Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
8fee0fef6a099e3a0e9a0f7973fbfed0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8fee0fef6a099e3a0e9a0f7973fbfed0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8fee0fef6a099e3a0e9a0f7973fbfed0_JaffaCakes118.html
-
Size
4KB
-
MD5
8fee0fef6a099e3a0e9a0f7973fbfed0
-
SHA1
7ed94f4946f439d209bc554c6a0f3ab786d0d91c
-
SHA256
bd3a64abf732e813b65e6cba3da228da80577782f959d057b6e051d36b9457b3
-
SHA512
9e8f36102a47ee08a8ba9a23bfb839567d0135b83c72b3df38a6a4415768c3a93c58472741fd926da93819df30df3eda8fd785a930f85583a1a77e320e63365c
-
SSDEEP
96:ziEfCmV4MSEPBDvV0n47ej/hgOKiljTR1QnyneEhlkkf2:ziidV4GD8/h/KiZ7Qn/EYkf2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055597fee9e43dd4e9a5906d7824cade700000000020000000000106600000001000020000000714c1cb6d9944c98d0f9428f0829215d2719befae3a9d2b7c62990ab33d27e38000000000e80000000020000200000002b5c66be8dacb1d058e9a5458385134bc83d6710389ab0f3c087fb2d17b6b902200000000dd2c62b9578a674acee577c31ad633ead5abfd4c02b1026e2efc4dd1f5bf717400000008ce5d4a4b523efdebc32813e6e3f0d50d3a5ada1f25c928f63302dfcaada3323e29a48e3326e20383a13a5d13d39926b3c8f90d4ee48f8e2358fb1e4a69a912f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423535665" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89DDA521-213E-11EF-B671-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055597fee9e43dd4e9a5906d7824cade7000000000200000000001066000000010000200000004eda520dab11805c1dfe55cb4d138cc8c9ec5bda052f34069b75f1a2ffeb16e5000000000e80000000020000200000005d816e4b3a926250ec594b03a248d86c1439ea5d8e0ddbb08b5198525843e7a09000000015fb0495bd62fd2cdae59881d72a2664a376de242a5b068f87dea162d5dff3dd06db068eb723f02385fd2f3e10d1f200cf8a5203cc673f9cbf684244427b1ec39680262128e95cb73bcbac0027c9bdb23da38a1cee6ee68037a624f40b7451c03942333ef9c98054f0c0928ae330803359910baa742125efb6245fa35550a9628fbd9c1a18490e925d4a2cca12b82ad840000000600b2a1162039164edfc822f6643ad0fe110e1d65612646e17b683d17aed669bc2caa4106fbc95d954334758ed7a5fbf226972d10c4739db752f2eef3e4f0141 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06a604d4bb5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2884 2460 iexplore.exe 28 PID 2460 wrote to memory of 2884 2460 iexplore.exe 28 PID 2460 wrote to memory of 2884 2460 iexplore.exe 28 PID 2460 wrote to memory of 2884 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fee0fef6a099e3a0e9a0f7973fbfed0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bd1b1442b18d618c3b2506cb9f60f50
SHA11076333ed54d8edc415d9b06e08990f3031b03dc
SHA256f492be0ceadffc0d2e9a855ebe13d95d8731e60e2fbc1d39185fea12086bcf6a
SHA512049bea4d981dd391d474e1aa4e3a6ec8adc83e3129ed53307788fad02148285474dbaf3b44da882228eb956876d4149957da3bf37f1c3893725aea4ba8d93daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5a6b272a118cf7cf9fce3b9f4acd03e
SHA1b2cb0999ca87717a1e7ce654cd91e3a0f442a5e5
SHA25606a77ac48ac000c51e21ab094dfbc0d7f7973f7d55a49975b609c6871eb7724e
SHA51214daf1488e3722cc1b84628afd5de7826da77082cd22739381b0dfd2c9fd3d76bbef80fa74dbf7215a81f953fcd36e00cc06b1a4d107465d4618804bb55b78f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51298898fbce5502ded912b1810b3a271
SHA16b3709b7a3ad174150f769a4eb22ead3c5722cdb
SHA256dac343bb368521a35a600702dfa982ca12b32f24e53d96e77049e4eb8bf89252
SHA512ee373048830a5d8217f9d2512698c96b8d523b728cd7ecee82831ebfbbd7e224541ef73950d7ccabe82c6fc6086e35adf5cf7d1f7c327731b9d9beb1a61dc9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d3843ed69c104aa76e1fdcdc06957be
SHA128f64c415f530182b307a24733bb3df14be29f3f
SHA2568270bc51e3b89be708cbaed517db3f408419fca6a30256052e7209245e023e86
SHA512e22c5b6a354142f78cf031973f398765ac73cac2a11eb9f6a42089d679045af2381156073965b04fa7132835612147df24380b6ab1f4876a4e195de245e43c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5760761bb0d03bbaef940190fefb563dd
SHA196894ccfdf1b4dd89c426f7f0d72c5a85c50de24
SHA256928137a31e461e988995bbce7d25d82dc7160418c49be023638001d46f3660d3
SHA5129f982a2c7b883d724974bda94ee6baa39c1280bc8edd199244bb08f4014001b0861f6e5972a2138c7a047b8ad4a4a7126b610eedbf89e554050fa82996c69826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a473eabc64468f649401d7a5eb80f98
SHA19f0649d54dfae0c489e90878f91bdf5d6c8c10ad
SHA256f237cdd6e42ea08c0023d12bc33f99e9ecd67b6496af0e744bea2de6e1c1cc47
