Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 09:14
Static task
static1
Behavioral task
behavioral1
Sample
8a0077e2518dc99b4cbdcb915decde0a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8a0077e2518dc99b4cbdcb915decde0a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8a0077e2518dc99b4cbdcb915decde0a_JaffaCakes118.html
-
Size
61KB
-
MD5
8a0077e2518dc99b4cbdcb915decde0a
-
SHA1
b2aa348ab9c476f0472aa85b16bff71bc9b419fc
-
SHA256
e23857c60d27caccf5e59c6e4dfd02ff2efea9fd382854e703d826ef90a46f50
-
SHA512
dc8c0273effda55d71b2f6fc002a33fa5684f778e3881308bd41ee44a38fe793c3c203d156f2e5390393f38c25bb4bcc09381970dc45e98901cbaf0d14d41976
-
SSDEEP
768:JifgcMYUcXGeCSXuhDOMEoTyZCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5nnt:JP2RATbec0tbrgamchNnWC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f19f2104b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C8E0631-1FF7-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423395115" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e000000000200000000001066000000010000200000005ebc1031f673a446ef2c5c20017c5faa7ab7cc8989010a1a3b81f5abc6604874000000000e800000000200002000000096cc2098c0ba9e8ce5a21c5dd624bb76bc8986eaf9f0b5e8f63317087ba9057b200000004efa55afa21b7660258ecad961ebf0cd1b2a03ed99f865bc0f9d03cade74c3e4400000000a1e30c44db579851f0a2942dd5430bbd96c16dcf2bcb7f86a947ab743db7be060e47d0c701ec158d4f11e30c795935150fda69243b5e79613cca03971a19e40 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e000000000200000000001066000000010000200000001a0f7f0183d7820adc2360ed0e04bad61513619a0e67c94f1529af5983685847000000000e8000000002000020000000c6dd2733df57d060ef379e9d02f5b4b5fb1828317a3ad828a2e979c9a2a533939000000081f40109ecc1f38ce056420fb60248f2077244f0092557344c9ac833783e974141393384f35332539ab498e49f6f45343929f0d18ac208f394dafa73eb3cace475f3f2d4706998cb70205158b47f75d2008fc44426e9b93e1d0e4246d09312e12852ccb43fb3db3911ff957c7514dcd770c4e40fb1fa77326046c11f788b23415185c68af675a3d6922e1fba4ed7447d40000000184c68568e78ea8adcf15fed60484978b9a28d644288d78a96ee1c18eb30ba5551ce2733158fd1f0ad28537e9c4581ce1a67f065ad7bd511d202f6d5b6e34477 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1404 2696 iexplore.exe 28 PID 2696 wrote to memory of 1404 2696 iexplore.exe 28 PID 2696 wrote to memory of 1404 2696 iexplore.exe 28 PID 2696 wrote to memory of 1404 2696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a0077e2518dc99b4cbdcb915decde0a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50583ce95f8a186a03c8d1fc2d3e4ca47
SHA19fccc1b24567ff797384fe985a443ec4fd1f6a06
SHA25666dbc6fe32b25d47fbf43b765b1ea98fde463541bed2f2d733a6f0b682916604
SHA51212e167d05c7b4c5f2a4d7a52788f85a2787b70977244342bd52335a3ba8dd17bb77fceeb53d85c0ab26848b34020c1c2ceec1057ce4de7a54de558d8f3e82a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595114ca0eebbb2a0c6510ac204c95962
SHA11eeab3be5dc4c97086463b86a1f30285a988c07b
SHA2562b8830cee165370975430fc650f26c38d3d5da21222904d4026f1bd5d7615936
SHA51205fb47179b4403231fc0ba63b860cb085794018528b2b9b06a6778c25d9193c0212bdfe687688f2ddec5744f6a7e549a5af07c7c778ea1650dc6946ec532402f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574bc0dc6af456c442fcb38a8f952537f
SHA1b390568153709f87afe7300ae354a648718ebf90
SHA256f4bbf0ed2369081f79c02471bb461a645374825750fe63206d5731b657451ca8
SHA512cf9485915bf4a7b7a120eb1bfd3545ace61c1e90271b7d5b613764aa299f3b273b216fb19eea7c6abc2f73439b6195ed41f28a74b0e09a89a0105bf618490909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540526a49f9fb5cc3a18df5a0fde4383e
SHA106f15af21554b4f89746a3baeecf49da9980e24b
SHA256708a8834c3467a6fcadb711f78282ac693b5ae1fed4c4743e9dc9babe774c0fa
SHA51235f1948e1b66dfdbb66005bc8c8a11ff0bc401508d2f0f45b31237d3381d1c774ca77354cee8da2697941b289bcc8b1b0318cd5059f4efac2826725c32d22edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539280a577b9c15f6c82721b11afe64fc
SHA156a1751f653bbb392877c5ecbf528493d9aec994
SHA256d55e7dcfec0ff25332f0f1a07f9a951b076a395761eb1f4b84259564fd33e77c
SHA512eca2825387ac1ccc5826ad803a2fff62963c85e226050e39f7ffebee4b4e8322767ca8766dfcd7f312615cc679171e90d817da5e7ec1efeb7634edb462643089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51869a4b897db457fead0581054d42963
SHA1b4df98081a5352fd6e59b64dd2339e0ba7c93816
