Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 14:19
Static task
static1
Behavioral task
behavioral1
Sample
8108221f74757c3cff646da8eb0eeeef_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8108221f74757c3cff646da8eb0eeeef_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8108221f74757c3cff646da8eb0eeeef_JaffaCakes118.html
-
Size
68KB
-
MD5
8108221f74757c3cff646da8eb0eeeef
-
SHA1
72092b031cb2bc09418e00dc657048fc48832294
-
SHA256
ebcd3b49709fac19171f1d62466af72963c046e5fc3a9d80743fc2b832fef8a3
-
SHA512
f35f1459ecf030dea4c6a2854c87e2031c007f145aa2af6abebeab13c664911fc193b890e249cd2744307a74a4b4238ec0e55492145f02f7f82ab417e19f5eb8
-
SSDEEP
768:Ji1gcMiR3sI2PDDnX0g6BOAtqlLTBNoTyv1wCZkofyMdtbBnfBgN8/lboi2hcpQV:JhXAIlLTBqTcNeD0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ffa98bdcd1e9b468468e3885666fdc000000000020000000000106600000001000020000000f79ba612ee415d840aa96ae8cd4d4bc43b46d6e64a15a6c81a2dea27f7fb4b87000000000e8000000002000020000000d7d8f8773ca2126d07be44313f2826a3aa32f1c6420751b494ebf29b544aec1190000000dbf6659d5363f8c0f5ac3abe65b9e0948b3f68a2a8fcb56c7544973aef1a9dbc62b0a8760dd0f0bcd1a18c30688bd45b8df96524bfbedd765b65012ffd0ffaa43b0c59d9497273c1ae56bc071aa2e0d579cba0e1c6014422d93f2d985f69112b622ea46750ab921998161acb5e5e100189830b4c98cc48113fca031823b52c558a7ac5486fb382592513d8b0f95a1ce9400000009d7c8e217b95f2a8e5ab69721aeb2d3025fb656f292260f3de93bf522e58389ff323d3e3ab973f28f979a0ebb455d0ab8707ba823317f0c9ab9ebf218f418e1c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423154234" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{738FBA41-1DC6-11EF-A1FB-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ffa98bdcd1e9b468468e3885666fdc00000000002000000000010660000000100002000000006ec258d9f81e79af9b7abf4f672e348803f5914c6da81be7c82c84601954bdf000000000e8000000002000020000000e493afc2adb8d400304400c19d6780688450c757cd1840183e67ca3170da39902000000017e8ccce3609fcf99adc51e632c40b0b8cd27f7c1c51c0088eecb136fa78feda40000000547062a3705a01b578af6d8acf9beaca493a07a6fb2052d9ec8b862f463fc2e9603db2bb8231f122fe2f323bc72c2f1d0431b4f1236a309921fccdf6094d2b51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70490549d3b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2908 2244 iexplore.exe 28 PID 2244 wrote to memory of 2908 2244 iexplore.exe 28 PID 2244 wrote to memory of 2908 2244 iexplore.exe 28 PID 2244 wrote to memory of 2908 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8108221f74757c3cff646da8eb0eeeef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eef163b3e236deb61401e60d41269b26
SHA1d9912cdc37f95fc4d69a0e44e15714f08a894c48
SHA25651512928f53494c9a04fd61a75fc974d096f0f09b5f6af1f5a1ad0c02e82c781
SHA512f610abf7fe261ded578e367eda976b9fa18ff3278cde444e454ab63328e3cf03d55962d7b264c32c207d9bba9ca1d7b06edc3332f2b849c5f24b7eb2a0f079b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3fb089d1fdc1f55f604bc75346b273c
SHA1e24d554e63d6385b75d2ac72682cd6b20183a30b
SHA25645092c76e0856e7f7d9d1332c76d9f238ef1f4284941ca6ae0a55ee8222d5057
SHA512e41bb567ae3485e6a7583bc3acc49402357021d1a1f1d5a8c42e563e210f4394249b0f4c9cef4ee5c02d2004b30e8e5e3513b0fc251b89e4b5b4465063e826fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556706c0f82a96da0615db95f4bf766ae
SHA199248d73a42421cc9074c058f99b7f28ff839b27
SHA256b1cd458656cf7e8f53f9c95340207d6d119822db37fe41561781d0eb2f46a744
SHA5124fd20db747534aba504f1aba8ef7ea32cc17ad2b3458a85a8acc2d4f13588fea332ccf5b57e1d6d14724a03e9c5217d625415b07da68f4ad1c98fd1f3f9e2269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e3b4eddf832dbb1619bf9e06078dc7
SHA1daf63f66f2bbaa3e3961f9b6f05ca10219c2a5c8
SHA25626073d5c4fb022573c83310d4f056066852fee3d543bb398bdd5c8f2333b99d6
SHA512e6d8e4fa61f7f2f456adcdc8663c17f686d445b70df2c995c549a738f83fb8db7fa8c5589c722ce4f268a3636b31693ead019f11785f14e43f3fc27a6a603844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ecd83f3eb4fba26f014e09cdc776f23
SHA10abc5005a685f2a989b26cc1444eccf56a9258d7
SHA256508de19fc48b412be236d53166d1e44699ab6ad7dcc8df3fce5a7b8285fcfc75
