Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
908cf304c5694640910be7f542daeb3d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
908cf304c5694640910be7f542daeb3d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
908cf304c5694640910be7f542daeb3d_JaffaCakes118.html
-
Size
20KB
-
MD5
908cf304c5694640910be7f542daeb3d
-
SHA1
374f6bdb973f8e2b3835601f2a573ea3d810e877
-
SHA256
88795759336bbe1aac091c16fadb2011b42090ed3f65d0a780721b034be4ca3c
-
SHA512
8ad84da8b3d171aceb2db0ffc84e3d31a6c1030861f323d5e7964a5e240c8597ce6de058dbd75aafdcaae6f0813a936e4565b782d5e6b182acbb597283616d40
-
SSDEEP
384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoB2UjF:nlVBbjik+zxPKPg0GmrGEJTydocU5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009abc0acba15ef44e9167f4ca12288e26000000000200000000001066000000010000200000000b3046d88d9f8a8fd9505661de2f2a086623224a242809be0f286e6ebfe2a96f000000000e80000000020000200000007185122d2a67269894608fe127eaa35e04525401c43771c3d3522373395c9f9990000000a34fa58f02014b4f04ac8193971a86ffd035aacea5ffcf6a24ef9e7f6395f2c7d09270df8ada5f685e6ac8c3172af8c642b9363e4825d674c8d44dd4854be72873004f25dbc9af053663e548b57571d7b886ac12e48183748937510a7931323577248674abd93a1677e988802ed84e2974f02d2cd3466c51248543cd6e3ae6816892e6ca12e835b01f6f98ec1a6ad6d5400000004339aa97d2aef7a910cad23bdd8188d8af142e63229e0c4e0e2b20a491ee5a351a288639b7bb58e8708ed00c4c5bc02aacad9a1b705da5a8cecadeef1241a63d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bf19c46fb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE774C11-2162-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009abc0acba15ef44e9167f4ca12288e2600000000020000000000106600000001000020000000d5541b649beaf11f9208bae6c5086e8d2353a1ea838635ec99be25a71392b400000000000e80000000020000200000000fa27cb3a71834b9e0ee93d47568717c7888510604af7486379bc39c37987a7e20000000c5a8c43f050bb0077a3859f6ba7d90aff4d1d6feac5c32bd679ed1ee18a1c5c34000000066e7c76a80d3988448ac79ab261a12e6b4c619adb0641a9d768dba042636f42ee72a43090457847d1ee84df9f8f6bf552cf80e127962d0b450f9163ac9d36f6b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423551295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1120 1796 iexplore.exe 28 PID 1796 wrote to memory of 1120 1796 iexplore.exe 28 PID 1796 wrote to memory of 1120 1796 iexplore.exe 28 PID 1796 wrote to memory of 1120 1796 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\908cf304c5694640910be7f542daeb3d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d65ab485275e377dc33a538c8e2b2417
SHA124c41f91924e1523e9914102c0c602348c9d7abf
SHA256909c57909eba707cb5d5a3f3eb00337b9fc3fd5b00c10c1e894cc7c2fe7ca3e0
SHA512ef635f6d1d76068c5b772a880f1de3b0bca46039ad0d3cbb68d0b885ac0db585c04d5ce4d8c6e1e0cc24fe4270155154ba00448ccc4441a43023d405e20970d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ab383ff64e0d538cc998e5b3a48eb62
SHA10f6c1a7aae6353953edd9db8661bd5f836906b27
SHA256d3eca6ba546d65b4500402ae89a6c96c7047b950f44a8f3c098812517977d975
SHA51239a1e745998883453d204642cc290b583c2bfdec995dfaf089d8ed3a92addc7e81a00f6237282dc820e9a90d31a2e7153e349985799191722901d31ee9ebea21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5135c5b713d7a21c1b321bb4239c8799a
SHA1d1e02c49d6c8f550a6dde188a5c11ceec74246cc
SHA256fbe1e3da0949e7faaf019413ae11fa4ee4c60696f96f1ac8cfc2cf675f30e02e
SHA512a779da3d712307ea76d1fbd4b529e558e7077238254379aae7bb54634ffaa138a884c4adaa1891ed589ff9ffc3590f8dc6e33584a56e097ab7605b83c774541a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5865d2f87b8992cf08ec7c221bb612a53
SHA1c6ff1111667b19a86c5b9ba0e6809fa8a8a753ca
SHA256bde7156007de27bb8912b438fde58b4ae4c95ba929ed128acc11b6de9e36c685
SHA512d8e150981ae351a88d5d92ace55da0581c81b999268c2d20a653dd5cb824d03c824b187d5bfd38278c10fce61fb52ae17c18983799291bdc23432fbbaf18fb4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f36e39eea32e55583cf76625781ff8d