SHA256cf42b4042a751c8e337a4f14804ce1b2af981a896335b53e34a0205d86018c37
SHA5120e07901dee9a2834021a6709eb7760da5a50010c55586519e90a69014dc76dc93d6248771292cf62d691b7bc9e3850ae2b143a91ed53cc3e85db58f47b8f02a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e8e624195863694661d743b06d560a5
SHA16f84c3f9349e29a2728246b64582a49e384ee813
SHA2560bf8beae36748d14d846627b9bbb2854172133764fa65ef2dfb1fe280e774965
SHA5125ff10472c852a628b531978b513714f64758c9a1aae3571d4449df049c5f9fa649d07d4100ebda5ddc7b48964c4b0232e577c46724cde43150b1f150c019d412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ee529f16f3e66f89c9d9bb2a0560091
SHA19c398d5a0518e2692c8e9f2104c316adcec15fec
SHA25602e8fb3d381fe2fc17910230ca516b997fb647c5ec9b06b797f9d8ed277b6d22
SHA5126158b2f940cbd31517bc54d9eb8501c274d2f55d5a8ff28f6cd20f947a3e9b6e46e6f082f352c79887bf1f1b98514d710aa1fd28e58a06d982f737296d15d651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b5fc74eaa776e84748b8907945847de
SHA1f378bcfac4cc71a98590f16c28ead17476a605ef
SHA256d7e6333ac8abf097908f98ac4dad727793d6f458cf7f7aae128abec4a511f173
SHA512a9c0cd3c59759ca807ef2bc20b2ec298b6a1a6684d0c68ab4829fae925987b44f74681106617658a30745f85dfff08416f5558473c720482ffc63028eb4efd2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f19743099bd3d43e0cb560795569cd45
SHA13a26689d37b002023c1c15f1fd49c2c581541940
SHA256b93f24ec5ab6080a33c0272e86145c36d6660d8603c9732740e6745c37e4c423
SHA512dedccbfd828a2593a546b171eba5775828a7fbba852cda60d9cf34d8d0857afe02191a2399e9ab0df0fb0bc35ee9f5b1089bff63ff8c1a27f36604669f93427d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6e9a4f90304c924851aeb9de9fb43c4
SHA18bb71f8298c894c8514dbdc78df04fd8e81064f7
SHA256ab0963e3b88c9d97827448911af5f85e1d7683390735167e567dbf729a6346fe
SHA51239a249199c38278cb13b8d5bba371fbedcd598c0be0bdf52000f6f340a27816cd20db242a9cb781026b57ac67b2602ddc775e08eaf965ebea83e1d349e191655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c9803c77292c307ee97b1d5fdd3a9b9
SHA1e888491898e3ab4fdbef558d0f494d5a85eca46b
SHA25699959f7cd791314e7ee8d56b9b7fe5eba77e7859f6d8819757b1fae12ea5382d
SHA512c361100798d6674c2d18347f121058da26e7cdd4448cf6cad9a40b4932efd2a1f0dfa232a9391a45499b8b2d6ddf119236b5dc2885e43339e70352b4e63232fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c45679d00eca71f278ac3032a9cae488
SHA1fa57fcce37c30763a4965fc4366ba4b60edd8e22
SHA2560e164f89d8f9e5ee7ac214a9cc861848b014a342bf6569f6a8c7f262de51ec8f
SHA512ab692598b169982e2a8487bb427e99e6be10b3ac503a7241ec123b07cba5bb211602d12ed0decf57c1204524808029a5334bd2bd779c39db3dad28000696431c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55404daae116e3e8beda3007bcc97f4e6
SHA18a497be7f1f371e84b9c8c0a3a6580be0cd223d1
SHA25601e68bedda197ff68ef021e9db2d880de42311e72a5ceefe5c4f80f125d69732
SHA5129b674807d135cacd1f04d6137410e0b89c619f91100dfdb2cf40932f982b2c1fab6201d4d2590b2ee9383d80f942a1dc011eed6c9071f85fdb8d651dbbdeb47c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507437a8fe060a9a92d7ba8f5df091d1c
SHA1f28a60c6f5287f72eeec9aca29813e3761c5c4cf
SHA2562a88ac344065c45aa26971fe527a5eee3a366bcb1cf1a12547d011e8606390e0
SHA512f80b42157ea027aac259f6d87159bbf85a382ae989880de27e82ad7e3ba39d60b6b430b261259fb400a22f8f8c2df104c723e58eb23c0dfa001f04c2bd51d1da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508f9088147ad258807b98695ba491cd2
SHA1e41e9dce26ab4c54461202f6d18d58ba25e9c088
SHA25665f96e31f3aa963e3f9cc94fcbd86c6a4b5ef4af2024357b4bb0e9f0956991dc
SHA51284df196124499ec581d9e9910ca43f36c1d0c1f6819726cf645520b0c10868ac7e2a4ed4cb8bfa77583fe51452acac50843c5fbfc116a5abe1dc07e1361a5b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549a2ce36183ecefaea810bfbaf6e0ca4
SHA1a9a994be689c597e7f7a66bed7758c95f65f06a8
SHA2564aae0b2cd30ebae3a39f3131d3071f9cc5d7c4b9e315822bc301546012460ee0
SHA512315cf013353d5cbfaf51062cf0d3d5b13b07412009b9316c29543db5c1a7277e0beaf57f2ba5603bc93aec60768f739e4030dac730df1679f71a9d81d8aabd4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ed735cabd5e1cf052afdd86c48accab
SHA1cb60b684e33dc71f179c9d3571eeddfe710bb6c8
SHA25620d172d44f81704dc478282e744b6f066208bce7e560cb5b4d388c0ca20f4843
SHA5124be31aef54badcdcff44b176a3ca04412cf49027caf3174545790e1120671fd755fe4b1243b5b5292302b7c2bde66324ec732b735f2411918f7f976acc7fce0d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b