Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
8c5c901b3d9a0f710fa355ccf0ae266a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c5c901b3d9a0f710fa355ccf0ae266a_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8c5c901b3d9a0f710fa355ccf0ae266a_JaffaCakes118.html
-
Size
25KB
-
MD5
8c5c901b3d9a0f710fa355ccf0ae266a
-
SHA1
ad113d6d24e4c29a4458362820ad0614a28c5a02
-
SHA256
8edea74c4b3e7afb9ef6ba53d18109187efd1c38b95ae595dd2eef667e7fd3aa
-
SHA512
34449b3c7c0d445da3da072b4c9476405dda025429f6869dbe546f26476240ff4611b5379eb45939256130573eb66e441ce5ee181f0cb228b9598a85bcda50c8
-
SSDEEP
384:e+gO7d/THyl1auIJdBMMI7witKP7A7eEfhRKAx58:e+gWjyllIJdCMI7NtKP70euvu
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423451070" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac43c02eb776f540b8882163ae740a1b00000000020000000000106600000001000020000000c81994264109208c4c4eef03858a150b352aa8a88a849a65b3b0d2ae00e5f7a4000000000e800000000200002000000019768a57566b980f16ac2423e3686dc7cc2d0f95c5a18eaa6816057b4dfa256c9000000092f582a89c5c333318e183cfa104a4004189ccad0e4a474c3a2c2c502df3ba3d024a9062fec3bb968dbc4a6e4c30adca82fe8725129a379d3325f06561986b9dddf8db0bb9842fcc4ed0872ae7213ab310bed8bc995a7237870f6bd1578e49ab3965c1552fd5ff3b0438af0610370692cfa7b87c7d20680227a0fa7f5aaa0bcbc0bf6aa04e9408d6e7253cbe6e17779940000000ef35fe1a77d25a87c4068732c99fc012acd34d8464f8ac2adf1f03e289ab0e910c8a6fdcd8b19cd0b6d2b3263fdd5f18071bb8242617ba766306ce99518a2cd8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dc056986b4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac43c02eb776f540b8882163ae740a1b00000000020000000000106600000001000020000000db7637d45b479541f129da3fe5d64826a3c721825a93628135f9021ca33fc1e6000000000e80000000020000200000008f9cca06957757059c37b613744b994564d18b3a8829b912ca9f8cb0c071f5792000000046dc2bbae5a458a1d9c755faeb5d3f4fb57717d696f7cb5ffaefc04aabb05b264000000065ae5ce26e5c17f14dd6aa1bfc28d9b1e9aa77ceb68c15ab802714dff5ccd091a52b24f5191f743d15eb3787df540984ebd07f81a96dbaa6b23839f610d35b2a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9446E321-2079-11EF-BEEC-D20227E6D795} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28 PID 1924 wrote to memory of 2332 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c5c901b3d9a0f710fa355ccf0ae266a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a83308bde6528ab945614567130b977b
SHA1be3448d0655056ef77b0f3e13494235e65f60b28
SHA2562ce3c385693ddbeaadb99cf1a0a8308e31f00f03105c0297e917daf4c57c967e
SHA512db43779392c2e1d5826f928b3daa4038d6dbe094354981dd446c22b5ee36b9297356edc6ab280ec2580641f076f86fee1532af6df58aee5dcb8da4bcc34007c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5571a231a8f697b42b537f2196d8903
SHA1d249b449ba230f6551ef4ab14bd9b3394117afd1
SHA2560e1dcd66dca23b90ec2bbb0baf924952099c99e12c42dd8fe87ae7de517a979b
SHA5127b11567744552adf2a762b24002a1b78208543039c5381cb7243c9dcb5c38a2e3e0affdbb48c4225776012d347e7240aeca9999a5b6b725312f7cdf8970ea2f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c771fab7de221de3b87746657f079d88
SHA1769593e9f0c2acb02d1b6c0b6f313ab2fc70ea2e
SHA256339687fc0278ce4fb9fed7d0cfec6a50b5181ce3f3d14a04749bc3b730d81197
SHA51299ed9df7a96d9e068ee365aa59c6bcb88ca2da0357d546c87d1f765b259824d1d0de20dc02bb4f0171e1ffa3524afc6b20e0f04bfb512df1b5d23ae92e7a5bf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb2c397bb1da457bb7e3dd4c10e5b426
SHA1712115227d5d541e06cd3e79b0103cddec6d3240
SHA2568f1d811293d5c3727b9cea7d551f91cc858af052796bfc337e26e89f7ecc8eaa
SHA512a6d3bc4600467f7446a3644f8d64830fbe338b42de47ea5544230918ff2d4f6bc9e5d23557e89aa95c20a7052c81b8a74c6cd0d4d560353b6e269e591f206673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e4ce8b29cece83370fdbbc1efc68645
SHA1f81ab13db408be21bdcfcd301441cf7e11051928
SHA256fae823609768025786ae361596a53a5dfba7581bf64688f125896a46ca8e3cd1
SHA51225bfec4774879c2106db56b191d1bf3e03b2ca592ba28c60cd36423acf71c1b25059ead537475dc1a4e54dd454e1597037d3b30ab2fae4c6f09fcd3e3bd48d4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23a43b82ba36adc578bbac8969ff6d5
SHA1d370f825f3ca054ce5bb0257953ec20832fbd2c3
SHA2560e658d44afc65b920df1a65a34ae069bc863b6ced013852b4bfff15ad273c02c
