb1f6b05f958edd6a973211138376
-
SSDEEP
384:ld51BM4BMaBMaBMWBMABMkBMt/OvaYjxzFU6H0Vq1KL35zmu+zuhF1DSTN:/C4CaCaCWCACkCOaYk0spzmu+zuhF1c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026e8fb5381bd194b86ab4ad08a2a22de00000000020000000000106600000001000020000000df2fb1d9f0a52df8a8c1eed76fab59ba8bed92269a8083777c79acbf9f34107a000000000e80000000020000200000000c5a61a68d2583bd5853d3093181a6871987505f0e2f1c7d26bea0253e3cb29f2000000020a787c0946a5b72ac3696d9a771569746e4c73c92c89cd5f609d3248ff6661240000000d2e4e441f61dfa3ef81dc6588f02703db8ec65792d42bd38103d46509623cdffbd9ce3ae685ce32bbca6fae02f1d6592d091d248c50a22ec65c9ca80f3480c63 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423141506" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEADA361-1DA8-11EF-9CBB-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70680da4b5b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026e8fb5381bd194b86ab4ad08a2a22de0000000002000000000010660000000100002000000034d9497e557aba51b091f08d23913948d024ede0fe064a0ebe25729359b02aac000000000e80000000020000200000008612ccf93486ebd06159ce7749de86eda3ba334e7edb3223b1f3ebdc79fb1e30900000001f5ab1bebfc49c78de0469fe79a02067bd38714aeca19d5d7ea085c00fb355f5079d207cdec1063f033c3ea5008e467ac8692fbc4693bc4209eea834390bb7940a1660e170bea88a7660410a8ec43b550396cff141e4e33b9f68070e6fa839ba5147217a725ebfa939a215b814d65e1781d209d14deed3cbf38562d1cf4b51ae593fccdd1bbd0dcaebd234279f5d75ce400000007dd742c8fbd9e798c3b9a38041b6e41b089e6dac9329dfe377ae3ef877a73acc1670a4b7456f9ef29429c17abbf50ff11ca3e3fca0d43f8288affc1b11d248da iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2992 2508 iexplore.exe 28 PID 2508 wrote to memory of 2992 2508 iexplore.exe 28 PID 2508 wrote to memory of 2992 2508 iexplore.exe 28 PID 2508 wrote to memory of 2992 2508 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\807bbe6d3c47c13b3bf062d30b87a890_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5807d0f5d7f339f6ecff3dad94fb6d356
SHA101da4c4e54226499fb348780c2212476a709011d
SHA256ebea80e5d05206fa5645bd56044d1a44f3d152edcf2ca3ed9ea572c6b9d7a1ce
SHA5128669ea878cce9c2f80402f8fa8f6ddaa577defbbcff84ab05340c8bcfb32e26fbf2219676d94f631860d3e28f75069077c707f3e6d3f0e45829fea9f1c5f1513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50db1e02262001d3451bf9f0209f14039
SHA11ca95789452dd67be8c95964599632bdac18b2a5
SHA256e03979d19417d7dc74e0532a496efc2f2d743301784b578fed9f4864ba7926a9
SHA5121c932bef72f22862133f7e09d6dd6d57284960c5fdcdff942e60a964e49019a36587489aeceaf8fa37ea13553fa6b5cfbeaf7e9675450ae941ddf7cd0a175a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b160cd04113377ae3635826268ff487d
SHA12bcb33e2a01d4de13974aebe67134b87d680b7db
SHA2565a3b5ac06725acfff82a0a0557e4376f52848c401ced37813b00c2e12f6a5c07
SHA5127bdc80c9efdc6546359a3709476a22fc102617e79aa9845be612102ff47cfdc927abf35bcd598ecc647feae3617f63a19680142b81b071ef5f96e0e7a62c9a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51db2a13fb155ab765d60466a190d18e6
SHA15529db73355c241298aebcea345eae70d038207c
SHA256aac30abe676e71afed8831c071b6b7ed7628f2d918c501140a769489cda649a1
SHA5123a9e0f7caee3a95db7f05f425800cee00c2e7c7a386865a272083911f8266bca20837fcbbef7bdc0cd416ec5d5c997e65e89fe9555769e7a164aa83c4ebc86f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567ad6f4de5d293637eca5594b64430d3
SHA1678206c810a6e388ae9939dbaa7bd70c24d8f49f
SHA256a7a03e5c274f656e66759be21e02d4fec6c709ebf045f2376d5c0446869c9d90
SHA512264d2c97c6bb0e00a1960696c91018626415b51ab72dc13e740e830d465b1fb1fef9829e7b37254da1c56aa2a6f5fabe02b80578e41a11226e4c6a5ffbde22dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab4bf129b9527a26b4ad54812d2f3e0a
SHA1bece680832d5512c576f33048181d773ba182945
SHA2568f6f26669719588f13484fe64ee769f5d83e79af320d0335f7581f1ee53629ec