SHA131576b20343dba979e88d462a3e44303a663432b
SHA25673faa2f59cc41fbdfce3f24517d31f38691ff935ef4f060171872d448999b04f
SHA5125b503d351485d79e051839845ca78a33338cb61e016c4e205b823cd456ea1b923358f2bb7c45b1f19a9de781c9f29ab2b05ea1dfcc2b2bbd442d7201a8288865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e39938ab655a69e24899953b3e6eb20
SHA1fa94ea534d76e8874a7a4eb3b463f3983dbec36d
SHA256567b542e2bb39605ca538fe5808174c077bc09480c6171daa1a6e4a039bee8c3
SHA512e0288b708a29aa44f36b0de6a7b7a9b462bff8a8f5d5d6c7578aaf9db420432235b3aa5e60c6b2dac3b54feef2f0aa81b0422d842b3ed6538e21a779a1aaae41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5926de242cb7a33cfdb748a7262c1e079
SHA122c20c175e95508ba551a79dc0b93d8e55549eb0
SHA256df277d22be095dcf42915abbb20c8c56ca95a42a1e1d0a847c4bade0f411f0a2
SHA512cb909de76b81488511c9aa50d28efbe3d3be23be01105b75351f1a253a7bb641bb274a27e3e8a606491fa4b2427c90de898c3550a1d285485c39d7a8252a30aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f63e38f32e16f5e25ceb9823f17b1693
SHA1e102620bf6d4a9fc0cc6ee701caaeae1f0d098b5
SHA256026a3a3182bf0a4543589ab02cd9d18b17539fe65d18d6e350904fbfe7fabb74
SHA51216eab940f2158a3a5fc7886a3d81ce430a229ddc8eb719bd80865471635d794214bba8e32d43c48581e398d2421f7650423a69d10bdd9180ccd9b8bc13d13257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2d494511552115f9c752b799f002061
SHA1441bf06f99216f952090a9758336ae82a909b4e4
SHA256b5cdfe9cd6a922c2f6f0f9dbef20c14aab8797dddf39544067f21f65baae062d
SHA512e1f6f56626ebcdf72018f0beaff14190489926c23882c21643ef4680a091debfcf73b6238a6b3d64bdbe1cf9c8273e96161d143ff44972479d44341862c73bad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c07bd9769e4b6a36db8825f592a174a0
SHA139a02ebb2d9745bd132ed9b962cca4dd6d7fac1b
SHA2564dc8d5fe8c6fed85f0e3b1e045a40c670315b36fcba689738598bf3912fb5ed4
SHA5123fa1c5ff8a588148d13a00189f03c92705c5fc39780d4c1ec16485a2556f1632dcdf4d9863fcf52381d75ef6610f789482370d1e2a6c22ea0456a8f474ff7ce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac67724b9658df797f69d91ae2e1b4c3
SHA13dddd2fc2f07f8a0449232fb1bc4db7726a9a24f
SHA25642c83b6174918233397e542374040eb44cc90dcba9f8fd837d4fb56715f0c48d
SHA5125f9987fc7edf34f2c4d63996f6124d52a5acd7e87e6ab3dd3099bcaa3e8c197612d480edc1f18e9391200bad86163d999c31f1e8b9d6f2eeb35d1fdf37218a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c358666928e619d3d2e6e6403aca9e0
SHA1f278801aa67652a993a80975342f6d20d1f8f021
SHA2560e824a92563adee1b89a3d86038d068ada1957ef2408222112ed44d2a698adc1
SHA5120edb281637d1da5f970fac41c1bf71ebe54dccc43da0d4587798ccda3e03321895560c043f134765345af66464ab9eb049bcb007ea950250f026e5aa4eb98193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c909284e845edf333dee88cc642c8a0e
SHA1d6944ca6685f296bd0a386a36f5942aa96196377
SHA2564e198a04d9bf9a7b5ffdbadc830dc4acb627c9c51098e097d691603c5b3e176e
SHA51255ab2193586a9a790f9b92fb4c356cfd613218f308da40b0b8508def58bcaf6dd06d6c5db102c2fdee13df25067b4b896ac9da3a26ce5eca5f1e080d5e0f7e93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f40f93f6c34d521c17f6a30d29b698cc
SHA1cb675fce51e7302bca3e363aa606f68862630acc
SHA2567396c063168c276277863e3fe98c87abbfd3ab64b0882d3e91dfecdd3682c517
SHA5127ea0544ce05455282fb159c40b919371550cd531f027efb9120d47a11c9ebf78fdaef4898403536d8a36d7d4ea28785972b7e6cb78694f08a74c343202c1addf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD54d56c0c8911cf3ce94f920d2b5a8ac98
SHA1aeb33eb4e3d9cd2ce044e09c04bfbda575633ee9
SHA256a603f5a1cd8b7c19773a640a82bc761e979bffc160f4bee6817627b7db9c42ba
SHA512d1e98f9e251e953c22df5185f7e72383020f8d337119d675ed2db8da593d99b5e90b007b43d050f549e284ff8b9d4629caa7505ba1c6b6b58e83a85ade021998
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b