Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
8bd4c21fcc366d72226f46b280c5a0fe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8bd4c21fcc366d72226f46b280c5a0fe_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8bd4c21fcc366d72226f46b280c5a0fe_JaffaCakes118.html
-
Size
9KB
-
MD5
8bd4c21fcc366d72226f46b280c5a0fe
-
SHA1
e3a0a5621f9893da5af1dc24025fbca4af8d0117
-
SHA256
129c19ac1b494e14e8777a7075421d63d7a848c2146f9cb82a4ecb3609fac26f
-
SHA512
a0c403b73227398d2dafa66306e6f33b7257324f0485b5ea1c8657bcc9c7f644e408cc8ef7eb19fbd5c00168391bb6b0cbb3256e00b22667b4a8956d0e49a90e
-
SSDEEP
192:+YRKJRT50ULs/cKkLTCJFVA45h6unq+JwXIuURM:K5XLWxL5J/qqM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d7664a61aff564e8ae4fab9976c72ce00000000020000000000106600000001000020000000148cdd36b90ad861cec5b78e3926105dc87b5c0f9117bb09f28dee9f50d3836a000000000e800000000200002000000014951c3d719025ae3e772e9bf7c3ddb11e7d1973762033c3ba370322b9c0c79a90000000081071aa8a05840344ab4dd1a6888a593563e2b9349f2cde92d479decc3ce2176382002c205ea288e3485f6a3ca2321da0154ba1bc74eb98483caa6d9d58e9db6b1571f0d01047263308f2ee2b8e7b0d8d4b75aeffbdc98f589c497cf42f08f4da78b2e46070ac3db57830bc4d9d4d438e421df8a558832cf8fb426b3b15c067227fa022cb28f19112415073318f362540000000e2b20379feff48433a8f77ffb2a91dfdfad49fb2ce74a8c3e1083644d685535257bf4479cdd700fe58614c8ba4a0b303a122fed8c5153c8b79178a7590894af6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24424181-205D-11EF-93CC-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423438861" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006d7664a61aff564e8ae4fab9976c72ce00000000020000000000106600000001000020000000e25fa8ecc0d27fb51c29a6f24182077c3567d8daf9f2e2ec5f1a87295d84bd41000000000e80000000020000200000003708b0fc31a75a5dc56f17d4d44425efbfbd0a2a70256a603094bb49718660072000000024e567cba33863f6f9a6d64cc4ca63de7409ba22c67ebf82813a297b7911ef4540000000e84f71b05904cd852b7144d091b55378af9310878fb4de1e885738ac137c0e601fa18f03889ba91b765caa4c2f59d28969b159da3b6f383f166763c8105491de iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00248fa69b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1196 iexplore.exe 1196 iexplore.exe 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1048 1196 iexplore.exe 28 PID 1196 wrote to memory of 1048 1196 iexplore.exe 28 PID 1196 wrote to memory of 1048 1196 iexplore.exe 28 PID 1196 wrote to memory of 1048 1196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bd4c21fcc366d72226f46b280c5a0fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54178e3ff2fda20d938626e9190593433
SHA1961dd021dd3b66724a6a2b161406af4dde30ded4
SHA2568c6032c3aaa1c4a730c9b085155cc109cc3a3538a0b51aa2aa3e897a7e69fc87
SHA512b57759c7bb9538e2f34ed7e327b8cb1704f6b0942100bf28b3927cf031f1b297cc71856f76c8f1161778fa371c16e862a3640abc45502254475f4b45424c8365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5393667bea131b382a463acc828178816
SHA15dc78e104528fc2a43b595c33dd9024a42f15890
SHA256fa9f4dd10fd64068d1be96b58bdb732eb2f425ba5a25168f9ca0640213ca848c
SHA512aa9de5af7a7320c351b92812a9ca367a885e9d68936af378c2c6f81dcdd205c8c80c3b0867ffa001c475ba210ee86aea63bcebd8261f7fd2524f7b66ff8245b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58381ffd96b960f7fb7e476a8ba4d8a42
SHA157c441d75a943d7e271d29553f03f690a30b62a3
SHA256e65ad40b69deea4b1bb1ab2b82e1e08ca3d090a85e8987d9a0968214d47879c8
SHA5126a26e43de168c3ced13181bd2d805c293df055772ec7423bb5c1af92d580d0432e294556d36456570440314a8ed910f8dc610e5ca98cf1f06f65f0ee169159bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c3cb15f434e20f3dd914fbe9da622d6
SHA1541a1b3295b4a6d5772bafa3be58c6dfd7acbc12
SHA256f5952e91ccd107b5edc9a6d0769944002fa6714effe70775b47d91c2cdb3726c
SHA512bd79651cad674015bc2e33c444e35fb80dd8ab7161a2a815d06f48d9c0e7010c1c9abfed4d0917c893182dff256879be30ddb2054130849a3133c763632b2cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51535311f9ab80be6e6b93ca0c702b843
SHA1679634327b6698e8cb2ae4c01115a10a9f0b2107
SHA25661da073e45d76c1efa1efcf33810d484d73e768f58f6ec89809b32b63626c9d4
SHA5120128f6dc7f72332af4b5b7b34b2c14f5aee63598e069524889f79ee1d75259ed5ba037342b35a74ec410ada1b7b67f48b13eea6264e6efd3bb09f63816764df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5956f3e2a247f195497b38ea4cbab5703
SHA1fe4720bf53d640476d82fb63cd7e84be176cdedc
