Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
8e953a145c0b18ea164d0652dc7b4550_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8e953a145c0b18ea164d0652dc7b4550_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8e953a145c0b18ea164d0652dc7b4550_JaffaCakes118.html
-
Size
47KB
-
MD5
8e953a145c0b18ea164d0652dc7b4550
-
SHA1
5e66ffc2714914d81f63bedf16c27a2a0bd3f346
-
SHA256
4524c1a19040af2d99dbbf2011b8b9d44ba068f0fbb3fc4009e8a85b96165125
-
SHA512
12aeb370d9415e3d80af1eb7d86876928f9ed9ec8dd91c712fd09e1571b3393a459ce55bb73b85522d3f809e5a1a1f28f15338dc8b443381ed42848f146ef096
-
SSDEEP
768:Yyavgu2bp2QoL1tPk7RsHB7p1nvzWlVxCjW2hfvCWNM2zys:YyavmbpAZk7RsHDhmCVpCWNM2Os
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015757d2634e1f1469ee6d469729a3ef2000000000200000000001066000000010000200000008f0193944b8a848dc1e3ead8956b1cc83dfcd3b3dfb1a64c021187644883bfe5000000000e80000000020000200000009abe2877618c3f055f754c90ec1a7f475b271c95ab8fc7c701a556bbfe7012b2900000008c85066a9467e4327dfef85984241b0e008e055e8fe041f65e4d5f7a1b55dc5a6af36c30d463197a26e948fc01f05da2d38e03678dcbdfcfd5af46a871a5596cc58476414cad35a2f52984af8c1e829dba22aa91f8ddc4f1f3794adc30f26ab7474a880f88602fa5b66c010725d0debfd23855638c66080a377b0342dad7f88101726319a6f2e5a61793d7d34059fc9e40000000c2ccc2f38211656f6a0f3045cb80e1e0f119cc849b4e93bceabfcac1bb7ee5a6d1dacf8b70bc77e382f8d31cedbc561fbb1434c2e7225e4c8df4f72a72bd456f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A66A231-20F6-11EF-8C47-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423504662" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015757d2634e1f1469ee6d469729a3ef200000000020000000000106600000001000020000000b0a4be2005f4894a7f6b4d763cb9268bdc77550c41464a2d226708276d09a649000000000e80000000020000200000008e3e1e67eee6c57585cbf4e061c536006fb5a6ea745e8c7333d4429c51575a66200000004c3fc16a7bd555da33e405ada12e82384fff93c7d9f9a6b3094d4d3c67b7c47a40000000ef5839d46344f877caa96e823af7398cda1f8afcff90c567d8e2da65598bb3e70f3f4fdfab7efe65fd6d60f3b54f8f57bd1471718d0ea0c44dfbb33c24f834a9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509eea6e03b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2312 2292 iexplore.exe 28 PID 2292 wrote to memory of 2312 2292 iexplore.exe 28 PID 2292 wrote to memory of 2312 2292 iexplore.exe 28 PID 2292 wrote to memory of 2312 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e953a145c0b18ea164d0652dc7b4550_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efcb8c18654565301a0319aaa7166378
SHA1639d061dfb5cae1984f3169856b3b159d2ea801e
SHA2562488bd92e2a780a06f37d7fea97d9a71ebf264774cf1ce0815283c3466f68f4c
SHA512890e92d6e0e41ccd1380c7d73837a7e36def8e296eb804591084c03f2e04cf1fe8e9eda7f601b7c52ae9af635d9f89d5b8c4506e5a0043e69cd36eceedb26dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5965bde7a7a91043ab5c93ccdf9fc3e7a
SHA14f8ad7cd58c9345557183fc774e6254b4052ddf6
SHA256350a43007c8eb8edfc3947731cc3c8563264c14482c0bc1aab2a949ee08bccb2
SHA5129fdf76fb36abd0dcfe4a813e8970ea613ff577e9ac8edcb679991d412c6382ff5a18fa9af39496ee26395e5ba9906bb0a9c6182d7f8634c84f3c48f862f6b245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf8cefa8b502b744fe278b10e2346c1b
SHA11caf00170e542df7276531b3758ccf47c85c5540
SHA256394d9add22d4ea543016c7baf906dff035c227398eb08d435dbe54026cd75459
SHA51249597ada41dcf2934cfee2bb092d454a181b4e1dc1682399b1cbac5d732504b7361bd182956db9b0451d4fc1f6a39ea6b00a0c06b1c81f3c95e23f875e803684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e097472fff59cb5dde54f820dcd32eac
SHA1a04cf60206ed7b466d8951f91c1e2ec794422e8a
SHA256b303f9ea800098af7a437ec7c3b0a5c59bd0105c26dc390e746635d823bf4779
SHA51251c83987717f961be7a3b0e5b9ec893a9e229827eae5b283291b7ae93c5f20b9a8bfda61250f3358b0d55f6e164e414c9cabd280f15e8bab90c6b23798364221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537735c894b2ff0b82c3364c8bd169bd1
SHA1bc337a846d157e02937ef90fdde88018f9f977a5
SHA256f05acacdab913a35a197ceee2a6fb476b06ed0c4dd1d9150bd9c485dda8c2205
SHA512c4bacb9861fff43a88219c3bbdbfa337a2eb25d39eb61395df7b8c30351acbd6147fd4a2fab2ee1e24aec39b83c66c03063d6c679549930c8ff60ee5f9fe6f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f0ee49a330fb4c1a6ada30266ce848e
SHA15c0fdf4d3c7453d32089be49bee5d3bfce5d5440
