Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
8ecc4a9af1861787349e22b8b2bb6d6a_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8ecc4a9af1861787349e22b8b2bb6d6a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8ecc4a9af1861787349e22b8b2bb6d6a_JaffaCakes118.html
-
Size
104KB
-
MD5
8ecc4a9af1861787349e22b8b2bb6d6a
-
SHA1
3b8bca3e9333ef5a22151f9bf73a15b10e0e3df0
-
SHA256
86aefc34e715f51815f1a27bbf80e8fa3cc8b07930e1e7ce89a59373e2962a67
-
SHA512
0695eb89623b31cc3ef057b82d78e2ab52795f1832c90af8d98329f3494346a59536ee0c2265cbad9fdc61dc4dc41f52254518cba009d3ca3e8cc5f18b00a02f
-
SSDEEP
3072:jZK0mL7RCC0FTDkZR1RezL4DhkzIv4ibFPjekpa2pFoelDRMcrUjcxKjd30O8xf2:jKZhDLv4ibFbekpa2pFuP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423509746" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31E8FA91-2102-11EF-BDEB-D6E40795ECBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2908 2180 iexplore.exe 28 PID 2180 wrote to memory of 2908 2180 iexplore.exe 28 PID 2180 wrote to memory of 2908 2180 iexplore.exe 28 PID 2180 wrote to memory of 2908 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ecc4a9af1861787349e22b8b2bb6d6a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD57cdb70ef5af4a6855754200f7593dc9f
SHA1f7a3c489a70ed8315015f4009a36b47fb0d4e4bf
SHA256a6d4194e3116a07450a8c0dbb1fcefb9ad12c290f93c4738f33f60cc1a21a9e0
SHA5123c7c3ec0f64dbf92baf068556426defefdc2d7c1a8bc6c48bd92eb3af6d2d88ffdb9f9f0747e1ab788ef2a9c096cf83c672287d58a625a7ce80b8cb3c360920d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e9afdc23b6bc9662e8a859ca664bbcf
SHA1d014a68084e3935e2e7ff47169fc00a304791e10
SHA256a149d34d5e64ead9e6acb01fd4d8ffbc2297ea732ae0b566a217a8ec71bac03c
SHA512284913dd4857ff91e9572d0d7a28e93df3f8c7f41e8f4cd8f5e662ccb755b8b773471711d873924b405aa6a8804d225e4867cf9fb67a88ea70ce0de90bbc682a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d0ed9f65e1de6343d88ac914e25c1ae
SHA18c47a257021b59af3549e8ba377b6fca0c8c50e3
SHA256948cab11da6f8055f560d6a181deaa069f5b12efba97f419ec9e31009963afdf
SHA5127aa0c0d31ef39d9d54afe1084157a65b187c5b6a15d0d69d375d380d99b3e5e7a4b57956d1fe0a90915c63595f3a7b4a62c55d2a75977eb101a1d22a334b354c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb1eabd231db467dc98d374021641508
SHA16f652402931bc5e43282eb3a32be5ad74112d3b5
SHA25671947560bca3a75ede902c7fac9f433c380aed32d9c12d19352638ae3508e4b0
SHA5120fc937db82a0135fdfe63c011b62b9ca801e47198d9de88524aaeae68dcdf2e02ed0b1acb354c2879a068fb18b90d2c0f727d6bb60f008ce43930494905c9442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55979a1b22e7c3bd6144f101ee2ae6953
SHA1e454b45c5d778f3becc2230140b011c361affb02
SHA256eee86c0f3b4dc5db51a2c4ff9f72b9e2435009288a5992660f12f97c70a24e59
SHA5126bc9f149a1e821a5fc486f345290b47106f72f506fef7515426bb052175c2119f6ccf5d17b7f10deccd26e47cf330aee13686b2c09b8ce26dd765fc6b75fc158
