Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
8e2127983297df3fcc147fc1b5f119ad_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8e2127983297df3fcc147fc1b5f119ad_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8e2127983297df3fcc147fc1b5f119ad_JaffaCakes118.html
-
Size
460KB
-
MD5
8e2127983297df3fcc147fc1b5f119ad
-
SHA1
3a57a0ee2b29897fca7af53d009e092df8e3bf98
-
SHA256
012f7eb57a6d151dc561642164adfd1855a95669136d6f664b66822c4e8db9e7
-
SHA512
e6d4e84d685990d231aff58fcac98bb61a3c512806198d032ed68b219728bdc507387d96fbb6fda80737f1c87acd22db009795bde851286c9aa6b8a4641ece1f
-
SSDEEP
6144:SOsMYod+X3oI+YwzQYsMYod+X3oI+YksMYod+X3oI+YLsMYod+X3oI+YQ:h5d+X3q55d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6078a262ebb4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423494431" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000019a2315a12fff336c3e8d578542e1df03dcfa6d5d072276751b27acdf61c58e2000000000e80000000020000200000001e6dde2dd72739c45e97884871f1d43d92f62b5f73f4e660c828c9c8e329d415200000002c49488159d4a9bfe7eca570131f841a7f4084f9ecb25c4f83cbaf827707d02d40000000b4bfa98b4b6ef9da65d561e500abe34dec05d8d94906973b2d7cccde60c1a2929214f030de51c735be02e35c27f532a2473923a9747076e48d531bd4ae298f82 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000464036d70b4f5acd6195af96da452bfb1a14f8083fd69b0470faa10521a2c71a000000000e80000000020000200000005485e09f6f3466f01b3060d79eaceff6946ba7e2fc6b8dc72dece3fa1718fcf09000000085665f6ae4168c862829254cf28113d4030cbecf56f1c3549f21634e2f0c764917570e756d0ed0b1b1136ab6b1858e15b5524f6518b95901e38e0c6e367ca588b99608a17441d84ff478d3de4335f3d92342b58f4eb6ab6f30743bec1f3cecd00a2c1755b3b05edec119c0ce14f711892aeda9aa6ebc40261eb2d72e44eaa1811ddaeb6b93f7aeff63792a72f37d3acd40000000d33020cd28be93231e3e0987c62eaf3cca315671e10083e1b681e591fa1aa48ac764aef2ecaa322181aa3105ffbcd5e5c6f06afddf9d3a025b54e424a4f2bacb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A180041-20DE-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 iexplore.exe 2052 iexplore.exe 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1284 2052 iexplore.exe 28 PID 2052 wrote to memory of 1284 2052 iexplore.exe 28 PID 2052 wrote to memory of 1284 2052 iexplore.exe 28 PID 2052 wrote to memory of 1284 2052 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e2127983297df3fcc147fc1b5f119ad_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bed16fae4f7753b35197e0a5950c1f52
SHA1079d400d0abc309d87cb78753df543da24f38b82
SHA256e9ac51a38047d10f5db47529ff875986814360ff94c37dd181e53e34c0f62166
SHA5121cbd5cf8759074d63c3ecc4bfaa2c0210b3793e888c7a382455adf0b905adfbae927034d154fa6b92b05f0e00ef6152bda98d299da1cb2afd9a941b8db115b89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565f7515a6fd85d4210c335efa62bda58
SHA1701188af968407ce1b9254a514e36c3f2104ad67
SHA256c7c89fa62c2af9730c215fdb59b4ef5d019b106043b12f261afafc834d9a7e48
SHA512312188df8d5dae87cbc3e0491d4ba9245389dd2d196d44ce9f05106061753bd1bbeca796a85288eeca85241980e3eb619dd9376ff63873a2a60548a3902ed102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a1a92a5fd609574dbdff8404c36cb80
SHA1680b4593db867bfcca36faa28780ce6a11728b14
SHA256d25f1e866eb2dc28bf98ace0ebfd39933e5f1f44baf16ea570ef90575ee35242
SHA512f01f1c9432046c3852f4cad3e0f1baaa3d456da7b894e75dc4ef407107d24aa324fcb6a90c24a7b7ba08a4032d230fa4837d38a9a472b9bee96c0c319387ebd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f14cafee039007df7ae28bdd1724e9c
SHA102db62c100672dd9e05fdacd85bb328d00f4739c
SHA25694b867b701efa66e7ce384b2dbd0818f0d37459549bf5fd666c161b27e813fce
SHA512add66961f8847a2450821f2de9304738a9cef953b13934d11364fa9c1e8a2d39b922b7ebc2202f1f85e62e3ea645d7e8842edce47acd962748faa3629cab75a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56874bf805387878ed81eade5be7bf58b
SHA1ef79895c134211d33863ac2804fb3686b9028ab0
SHA2560659d61594000bf9a7d7f8b9ae49a75941c96ec0ed1adf4764903210c1d7a62f
SHA51261b51e08bf5abb9332750f65dd956996dbf57f8b7dcf63fb1c2772c459b300c0725b80a062a2e9ca7f3d49921d4090b86075bc4f9324399f760964da17e2a976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c88609291c826fb4629238caba44482
SHA1818fa0dc3ffe9ddcc9585565f0f4e0a37fbd4fd0
SHA2564ee604ca0a538fb8761da9d75cc123bf842891fbc6669c0a2f585ee61eb7c617
