Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 23:27
Static task
static1
Behavioral task
behavioral1
Sample
8fce69629db607182da30d8e9fae3de7_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8fce69629db607182da30d8e9fae3de7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8fce69629db607182da30d8e9fae3de7_JaffaCakes118.html
-
Size
51KB
-
MD5
8fce69629db607182da30d8e9fae3de7
-
SHA1
31946b52738107d07bfb239c60b51a7660210df9
-
SHA256
6b2072020987f6d9a49dfe17e2fce6ac8c9e74437956363486888930c46ff733
-
SHA512
c678e06e60db1e703112e10befc3cdfc39b91bed03b8df9e28b84df4ac484c06cd322c4080511faae790c1b0b54e4e1088f2362d90e2497e3117a336b39420cb
-
SSDEEP
1536:P62BOOZOr7gBbvFDzCAA99xxllAAppxx99ttFoY3o+j1IpLCM5k7QovN7TmTYEkM:C2BOOZOr7gBbvFIo+xtqk7QovN7TmTY2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE5A5441-2137-11EF-AAE3-46DB0C2B2B48} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208cb18544b5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000861681486d9cee408ab5b3412236ed5700000000020000000000106600000001000020000000724ff2035821df38cc6fe77df52174ec4bec59891aab25c72caa9cda2f9d4365000000000e800000000200002000000015d98bd4f778fa1f9936ccb1a668227941ea00eba7e2721256c474a9f5d83b539000000011572c55c850f5b91b2d39de964525e40489dd9af7230e6752ac6066d2e9ab3432f192e3caaa1cefbdb7b8cfc3db55a7e058e046a7b8d0206b45fd370651fc72207d1b8791755f9ae1995b5cdd9c174d9f16c1c122b0f2411db4c00c3fa992e14ae2faa30c7a3f3cd50886013888680c9d38f926b003c03b9aab80be59029c3e50a0985b8379f5f10343cbf24b37465340000000e38371768df6e0dcfb9b656b477b0b6438e82ade38f7769a67ac90680824ed8f1a4bfed043544437334ef5a603d3c7393849aa96fbd8cc06773198b3fbb78d1e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000861681486d9cee408ab5b3412236ed5700000000020000000000106600000001000020000000e0ce30c92439e4e5860da0f6ecd3cb262c3fdb9e570b40f6c72f0af5aa00a1b0000000000e8000000002000020000000ceeeb0202dd106750298ed6093e2536686b090c6c1938a3543deb80f55cfb4c620000000c40d552f98f2f93f1ec1489643cdd46e502dd5b51d5eee9f05d85bd3b58c9f164000000078ce3ac6de283f20ccc9b1e36b6c5e6085d1e78f94367061da1035a29458493c707588d233cc99a70323a2f710413aa4d3e40a76627e7e58b7e646c675a12db4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423532718" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2172 2852 iexplore.exe 28 PID 2852 wrote to memory of 2172 2852 iexplore.exe 28 PID 2852 wrote to memory of 2172 2852 iexplore.exe 28 PID 2852 wrote to memory of 2172 2852 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fce69629db607182da30d8e9fae3de7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d1e46f7cfc9b06835948f24aa5a0f06
SHA15d90fb5abaf26d7bbc813ec99ffa71d1b70b51f1
SHA25602b1ebda77ac605ad0f7a1fc6ee6b6e0193404d8d622280f6f2b8a679c9739a2
SHA512f567718f117b96880a389470f7e7e1b5737d50da236a10d8c5a07fc9aeaa7a12a42ca7e84b554c3802eea5ddcebd4ede460f79f77fd73e21f357f176a1970f26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502219ab88ecf173ff14cd21fd75ba4ef
