Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
90f8cac23ad3bdcb3325b8f679053cd4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90f8cac23ad3bdcb3325b8f679053cd4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
90f8cac23ad3bdcb3325b8f679053cd4_JaffaCakes118.html
-
Size
4KB
-
MD5
90f8cac23ad3bdcb3325b8f679053cd4
-
SHA1
ac032ad9ecda4cfae12354ce4df5f153f1086370
-
SHA256
daa77b923be52d106b3b9fea6fb1dce20cd6cc63010da1f1a5233a5c6555e533
-
SHA512
2a58384ab3b7f0fc3791797b8d097f62d8a70bb737af6b452f56756442314aac74e5d0cc23bc18412205e1d0d110ae618b6ce4f06fe0ef7b04760f6edce4f0f6
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oEjtfd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05804b288b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099be215841e83945b91604591925570f00000000020000000000106600000001000020000000b39084ccc4845b06b268e26940b5ec822c1747f588d4778114dd0347f45c9e38000000000e80000000020000200000000d7516c120729e418735b334a05a994f9f74df153603432ca3244f3b95be0f832000000064a0c6698674355ad8d7528ecfc900c8123e8b7311725cdb4fb232165ffc2a7540000000d1defacca4193a96be379e6ef3b85d48969dcbc79f06059c80cd229b59a069b78866da5dfa0f7d26d0740dba953107cd3bb90d2d4a51214f39b99f8f94fe6f8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423562003" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099be215841e83945b91604591925570f00000000020000000000106600000001000020000000b8bc8487118155bfabb4ea5e1fbb9e539d596e081c43c122133bb1c0612b8adc000000000e80000000020000200000000185a84d3c518daabb75f66b8bbc48963cabda1be03bcd4d9adf665bd092c54490000000ed0176ac152532241ddb47626b96cb0b8b54cc97a12b8bccff915039163f2ecac846cca6fdaa7b5c49205b6050a725c73d1bd46aabdddf09cbec567eb3a561d6376e45d59b76fb715584bae65ae1f70862bcbc72f5a42ec4282494b0b9e2ab836fae7cc753663e68a57110e7d4b1d105c46f5e166489fb8bea10bf7b979c2f097142930a27acf585bc77343b4b7dd74040000000b547bf5e9c8a51808d498d82ebbea79afb90e5d1430edb55bde202c72c8ce0a3f55df13b583142f1ef680432a7b74bcc94e4f343ae71de442d75b48164d0eec8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD895651-217B-11EF-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2232 2164 iexplore.exe 28 PID 2164 wrote to memory of 2232 2164 iexplore.exe 28 PID 2164 wrote to memory of 2232 2164 iexplore.exe 28 PID 2164 wrote to memory of 2232 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\90f8cac23ad3bdcb3325b8f679053cd4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531136ce57551113735e5257587472b51
SHA1082b6892f0367f9d09d0e33f72858e15bab23905
SHA256f921edce107e188d30562d73ad4ac7bcf8bfe6ab31ce7225049ccc8738e4c54f
SHA51234ce5f8d67023f4b6d5c92ff364364a918579c0fd4514923ca1ad60df347c6c964c6f862516f6914e6d098e0993b2e96734c8727706456ca7b3041f9e3d0f86f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539ba0ce9146c6fd47abfbc6827b533d2
SHA14139c55e4915bf2e81559174703ab2fcb9ec07b0
SHA25610a32994828a3bfe4e42df0d071e070ade95d23e8f59fc60afff04ba6a8b865d
SHA51233fb7887cc04f9a771b1a83dd19cd99260530625fb07ba90d3029f7339222bf15d1f0cbe25c443a266cc644dfe8c3302bc7a7b93cd428c596ac79644d0afddf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d0e54b3ff74d2603a71387f6e817ee
SHA197613cf2c110b9fd62a51394d00477838faa5b1c
SHA256a3d9915b33ea3eb93fabfb9f9ec0b8324599c0fda0d89c759ca7cd49487852e6
SHA512a1755ad7927727e9711a2a6a0010778203abcb708c0ff4de4c290b125f9c89f49e26e03723f2423ed14bcf84bd648763013cbb385cc0eb11d695a4e480f2ac50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a87d31b1733f2c84747b74b4131f552c
SHA1b9ef25e97c3e8794758797505eeb3efa887634f1
SHA2569350b432928dca006ea67c5ff34d921e640770f1a702531e6b8b5e302ed057d9
SHA512e7e71a3220bf61d71cbc02d4f2d5ada9c054b4f010bd7ab7364695268f36ad57f6fa2a78629a4577421365acd1956cd90939c95afb3202dc2354347356255fa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a80449bce6437f0518ad279e0220791d
SHA1c06beec5b41099e850398c4195a2fa9159cd414b
SHA2560daa9911bb39b116e202c0f139972677f2b253c1b1a318496897394db4e44193
SHA512022321cb281844d247e1ff48ffc50c803e4d1387419adaf1445e57ad85b1cbcc6caa134c3f8a54feac42587e3019f8464cabb8743d4c84c2586d95b3728279d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a19e94fc2c83007fd86afda701d4493
SHA19056f62e5700a674a0e1388678ba7602981d0c70
SHA25686ab3032579edfa45fbf566fc2ea697e3c949651130cdaa0efd0fb4f593a3085