SHA512131958b62b0fdda058f4764a45a6287f8767986bb4fd56712f852bea920f94d9be5680490b7d6a8e03c36d77828fc41b93bf389bdd73c392bf10ea656adf9e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5d83e599ec556c1dc8ef4ecfdc5a702
SHA179d762c473f1e85131700ef3a4620753d1ead55e
SHA2566493b1bb8db011eb6eaec200104a90a11b1132c87a54e3874ad06f1e149ed710
SHA51297928a196fe4557dbc01832f5ada578ca7f3e55c0d1faee28aa0aea6a7052426ecd7b8c1af5e80bf1b1724d2ed5931ae6f6a6c143c982f0170454f73a801e1b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ae0aaf1d1616fb2bca982f892912e9f
SHA1cc061561e4d64155b7bf8abec2fc8386d72e6acc
SHA25673b503f6eac8425d2a5cf80b9afec55aa06a9bbb4beb3aff788043d898ea868a
SHA512be577eaddf55ae73acdd05b66f151fd49c65a63c62391b70adf350ab8d4ee5f01fa30e9d91a1dd9b75b70c7600c84338424eb1db72dcce6b1a09c20d8db471f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f826bae59ed959fd0b8b95af08059f31
SHA14bc4e27fa13b8a436014244e600ccff2e6184eb3
SHA2561f8703461f34a694a2f67deff35267f9e993feb3dc0cee0f21bcd2bdafada1fe
SHA512de61c9b61ab51b0b84082c4a5d8450cf0b1b2e77d90ee17efc05d16576090fe621bf65e465f766d570b52746a45aec519263e3d86168f24c51e321efee67d046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de5722d1fd23f2d6ec3c05f9e45b58c
SHA104b1bc2cdfc33ac1506063186332d3efbbd7fdef
SHA2568c5e0ed6293fb59ac0305958fa04e92d3378d90cc583bb99e59321c23c9c5508
SHA512dbd5071e48b49ec947fa7918cac34e21a77e759b5117f7fdeb6f620366ce2fdc4e495ef68e3de44bc18df0e2e321a1b03fee33b96fbd5cedece3fe3482ec7788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d051bc648a0d94dd6abdf59d349d8d6c
SHA1e685e8f77adb9ef0d0214959d3d709d19238e31d
SHA256e8a78d1a935aea5b82d73ec5b270084d6ad2807cd756e5416b062f9d3b995d44
SHA5128dcaaeb0481a749b221981a732f55d4d3c958164d5c0f74e316e954e81c9a187739bd60b99834eed3191d68382b7c43b83f1e873e603c4eba55b70cdc0b1919d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6548ed1714e453ed4722c867fd3a526
SHA1de6aedb1eb513224b90c0a10f3acdb227ca1ca0a
SHA2566572f6a41934e1700bba83b1a473a643b428ff48f74fe5d40938df11991b1392
SHA51251944739ab871c6898e8041616d24498571959cc83c82eaf9975775f88a99b53c38a13ecd2223bea83220ec35fb179aec6b325b642099b056532bfe4a775aa60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b138e43d11c24569630297132841b705
SHA1ac519080239d5e2cc83fc8df1df2fe1657c8e99f
SHA256c0805f00a691b165620fe74496ddf8380ffbdd6e3dc36d13f2187f6cc4d2a1aa
SHA512e6431078633a171a3c7a1477a0a8c56bcc8728af2e6176bed04e688072e4eeeaaee2e22c14b762681a16c717500fd95884a6783a4e5fad72a70573ccc4e1460b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564feaff568b8fb6091c50cb13a78e02f
SHA1a5e16555a280a5808b88a517cdad16e1edbfefa0
SHA2566a3e0bab2961538ff9d8f288ea35beddaf07e01a132e6aa5876c69df8ca37538
SHA512f786136febf355beb73e4555ab3d6608c5111933f58ca80622677ccf4a0107886c195b6b6a18ca933139837f8008467062333e6aeb15ad4bbdd35c4911e97295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539396c5bdc66d10326c92a859eb947fa
SHA1fe527056050f39eaf092358935047d07e3b9c29a
SHA2562bda79f477737f53bccc84265fb882dad85843791890b4a0c03b399fd1154d54
SHA51283dbad783bfd327485daa550de172ab6456fbc597c7fe169e292d898a3d92fe923b31070f09f3bdd5e7241aca2a027de097e570cf34ca90dc38cc92b8db41213
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e3bdeb15477ab83551948b38edbd043
SHA139e6b90b88da5d81182827190cc8b3c4f42c79cb
SHA2564403f5f5953b8bf18e4d3e34bc123503ecc29d0c9d8b98b6223963cf31e1e9b4
SHA512d5f49d9cee2e7b371846b35d16911e7c57c749161fd1f2270b4d284fcb6d474d4bd2c48641f9a67679c251183eb062c8be0cad4432a3cda77544d9a5f1717df1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fef3299fd53b710a383549385220b7ed
SHA1634d642ee9bf9bb7d71d727867d9acf2bea014a6
SHA2561ff6c88f5ca406f2a9337840a1cb2e86eeea1a90b6428d8c90e89b104ff7de58
SHA512ca72970b935462666f05b252320f5d785a0476858e252c9218b53223a4f2221a1a1985c34cba28bbedcc5154d47ce61a3b5b71724e89453c2d6618ef60199cc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be72726735b4b000f4b3724a114466e9
SHA126375aa602f754a2ff884105b7529df2ea1e9eee
SHA25669dc3f8adb474d3d7055f58f402dea227608ebda3733122ad3968fec825cecb9
SHA5124f1951de40f50b050d77ea5d7c6dcfc05eebb7b19ed4fb1576752539bad09564cf1111eaba4c002a887abee598ff23a7b6681058e988a4daf8b9b969598231db
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b