SHA512130e5941a6d96920897a9c7769b2546c700a7bcfc196869c5677041a707ce3760b3ddb5eb0ea3bc470caf96041e23651eb605c711d77330ce2b6cf358ec1d119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2a976561807a0afb9ec7297ed8ca71f
SHA1ed0859f0159ddf41e97773373ffb87e815d63686
SHA25680e187de4a2e25b4ade88a2b2b24023061fcd50e9fd92ef6578418cd8efa63da
SHA512a3e5cc63b0e47518224756cae939266c6250c43f4245b0bbec64d2de2e6483c6808a9856a158bd2c0241eae409aab922df110b4c2a9fd4d9292a5a55ced6f5a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cbb340c65a0c722768cb2ac367977cb
SHA18031934452382457a4bcaac044cff9bcd3a2a5b2
SHA25665683f9e2f49f59b08da4fcf08d8dc537196e0d289cd196ccafac1022af73b53
SHA51269819e7121d3c2e06c8c05a9685bfd8b34ab7fcaf5c85181fc64030c02dcff2046c136edb8c95cb540d61773efc2314fa304a031dd0d913836c56b2b10d4c419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57aeb60458d203c50330c038676fad754
SHA1d1ed529ff823a6031c4a824b3909126eaf08462f
SHA2564bb6785063b5d959370f8bc90d0718a135908e8778080251a725c33d5f655261
SHA5124ea08a8d396aafe94cc9a77c1cfbe66caa4df5e5c6a6a1756c64388af40c000f59fc9956859603115bd5ed5863fcf5351665c147f12f2e9911287981731c393b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52beaac28dc6d31aada13dbd43063840f
SHA1427453732b926d9f1251c1eeba8856eb21478f62
SHA2560cfcb53896a8c55c97722281f580bd1713956f7e45e457bac9c6edead25688c2
SHA512faaa22de785d9478a9b5ebe9a31bbe29f917dd570f864ed8b7e1a28907e226220842cb6934f042c64ce36b8caf0a5fa63d348e4e0cbf084b7602fc9c46218252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef7236ae635b9e3012727ebab0a56e8
SHA147785636edafabec541c763f5740f68dbc63dbe8
SHA25679a1e290f94d84a8f33a62f9f3d649116f5669a46922937841112a79b6368f81
SHA5123c5bebd4ec15d8826d88237abc12b489ec3b862d93a6bab7ebfd485f87bdde3cdcd7746c3aacc9877841e8b5ff651dbe99a4226450b72b1b53a8e297a4884431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb068c4e677036129758bd4aa04e9cce
SHA139a723dc14d56c037fdadb6e84aa9dff9d02f899
SHA256c6b33b6dd1221afd38549879f188a795233679c69183ae6c34ab195d857fb45e
SHA5121aae4763b22b7f558458916b5031b4b0e60bfc1d08b3a2b841adc8689c182759ca28d2504319743902b844bd3ba94fd175b669bea8ce40bdc7d1c14eea58c192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522caf87aadda759665826b1e192ac2ae
SHA178ea3d23964816d5ee9a0ba126a9f43ef6e04a3a
SHA256c3247f4d772097d94ee506772323660bfcdacefa6995a895f845cbdfb0ce42de
SHA5121051c4ca2201836b9310e6f1bd45266fd374e12ecc83077f22c1a91443b4ff0296b16525986c5b686537d782b90e8523cb08a50b0e289e675205558db7ae20ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524aa3c3c1ec5e5b090a70ee199f2d601
SHA10afc5a30347baf2a430be664cd43f121f07dfe30
SHA256c6c2eb00fbbf334b9be72ce5d42d4b05c869883dbe8fdd878176722f4f7cd3a2
SHA512b6c296312fe90f2ac1d848b01924340d313f6a52c1c9a329fdff450c437be20a8a02dfff8b5b0e075f4c0ec161b0e24f5223f0e44edc5a939931632e68a60fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a4a191fd4ce4bb22f0975eed129dffe
SHA1bc71cbb5378a4f315038db12ed2a0b6756c40b06
SHA2564d24cc38c1285ea089c0394984356e47b71e37bd5799a8f137f400d9ccda82c5
SHA512e66fac743f3e2273c38a1cfcd0559f4bb86052f0b448cf97eba9e2408aa2a8a61705f2e3bed6286e92167066f02613e25223e4c2e345a850a75574eed8fc2a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5964170459cb15d76d6cd622869dcc242
SHA1505b54cd672a24507eb6c9a9653870bb5cddcd68
SHA2562097dac352b232553d4d1f6183937ba89cb8102c751c63a195eda575f4d12b57
SHA51272f722ecff74e5d4280958b3b0f412ccdec8138e253192e580b30015f552fe8fde740d1bf7db908e6e244afa8aa26dbc846385c2ada294909736dd9a6e0e38ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b35d3050ca42389025bd2f925479d08
SHA188af7cfcd1b6f3f5306c59e89f718bf1aed8bac4
SHA25675d547e5a1fae7f3ad3d698745e967ced284a49fcfd0043427fbb57201081e33
SHA512085c680841b79f5ee51f7a2bcd4524637d844e3e437676aa4772d241aeb82ae49f4b49c32fa460c4ba03098c610a35203b7e5feafb9bd8fad0e259f0f5db187e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a5059489ef56e079f9eb15c9ca816af
SHA1b98ced67680fbdd03fc8b407f7fb137af552ec70
SHA25677f6da715923d71ca277e8d6af767391a0ac11d0328884dd454cfce95e02b60e
SHA5120d7e1dcab522d77f8b2210346ab42845c9304da190115517a00223174ddb97a14fbaf77725e0429ab2ea34cf3fbe4bc8edc5110c95b8d3ed583caba16433f84d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b