Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
8c67bc50fd98919ff170ac6501a37a0b_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8c67bc50fd98919ff170ac6501a37a0b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8c67bc50fd98919ff170ac6501a37a0b_JaffaCakes118.html
-
Size
461KB
-
MD5
8c67bc50fd98919ff170ac6501a37a0b
-
SHA1
846339333b5487b388eab9461a237815dd7eab9d
-
SHA256
b11f94beec5ea8e1ba5cb20489cd01bd949651a3742b6213c07da27d438e5c38
-
SHA512
62cdead43b9f3b612ed0cdfb1ad7a34683ca7132119b6f619d124f9032f01ded64fc21a9eb0b46ddec63815b09821dabfe9cdd41872c18c98f72821bea4a6d2d
-
SSDEEP
6144:SRsMYod+X3oI+YssMYod+X3oI+YCsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3I5d+X3W5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e08e61af29d41b40b6d33ef7737cc2fb000000000200000000001066000000010000200000003c40eee3d116f6100296648c134d1e4c6520542e696da92f47cc82b04dc0212a000000000e80000000020000200000000850a75a142d50d64f3860326b19f8578c7b4c2194383ac32ec7988300f55c9590000000a0411e084b1ad1fae6f9943e3fb6fc3d3b1ffd5a6bceedb344637e168bf4399df0c754946d6b41411c3272859c5cfba556680b544ea86acef975a35fc29295d06caaa145510ff1f04127952f08c3e849fb4e46565669128267d8db5da1dc78a66d3a495947d2fcaf188c31a2013f28eec815cc032374559944e0165a72622cde6c5fb5a71554e8980e6ed196d7e20c4e40000000f0598453715a41b8094dbdd855cb5062a58a12bcbd9133b69258a3dc68f9dacee7b45fe598cc0bb0485a065b4ce4eb4fa65969b173f889eef120b17d38fcb597 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c1251089b4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423452203" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37A144A1-207C-11EF-AD12-DE87C8C490F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e08e61af29d41b40b6d33ef7737cc2fb000000000200000000001066000000010000200000007998b125fa5e9978ce7a00350e26c8cfee9046276b37465dd520ef83514d333c000000000e8000000002000020000000fa019fe7e6efff3ddbbac2327176ea71aeaabff2d4216d13b1c5c45e968edc6020000000e01d6c69dc516b075f310b4cd8dec165aa93c9800b583fd5c2b16061c9bc74b140000000a0a05ef2331fbd6217164025f492f69dbb4f2d28c3e5be981783cfa16e8e2792ec7c3dfec7246c170a8c7b3a26974c446d880175d1140a5a79d7460a232de386 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1892 iexplore.exe 1892 iexplore.exe 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1036 1892 iexplore.exe 29 PID 1892 wrote to memory of 1036 1892 iexplore.exe 29 PID 1892 wrote to memory of 1036 1892 iexplore.exe 29 PID 1892 wrote to memory of 1036 1892 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c67bc50fd98919ff170ac6501a37a0b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5191ae910f8f05ee96de37bc02ce4981b
SHA18618333a1408c65088512c92c7171ec8ed72c92e
SHA2566dba13f6c2241b8715bfcb0c10a32223cdc3ed263ee48a352f608b46b3b80c20
SHA512c01bda5b45552d1d03673c4c4fcc7e9e59e70057a57f375e4e3c8bcf064da474faf7b969feb1b23108e69b114f01685a3f3b729077a6f9d00f41a1a592ae396d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571395734afe631e360f48f1eb3ee7d22
SHA125def75d10e0c0f69850edf36a1bc44700238e09
SHA2565fb977f8a367b8de4cb35c954e58af9734f0977dbf76d5a7e15c1b2c5cd2d696
SHA51283260372ffe0bd36426b41417ad71d2568e555a3c157ee6b3c93b15dc79f329c15c2b292d80c8b1f6fd7e0ea36369a227f1db672bcfb275b33f227fc37c1c272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a42cbfe3fe474e451b312f6eca134cc
SHA1661cc33cf5215d7ebec5fdb4334946b66146bd41
SHA256d0a1eaa2bf46662eee02976e87821ce142bb3f4596c2b4200a2bed71c5ed91f2
SHA51227662751540428e6a3af7207855cd7b5f9ad6ae20adc93eb151dc0b4f6323ce07dba483266505b1d8eda0a6cf4aee957bcb49c06b92042dfb73e6a97457430c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f8cf2d28221d7afae5f0d5ad6a910a7
SHA11e0296aa9adf360dd0ca62e43da61ac7ebb82704
SHA256da38c1c039ec62a5ced9a64bf39a1a7be5fcbe9019b34619d70d1466aeb06f2e
SHA512105d8d4bf5565918d3a124052c18839fc9ada4f24c6bafb0b875eb27c85c80d4d3a79a9f229d3912c7f0427d26cca3ea4e490ed4dd3b14977e87464264792ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcce68cb44b0739b06b6f369c903fd1b
SHA1545212a03e2165245565029790dd3ffe170b432f
SHA256895db84a417acf04e443ebd75cc4e86a48d4edcce7d08e6e28bfe3cc48509bd6
SHA512b19fcf10360b15b11e5d89839fe09a1305966f115f6f6b95fcc2d205589f167bd6aa44a30787eb4af08fa682aa931b65962c7f72c3045894447a9ec27d9209a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564f8f3fa49d55fa048cb279a543223b5
SHA1fe8a6748e8b60b571266c8f82dd420eda2aebc9b
SHA25613d051fdf2e1111f1b415325fc4794ddc9700dada48cb5d982db1edbd09754f2
SHA5127d8449d105a3bd7afdda1bf76ff4234f8910ba968aadc93bf2d05ea209263c521f4e8f2ae5f108fd7ff2b48f5721175496aea677653ba5da0f36e401b055e276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594ef00aee0ecdc54ada088a507fe7e50
SHA1d7ce63938f0830d2d75ac94af932b9ba413d0af8
SHA256bbd4ade50dbf3413f96c63230305cf0d3ca8a56f8e010af3aee0be06faa1e7e3
SHA51290e6c914dc747182f234fe2189173f43e3d97afa5103e25072cc529559576fde4dfbea8fc57c4d6c6cba7f951e10c48789ba0841b3049ae28947488948e75a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5353882da6a6f9076930a5801229ccdfd
SHA1fa0f7187056a93a673dee0ef2a869bb4b5aae56f
SHA25688033f90bb3d00411856dc8b7ee17ee6a5e4ea11f1bd94d897ccc5b7318372cb
SHA512ce42dec7100903c5642162fe94d1db2e2003fac56b4493e8722d4db1677e67057a1c3cfeeb8c6af961b0f72f6cc04f9fd7bd168ce7b2d7ca197e6337a727f7c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5090f0fd7a91ca3569bcb7cdb8f397930
SHA1624b6bb65b557b79736eed79c028acf40b46c393
SHA2569ebe11aba04a4a5bb1095a7e809775c49c7a15552d3df40a18dd85cb6158f578
SHA512b36d204adf88cc45e01740aefc9e6adaa036bf831cfaa9df7cfc616ceaf1c0184de6bb602c33eb1c284b5c28b6242176c93ab8e69b8245a374980d935ef94a42
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b