SHA5121ec1f327ba19d1d9cbce41d65bcd11abd1848889801b841c686c4bd407f003ba4cefb2683d9050d0c130db2caab94ab3a7738c8807e6ad55e1f3cb7065bca28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da63109982e91e8b96ebf7a8358472bf
SHA14c489212947dcb80559831a627b404a6315e14e3
SHA25640e70aeae436a930778412c8db00ef825e033c2bdfda5ba21780858b45302fec
SHA512bf0a66cc179f5929ead2b635d529997f4c2dae19d606c076fef8d07d552240628417165f2158684a1ded3bd63b4426d20e5d1b5d4669496eb9f43cda492252c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33f3b9b70ad928ece3ffcf95e9d0efe
SHA1280f0ed761484ab72cde1c25d3d0608123bc1b47
SHA256f99d98b2f56c83ca86c4375dff713ba5a15cf249a34619c2cc9492c8cc58cb23
SHA51291c2d89366d2cc34828af77bf28144529fd23541f4c05d371e0bb69fc11ec175136d57638e4ef72c9a63c65cc14cfb6e10f2ce4044ad9650d4d9b37c07fc7b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ac599d9adb34633201b1122822ed025
SHA1cfe73ca87ed82535019c0727bcae1cb6b90d20a2
SHA2564e831d8191fd313d9406e6830556c02f1eea30d3cf0fd4cc673054ee3afbb299
SHA512951ac479cecd58cd0081a54933775b5c85d066796cb42d09cd1b7b53bde0b989c15d2c74e030afcf12c8d7d3ac81d43d769df092ab28a605bbe13a925c3087e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3c53b8d333b91c4d8d372920029c44b
SHA1af4b385924dfc5b2283ef76f721033d2aae66e7e
SHA256ed406ea9747aad2b4c8f9dcb80ecb29ebeae35da656c5ad284d416aecc4c1737
SHA512ae4d4298aac433215fd1f15d7fa4a915303bd291c3110933d5fc6f39d0780dd2de5cdca6d7ea1ef7b7b3feb6e38b7802d1ae03eed2318d898aaa0753959e736f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54189c93a6d15f7775c4cd2ebfb36b32e
SHA1f53e8897c84da55ffbf9d759997dae912be14f08
SHA2560a0e05caa48c259a2ba8f822bbfa4f306d4ae76d8f31544ae70ddd214f86b77a
SHA5122a49004c0d7c574b4b18c81de35888191b08b20a57733f6308f1de7fa3ed71f3f7ea355c597fc7c28f22dcf00a420261965969f267f9d2e220f86e2b2c186c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5018ccc4ce02ec18a0c58523d9f196807
SHA1d9edb9a1e06b3837c1d69d410e31617d7e16308b
SHA2562a02038086eb20382d3a535b0a93abe087254c4067585738933977fcf5c09a2b
SHA5120d50a5ed59fb9e8bf42ab846d44a00448c5251e31cd3a8a93a52b3de88b43fc582c93893994e43f90b38993d865ffaf78976c32407227686f90db28c6fd49f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5998828e91d6290665fb1b3e900354445
SHA1dfa582a3b9bcd9f968a22f90eb8a75c7a064c0a4
SHA256db60c3470caa93d84fe7236391afab32b13f108608a31d33a70229f9c9285eaa
SHA512e2a85823b8fd17f7e4a433b0377f3f1f23bf531e71159fd63d62efca798375f3984baf6aae76c97e0006ffa48138fc52883ff9c58c7afc2aa82c5e0fe4543435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e446131ff61747f409d91903a264967a
SHA15b4bea0db89f8a13e0b3cf396476e4e41bfc492e
SHA256dd9925e5a876e758d99602c5ce192b3cdb1259ccc37a55807b20641a453d1986
SHA51248853baddb6c05b2e294290155ddf20b35242fa4148fe53eee0013d8cb5386f60a6eaf9576035fb7eebe2d4320706cf6c51184c134666c6c1380bcc697a0c6b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bfe1a643748c81f2b91da044afc081b
SHA175856b4dae8830545daf6d05cead82ccc4f00ff8
SHA2565e32a44ea10e85daf1d4b6413be0ecf65bbe6da588a0694a4e7da750a2be79b7
SHA512d9ba58b97e7ef3dbccb3d7ed9d9f45a6e70c2e278289ea8cb166405d7867c53561c9c8a9e5bc0d49b63c4eddc231626e9ce4ae0ec86224fb99636c7aaa44db09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be0992e204919acbfbfbda19d5482581
SHA16c98be653ae3450fe2fed605eb54e011c5c1669d
SHA2564c862febdcb89651f5b050bbea02d18cc3b8ee9ad7a0ac2004aaba0796abee06
SHA512571681e98dfe68ea8f18611b6afd43f026c43269fa45fd4f0bca51a25229fabd3d609d477bffd78aaf1057f10df6c4e6c59ca75fa4328c4faf292111ac6fa100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e778a68a310212e7c57b425f766917f0
SHA19af7a6657feab573c3eb09a6fc44888632c3eff7
SHA256203306725eed29bd5572a2ce4b4da470c0b746a752638c1ec8dab20b1d9b08f3
SHA5126936804b64de5bd40e5a7c5247645d0b21004570c2e94843c37c14e89ab8d2e5f826df9c3c9f70d4a59f9a609ecd1af50d335a7f524db591d796017582dc87d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a745fa2180a99a22d91b44282495212
SHA1d387e61385852e51c75c5e4fb828a9a3189e91e7
SHA256dd01309afbf6e6742826d26749ddaf905423e5fd564cb62e1ca1f4c1eb2f1fb2
SHA512d81623c0d0f897da6699250ab7025589d016756de0d57c7ce52a7498057edfd6d0f586d8262f86238cecfb231fe6a1e0e2cb57feb53d6ee9e5daf80a13fab185
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b