SHA18c7b5d2324ffb711a5010b64c522a77b7eab3159
SHA256d0c3e3ad2c148bbd6c21c2ca7dc33edc5527546885d25754f85e4d888a7e8ab3
SHA512d81b4b3527fbe8b318a53c820404cc907d569b4648da999d714bac5744decd38668bdec9351880a69eb6c11d6ac3932e10dd82b8e12b93b78dc149232a11e8b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588087d607f13631ec41878df7f8b363f
SHA11c526a02037b98a032941c0c2d3fe432980aa4df
SHA256885d5fa1329da5e23fb61bcce78dec48d7ac585a3d473f388a2f7ecf4aa6c332
SHA5124fcc51bbe3c5d8cfe7999fc78d3fc5455cf73fda9166421a79e70a405e34691a47545566436743ca785c099d417f1187bf6ac69d3649e5d8cbc124db5973870a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ed2e1293fb23b80f6b28695afb3ab98
SHA1b25ba37854abef12716d2fbd7ca6278038321f29
SHA25683c6d78a3d9eed2c9c25ecf7540555785ac447f3c9d27b25394acf6bb3b3d771
SHA51247e965a805a1f69256affd1a80d4177f6c0bfbc9bf4c746708e3dc6ecf39c9c96f7bd1df9a0647cb8f1c9d718d735e1f0f0d618342defdc48ef3ba80046d24c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc4288ebd254b6de2995e96feb6b6913
SHA122d1ecc30797a2696af3adce47108dee350ef9d7
SHA2563e3eb0c2cba0450e6949a3181ec12aa1e0c61dae5e2ffb9aad7f8438b293378e
SHA51200212411ff4a665826145319ea6ad939a5eb227501dd23e19826f9b5a0a17b65440a4ec10100e7ee69c1438cce8b1419003931c86dc30293e8da5bba948c2b0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5956d6418865d85f63e5ffdf160553d18
SHA1b849169ce9f25662d6e22f036f71a96b66cda175
SHA256cca0ea898ebb04fe0d6edbb233a3ac2cbfde73d053425447ca757057efe1d949
SHA5125020a9c86b2d540b5bcbf25fac070eb90daf67247432d9f39581db53f9e696656e78d720ee19f19d241973d39346679d8908f9b2b49bb76dae8654e1a8e3fe4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c99f2f50124c0dd8ada6fb5c6aa2a782
SHA18d664a00ffcfe1029426c91c2c26f04757442227
SHA2562dfc62b81fdec803dba070d0645ceadba55cc1180dc52865dd92010000b45302
SHA5122d0bc2e5b9b444bdd5aa87788e7070b01d1cc72011503e210b4c7c2b7bcc1276e518ff26339a4999d8e9a779e2dc2703d89f14029f611c77c6a483694dac107d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d02caafd57f47e24710aa4cc428c39ef
SHA1a2c8c3269376d4b6133a3bfd4ee88555ee01bc1a
SHA2562353fbd6ced1e0f52088193f1daddc682038ba575a02181bcde68f8788db4737
SHA512afc4df2c08233936af32c7bee5f770f1bae40588a09801a7b8a8be6b56fed7c6c8014692e3f0d4ab660aaebbdc99ea89a6484714e819bec409229bb5a10d5520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d153e393bdbde72ba5d4d9082909d971
SHA1aeadf68815308f8a6201154ce277989ccdeee1f9
SHA25619095d5b8a718ef04490076b5cfcf8ffbb8204f582e69f8928b179a9e2025489
SHA512e3e3a1899747f3b47ddf022848d61068ad2c29189624508d7c06e57ad362c86625264bdfc460cfad85bf2eb9f35a0202e02caef51794e1904fdb44eb50b705d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd2f091cc47ebde9688e901b4851e4f1
SHA13326e09c401918b60fcd4ac0d7fa87b11a9e7f22
SHA256909e5dc33e5054d8dda5c17afab7613f5950ef7815fe5cb0f525319914423428
