Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
8f86c1b73d149dd4b34a600388e3715c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8f86c1b73d149dd4b34a600388e3715c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8f86c1b73d149dd4b34a600388e3715c_JaffaCakes118.html
-
Size
6KB
-
MD5
8f86c1b73d149dd4b34a600388e3715c
-
SHA1
0109683037cccc0a239fe79bdf5ba32799fd64b5
-
SHA256
14e3ce38abe7cc95bae3ef4b77fcf3ec4586de9ac3a43a8623f65f4ab265bd12
-
SHA512
a213feabc11b8ad0ce182c49002b2392b47041ec14d8d9b64642d86fa4d1d0ce7473549c63913a310f437d67553be0b82aa639a0d84507bc6f8be40dd4d4853e
-
SSDEEP
96:BhM3sHfb4m9LPca1/TEgNTIC1GwWWhWJ5AfuT3:BhM32OSEgTI6GwWWod
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423526397" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca6542b595d6b641ae995911a0676cbe0000000002000000000010660000000100002000000092ca3ea87d058d4fb577a097a9cbc7ffae30dedf582881b6d9756d5e7682bbb6000000000e8000000002000020000000de14f795cf08ffc78559c12a6fab3cb8dc0203d18eef602820c25e90273c7aa3200000009b802b038c992d02517c27364623b6358005da5b0d41fb6e675aae50f89f12a1400000003beb87a975f183480e7a2ea3bc023494c6a8b3804b684d600f6bf6ef33f03133e66d44033cec3e17eb300fe6b876ed2e8dd7780bf073a3edf5a3942058ec2f26 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6C01A81-2128-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca6542b595d6b641ae995911a0676cbe00000000020000000000106600000001000020000000abedf2ddecf07c3387285451d9e0d56e1e98c11e5a736fa507b4b2b89a0f3cb6000000000e8000000002000020000000e7565d7a4a9f177cda5bd226187cff4e8e55b6eb07f81cf6766b2d1232154fe79000000081d5bc87a5a5f7ed2c0ba12f530efabb2b945bb2e4ce7f9c1d189ef872ecd1d8a161a0d2080e7f04806ab2706a1722653f473b9996a2999768fac8ed5d90656cc0a79555430ff076cfbcb4e441721aaf7de69fbaec4415f367e2189a986f94ef087183f18a24fac9d36b55803a432bfc799999d04257d131bc2fc21c4db7604c65b9167a1beb7b3d39af5d5385d07320400000006a68f2c5da0282f077166134e266b9105a69467b5f6fed0897538100d54018b091e466d47e89d7ee31eb0bac6ed14dd5d7d266a708d60dfa9d7e45fe97acba55 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30884bcb35b5da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1228 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1228 iexplore.exe 1228 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1228 wrote to memory of 1272 1228 iexplore.exe 28 PID 1228 wrote to memory of 1272 1228 iexplore.exe 28 PID 1228 wrote to memory of 1272 1228 iexplore.exe 28 PID 1228 wrote to memory of 1272 1228 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f86c1b73d149dd4b34a600388e3715c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ad5da9e245b51ccc5f14baceb2f3f8c
SHA1002863c96e7698375a7b6d617c24a7315763ad73
SHA2569402af1494b6ac62e7d3a5ba9cc297183ab9b3a1c82a83ba198a71b0b9b17826
SHA512c718b01b254227416f18b75da3f295b993f6f9804d759a946f7292743849663f908f483b43c069d94764033d2e0e42d94b2aafadeecf7e70a70a107ef85a8eb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c790abad28f3bf7053ae4fb11a33d0a0
SHA167ef00f70831ab0ddcbae95d17bc079007543c38
SHA2568ef52897d9102ec6896a3656ca4812acb3e98736ffe40eac719df33adcdd6aae
SHA512386514f93644539a2924420e85873cc072b1719147fcafccfdb95fa61acaadd474d3fd2af215a2a68e1e6638f8b784e7022986b80d559fdfc99d2a3cab9d6dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b18206fb0017695654b96efa7e7c5d8b
SHA14186af38fb8f242dedbee383544ee4b378ced689
SHA2562e24f9afed95e1adf66cfd0533ef4456131675e247a8053c0fcd23bb4c8d16f6
SHA512da6c90293b6ff015cf5fa423f922e9d48fe2af76c7e5d80e0ac0ec40c50ff80d1af0948551f984a32efec58de2d861321043d86cd4603b1688837e69a19e28f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4ebd34ea767c57a823aff6955488910
SHA1c510bad8f7a0d8dc80b42ccc0a7f5778801f484e
SHA256e6586996251fef670f13fd0b148611eeb8925fb4042ab64db2434e78538c4649
SHA512b01b9b0e71e0f0bfeb1c5b3ef13550d71e252639e395086796ff7ecd25010235361735b04edea7d0c9019f8f8992e063f90bd3f8cc0f805bd634aec1750f63cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bea289f370c17600922b35234bfcc7e
SHA1b6ca5c35a49ac203cf0b69a6029587996d1ea5c8
SHA256a55a5ef675009e977ebbbbf8d464a371c4148597d3f36d68482bbb9952bc6b43
SHA5123a0a96ac4205daacd416998187813127d68204b517a36dd16a2cf0d20fe066d7787d3676279b9376d2d3006a56f97f0e0bb4c942534c5a908d0e4fba9341e9df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5769f2caabf4ca9244b06e251ad2bd06f
