Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
8a45a60c614b8626ce956663cdf697d6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8a45a60c614b8626ce956663cdf697d6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8a45a60c614b8626ce956663cdf697d6_JaffaCakes118.html
-
Size
100KB
-
MD5
8a45a60c614b8626ce956663cdf697d6
-
SHA1
b29f9a602d29cbde6444296229adec6eaf166e50
-
SHA256
bfa86c0bf7f04d5ac8cd682f9db01f5b69f5eed81b7d20eb529f86b1471161b8
-
SHA512
1fd51158b0a34d3a3b0d27b46b59850019a301099e629497bcc61c0255f6fd4edac8875837bd3583df6c456db324a9eeb562b0c6cf2d7cefeee926e1bf10e63c
-
SSDEEP
3072:5zq72pcrX6n1sOdBkKrXF5p2EcT2VV45FP:K2VV45FP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c9caa82889ba2b82c09687a5b39e702ccebd1696b8e37eb74442622defe3942d000000000e8000000002000020000000982f10f994cbf45e0c463c1d16ceba6f4484c47ee1bd1307c2ad711050c0856e20000000b429eb98d782179b1806aefccd64776938944dc75cf2a418a50a65891d05d3fd40000000b337e7231c1b741597c333bfe5c8b07784e9901c72ac475aa29357b8d93a95cad46d60bf1df094ace8f8efb275c65cea64fd4cb05649ad8c50f8a0afa113bc8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bd14d6f5843dcbf05fbb3e313f182d8f21af8fa0e6946c1bddcbe0e9e0910577000000000e8000000002000020000000011e05a1e42ccad55b9d322c35aca874dd966595e9c619839d82a865fd11f7919000000045a3334b4dddc88371759926256f3f8e51e3a98c982be6d477fc102e3d7c000e9c6a0597b8a775a2ea4756b788f8b8a364825828745daf8f67a25ca31c63d236c446cbd70a1f91dca501271e6ddc15d10a19263631e3f9446ca05fd16f61527881673baac9b7a19c6cebbce4abc17fff9bc37adc1ef7717ff7ae8b438dead0649ae43f21ff2d63f887358332b83b22ad400000001d557af3243d0bef8e95182567cfe105b35c0026b7d682c90f97c138f9e5210e88420171b799ee02c928b510214679944dc56e57d24b1e37c6d7b8a46bbb4a9e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9028216913b4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423401678" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{947847D1-2006-11EF-BA8B-4EB079F7C2BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1980 iexplore.exe 1980 iexplore.exe 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1788 1980 iexplore.exe 28 PID 1980 wrote to memory of 1788 1980 iexplore.exe 28 PID 1980 wrote to memory of 1788 1980 iexplore.exe 28 PID 1980 wrote to memory of 1788 1980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a45a60c614b8626ce956663cdf697d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536f0734b29951554184d397248961e59
SHA1aef2e197a165de4b86d0840b21207abcb0d9f2b0
SHA2560583d096245b84d569aa8d385ad81d1133a17f7bdc2079424b7a36ca4a7817fa
SHA5121c018acbdb7b5c5d1028949dec6bed0b8cf57856ba6eeadb4be7e2048f744fcc5be44f87763465be3593904f66413ed1d5e2dc83040f1bda04e007616e8fd287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c421b4df70b594162db8d1aff6ce3b69
SHA17ad51430dcb42f49eda79f3bfac5fe6b9caed264
SHA25667882ad1f73a306d5fe5d7ec6943916cefa636ba67f2b50720d6b764874d0cec
SHA512b6f2d713b9faa836995203cd07a453f1ac65714432646be9c388a70f2ba77fe5adc50a15825a7fba93ad05731adfb0e6da502437be6f56f3e87586edcd678633
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ef6476f0e111313b18ffbe2d564368a
SHA1743273dc493749a4a065e7b6865f170d513bc438
SHA2563333727718a302724f825897242bcf8d3571e9a21f6852b454e3e09159c6fcb7
SHA51289ad974b53bdc17735aa09617aee475d255760d82726c3f54de4bb5440c543d3998274ce7af56c75e7fa26b8abb7af399f3a4cd2c1d231bd666d6148b1f9e669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5355cea42a0a373053984ce9d0ccefe83
SHA1e945e8907745533195b76aae398fd48591b36848
SHA2560b3cb594b7fd111297387c93d13c98854df977177799f5516a88090ecc5e659a
SHA512861421a78e8fab548a2f60094c916c475ef2fca91104290a6b419d836d78935175801c5b5d793e1245697f1333d350066f8c101da83944e68494a23e51ac2fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fc4b2aa9da7f3ba897457c3ac514527
SHA1eac486fa3aff7c9348d234eab6b6361231655de1
SHA2565fec8d0f5c258a1796fe76ba553c8263105f6318523fc015e33e4e1d44e6c55c
SHA512a901a3990b8d89e9d47844b287016f6667f1ee829ab1cbdefd30d07cca2da2f86b24750b3d123519cff263be55f746a47d1877c0d2c6f875119a41af5092c904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bec5bf5d31e26f929169cc71301b590
SHA131dab037d689bcb0f1e8eb23fe13c01e0b4d770f
SHA256dfe4e436a162fab94e13f06b1ee233fad324a75f5fab3f0d923a236d7e6da09a
