Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
8cc586778a4857de1636373bdc28244d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8cc586778a4857de1636373bdc28244d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8cc586778a4857de1636373bdc28244d_JaffaCakes118.html
-
Size
15KB
-
MD5
8cc586778a4857de1636373bdc28244d
-
SHA1
05743603e2fe7869725ccd375a9d29346220c699
-
SHA256
d5ae656eca15fc7ea4d783a97f08c165a64d6f917af019bdb58c6a7f5a80b18e
-
SHA512
af8f50109b7681de3c8e55bdcf9fe1800219cb7f5b96c22e7cfcf35fd642c13f3b70b91616ee23b3151b0b5150caaa3523373b83b0f8ea524a8de24bd65a4e09
-
SSDEEP
384:SIvKZByjnKyl/EYNa5HaetvN6PeFPr4P2Gkku1lbvkROu:SIF8Drt/Fz1s9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423461357" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86A0E9B1-2091-11EF-8698-5E73522EB9B5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003acf4ce7261db04a9e880ca43f4cf36300000000020000000000106600000001000020000000988e55e8f774de7c71a4f0352a249b4c3a9f4b2bf48f4d33a64c5770b9110e29000000000e8000000002000020000000b4de02182231bff385e5440f03911bd8bc8f9d64cc9c87c0e415c984b071cc1c2000000072e94f77b2c9aa2287ae28a0ea3815f7e71a7b640eca56b24ff674cc8d00e01740000000fed1b0256c54f219aca183d8dd35ab4f5775ee6d548bf582e2e8b30b8ffcfa8433d1a42787110ee8fd00bd0eb137a81998ce774dd4ae87eb329e7126141ddc0c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d39b639eb4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003acf4ce7261db04a9e880ca43f4cf36300000000020000000000106600000001000020000000ba2bda815153d167c6c1fffd632c4752164e037dbc91dd7424ade17eb4f59d00000000000e80000000020000200000006231c7c6cdaa630cc3cf34c1530e7f47271e79d96e725b8c44fd4e914252ee8f90000000ac869a9dd727d64f8022797d7f2654a13dd65f15d5e1d1446572e359b2c1e2d350557c4b38b3f11da25e23a339081a4222ab3337a7b2dabd15e15fcd3b398590d4af81547a1925a2a8673260206fde56d758b06b13cfa887e384196132b185e728640b508df6b4aa7cd99e60dd2e6e20350563c4969181ce5ac081d46ad83b5b248687df9a526e992823590cdba8527940000000a06498b1c11e21eaac20604718f6193bda9b602b36ed3d6d2c8f0ccb4544d2361b8d60c0b3009ef47e3ee7f46bfad350dc1ac83c5228323499ef9f74419d3a6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1056 iexplore.exe 1056 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2628 1056 iexplore.exe 28 PID 1056 wrote to memory of 2628 1056 iexplore.exe 28 PID 1056 wrote to memory of 2628 1056 iexplore.exe 28 PID 1056 wrote to memory of 2628 1056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cc586778a4857de1636373bdc28244d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58604aaddff3fadd04e20f83f30e465be
SHA1e93074ddcc51ba7c9d00847c7278fb9fd5804195
SHA25618baef2daaba703411440c05aa8f86ed4d5bd4a553aaf227b6b4c1d5c3d634b4
SHA512c7ebd47e541be6402bd038ca407c0698087ca560f4da5a5153826d60043f5ff0ba76ce2d4ca8dc5efee080d3e9505359af8ac916949637f8751a73a35c83d3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b0a6acc14afe819c47e64ab313c52a6
SHA14c5d004bec6cb110099840440dd4b8a40a7e6238
SHA25627245d2025529a5bb94da1ec87169e9e4741cb216e110b528e47775eb313bb7f
SHA51223056ccd9a75745981465bd4420473c17ce67b5346dbb7a27329261f64008ba657bc4a5721555928c738fd29e70583c36c119a99ecb521110a1f9dd23d99c6de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fcad900eab33cf19493b852d385629a
SHA126ce94095a816d5a318a0a1aec5461bd9f6d3202
SHA2562ae5b8012b3ef3cdd572cd587f9c068dead7f1f8204f7b66a7fb0d24b3610d9a
SHA512821deaac412e0ed5d738b6d6222cd13b750962f199ee2188aa444652446c89e4952130d8862664a1060b7406956fb074215a4f8ad017b6ec21b7393042c3942f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e966a5f2c1f40b08b4830013808fc5f
SHA135df6f8069a56b834a0ef2167954db91afd0c7ec
SHA2569971d040fa8a1da4b56ceede6afd8b0329a7eecb9605571049879ee97681f296
SHA512878aa951fc496502b587f28cffa145133ce5cadd8549113195665d07420498408418b283b3edef341680b61949b39104512f79ea8fa15ca6338940ae0859a9c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5897d68f1d84bea1adf7afc6e4d2d5194
SHA1ad90f6438507992260c3092b1998ffbcaeb5ec7b
SHA2567b679a0e08b2a02efbe447e8710dc7159494ff6d41e54dd19a2c1d54a0e49027