SHA183eaa500e3312042d501c05e23712aa3d2c54a27
SHA256f91eb62f6e0fa9573e319fdf2e717ee5884887885b2b16cf1393470e3c20c300
SHA51243346b20985976d617df9d98c1e012c0d2767287be6c4f428b6587a926a9bcc1869ee656c789034290795a1d99a860121093727dc8e941b02b4f18c32b6c499a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fa2594a5a23001ab288db153155860e
SHA1a22d70bdfe27d929bac45087b6c098478dfb28db
SHA25699baecfa68af6a79b215e4ad940dc32a251376005a5a60f54b24336e464e6499
SHA512817286da43ec723baadc4b22779591553a2a016565e9bf96fc0e054a0180efea2bfb0b29bbcbd1fe6fbd60dfde3fb71076ffc961e83f72960fa25ef9b284e174
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f6a6c4be898c1845a4ad1fe9df57c3c
SHA147a2bfa6b5f8e03dae6c2ba1ae138ac35e1a54d4
SHA2568d7d948e6fd9e5e06641898ee601a78bb60fb56feceb4ec5bc0dbc40407ec481
SHA51230fbb23eee7c3bf935d7456d6d54b0479ffda204e3c12bddf68678dbd5dbdd7816f76211702e6139080ac087e39116fd4d0b7f10a40d750c34ab758039c1a5a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59830e5d3a67ef74bc8bd73ae0b715901
SHA1847c41590eb8c72c80bbbecb588bde5e9006b525
SHA256f3547eee0fb50e1635888396f507760ab46caf6ea6878835afa8024b1c605a50
SHA512ac8d86ce689f360b551064a4ef38c10cc4e825cf638daaa0598328dc79a3f8c582ee9ad7bf86da71a9018927372de5297d038c189dc1a25af155cdcd24888024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fa87380e1a823f6be639e71d4fe996a
SHA12efff374accd09318850a3ccac4987769a7b8da6
SHA256dffe8f0cd66e8e8411a8f8d4019ccb11679102bef3ef2a37d502af2d2fbe24f6
SHA5125ab065d82f1172ad6376c31da33199a5f7061410ba8c720df8cad3d7f04620d0edc26b55c8a59122e244b1d0187490b4eabf1a708103a023dae5427ef2b024db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5898200ae9e944fdac780feda2574e4c0
SHA1ca7ccabdea83f06a38b4828373bd1570a87511b7
SHA256b524166cc154f268cb81a796d3c24a014d3914c5f8127354af7306400564654e
SHA51278e20e4cbba539179df98caf96de94d3dfde978cf20dd60ddd134444ac0a30fcbcc06f6eb73665c0a2f0a25a29889d446d518bcfc39818c6392eba75e5787101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5e213237b50091856bbf7d8a1716519
SHA166cd505a784ba5e631599cccee3eadec70d020ee
SHA2566b5d269374eff32aa9a0a9e0909ecc1707d752b5b928aa2f4344d9c128d56ed4
SHA512c9290fd6201045ece822340c0906677b9d989f12a8fdab5279d5663e9adc7ba2e714d7c3e18ff960b2479769a8fcbd759056a63054723dd0f26df27e44b6b1b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51017fbfa19f4eb5d081650c25062f907
SHA1eceab1c5d169e7a68593ba55a49950c3f210d847
SHA256923818850a0fe8472944ad26d88dec52040d76c35d509c00fd26d5ba897b564a
SHA512b816d3dcf48206f4adc7521490d68c960c6d941658b46e0fd6a82e02563a46de8511ee5340be8c933147834b2f2fcc8fbd4adf17bbd6097a8505d0e6ae6ce34f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54996cf8b0c9c68bb55d68873cf9980c4
SHA1eff3bf2eb86d2c5bc0cba20ef07a0e566063616f
SHA256e23c48d9917e596411aa9d147c5f83dd3b4ed178a524e064b24420728f378bfd
SHA5126d005c6bc922fa694cda19d552bbce9b1bf371f6f276c6cdc1abf095c49934a0cb2db5d2ab9e599dcdc08c072d95bd478afd145ae75a242739947ad7733dafe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d04e2fa88436a128008ec0b2b854e67b
SHA1ce538d5b1f064ef41026c1a986a782d12467d836
SHA256e6a865fd0de33c5f4b1a0147a840175cbccf0ddd720edc61797ccb60e37c0beb
SHA512da6e03c37cd6fef5907333d83a26020aed391be4bf5d1992c6a9454d4b66b1c137e1ff6b14f19a15bc8d6e3ab7fa19efa3157e60245c8d900e1bdd1dec5ebf85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519692fc34f7d9a53028e502d61b16d54
SHA1fa3b4d94e3ded5b1d4c6d63777eeedb3f40b4dbd
SHA256c743ac1206e19029bad9bebfd23508bff72d565a792c5ae0cc791ba159c990b6
SHA512079d752d8217f773f62a4310c353fb6c83dd7a1b1d5662a4049bda12d9380a7e9655c63d7b35a453fe3132d062fcc8aac2b6abdab9d08ca008c07d1144519b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565309e8ab48aa60cf2e496b818904e00
SHA13158e457072954210c9c562fb096f0426c1b9836
SHA256055bdd7ab295747c9f985ec047d62e7943c8994842203282fda4528b30e7ff85
SHA51244268af5cc3820f6de0add091f5af2e9e654ad41cd698b5beda2fe56ab241b2ea228c0eae1cb9957a3e99813fde0531d07a3b064b422e42b68a6bb480f9fe1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e8a426dc3b09c2e9a1bcb89ff97b441
SHA1f0240f7104d266b9f99a5f25cb81a2cfdb93ddb6
SHA256334bfd98de0918b9e37b817ed5efcaba4905d29f462b22c8cae4127474f1e050
SHA512f0cf061f0af44fc10eaae417136c888ce82ed28200178a54203556c9e8947b533bd4f0d54fa723c048b6955ea152eda85736b9a0a56152bc733c14eed4ca92b9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b