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512ee7a8dbc268db3f66788cbc5306535
SHA148e2e418a52c214fa209cb6a0533a24cd3b22ebd
SHA256c75f74696f0db1d3817cb89c48ecc1d26190d8fba6e7eee45c444257bba9f4b0
SHA5126d2c1fdd3c4e7050231d85072d0c115bf16e589a0e5c4c489caa926513a548a413b1a1bd7ca9737eb3e374289e9a8d81372a6c06c3c07f2432cdf7c3fdf62c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54387591f53b9868f9d17018bd4843381
SHA18fc8dd01a0b1bad1f310d78219513ad574c419de
SHA256519946e503085c97d279e49f88a6fd34eaa913288fa1d00522b0a540e62f944a
SHA5120f6914b92d82e6f8add9a9471beabf7f2308ed68ce47ab3a3a152680c502a1841b4eb5e4939430e513f9aada1f3f350900b3f09073a9336805f9c161d6bdedf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9a60365950bbd1c8ce6072d17b4b21a
SHA15ad2850f49cdd6b6802a09cc7ce918a89c3b6a9a
SHA256e011cdbe51aeb9a5827ad4eb7393d101c2c31daf54f32fd7a89f47c7c52b4ded
SHA5124d2da09ddc4ebadcd0562fa6f92532a89b8c74919843207c199155696073651fa60df9c0d70e6c852791424e86a8f4eeb1c77ae2156c5105bcd7b34bd460258b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fe5d3eb32b521ae00d2311e7d4be4db
SHA1dc8645f1c09170ae1ea7a0e602fae3b7b917c752
SHA2565d6ad1b66817bb462061347880df80bb26bd2484b0a3f08e42e5206c53e5ac8a
SHA512263aa469b8179755cdb5464f719d152cc580224f40c388bf9bcbd6a2d3c0f368432f0cf07d598e9080d5349658500e77b249225db57961586f6b0f02ff67851f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d93e0eb84e56717f757b5661a989e58
SHA1cd75b29ac6874cbfc1f1538b6cb36679f8878cf5
SHA2566525db4c4c45a8c2c92617a0b1297be6f1b9e2eb979b010938910edb6de1334c
SHA512e99f016ad3d0f23909c4c18319a7babde056981f0b2c713e9f4463fe77295d7606cef44dceb694423f2416211dc0596c75a13cb4b161bed8bdc8c439d5cf13b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5258d32d2e65126f438a01a60bee4db01
SHA1cc5db023719b636f9b84ef54f026612001086420
SHA256d92844a0cf7a6ab4304dd6cd4e801af61b726e90818abd116b8ba35180861242
SHA512ce9a07229bb7f6f632679ec56c5e0d98c57222d257729a568b24eeda51c907a344bf39cd5fb50867af272359b698847d549cba7f2520eb4ee61d84b19c863596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5450e11d455acd9b2a197181370058c9b
SHA189b9fac3020d5cdcffcf480f3de6354bb2da68df
SHA256143f5f8c3e7070fe52e678103a9c0d313a98afbddaa9ab938b3d7c7e559590ac
SHA512783cc0a21d97db976e49e3d077492f2c9421573a7650b6c536268dab1dca4478292478fc6ba7645537fdc34ff5846e56fbb95e0e0ba834b3bd0f94ef445ab14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d7b4af438e34bfa386cf9b44ecaa128
SHA19378abb552ced838b1637000558f7f7998d7b1f1
SHA256b37ad8ba8cdd5919fbffad305cd75b5006ad4c8b339dd065f5a28cc0dcbee511
SHA512c87577db93c0a47b31210c34a910126f6e52fe356e94aa716fca18861731e75a54f94241a9369c17d11d18cdd1dedc327f4decf9c28d64f59e41e64d5499f208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b9843ff0cb73cc372236c60e3cac632
SHA1be47efbc2e58ff83fb813e069c3ee0438fb1b950
SHA256cb996dd29dafbb2738fdd0ddf355f6d12e76404c915133d835962e5f8f2e5664