SHA256fb5a58bc1ed2956187c9a5c37784ad52d20d29a03015a50552abb16581f7b3c6
SHA512ee7e5740568d6fb30c3195d459a1b42c6b9ab126e38a0145775094e1481d0cd011b60a1a68d7d2aeaa4b63264a93df4c7567263cd9776b4eb56f30005b700120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5496aca02cb6ff64f4500707972ea6b1c
SHA1c068a3d53f45741f8f7871c02cdd3ecfa303f275
SHA256c2366c831f9b363a36e2045a53a9d0782bc990ba98dd83f480451e0cf0208159
SHA512dfb2cf2b5e4ace47a6b7936e10ff410712c24d9fa153e471db97b0b4868635636db3c1774d27fb7bf6a885d91434ff3f1bc45ace89e81f4194b78b32f156465a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51158ca71e1a8ca84c0355d892866d7fb
SHA1f2b7d40f9f50540d01dff5f545aba8fca894332f
SHA2567ee8497e82fe3d1d364a05f76587730f97c99a11d7c3cb1491c7d30b657b428b
SHA512afe62fd556cf14ee2b972e9439adacb05871cdbe3298d7bb7ffc629f44c82db10f94208b6dfeb90ce3da5869be69855ce93a8319914fcf99abb81ff70abbc2e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592c2c9262408dde0ab7412aab20e0303
SHA1f8483997e7c8ed9c023d888a94c914296a74e72a
SHA256c67e8bd66746cae726302004aacdc572b0ccf967852bc3632cd7941ae58ac611
SHA5127132b4261b7fa5ef2739df0f973f3df18a4f20bd75ac489cbb999e557654cfaaffb1141613a9cbcf03ae8aa2197117f626fbc2ff9a5f3221142f7e5c68d0ec16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf839c5228fd75e72a9a1640b97a9450
SHA1430271fe0e85e3bba06411540b0b0a6ac3ef9352
SHA25668bd6a8c30733a3842eb8dda1346c0a688f59bdf63dd5a651311020dfc605cef
SHA51231aa47a891c5025a45942512ae433e5ab0945808da033e45ae0898caefb125fa788ce9752d71c3b0bdb92ce0ca91f99a0ba00941dc5d7e2b6e3266fe166ded3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e35ea3f981937507c50b4ad086fc28ef
SHA149e90bd66a794650f2136281751cc6e5ea5faa40
SHA25628e360629defde4ef9405700bddf7bb265263377989c6aaa03f9b85f02fb1762
SHA512129cd17580f256202e0cad3601df650ec172919cf76c6482b68ab8f11a1eb12ba297ffcb091e4a112c9dea7b18f21b8a38dbeac8c7b15a3b9f4d3d88158d7652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc5d3554238193bebb8e68a8c3cbd76e
SHA1fe6fcd68790c58ce4586556dd71d8554856cc8d7
SHA2562c486fabf2267538804607dd2de8cb83a97ae42683c804b7afe63e3409021dbb
SHA5120f78ee0ad1a118475b5afd8387f779cd32c0f5d954390313dc782c5acd399a70e59b6b156214b22c19c2f93e8e11bf086ed0b6e04d6ccd93859dae422a9bebd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560ab3debf34c5ecc169eca530ee5bd3c
SHA13089dcba4e1ae5478b33d18fd70b86226d06847f
SHA256fb296c8be9920f23e1e5ce67d35d887ed10a7365d3ec246ef4b644e2180fcb51
SHA512e84ea6f011c860f89302d0834970194edfd6361624ed40614ee4427183f3357bd8970b63f3888758801d53a956ae2e2df2174ed9b6d61fd7deba2520958de6ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa5fb5b0050e5af597b8f34ad23795fc
SHA12869d2598e7796443e82d33046bb974f1f6cc739
SHA25607e140a6177b5e56bc4e813704545e6427c2e184144aad20959c678b7bb6befb
SHA5128f9d25f6c83f43357f2760282bbc876814c9bf654e2f2d3aa51e07fe5127d290c20f70fed82bb40d541e42a785ad6ca127dc52093e7272932f30ffc7ae9505e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2925b6615e51c2a20f2af6109ce2e5f
SHA195aecc6175056d11ce97f557b7d4d24cdd413694
SHA256758dbea579143172fdeccbd0e3febffd32bcb8c51ecbf9319bacb35ec216267b
SHA512be5505824462554d09076da79174aab56f75ab58c6d15851a8d9a95c9436111ae22a465cfd7095dd2bb6e8e50a763ee78db65de5e4e96a9656274db1a0c74eb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573e4d846e8878ebf09d951cc55a69705
SHA1e1160876abea3a198f2a719f1cd5cdf4bfae2b15
SHA25672534fe676a1a2b0257ea7e04ddc949383a02ef9b90235b2d6def0d5f3f03bed
SHA5127969f5c90126c10e9f3ccb8a3ebcbf6ef59dda9368b5f0e9fed8d9cac4ac78d6e3adb60826e89a8f8e54da88cac126ecb2af661b0403247907bffd77df31d406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e83d548047363819cc17d1f42a1649d
SHA16b7dbbd3553a3f81391e85e991e1977280de79c8
SHA256d30f41c02da8404a884fe0b52349b28d032f3cfe86f1fe27f2e768e2cc682b6d
SHA512b66c26b7f9ca3de71abb42136db8a1739bc8f9b234b0206f1a4976ef5f6ddbe8a1bfdcad9eb89e12f55e9cef437189b9483ff681a107a0f9de8cf0c4f88deea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51860e5a35c8f0eed0051c0c54b2701e1
SHA117d29bd95cb29646c5ad6f0091e78f10bf205e28
SHA25608a7737fb5471dad3c7c5a1023f0ba5c5b31cdf80e7615c1af25e7be2e7a0f32
SHA512e54aa552efb792398b733e8966f4e0e79ef2f8d57c2cc86bd264997643e0082ccdfbbea65895c32af7cdeaa61943815952173b24ec7e4ca00f124760b3d0b514
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b