SHA512772a2f5e39f4cc42d1599f1c218a13a0dbc799734ec699eeadade93220941063d684d2e6d692f365a8ef2db5d484337c99bd7c2028a0d070176be8b621e40b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552f38beddddc51510d6b42d94c289c6a
SHA136b755d09f0f93432c01247b7ab37032dc4fb80a
SHA2566e2699002a1b90489bd8f93b81e809dab44d60afe90851b5966fe3446690f123
SHA51234a0f4f07d34f0ffe119650efff2de8925b8335602b7820d35765932079ce425992cb19dad24c412c590812952dac359d8bccd40c908cf07d41905967b8bc6d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5006c8314a04cb85564280ee78c4b3cbf
SHA12631a2976fc50e0be12f7f294b119ecd62063916
SHA2563f0bed4d3276057217fb3926a82b87eacf8639343618f6bbace35c6a21c8016e
SHA51239fb619e7c053818ca643b06481e2ad972582b8371d3af5274cd0a858f6048e4db351a8ace7429d4c8a2da574efbe74c9f563c543a1780caaf252482d343d72c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33b2d9d6f5cb6e9deb08dffacedf571
SHA1edefacb8e68aaa4f9322245ecade1e82b5a8b3e8
SHA2562a623d228a65c695021ca45989f2eb2141086624f180a4a3bc60acb39560b5a9
SHA51265270c1c6233933d67d291feb8182daffd5d89b8c91159cfabdefed05eee835994f10c18f18f615c665668d3afac44ff9080574a191365087599324497305631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a03a97c7b8131292171b059eb81a3ae
SHA1b7b182744d4bf514a822126f33c9a5dc7caee180
SHA256f421a86fd6f177ac2d4d044f707e188091cce35e7c0d31f2ac57f5cdb3b76b66
SHA51215ecd6c89a02af47156767f20b57b9b4914e7a6ab096a48143ef398ab67ba290cf8a3f8ebf1416f85aa58bffb85416bf9c20cdda71d91d0fc5ba9b2a97d0fa1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527112d2a86b36f0a66eab92b2a304646
SHA1697af090036be8be8efd655fce03bee71a4b97f3
SHA2560c7650b50510749fb5e5f02c67af10d001576bcc050d4fcd4e4498c82ce25c19
SHA5123db8704ea39e1ea2198c58577ee5869d34bb4b5c1fe9aeda6ad359b37d23f848ea436cfa5e0f1f4b20d6b916f81cca7c4df99052f36a797df5e1abc40bc9838b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cb341c152118f9d9780eef7fc74dd81
SHA1515d7b93339622a022fdf110d48d6e00f9bfab3d
SHA256b7a20d5da44e7c836d19cacb6756d07f208f31fbffae528e1cd12e8c19b44b2c
SHA51287e14c6215d5cfa5c3786d5d93cb466a97332720d4e80931c5bed89d281cf9e538edae25e372906bf5859f7fbc7a3dc2825d615a2d42140156c7b285313d8f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff0f28d13502165e7cff0f66dce402bc
SHA138c13902de12dd97d1ea6e36df0dadee4e1c1fa1
SHA256e8f04f08c11091ecefcfd9d85137f2b3b0b25c3b504cc5c93fba62f9ce2239ff
SHA5123247dbbea33d4fb781fb4e8191e01c8b094d2be72de9f4721784c8191587d325a7799fcd8fb37175c6e1f6676191914640ae0b4b6e6b91fae1e6f7a6b68f4f5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db9ab38a8880ff45d1f3d82842db991f
SHA11353c31f1ba718617eb0b10d9fdd41f678906fb0
SHA2565953b94ac68b7712bcc8a2cd153bad437feccf2ae285e79dbfc8da7e85d1c71a
SHA5121772b3568ea6f6066ac6f1185a2a8cd3359da47bbc3e1545409fcce622b3a540d1d208b9ff1646239a433787e85f44502bf9e163e6a25c404f106cc5016b816d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57031b75a152e6916bbe8613220763764
SHA1c1bf1186460c1787e944d142341bc18acb6b1eb7
SHA256423d29708765f81ad1fec08fca7fe88f0ca25d710dcb597b0379095abd82b396
SHA512ade572b87b36a7e2a1ef3c171828902b2b47a638bf5a0f559be3638b143378cbece02eb03326cb676c52ef09a5369104f551f8c104d2ac85db241ad3f6b737eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0a949a4f8b15e989be3e5ac0216c318
SHA135ee6ee335840a0ecb376afb996877dc6c33dc61
SHA256b9ce94092e30f1389887a647276a3d289b875d67f50d6ac09a20dcd4774890eb
SHA51233195d9a3610cd6465994c25d52995cbec8f0ce08c3c92303b30dafda031eb3a8464efef71889bc9d1179893393ad0f5d12f24358c56efc7a55c9410ce107271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f855a266dca3f5357a13ebf2460c46
SHA135b6247ad69e76a298bdeba846b03f22b3bf8487
SHA25690911a34182352ebd361ec953ad600cb38723694ce7cdba4ebdbaf2d0277ed6d
SHA5123f0910815b59ac18be77a4beba5520c82f86161a2680cd9f67617c54a9f1b7393d5681b9b6015db790be4533ef9dda22f8dc3aaa73a249f12cf96bbaeade3314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc498c7e90685004e2414fcc7380e4e6
SHA15efd981b6e123bd6b3bcfb2e0370d73226bcdeb3
SHA2563b123472601897806ab50db25e5a69ab4f279931c468730f2d1c24daa624433b
SHA5122792f786d0b6f50961b7b712f1a07dc05e4ed217c39f13059d0f0ddd772bbfa3078d648dd1c8da7b04c69e2449fff24fadc5ecc4cf3edd1012333f6f5082c600
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b