Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html
-
Size
38KB
-
MD5
910d2e3605b3dbeb91f476f91e8c81d8
-
SHA1
0a0ce28a837f5545ec7e5db5afbd50bb4d646192
-
SHA256
28f6eddd3efa28f71b8d0d86bf08932f087c331b6f053b5661ee58a3625752bd
-
SHA512
20ed810cfe2b5435493760481711fbbfe90ee3f237833feb22d8f88c7b87a8f4d864f9288f9cd922931d6fb91630a72b2360c7f6eac7716c81e7973e7747ab7a
-
SSDEEP
768:ZcUKuGBR+ZPgOQZ4/POu1roC73iTF4RGZ4+5EhR9z69SAynk7cx7hO3:ZcUKuGBR+ZPL24t1rp73iTF4gZ4+5EhK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005199e192e70befba9753e870c9f7a5c6953a9c3bcf8fc3e20e915f7ae5ef29cf000000000e8000000002000020000000634ad9b7c305d37105b316c4e15ad7a68588d4245cd8396b6100bdaf1f06a09b2000000089604c3a56434e9874963d8b39a80fea83d1f3f8e6757c8aa33cb1aa7b3fa3c3400000005d8be64a45a974fda3f1adde512358e9ff7d4c1d72a1175b29e75549625188be187a66696fbb9900505c8c096fcf6fb223c6c1dc5dc76823b917f7cf0fb290ca iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d0d0d28cb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC8E0DD1-217F-11EF-8C92-6A2211F10352} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563775" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005397c7e3dc9d9eb395721b2b12e845617b2e4f57cfc9fbbb4820db8c6274c06c000000000e8000000002000020000000ba852c7ef201c3c1e40cee23861f4252b09d48e8c698b57f06d081ab32aa40cc900000008077e1cef6152f67a05f29d33a5d828811d61022cfdc73ef1890b9f01411a31640f4e2197dcbd7b4f9893268710f1a3689a46fb7d5161b12ead5b554eefd7573569e1f7de0a791ca6a6afbb75f3e7ce2251df09cc541efbc9ed2edb950350e0831d8ffb580fd92e7759d6a73e307f3c4e809a1e38648c9b3219dc7b0b673c0fc84c8ad8217e34c24f4dd5bd98877f397400000007f09eeeccc063bd3a6ae776cfeba0fab348434baee437c78dc1db3812b7991303d2343d5ca01295fd4f1d9540c011fe061ebc594d60f6e957e6c0ba01d139d20 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 3040 1368 iexplore.exe 28 PID 1368 wrote to memory of 3040 1368 iexplore.exe 28 PID 1368 wrote to memory of 3040 1368 iexplore.exe 28 PID 1368 wrote to memory of 3040 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57a350d1b25b6d1811bbaf933731f4547
SHA1c4115c106c5afbcff7c4634e0cf7180472bb6647
SHA2563aaf01c25321fc9331d4fceca1c52e34e152957638f7caa34e6479dada4caac0
SHA512ceadb8669633f04f699827a6967f6b4cc99687e97ed0d9c3095c537605900d62dca639a419c3b93c6eeeafaacb8f2e32e31a6b2b0fde3b2ff219d828f6297341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD517cf104787f16f72c397fef09890980f
SHA1603b8cbeaf7650f7f78b8f2cb619d7fd7ff38a72
SHA25623d9986df5bd07a2624dafc5ce1a3953cf8f113fb6a1e1c0a328ed4441cb9da8
SHA512e87e6527e8283d2c3e7e9a7d6fdaa4a29733c6427663a4ae9b8f669a7b5a2eadb019d8bef6d2ed4721df17ddee6f689c252aed7655290df4883416629ec46d49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53a475f8aef484c13299f69c21db52072
SHA14e1416b9155bb39a0df53fac4f408be1b008e3b2
SHA2566439c906e6c343bcfdf1fd78a6affc977fa3a317ef5980fece9125a9c3fe5d64