SHA512783fb15fcaebc03c132b9f07fd3a2c217eb5e6f097f7c5f2bafae5e8d62c510779bb34fc58f73b154b441d05c2850184f78a0366d0a5fe8a016ff36a3576e025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510bf5f35a76209d6b609a23dcf54eda0
SHA149088de8678553aeeee50aa7b4c3c2746e084d8f
SHA2569b66e6582eb56e08f1d4b59b58fcf34b0c10eed3288a349ae5d03aa8612b18fe
SHA5121d1bc4174a3f32f5ab819fe7dd6f47f35a1d8865019983f43f5af303fe0e59fd04f802165c8d56d3823633d5de3976eadb3b56f3427adb65a31ea435f1988b27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c293cb40ed7cb697f73842353f61d2a8
SHA1f76cadbe4d9be6e4d5774692129cf475c769d204
SHA2562122efa02430c083c1ae698cc7e5eb5cc8596d29ce5c1242fe6fea826774cdb6
SHA51232319e9b7ef35fd60662028d46c4b8d0a5d70500d4390ade3973dd448523ac6e87e9c76e676bfb9f9aa70b54df08d2888ae134e7a79a13cad2f7ab2c1d33cb9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b84767c9da806b13143ad2eb645f64ca
SHA114c81106693fc0de84c3fed812a0ee30d6e6d2ba
SHA2563d795a08a224cf13186876c0434306d78116b962dc06d4493c1bbd9740f34cbc
SHA51258b764e9208f4138010d5d9fa911a6407659e183fa38a91da3152a871340b98c33c1014de4f4c21c5b6c8e6023cf00eecf12fb5ff09e26095c7bb91ef2a84a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52adb18ba31cb44a433f4d546fbc210ec
SHA1b8c0fbfa551af6ba3e612935d9cde12b3b9e6282
SHA2569e870652642abe15a9ff0f963cdc8e76451e1cfa47a65e7766b6ec7013f1abe5
SHA5129ce55f84f133071e8c24c9b49e6c8a8422123c68a4eb3c0db7731aec1be21012d86168fe64fd12b7e1e3ea971ecfc1238488e1d9450f7d702f3a0aab4ab36754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a10733f05ba1d8d1114d6dab6daf720
SHA13c6ab45b2d473e51e91776993b506552ba028476
SHA256dd2822d2513616ab1e0ba2bb76414cf75733ab965704d9f23cb0a0f0ff1dab26
SHA512506ad3aec096f04eaf789b7e05e8946329b0be7492663c9ebfb1dc46c9ecf9514af3ad8e23ab8a288806e5fdeef1bda1e38a053d03bdc4ea9acceef8c25f0a8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5ba0b01b5a5f4ed96e9a866588c2397
SHA15a4096f7a4132385d1792694127088b5fe95dd36
SHA256fcc89b239c2767ab5938d60def792010ca00d418e15afac0f4a38e91eaccb4e5
SHA5124c9a69a1054e6027f18c0f1b12fcb508457447be49c84f2e8c589d3367e92f9b93ebbb00b4f438f19de0fb0239844953a08659520d5c3f8273ee4ebedc9a0fce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50799729f24a4729455e846f2fb218282
SHA1546f0a69bc074c9701b68fb75220c11f576acd30
SHA256bcec4b03b4a13ca1a2f92cf91c0a68c219c2023e49b045e5c8838871b43cd6a0
SHA512d1db6048172366bd4e3f9b8e9ae936cc4dc3b7185f6f5d8d17df9857896b3134ab6b9b12c4adb0acc546aa112237a91acc43569dc66841e3bc6b3b97aa5f955f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7c071a9d994c3c044ea4f0b8b449531
SHA1f741df2764337f2871a57be1aafdd018efa632c7
SHA256e54c6463772dc5886bc21e8bf35cd70c2409d3c81143e3fded7665268511c1fb
SHA51220bdec14b4e4596774ac394b481a139b6cb0ae880df56be7bb41a19ccf382b311bd47b659426aa448909775a292aeb095c76514dae5f6303ac140596e8633cb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51616f62754bd46de23c9045e31edaed8
SHA1cd0b30ec1b4e16099b3bcf4826c62cf278f90066
SHA25684b5d20821c675a035a93f7a6e34a2e3f17a49b3790b9b13c51fbec56cb791cb
SHA512f3a90ba7d5c0196764dc702f749ff7dd65d1784a171f89794bce58eaea5fd6ab1e2915c6c479da8774990e3d92c5b288da6606bf8ba7bf180eb71d4a4c806cd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52af456689d4957bc3cb9c43d86ce359b
SHA11913a92f62df861c7e7733975e0e6d5d79679791
SHA25632a1a04a9b612a8101aceba70bc1d080a9ac1218812e93dd8b0e2379a25659bc
SHA512a84e8875c36093ac2a8c02c99368f5e7bc79103a6839e89cf7919af57b75f6d463af97fdd1f3cd023a789175bf5f8779582a944a0198027c717a44a550a585ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d26af4111bdcb6f21ded65166ea9ba5d
SHA128cdd22938fa72609ad0f5a08a8079c461a99e6d
SHA2568612846a220601c16ca704f9e3a0ac5e82321bb900cee0bea0b9c8648fda8914
SHA512744b934bd4d65d87e127a4b234186921e623d6975d357936b9a94a915e97e0915df7ed4d6c73bb8578eabc10190ac172b43f91ec96df6e473dabe9fa7d05015b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b