SHA512498a890d233d627b011c2eac7a1034e7c07dd4a0b14c27bbbeeb34fca8478e011b2a87eb3a5e7ddfb7d352b3493f09d1233710b9f27825bb189749d9774b01ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f51d6df6fc0e766077881b52a73728f
SHA105bfd2fc77a1e06e4e15ce5825041c24832a8d19
SHA2567850ec5b1162308417da2143623226c0856c1de2b19dda86903ce72baa73dd38
SHA51204490c78fb54909441d7ce368eef1322bbb1efc6e8e85a36442aee3bdc7c142b8d7b0f9fa17076bc17acf8680e4fcb5d95c06c4064b037528e61277474045fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545bbaba56f5b2ae497280e52d3e8bec7
SHA1fec0b09d13412e9850e040c30852251acca854e8
SHA256f4f1e92ed2786f359450554f9e31bbd45b18f0c884aad94d1713568822d82cd9
SHA512a9df8ea7cce2aac6582047a7861e3731425d53d0d41886d66e7a1e6e06052348ac8f2f3fd2dac5b73764e182ee4141ee5bb76115770123fe66d47082edcd604a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505b6fbc942c48fdfbe54443ca4c2c2c2
SHA1a8df23a4f5f960a55db56b8f9876db2c1a2a5b84
SHA25658a5ce4a70c4d1ae51254adc70d250b9455c7008d796204d91a0a125c0596bfc
SHA512ce09432bf5e02eeee2aa4c7b7a7f4a1361ea18c51ec3c7b97e0bce66d126a08e724dc7379af17aba919a676d909740090df43308adf29afbe60375c5b2b796d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5241bdf8652d0641e7498d49807756968
SHA1db63877853dd96196d7b97abfe15f1163dd53ea5
SHA256f54267df8023009d0fda75ae9993a9f4f7e9c78ce1a6d8ec7315adbaa50008a0
SHA5120a1e877eb9b2315679daad9e9800ed8a4c208f8c65a176842bc06d9446afcb4feeee2dc99e0699464d3369824f7c4cd98f88eca1653cb62df06d9ffe4f1517d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7a3775e7187b60cb2b5d4abb5785037
SHA141a4bc13dd955d4984aa5c47347a21154f7f6349
SHA2567827b625ea6256cdd42f7d21faaba942f247f896a6c7f2728a2c34cb52cffdc4
SHA51297c72a5e499849c7dd37266b10c8d95ded1e8bb99134a3dc059fcd44064f07b801852130e43f611589735d8fd65b30f49699071f6d81d4a914721cbbbdeb445c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589464fd8d32d3e32fbf93f824300c281
SHA1004bbf3f1f4c9534ebdb360c29a5f09aa7963a78
SHA2564622e5c4c6573aeec24acff961710c79c6eeba36741db2afcba29fad50c2726c
SHA512fdfe1b81fb2ee2ddd10cc2bbaeba18bb0e9b6f56e4a585c44354b029f91f66060b79cfafca095ad10bc96ce0c134e9e7ced1641eb7fad806af718008ac29ef75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a1783664063bd7f4b4e5558d8740339
SHA164eee2aee4801d1a79cb2be758d2b0d0963051d0
SHA256460af232ed926ba04622afd7564fa497c647f2614b01f9aed46553b4d9c1b9eb
SHA512ee9be9f5a8650d09dc0c1a9846c6d13a77b57b875e164fd535645d61ecfb16edae21989cc370abe4c523648d3ca44734e7ce2b4878b35a102114cba655125c91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544f2a99aaddf5dc1ebf2748aab778e80
SHA1249e21375a308b67fd176304361c8a2ccb112414
SHA2568b1ea1ec1c92131179919ab70bc35ec05a3601d561750c9cfc0ccaf30bc0ab9c
SHA5120777b3bc5d78bd7087fe8debf8466a7e98ec55714da7389f5650383660e4521e2c4cc50c3a88237a9a6cb518d558e7cbda64c3894dfa5b420fb96c300dc8468d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e74bdd2894388e6b13cafd4e0c7caf1e
SHA11ce1bf0a176b61ecead7c54054fb11959aee2c93
SHA2564b6a8cd29071911ae3b625c0c68e913e9abacae2eb887173d0d6e98332ecb2c0
SHA512ae808f64b25dba8ce61274a279bc0064514e5d85c61374407890e77ab39aea0a7b05eb52db974fce7d9b30629eae79d6b8e5664a4d3f09a3b449c902607ecda9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505503d50175bb6b77b528b433bec923f
SHA1a21a7dcbe83a51b2fe582f51c828bc355a2d3a25
SHA256e773a476ddf861a0a75c7ba26c78379b4ca55d58e681b18ed625bcb8382f635e
SHA512d19859923ef20578ef0c2ff4a9a4cb40dd5062e1acb75adda96c6584926a3e3eb3b286f9fa8260a60dd028158425004b2f66d3d6e8f41f2120a00d56e9b85217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8391bef63d932a04ad4cd8c5ca25606
SHA1a37f01d72040d659f4ef41a06a325b9f5bd5b70f
SHA256100279dadbf472f1ce06a2928be45a0faf834fcab27156f96bd2bf93f28c6a57
SHA51230036d5c1a115005d9ba231922ac6e84cf8a08e8be1e3d7dc20b0771a172f6714277783b2ec074ba3901676a17167c8e7f20885e2a4325793ffc11ee43b07781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597cbe37c65be48fe14f101a6f9dff255
SHA16f02ef3854fb5b3e3ebc1dcbe49a155300426774
SHA256c5c7dc49d63a6fa8b6cf00f76a3d0e9fe68555f996c1cfb5cc48779a39219cc6
SHA51203eeeeed8cc93221a84c99f097c5d51e956466750e19d2f22f3bc9f56c1d72422c18767ab4ab5b217c56d9b7a4d8a90c9b2606afda9c880b54fb3ca4136e9f51
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b