SHA5122ab29a8a4a14b7e8b9a75564e4e3ad9459691070b949edde84f5913566fdd6f0ab6c6df3c53c27d8d90bea4f66e352409f1a2b6c076f9ddacc3380ffcc371b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58033d066399af6f4c89359278a820447
SHA13527c94ecab86e3477b13ef25489c0f156431a06
SHA256dcdcf3d6d6c2bd4b563ddbf5e19583db9b3dba74db3fcfd43d46e4cecee45f4f
SHA5128bec60f8063980484af3c2e5cf1cfa88c904b691125a4e506a9cd59a4b78b7f8957be8f1b22ab955251b37329de01202b622ecd9a54dc87c462fa73f9d50c270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50370c216a9bdf5b07e212a9df1ff5078
SHA1beb7b67c9a8fb43ceade9d61aba4ed4001949de1
SHA256b976bf581775ac08f9ffbc8bbfe0868dce75f96090630a8aaa27466131fc7fd9
SHA5120f0291498acfd08cf53965145f49d3d19c33903cc3bc39c7ba00c6683033cfce853ec351a4cad22314b3c78200bfe280f68a38b8b65a14cc266a9641b47072eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5777a988598a66829d319181cc6061897
SHA1fd45e363ffb5a0f971b05e51c88da699f2d3c171
SHA256f2351b4bdb2726530474f3a6cf9c769fe07c0138f6f5c0a3fc5989f7f27e7e40
SHA512174d32be9b1d0bfe465697912e09c6a3708d196e5bf0a2b2050ada0bc24407f253fd7a36224c29de95c606eeebf0e4587c961ebd4d600b2fb396919a70a4ebd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a20edb5e65aed042b2d1d226eb7354b3
SHA15fb2f25f49dabc11f0b55932425b251f1c19b382
SHA256a6cb5ecc29fde24d71007fc90ff42bae408c19ea00fc27aa7e601b2f91727ffb
SHA512934461a4e4955d4f2f2d2accaef31991b6f7cd07a286a1577ed9e160388941f958557650fee52b5cefcdd127eb833a41ddbcdb32109a67c7f65cc6f09666a275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520f07c93fd58805f11f4c0fb07f3d688
SHA161e83ed3d6fcbf13c530723547711396dce280da
SHA256a18959b5167a7b45e884354ce8aa7743689b90cbc7ae5eb7ee9630d9830ac72c
SHA512544210678f0d8561fbf00fe6e8ebad882d0fee9a699358d4a1ebac14bfbbccfe54777c98ea66f428e2c3efb31618c012f2e478a64480f3cb49e524520803b219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5063267514b4cee07859fe9cb96d23341
SHA1d2ad16f0c5727607a952347f8d33878bd2e83287
SHA256121aac5b92a8b86a6babe5176fc7d9644d95e4aead291371d68e22de72d47e7e
SHA51258b1fa158d00b0987d2578762b2e20c5a91fc7866b9bf8e40147bd1c26f2932fe44e77ca5b593388dfc8d3a93677bb2bca372078f729e07ecc5cfa921b643bcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c46416592ec4e6d357ffc2c90b21fbd
SHA1d34357a3831b3b684a822c485e76a050af862155
SHA256728788e43efe2671b5ed5ae2dd9a21fc61761f716f879bb0a3c2dfa4bb8e16b1
SHA5123cc99ca0594beccc83663daef879d3abbe57bfb63cb6490a71420096ba1ed2a59e6d1b9aab706c157f47d6aa246d424df130d9f57a40d270ddca2fb2c85c4fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7aba5275980bdcc0f450a25b8928de5
SHA18522141dd87b33f8e575009e6f2d3b6c016db42a
SHA2560f6efe01472530aa47b6d87cd3ede18668c31f2f144b0321bb8e6cc6c789bf30
SHA512c7b558741036c6c153ec157b64950eef019568881e1d7fbe6e8d5d86ef9003d12c9aa6e90f280b08febe9e8e6462895c4fa4e57ee90ad234974bd56957386543
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b