Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
8c72d37ed37bd751c91ca9e6b26c6511_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8c72d37ed37bd751c91ca9e6b26c6511_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8c72d37ed37bd751c91ca9e6b26c6511_JaffaCakes118.html
-
Size
4KB
-
MD5
8c72d37ed37bd751c91ca9e6b26c6511
-
SHA1
532540fefb34579f5980c2b91114283e02ec2fd7
-
SHA256
7fca19cad707c5ec6f290571ad98b9d9c3300b4975c75888e213037ae7f30f3b
-
SHA512
06f62a90f4ac01cc0af1b577521a313e576df43e8f24fbfc291587fa1d19c080b02cca3e78baa7eecc377007c3a80949f3f0d8f6bdc7394793cce16296fe85dc
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o0Knlcd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDp
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a974a0db1fc0d4abafc0ab364af10d500000000020000000000106600000001000020000000c205e02c539be75810b4e4a15f10bd09933e5d936a8292aa2ecf0a5392cbaf51000000000e80000000020000200000008ed9f0cda1c3b460db6bf471ce83742f82132b6b2c25d8fed43f5fcd655a1fef2000000090d0096dfcae3a325b88abb32bff6c3b2c16cce5776a842edc544687881e794d4000000016eaf7213edc9bc2bf46baf53934f061ae352b880dd4d55a99134603d52b0accc5e1950f143b810286b30594d2b666af4d1693cdc56a640f7d4eb9909d53fe3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a974a0db1fc0d4abafc0ab364af10d5000000000200000000001066000000010000200000002eef5ae50cc70d8c0b5f6f96514ea974b4352ac6ff6b2007756072f996bff83c000000000e8000000002000020000000ffcf9c807f35629b1bbcdab1573c4bd67868084c0d93d030d9715a2fd2947a099000000042f3d3da6b86761e3bb49d5670698111c9c669aa45220395e49f50141848f2c3d27de0b63ade5eb6096ea87cd62230b641ce680440f2fbfac58933fe00209dfe4e07c3a7dbfea9e5654c09217fba4480b97291b43a861b84fa811011bbefba29c1c7e037ece1565e13d89dd10bb6d1bfa6626d05f50d5369205518778d6271de1d646e1c48464cafe93730affa4c5af1400000008da7077af8099e533c6c288f50674ac16995fecc1bc508d18e20eb2c343a329a4170fed32227aa8bd02be35051c682e9b1cf7f22435fdc07b92f25f7091b4b24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423453390" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108db2cf8bb4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB2A8291-207E-11EF-B20D-42D1C15895C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2488 2460 iexplore.exe 28 PID 2460 wrote to memory of 2488 2460 iexplore.exe 28 PID 2460 wrote to memory of 2488 2460 iexplore.exe 28 PID 2460 wrote to memory of 2488 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c72d37ed37bd751c91ca9e6b26c6511_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512b3572aba642cf5b336986711159413
SHA19f4bc28e6725b55cb438ebd5bfad4e62ae85022d
SHA2562d29272cd1aba041114727486d76592c526db2be10bdc1be556986728ad97bac
SHA512ac3061b0b056c2948c0cec9c5343b5398da5f7d944e16ddbf93300d710c8437f8227a784abf895e9de21fe45e5a5ab702715d026eb0f7952d0f6d93e375594a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52470396a259c49fd783a893993d160ae
SHA176da6ff46bc0e8a03f1ef8e67b6306ca577a9023
SHA256c92f1079f34e85cd1804129ea3d017a868b7f6802c9406bf8f6152bc5e37b7c4
SHA512ce6108e9d09cca50e23be572713fa95859dc14d06cbc9c80f41b0024fef4cd11517d4d64435463623d6edb345dabb698cbad479b34bd376066dfb8555de6951c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7096b8265bf8064ecb9d5f3b3e0d0a9
SHA17026a6a77180526251e9481aff233c8e0ee66901
SHA256f4026922a25b3c7ca741096d225ca39c3584f7572a2661af0ce1f88220b8de49
SHA51248101a19de4cf9092ce9358c094a40b3660eeb7e2b3aad91cad07d24d8d9a20e6b7d331169f51ec82d3fbfad7e2f39c91672b744978e568c2777b05d2ea3da24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b304ff0267c5d2ea5ca28cf5897c5b5
SHA1d124824e3cda49f362f24a13906be56c1557593f
SHA2560447d9b2b9fc87207697a0dfa182aed5a7dde666abfe4ef4d191cafe61d857ff
SHA51220cc5de62baa18f60f40231ae18463472de8dfdabd1680249faba4e13527e22412c98aa55866af6f71128888d8d9cd502c790f0d86c7bc07fceff095ecb7405f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9ad8a7f875b1117611f8c162737babf
SHA10f63879ca282bf230a9ae7504e4974da06f8efcb
SHA2567f9094582660141e1ec7ff21d369b39c5aeb56811501d477fade33b60bb22576
SHA512955b3569117a7fed91585f2cd8968fc9e5f0fa9316e795142ef1bedfe519a41cc7ec853813d67703964dbeb786dffd89f312900dedc74605df0f85249e09df69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54852d827c7710116227d68eedd79377e
SHA10d7700500924bc1edf19a9692dc1c731862d20fd
