Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 18:38
Static task
static1
Behavioral task
behavioral1
Sample
8b623bd32dc0872a3b84b431e4ca01fb_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8b623bd32dc0872a3b84b431e4ca01fb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8b623bd32dc0872a3b84b431e4ca01fb_JaffaCakes118.html
-
Size
4KB
-
MD5
8b623bd32dc0872a3b84b431e4ca01fb
-
SHA1
81137778194004fa2e9b5a3ded93b596a5be0f46
-
SHA256
3acc1874964bf6a8c1a54b21eede16c9427474f8044b048e7fb5a0dc96b97ce9
-
SHA512
3eb34cb925eeeb3689df241373343f8d13bdc2cc35d3752fc6446b302c9b92df094e2e81a16fe0d6cdf2e6b752150649d241beaa7b373fc75a153af2d5923cc6
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1/wd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{289BC741-2046-11EF-9D76-F65846C0010F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90df22fd52b4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4a9463603696b42bf802bcfa703397d00000000020000000000106600000001000020000000090136c2dd8194676eb3904ec12b51a6dd74bb4a8ab868ef30a22f2fb8f508b5000000000e8000000002000020000000ac721846f5da2408015836f5ef2cdc331a2da437c44f331338c4b3f3b11e770590000000c80dde83194793aa1406eb9baf22e8b814ae201b7909a038477934edc24290334b6dfbb5cbd4d8ae2affae6ba54836b4dffc76f69a2c2456ec8f15ac1bce01ec313d1aaa203f3e4ca5db08f385b285019759c5a4984285180c5049cd28522a7ac59982b3136d538e9306e6394dc52b69b0284e31e6a1726ea93859d4ed16ef1e93c3942ec705afcef496a6eee1057803400000003ff1de6e6fc1a86c948dd85d5518d32ca5c1515bc9516611ffc3a6df458366d91feb3d28cb3653161c47aa6d2d12702a9106b063f15789be323b79387eb0dcb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4a9463603696b42bf802bcfa703397d000000000200000000001066000000010000200000004f3fa43bc5bae6b998cddcd427309b5f420daeb8e754f903f8c1727d22599eb4000000000e800000000200002000000002c6559ee71dce134383a953601871ba3920a6a49a4d426a56e3f18fc83970d720000000fdd0e63ebb8513836b31c6bcbecc28f6f1abb67a065da2bc3e25d85d98714d7a400000000b91bfe25895d96407259587a78db8d0f230ac097bff6fa2ea3b9f332977e2c21ba13a21109d643dcb49084f99981ea067b96d650d6b1c4478a53de60c1bf99c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423428985" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2564 2352 iexplore.exe 29 PID 2352 wrote to memory of 2564 2352 iexplore.exe 29 PID 2352 wrote to memory of 2564 2352 iexplore.exe 29 PID 2352 wrote to memory of 2564 2352 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b623bd32dc0872a3b84b431e4ca01fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532636cc9268281b5cd11983344508dcc
SHA13b8c96a9e73b1531783cbf10b3890b4ea9d88f94
SHA256ee33454ef0d97e6de3bf18bd640258cd2e12d665faa4570078dff053d84b4b34
SHA512056623bb6510cc0cd85e65d9b73247f4feb3a425892934651d286e14e2811796c7ac7df89bdf3e49b2fb517ea129cb747d5e62ac5ee34828fb526cb221e51e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f828cfe60ad643fe1d04c206989bce14
SHA121c2a10783f6b55ae3764d8aeb01cd7485855f07
SHA256ae6b182f93c88682615c293cf816d989aebb5e8126415fd3ebe4a6cdd40f0f76
SHA51234a99a0c6c8240c20b41f960e02077191daac221224ca12986e55bb36d06eee1ee461eb466b5ab3ac45d3842226d92b026f8e4bcac821631f3adb017a718d8f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8dd17ac97f4c6dfded3a33c819aa0da
SHA1a6d1549eecc9791662443eb88e3ff5328bfb8a53
SHA256c1f175027b5595117c524c7fc1321ef713bd89d7b9a089f4fde532e87c9dabe0
SHA512145a3ed12bd45d45d8474aa21800302e1e28ec1088456c0376fa65217a5cd48a6d12675510f4c416e23a6bf9e780ad2d499e9d116e6e3383b320067e7dd74277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5433ebfec43f290e1af3b399cbe64689b
SHA1e611c1e705ba1498853686a3e7dfd324f53ddfcd
SHA256cce875f0c3eb4edbeabfbf3d2ca663faee14ddf1c84329c02209679551c06b64
SHA512dc3e4c107939c942be17cbdd58d36bd2824dec660076098d7395f85981a4135d2d3fc72658b46c4198530e9258bde473fefd5c49e0152d4a29a3ca3c02862f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ef8a1de6592c2d2fc26aa2dbbde36a6
SHA124109477c3c5a0bb24a8c9b225ada26ddbf0d53c
SHA2562fcf678d8124061cdcabc5d3c60223d6df0197b567036c53b28bed210e03a561
SHA512ccd57819f02a70b2f96d4a763b079534445036ae9c51c51d1e867db3182a28b35b3c1b1cf5389cb0f5bad9436db3686d8bc240bd4e91554240e8905b5730e547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c89411d131ae6a94398b5daadd505012