SHA512eada6494adccbbb9444265a0c1cb576176ee2c5ec8f683a484f4265f1ae17eb83ab7c844d3c6c624ef36e87920df0a4e12b98c7bdec4847c432e0d80a2e67aa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b79df7c15dc714d4fd289acad31f3bcf
SHA19b9df4410a68d38c22251f9ce787bfb78dddf86e
SHA256146fa7a4b7f774aadc78d779d5ee7c402ed47ac99c4d59ba64ff34f975e14832
SHA512299b90d6b4a567ca13ec51adbbdb41aba39ad27708e6a417fb55fa148c8f5808a053746e02464b775dcf8ecdd68b21e1384b015683a12a161c14a0ab6d12bcad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59043af5ff4a2e779eef99776ccf2ba98
SHA16c15ab4f9be385b2d83c934c8ef33575c5995e69
SHA2567c58798c58527f603f00e6b4597f8e49cd5334042840265a544448b1228fd6be
SHA51243947b632d2684af091489a71b01f6a76909da0719a7f710adcfdc808c47ae5535bd79d68d977f3c0a2cd2468dd309b234305dc653e6c4290a3576bed0b8c6a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6edb683108f53fa3c666b1a8e735c79
SHA1767a9cad3db065e53ca8a71e8df8b22f76c808aa
SHA256aa81338a6fc976f8c8f9ef2b01f0aa37305cae601a6e05e8e061f4665a89176a
SHA5121b6ccc3a6c94f3998c153067f0cf19ccf53743d1d639afa83bd8536efad79c9e6563dbf63d1b533e741dc53e015c16e0d7a9fdb2b34acf7218fa2d8269cecd2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be930c2afe500d6ca19ec91f60802db2
SHA11085f92f4fe1a9e872ba4822a34f6fa068ca9af6
SHA2561e9aff7de0e82a2ce931559d58624eaf0331870e4355704f283e9e21bcad97e6
SHA512f7724753f9d8c28fd15b70995630fcf1994c71ec7ef0653c91c293c093d375500b49b4ace3fbf047a7621228323afada0be257a3c80af23e27ed16d5ca26d923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56af7f12bb19643cf0b2fcd8e27e01d2b
SHA18dcd1cef2fa65b0be467d246524927745eb46152
SHA256876be003dabb9deaac6b52ba52bf9f6472e62310cc10040501fa660c422d0364
SHA512947146075773d182a17db9b0d5df1525d50282c3995636308fae563459835f93f522a61d470deff957273247564a8542bb378430f9d39d75a4a17a31009a62bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6921c17c7f8793edfe4c16d06e22945
SHA12efc348182d13476a02a485252bed3a7a799ee4c
SHA256a52fd93e87d67bb9717a9c022e698050bf81f99ccbe38fb6d1aeb915f9a0c87a
SHA512316bd6333ff6f32b1dbdda756ab0caa36baeeea51bd108fda6c9241b289b5a104213284e9c7bad4eeeb1a223bf40cfaa1d557f5b8a5f83077493b1dd4e83a369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c37060d5c6df75a71ef735fb3d481d7e
SHA11b9ad784be10ae7746bc54dee9c7912e535905aa
SHA256a4b5786eddf6aeaa4964150c2c53f63dd1d8aa2d6295392f184cd40b2eb26912
SHA512efc193b143ff5d03e9de6955592a183a041457752e041cfc27a1344b6841f85c8b5ba644b5cb69dacf404cc91d3d7a4724d65d777e0ca8db5382c467e1a11648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5550abbaf4b63636960196726603d13fe
SHA1f8cdbd026283cd3c7066e8cab7898c739c68bec8
SHA2561d252c3638db9bb5c272787288a12e29581d377f6bd30a423c43eec5777f18f2
SHA51283540765ba3455a6aef2c00b5628f16e9330e83c701ca9db0af6a07d49900e33d828cf42168b413f836beea7a696b602129ce6489c9588ec9a7563327d8c2012
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b