SHA512f657d15277d7ebaffa7e8a0c4ee67287d02aa6e56dc911a4d58b697707286a1a518de69dcdd77237d660c0597c7381ecba3f4d9b83611fcc469fff161cea87b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a8fc10de22ea005b84ceeb2a242db35
SHA1c2975370ba62fe4c114fb15f57e7aa0d768972d6
SHA256144932dda0b2cabbb83a00705356bb3ae43a3fd5ad01afe6535bd6850e2fd819
SHA5126f8e19f626b11b68355aa5755594dfccbccf809428ee9e887e43dcd2deebb90265b2763e11fe032186f545b4a15b19fd8deb7a57c6cb5c665d59ceb5fcb80304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df31eb22cdd715c7473d651e401d66c1
SHA16a5e1178ca7d9954a3976afdab0000e6fb587fa6
SHA25618dd75410fb21de82c573a7d925afcd046fd0d20f55999583deb235ac8265d03
SHA5122316659f40b99d880dc04c50cd5c704fcb28644e4e0b380cacd287168043ff22451f66d5c7b83640d9439ecd89102524cb086ada573b46ede9c29dce02ca1de1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5692638f639c95463f0d91b8672d50de1
SHA13c3c74e9ad252591a78e7e3bc6da7101aad9701e
SHA256101a8db66342446379a937658a76f2e054e0f0148964b41fbe3318f8e9c31b40
SHA512f5139e1abf8deed42fd14ee5441f8a4923b7db46453a7958a5eeca14ef18d5334fe8a79e658bacce0ccd9ff28bbe9f9bef114bdadef165ac694ae66f8f7bc036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a44577e4c4db03230835822edf8f6bf7
SHA1d70d7453f5ed7bdf3c3f1c5456de201be446fb3f
SHA25646aa0aeb5485d869bef88354c0d8c08fee24b58349c322047a5e1206d9c82870
SHA512d836bc288acec51c9f5b7de45491619a33abe202bbf79da6044f32c99240694543e4eafda90f08aa70f7d00a80439c8f2d0fe460c501cf16c723241d0e8e63e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552f25b59a8b0ca220470946009cfe676
SHA12fa231639b50bf188f6a54234be96d90b82f6efa
SHA256899d0bdbfa7c36ff0755cb65fdd7d4f30ce2629001c0caa46eba4cd03e262fb6
SHA5125a3a677c06dc843bb0c59f26098bbc54289f2f5fe4d57bbff715a96f4cd4dd0a1190e6051725f8f548e6da59a694e7d19d78f0f164813f927fce4a48e27141b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ad490021e30e67fb81b4a824823e2c0
SHA14f3dfa0640ef2acd9e5529a76e5fefe49d352248
SHA256dba14c876af7671fddb8d585de494b4869794d095722b91b25e1ff087071575d
SHA51225fb9d3babd90f79b4803dd5f73ac0cb39f378ad809d091a70fc67897a9912f1be583fa258639fad5c6dcb16da795eed4e0f0e7871a1a86414f447e498dea772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505aeaa07d07bb60db766e160a46dfa97
SHA1d50fcf0ad57b82f7a4b38eacff1bcb92f55d916b
SHA256e5962269cfdaf8708e4c0e8f79e3f2e065063a38b5b3945c2a95375693b330a9
SHA512acdbf644de4dad822a7b4a7a6c457166e8fc10d45e52bd7e498c5d3a8b87bf17fe9d67c9fed81f6f3e6b29815ec0352339bf824f787e642cb5429596dbc5c560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f2b6e1d72749b26e75a4f74cb4e2fc6
SHA14e7bd16d4a5843cacf86e11cff3f64c671cea081
SHA25621856235a57ea04e84dfb474e241a263299dce1264869492c51e2dd320331928
SHA512b7600efbed95b4438fd76be0fab0cb342ef777ad4dfd6debdc7abebecb6b155a5d5cc1c68df8fae91dfd68ef6d97b61934ecd8a4dc26adf9bf554e5d7cda1f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d93a50706ddd1d79f002228922ad5bf
SHA12ae9af666a550a537b57c0f993380f75e4c1f0a4
SHA256fa4c364505475bb91b44f5dce413e1501ee23cb9f6758fb5841bc6a05e5e1569
SHA512286b17a4865440c96a316ffcc7dcf3498600bb53fc8a70a1b5a48728eb5384d3fbe029723dfa448007814217d60c2e8fd4f03c31426c22ccdeddf2e01c239a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faa77ca364c19e1486f172abdd02c63f
SHA111474feb2e1ad88e0b276a189a822e37e721dcdd
SHA256c2795300809735670f8aed33e0cf932ba9612075a6a191bd1e509f56f52fbdcc
SHA512eaec7e8f0f961987ebf2e217c2b76419d1c67b723bb1ca983154a538ca775d26218c9c4ae0ac8dd865e608b80534a946bb1fa905325ddd285a98005278c2017c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3b14c88d0ff343e9adfe81d525b0da6
SHA1537a71366528ae29f353de4f53c47b0d9693e1e1
SHA25680e7f4ac8698089c3f5e2d30e9297bdbba54b519f8b55d20c479effcff74eb2d
SHA512027766b551dcaea9bbdac3de8269c5f559ffe47dd958503913426b5993de975805053f65725bae1a767c159d2560c9a4b72eb388ce090f085ccec2601d877641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55263fc3b846f51ca68fd7c0e7aa0055e
SHA13e310067b4e959a8d608ab7d4ce45eec5c536620
SHA256146bdf57bcc7f938b122a5433e14ac86a006197b70bdc50d179a87fb02edf9e6
SHA512fcc98a26d6e737f6ef95cca9cc8903bec21d3e66eb93ab44310157d75ad467f42b4258181df141e6dd5a169fbd49c45dcadb05d271dfce3bb0c0bb76a2de0436
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b