SHA512c36114b63f15f2abdb2865b3f0a639217c84721f4e817d4453434288181e4849d4eb6f0ffa528f586ae50f1f1f55814dc152a0538d9d8f8286a0e1cac5691f83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e159326443f30b9cbbd626979b2614ab
SHA1b10df8c7f183a9dee6c430137b5513e5b8d628d0
SHA256318470770f9c0d1d2527c91bd6244d167590f386a46dd41a583aa0fd9bc3bc87
SHA512b36527fcee774e2340e038fe8bf29e1b20b16e2110a8e061892b246c29e59a6aaa2b5c76e59d25e6c409e3c997391859a1b9cec7c01f9ed1b5f03d617db70a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51465b3dd01fe7bb5704aa0c5ce5bd5f2
SHA18316bbea2244f9be5a61a171b9753c78df46fd1c
SHA256a8578102f172af13f0d78a2126c98bdbd55068de8d4680d952e1b9f2d90005fd
SHA5129677823a26aaabc56f16a5775a0380ac5554e08c4b74b80fa90b17b5da35a185f05e3315dba527155ec248601d3ccee4c163df91469b9c3131b0d357a3c1deac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57deb7cc2b860b8060861db01a5522b82
SHA1ce1cc853c04e4854c657ac17e0b82c8d4495b954
SHA256d6929a7a582e42cc700d51ce0cb1cba2288d61885460572ad751ef74cf504034
SHA5126f09b9249671665d764301466f5a90f66a9cfbe2cc83f5c2ebb5ccda1f23ac750116254db2d90a9f030813177f5674ea05a216226a6ba54698f76a641cddb8e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a51c3978b66dca2226c79b384f6d3158
SHA1f3fc13140bfc44f1d2a13283125f061bd46ab974
SHA2560a94a9335ae09d7dd79a5f6b51c37c3a406e561766943279b0519f854aeec748
SHA5128e6e477ec002520062828a682d7dcbb551fa4d507087b1b08a91beac4b34ee4dba4e340c26357e49ebb73b3494e9a399c330f4e2d22c5e724e5c14c45b2a748c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52eefda9fde30a4022c356e5d39bfe06d
SHA1a83c0e4964b87ce901e2178321a1b97ec9e7588a
SHA256f6f39cc1d437d20d2c6c69fa482b9fef4577d4d73f731f3004676ca7e97fd95b
SHA512d02943f8805f5e40755c7711dabc42bd12b830e92cf644b4c106cf1797331b0689fa2a4f316195752a1cbdff753a5b2e658c7e90557d2006f3e0d849e1b6a18e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD585d188b10fd1712216c5907aff242b2b
SHA182a565bc1c740e76a39effbc20b83c598500aa70
SHA256ef3ff9e818377b673fa8399c9a72ebd30683e64f0db9845ddd2673d8d4880d01
SHA512fac167b04f4c5683512e40a3b4f7e6c633512e78c0057632d8ff09979fea9e372c678df31c0d0a36ee566e238fe38b26b166d20ae857b784a239e6dcb105ddd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f990ccf5f11416cd465e25cfaf5f0fcd
SHA103befed35088c1075ed2621026999f457f6b90b1
SHA25637c8532abd3c75b8d043af2eb25a56d8891e768caf327b18aac9873127f9e056
SHA5129a2d6e1534c0588cc6696b631fad664e3495bb6bf345c5a577951f02d1d589da315f7a51319d7338b0b134c79ce3894158f2fdfd69ff27d5a202ab1b4d248c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58227359f1815cb0898fe01fea5efdb2d
SHA1886b9a2b6e66d9f654f599136c253d79451d44ca
SHA256b0096d3580643f8fa0933b538f81b61fe25839820d1b7e25ada36c2a9f7e41f7
SHA512134f1b9872d7fe8942d0f00a01b6f390c8ad0c3894500721ef490fbe5420449bcb9ac651946171ab90d954efcb59309ee4a60962c1e456a25208491fcf73e82b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b