SHA25673fc0849cb141772b07d3fd01ef347953132a7f5a76fe6ddda00d521d68d099e
SHA5123d6116eac3904f37b138b84629e70a7bc8862eee327788ea45dde2f43b0b083ce728da3ff5e963af1f3a337d9cd055fed447fb2071eccaecca6a2e4cd42e8113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5533bd6884fa8dcb47bee2670f1c91e64
SHA162036d3c0d952378388eeee75ea3d71661cafe3a
SHA256fe06c5619baad99ea8214156b6581c3785f4b75b90dbbb9ac87884ef2cde6680
SHA5120c514c8e7fc9413208f5dc6d340bbba73d19e1ff77a6b2ff32909d3b687cc0c3ae0bcac79ae33f08a340d44cf78ac6c8f068de48ec2fbd24eb85fe469dcc8f2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5470e78d7505cb15537013538ba2b1adc
SHA1cb16ba47c4bb8c79add9e95668c9347dc578cd31
SHA2562af2dee88fc97014bd3e90f4d5bc6f646b7c817e16258584804fa73070b1f96c
SHA51240d0e4d730bb49f91edcad60c017e2dd6a98ae50cac404cac78e29ce2487aa6779e22f6d9f876d2c61a76cfbe5dff8fec2ce5df9eb1ef3c3e5a6f2fd4692f2a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e92c72cfe2581bd3eb1d0c90e95d973
SHA1bfe275d9d1c78d5ed3f7457c1f83534c7fd5e60c
SHA256325a04c7ad87f971bd01807d90501ef65a0a349a08974e3149ee093f7350dadd
SHA512247e5cbcafb4a00e0038c8efc1ef0f9193309d62f9a0d0401dac5835e1c21b2dd8556ea98d0bd69956e35258cd59ce9b5498d7195746b0b91a4b20f767daf333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7d0c64ae7cb58df09055f8468b1776f
SHA1895c00b6b6a4a7b1380b9d0c7415456fcfd59bcc
SHA256b6d3e455b34bd720900727f5bf762ef3861fbe1c149f52d0b1101cdca49359a3
SHA5121e489e032f5e26fbb6787067d82835c0cbe369640b5675cc78dd05dfb11000e9dc2db83a669b143be302c5e3c9464817b88d6b200366fba9739eba2bc2d3a7b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a057b59c77885e50902efb8615a8fda5
SHA1da5bce51d66aedc72da0dc1843e56b17004cb428
SHA256523cdce200114192e35322f2c1b2c2abbd2ecf4a423f9f548e9b6cd2b4beb927
SHA512ce9ed94bcd811bb794b381ee4e0f357bca4d58e3d7a5f35b233e3758e71c74a3aaa01a1ce5f3517af5234d44c199b5c63f2a3a44a4676a164da66f7026adaac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5753ee462f6e0b6a94efe6e88362b14b0
SHA18a484cd58fd2794b9330ebbe6830018499d81a97
SHA25649f73c7a738f2ca9008ba013f110d07515054b104449efd5d4eed7f4b5419a0b
SHA512a6b1c8d709394df2812d6e17e0784d0702457fd8d27cd51e865c97799a6c6c432d6a6c1bb3c1d9adf6d19aa7f448cb91c020069bbb036fd5da763ad5b6c6be6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae9626a1f9582e8419516c31acf7dfdb
SHA1819398fdbcf6d99f516fdd607d7fa355d08b9ff6
SHA25638cb08b1805e139cf4bc41244e5f67da27f114bfc299c0c30a4026169dd1c0b2
SHA5125e47d2338e6333f5521f18175bf3d24ca309877a05bd9c0445a93b546dd1c7f0697b90ef5a86dc8b518b261a656c2b1b00c28715ece0fe2da94a98c1ec30ea07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a77b6291f9e78299b9977ea83faf1e1
SHA1e32653e4020c1a1d3b63be8bb5eb21acde24fb98
SHA256f9742f1937e1f7cf2e7c8ac4ad2bb82245b34847409812f40733cc744238ec1e
SHA512a82904082536f37773b1f471f57fba1c757513debfa27ce3c1e3fe8ee41db57d81a1c904045d990221fc0d12011933c05c14451886765f4b5a90f00529a123a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54051b41972c7f78472f40be9be62897d
SHA10ddf2cc1a02414c032c320f612e8d48d772342bb
SHA25670963e998a8d660df3b3b79ee599c846124def163a19ce3b47c4ba7413e83cff
SHA512e53df80e2af2504c11c311be11b713581a8b91945ff52fe0f3b036d6fa0a1f7fc297b92baa24c451d85f8ebabc35cba4d648ccd74fb81b612fcd61c0b7673e19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50641929b142f43e462a7baeb39cc3faa
SHA181b11cea1a63d1224cbccc5d06b9a0fc55ca6fae
SHA2567daf547b562c7ba7babf15df21655441ef4f54e45a7c68da08816715317f0160
SHA512038058f6450e1029acf2baf4293ddf52a2eca366c2ce9237b271fd903cd86b54f139456c357b5b7ca151e16b441b87dce718d9dd53c37f92b38af72c08e6f2c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5087e02793e4debd5b2567ef5c47b7a9e
SHA1f88f6c108cbb9155aa4671f2813cb62dd26646c6
SHA2568b6e3b61db10bcd13d47ba611a91942274f3d5d743922fbf087b01844c2abc60
SHA512d20f65a51d18c2e9bfbaf3a7c958d94a5a9f40ea2b3feac67934f8c07c7129fc0c4e8e9bea951ed88c811e04895e5294fb36dac4e21e6c9b83a9493f62bdc97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8a9bda65475f5c1a918b7841273d11f
SHA103a65d90f6bce29abe128af332173749459db82c
SHA25629d2afc2cd7cbe182161dc55b11e3ea21b8c02af9dd2b0e12be2d67a3f6cac2c
SHA51296f8cc9a892c3718cd18115dd282e72e312c5687c9dd902e5855c0251abc53c8f3710023798e511b7437523ec95fbd08acf47ebea058e54a15b848260896bf13
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b