SHA51234cd49cf7232e4fc73ba0bc2282e4f37876ad6e646953078cc520596ae205f0becd68edebaa4b46f507389c670639f487ae477f0414093890839c9ada78d3368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9a3c62ff89ea07c68f5808d69f1cba9
SHA1116a62b525e5a210edc54ed45a35e2bb302c7a1b
SHA25612e1ee7c6197022e315e464c49daf6507da95e1f94cf25e66382e0c1bb8b423e
SHA5122af0ae33a8427c64506de5a7796bc84e599bf115ce6361579e948f31ec8843705692a53667c21ebd9d2e6cff37215ff192c826b12e04df9927ad73d3ce629af9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f50a656a2271ec666997be43aacb0674
SHA1e9ed47d73aac6122014369ae3e65995102bf6172
SHA256c1362d461fc43b659422220a3f9df0e1c9c37a9740a1dca4d601698a543cca98
SHA512668e720ff59290cb9986f2f2e2bdfab4b14ccf017e11ae3795484f3f4cead60f12ff52145d4ac8a9ea06018a37df2d0cea81f7df87b9595bb8123cba77fef399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a7e0c58c4b5b1d68c27040691087229
SHA10ba7e605b0cbf8476cdb97555a0d14812521a04f
SHA256e6a450dfe4b51c749a4d05b8b55a9c6f027345c9d870b8c23f5126a9d28d19d9
SHA5123ff88e566038b265f1ed547a458d48481783a4a55bc560274592b1b36d4e70012908145a896091c358e3a6a76d68ac9270d71c4cc0f5aa5cc3be2ac41db38fa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b2fb74306ca7f8a130d411524ae0502
SHA1b221b5f4b0dfc6b654e60e7ec7d22a28c0e6fece
SHA256d462e6cd8d28494cac35f64003a9d6fc6199ea971d9060890ebb33f61c9498de
SHA5128ac31f77f6d20c5d20b1a1ba7f3c55a03fd4489bed141925cf9c93c67a93e4654a3d544d456378f25cbcf4ec4e33898a850faf3b515b4c67f0e09b23af027c7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592011abb0130585f17a62d44422a09d5
SHA165cfa19132d166188f56f12903a079f0103799b8
SHA25607311871ddd15811ed50ac80ee25d5c45df82bbcc371743b36fb7975f7830310
SHA5125bdc5b010bdd75d5b6f4a9ca0ff5f0f5b5f710f6de69baf253f588d38238bf687fd59a8ed196b1beda62e5540d72caa911e8df0bdd06afa4f476717a1dd79bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560509e239bcd0bc82ab8b23dcdcbeb61
SHA1760379e6c8f10b6a34ba6077c895ba0a2f5241e0
SHA2563127db8563a193724d228384c2e3503cac37c0478bca73961459db4486148918
SHA512bd9bccb0034f409a6111169d1d63e3cedeaac48ba6fad7816fec2275f08fdbb7b882b1c34d5b167af5a6be5fc131da4e0c2a9b26fc590b67955d125a3614a413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bea6c07e1074f459e994b6d477cbb278
SHA11130f7a7b7e624cb94ee0c705d7f2b40eff38fbc
SHA2569feaaa634b63467c0c653b0b516f0708e1a144d2c0c28e255f4b1a898c3c69d6
SHA5124728a44099733be759e4c826e50ffd3997e6b9feeec7819f75b8640c74a5c5ad1d0ff6102223e22895894e9c32d25df7630f16e67dcb49b96c1df1020f1a79cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a98fe339a54d19852e9c09f0f150639f
SHA1518acc9eb80282b1410ed9df2a734407bddfe840
SHA256d4dc193bc54ab8c674cc6549572948c83c593e775c25f7896b35a5120981b323
SHA5120a830f491fc4793a1879954ec3a7f351f576a20af9f2d5c30091f3152f70c0292b9b04d4fd205e9a403b1b27b81baac5976542b9b3e7d2ec9522f17d11b0ccf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524f5fc148176410a325721df5a4f2d84
SHA19cb7903f7e5fe80d1a90788bbff4701f7ca80f5d
SHA25627894253e27e7626db030ec0c18b0b86c6acc8c9897599c867023240fede3ecb
SHA51250532eaff4951fce900d1a0321ebcd69e9aae5b8722fb0eca29288483b7b1de2522a9330d4c18770b99cf0d2df803409e52ac08ef6aba969c39decb5a40788c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e436547fa9ed46c43d7040b17e055786
SHA1519f017fc13ca48372a31c25f21ff94b26de921a
SHA256a5b39093857ef7566ffb82b2c30fb472a37eec41a5c8deae7d7aec59b5ce1bfc
SHA51208d85756cc05b5498844ce26ce2a776e97742352e304bdab6ffd5ef735ee8a3aec33b36e4297f3ee94ec2707d3fccf9569b051ac342b52ef6251929cce02d9c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea9fc60ff77754321659838032fc1317
SHA159c99cac60a4347006db51fcc5d4442eaddb9bf3
SHA256ea2e4e213d10b21e38d7f8b340e54ee6a4281204b2a5d77432a120be9f477001
SHA512f0303bb9166154183688b9a5eb41e17a610f7adcc30fd6ba582dc0cc29ddc12211bc84ec2ef56e43540916750c77c7ed8228b94af3d2d08cdb388e59ac2d9356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a37780f4d67fabdb282fab1a7a46069
SHA1b2eba42effee0484bbddcd7a4267880b62a4dfca
SHA256337f28c412a2fb8522e603a2b1ba78ec6409e1b8b7e8ff63b610bdea8e63d23d
SHA5125bf1ec6a0e951bff41b96b61e3d5e02a32cba7df9f10448fa09c38bc738201146a031ce344d575fcbab0ac666a7c7fd1172106de14711b571873d224163956ac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b