SHA1a4633d385660b3cfe9af6177ce88fe77b87ae3e2
SHA256eefa2c1c4122beeeaa0455756102453d366df862f7fb26d1c3f541cc5475ecfe
SHA512051a5d32ce6b40b592b9bc4129dd534259c90228b295edc23afa06986b1ca9a16fe9da1747fb39bfe27a4cb1630b329ef0467b8b9373f88f2ad9843f8e00eb5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2dce05183bb562d7492b9289cd78e35
SHA15834d28f147f50f78376afcba7f25eb5abf1b41c
SHA256851a062f9eb504bfca74c25df43c452a4053fdd06b776e7d49a4d63a5edc580a
SHA51283f72ba38a58ed2b6146b1b2d9bee9ff1c05bb97ef3f27a758aa1d836171571d4e13229de646ac84d1c3fba3452144cf64c449ef139f2359a00d664ab3870c8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567bf9aea55e7a44c32e9de8167eca27f
SHA15d4752d78576a5a617259687b85d8761089f73fe
SHA25616f8160b1b11fe39f2815c99861ba5f2c6a72e1be1502c0d9ba1838c6e73b3fb
SHA5121abb8f2355a2811dadfa3e4531c48c31f321228695413f3bba8893685eb33c3a73b30c8d49c2f4ea567590336d7c0dbd24b780a1232ce486d56b583b397718c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f4c178c12683429362332cac8b1d471
SHA1a874b9ff2772b165cde016bd7209f665addd29d1
SHA256fa17c87fae78c2f2e28355e1494dda02811158bcc0202c3e7bfa43c393984de0
SHA5124706628da36be821686a29ec6fb4d207d98e805d65c1c51cdac52f58c024c26813ffad3ff1e0e55772a37d420fc1a7e53a97c62596f79dc5544af76b65c2f882
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f4cd3c0c71e5681b3fa38ece41b989a
SHA1bcc4db606c4fecfa160a6fd106f769eab0e43d68
SHA256c43653fbb31dcdcde333e11277fcdccec98c696c5eea046ca65254ab4c1bef2d
SHA512a7ccaee3c8822faf0c25d67faa9b458b517331d7b49417198b0ce95997e433370f96dbe102db9e6554a24f0543e115d657a33db381ee5bfc1963562307ec2f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efca12153ec28540dc5e4ccb24ad0390
SHA1d4b20b66bfa3f9828357c35bf76a159db2626c36
SHA2562b31b5a726c82831f73ee89432b5feb0be282c50d8d44316d497f5bfcaa8e95f
SHA512be19f8a57a233212137e28bca23ded4d3b876a26039d74651093867cbdd3adb510793c94a82ce439a347b6a232a237dc673c1b2a56bfc695b0943a059a347172
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc5c3dffec9516c081831d10705b239b
SHA132171fbd9cab4aec7c1779c7b8b36bf388c1d508
SHA256d7343848326df3b33bcac73895123810401c57046fbf99adf15a90b22f9815c4
SHA5123bb4a7d4558913d9b6fe74034c0924fd4d79a06fe09bda62fd346a42f9ad3499a34608f102dcb8c4221d3f5f9c1d580c5fbe9b7114e666310cb0bcca4b81d108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bba3685c67fc93e9d40d1d069f2cb1d
SHA1af9f58ad38889d2b5de2ec7040dacc85af2404b4
SHA256ddb94f3fa810f23f8ed6a26f9a668d9cc33f6ed5fb172823ca59e8aa6567b262
SHA512b2187f02c6950ac0a09097bca281a09d3feb3752e633e7e0928d78b0fe959cf5880af0abe80c0ee1897ce4241240fb64b219fc5c17bb7ed11e8c17215dc55efe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eae5dbe78302853798f7182fb332e421
SHA1e5e0b3185486b1d9881c2d99c8d1fdd9fd718a39
SHA2560c68325dfac266f1ec24d0cf1dc544891d254a8533589efdf84668e177a18ffc
SHA512fdd79a423584ff18c8e6728321a9845d640dc49ef689c008ecce7c230b83656eb9150fbeeb2c60083e4f7cceae5df8c2d5318a88e23dc75fcd3f5d708b512d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6bd11b475900b63532a47dc29167a25
SHA1d3e26fe778265d98df70f139a76531e31d26b781
SHA25626fe18d937ae4ffb53b254414481a4e6575fb04979dbe24160936887caab6da9
SHA512360441b4c127edfbd12ce1dbec37ec08cd61b89ba85aca23db88e590eb723313081c121f2898929a1ac7a2f343201084e7a39c5e275d2654848bd51a5f0688f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a89fab670e5be3489c5d66d1e58d5b6
SHA1a768904e837edf608cb9f24d1ced10a67a4934d0
SHA256ab5301c878ec34466cc3d715a69e10dd694d9201e3ba01f31f32b78bd4b81fb0
SHA5128eeba0e12d63cd62a01884b7481b34db9480125b2853bb5ec81351cfc5d3ed252b3aa5a785aad966415073295c745fc940719a992ca107f66b16505454750d20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5280c708f581979a3a03cf1ba3483eb2b
SHA1e4c0c1416bee8878e74d688292f9d57a3d240605
SHA256bfd8498b73ad4eded81acc9bcc18ea7ac2e653bdc59da166b1cd6ee3053e0882
SHA512335373fab38004727c78f1a5f427c48a7e969e8724ad1b578b182fe5ce4dca33a701b21222db85a6047c01902095f8bd187a3752607ca2ff7cef50daad56ba79
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b