SHA256f8cedf8d8d9fa639453315ab9a7ec582d4f0ff0153f263ed715a1f3acd2375d4
SHA5126d2a92a5b25dd62daf7fe08f8fdf383eb18db9cefe0438bcea0f255981f76046293528e40fec6905996fe716b8b6049059052664d089dbfcffab978082d59c38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd1b89d15f60922b526546dbdabe1600
SHA14f2ad390168d0c15fb8991702d42d27317d8327c
SHA2569e0f491bd06470460476522f1b65c83e835867543f74f5555602cd381eabc6b6
SHA512d13bf851afb7ceb789e11c90d13e0f9c6c8b88a85bff4b5a46e0f88af0de64cf03c47430295a5bbd250996eb41b2573b594ff5263390dfcd00d29db34f73e427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd1895e193e1e2d5d04d4cc9c9b0e371
SHA17ba5fa58f81d04adeb7d03c758c127c6bf99bed5
SHA256af681a24110f4a2139d1c206b0df99c96b80f58a345d3831168321cd394d475c
SHA5122a7bdaff13be36860f8f18ec108e01f3b6a2526ddf6eccf07af3e75fbf77e67e00481c875ec3390c4db9c92fd22e077bdb84462076854fd9a0f5142b9bcdf62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595a0a3042732f47ace90684b6983bb11
SHA1fde1e32e6b784bce802430f7de26d5298f6bd57c
SHA256208c20b4a195f1abf33d2831a8c418fb592ee4bd3089215834bb875cf0f8076a
SHA512a0b836d5611f1dec32bb491fb053273a3dbc738ebdb62c0931570fbb0973fe9280cd4a02b08f41debec90834ee93fc271fadc6dc53a0f8d80ea2de67a8884193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509b6b1f3603abfcbb5b68f323e471d3c
SHA14720bed24d98cad6972db8c8f8d6e6c8d48b56ab
SHA256fe56ac36e31105602636dd386e0ca2fbd9ecc67e0a92bd77c4021141c842a345
SHA5129a091bd1008e0f756b1ab573013e87ffacf0b9d2b817e2bf466e40cf393ccfd4288ce4f04f36746d11474d9c7005921152d03fc9546d851f86683460892d66bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d396849dd65013ef297cbf2a1dfe008a
SHA12929160e7cc95c4b486bbf68395b9b42dcaeb7c5
SHA2567e89da46cc0b3ffb32167d94ca5f30baa0c4d69e5e084b135482b8fe1a86eb77
SHA5124b155aa463d92edb8125bb297c2fb5056b67cb630dc3dfa66ca353be98d76a5859c2ef65a2bff4d5d163cbe3a598af351abf7fde8c41c374fbc5f618531f21bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fdf415c6908eed0dfadab9ff3dc17c1
SHA1ee0b81103c96898ab2be02b540f9a3696372675b
SHA256700720664788a4bc0b3ef32ac5f41977f997437fd63f4ca38231126f07668b24
SHA512cacfd76dbade4d1e68e1aeeebbc065a3ef2de933c23b28db1e8539aa70fd0bb977d47e698ce840a83aab987304b5875bf5e7b275111a2de4d4a73c63d03f36bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc17fe867ef05fd3605f0afd2cdedafe
SHA111326f8b77f64c2feb853d86863964833dd873aa
SHA256702a3023c5d9bf4b9b41e17f689dee94cdcf346741079834b5385bd6d60ec054
SHA512ec4addbf173f64cd8d74bf4c3cdb2131911d5d671136b2458a93fe6ce6de0ef0a4ef6958e0c7048650393b21e73cf88aea1de0d9ad295047461a95388e96767d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3890b5afd1a589ac89a5732730f5230
SHA184d88915dfd54e4b6947ed80943e0429a69922aa
SHA256f201838a9ff8798b7fc9d169f6b375259dda0bc8916c242550c1fa504db8bb14
SHA5126b055a2ec8de64e0c8b8102ef944b80f09b53aa2b9b6e773e096bd9918904a5d665a20219392cda99f086c1d17892751fb4a9acbd4a20e1142b726d63c82d23a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad674cae7f4660b33983e4e6efdaeab3
SHA194fe653a5d927643de907a8049922a6d38b93c97
SHA2567a7c68b82ffd106bc833f048104a076809b49b033549c6c89b1324408a8ebbb0
SHA5127ae7dd61e4a85aa59d34a438f47903bc92579c46f769b5a33c26f115e602db3be74e5681252204f83e14b9b1d86fcf4d73ab360bf39c72c9793b5b22ed94f191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b792e770f18b8d517300c1251957a235
SHA16abff0fa048b20c906f9785cbc9e78d0a4100d32
SHA256dab320bc62e0938da06df59251dae94c9efd83ee9bef66dde189831e2f53bb31
SHA512ed6c23dbf5c86456b55a9236f3e29bce55acde5d9963446a5f82a55d3886921b429b816d93e7f471047155c58ab4f5f4fdcd086a30f44d993d55341919a31df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59232a58b12ac109cb60250991020a5ef
SHA1c8f73497e23d9465700d82262fd9be0a8c776809
SHA2564166ef66c72e9b7f8caf07b4011a5c30cc580890cd7904837c3cd3b15720bd38
SHA512e835ba3e85833a29fed330831210d85c52dc9bb0c37b4f2cdbd3290ce2a8951207a8937539bb9c2853cd2092eba9ecd51d8d670cc451cefaf9fa9ab10af066fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c5514958ad90de3bd120cdf245182e6
SHA19cd5dec3cc9a283354cc19e2ea58b02a57093a5a
SHA256e00660b5575519f65c9521db60a17f354c0f56e24dbd54cebca7ed37314ab1cb
SHA512c79ed4c25b53ee3cd2fa2555214fefed2df09219418d156f9a12e4e645d8a1acdd1d4363060187686a4c0b6bcec1bddb584cf97fc25ebc94b8b127911c09215b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b