Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
913c2d84daf57344bad2de9abcaeec11_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
913c2d84daf57344bad2de9abcaeec11_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
913c2d84daf57344bad2de9abcaeec11_JaffaCakes118.html
-
Size
63KB
-
MD5
913c2d84daf57344bad2de9abcaeec11
-
SHA1
e9789467fdbcb7c49174df5764a507e7db8b4f37
-
SHA256
54c6cc4c51a9be6675682b4aa9cc1a61b8884882ae3300673c16849ffa30212e
-
SHA512
16cb01c430230f5dbe66e2b26dc378dac7786a24c7be7d138f3587ee919bf010d42c612254f1feefe5192b4ec0914908ecdbe55993062d3fe8bce65a78c196ce
-
SSDEEP
768:Ji/gcMiz3sI2PDDZf0glJR6pzoTykyCZkoTnMdtbBnfBgN8/oi2c8QFVGys//IjC:JdBTTFec0tbrgaMc7NndC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001eb3e9adbfe5ee44a7c086f44fa833e900000000020000000000106600000001000020000000a06c0a688f4f8e749b26833d0b5e49fc63b0863b614fc0fe153f9b47b70e04eb000000000e80000000020000200000008151a747e9e488199ad113a142cd3a522744d02c01e108558a6bfe1bdf50fb0320000000a7105a85fccb09b4387ea31239060f0a717e1c04f130ef06e8d2a2a9fc2ae8374000000093034590d8b96493680f64acc4fc6dacd0f59821b81c1ca284cb98d918c0f8b69457a679c9e60c87eb5a905145ae77e6ab93b732dc502ba07f64f6c14697a38c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0975EC31-2189-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f044e095b5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001eb3e9adbfe5ee44a7c086f44fa833e90000000002000000000010660000000100002000000033d6f8750901353e30fe6006806818dc02316542a3a4bbe6ab36502ea8fc6f54000000000e800000000200002000000075f846ec003a46bcd569a29f7b402d8cbe297ba6dffb7515233855a385ce30f6900000002cdad9c3710f9c1307f4c1e9a553fbf4c482a66c7ff5088d4f2d9fc93f236ed1fbf843dcad67695ed93e4fb8c48c0da157620a70b57116c6948ef7999c78910df4f7c3175a41202599c8213097b67f5e9e2e2996875f52deea980d9f75f1ce29402dd741cb644e64bd7e10e80f0b0718ad736b9ca51dcb96220263925242728a03c48e51dcc3616e3a0ce303d963f1f34000000002c5b3ef7548f0dbad5ffcfd404814d49409af2a0f506fb5457b26d7cbb69f39e6953fe22340da1505ce67cb9bf3c710aaef66f18cef56cff046ce9c63b67a24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423567660" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2300 2236 iexplore.exe 28 PID 2236 wrote to memory of 2300 2236 iexplore.exe 28 PID 2236 wrote to memory of 2300 2236 iexplore.exe 28 PID 2236 wrote to memory of 2300 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\913c2d84daf57344bad2de9abcaeec11_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f04bf1742cf75411cad8acf66df82598
SHA1c26c52d251fbd5db8ff0488e051439927cbcf539
SHA256475aeaef3b27ca8ab3a99a0d4666fb2d5d61dae203727f8effbba5fe1f70a78b
SHA5127caa4dd9eb1ec71b1643fcde5fc1075b044dc4dadea8b0ddbcb3bf197b19452adbe76b38cdbbf623d0304ab9c29fa38603806744f20e07f69d0bcff8ef091351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5961d7ee30d9212e5956b98406cfc603c
SHA168b049a223f5462d04bd2e29585fdf25ad72036a
SHA256731111896de7c809323ad73ecf08d78c476e8f4014a12682b1b1a8beb28d01a0
SHA51268e054c366f0be6c6e2c0dd2bc6157f6c74685b8b80a5cec246640a419249fa1055d935f81218a87c275c361064cc594003bc6227f1159b2dc0c7e7e48ecaaf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b217ecfa9717ea1b07f64296307aec15
SHA17c2ee0f40117e76848420d31af02a88dcd5858bc
SHA2567eb74577f1bee24ff71a24d129b08e734783ac70a5aa7f999fd177ca86925840
SHA5122ca66e0dc06d23b20d61707ee799ba6603ba7b07b9ffcab9d05e6164f69f3e6dde77a794ad7801b935f881a4f54752fb83747d193495e3dc2b5ed5a96e074aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dafae7e35a72a950cf38bf33e8cd3c2
SHA182b483c74d5def9c64279c6903046dc24b0876e8
SHA256ef9d8403440814ac17ea7691fcc33ff9ab2d099519b36ec028690a97d96f8cc9
SHA5123c070bda5f04479834c5e8af165e601c7a32858f43a8cca21e364bf5645060416f88adf5910da892f75d0254a01b9cb3ba1fd3263f3e69d3d73b50df1f61d2a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd2e5f0799503084938fb5586c20c4bc
SHA12156bd4dc49b34bd7fb21555da5f39690c47f4ee
SHA2561f7049382478d1ad21fae93eb468f3d5449d9bb59333743b83b28acd512b766a
SHA5126c8f184c8c1f2e760e55666598c4472e29d4aab971548f90577d9840d2d74a0d9a58e59e1a1311bb506c10f84117828ae7dd8f6186c3d78a1cfa980b7acc7318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8a374c0f057c340bdede4369d1a2fa
SHA1a0f209d39dda927e886fc5b7b83dd94979311102
SHA2567cc2f0d1a7907e790bcb415935c92ddb4282b3037486a7a20843b93cb7a31543
SHA512a51f5ebb46ff99da96dbd66191424132161e536966dcd9f362e6647d859a15d799d2bb81253c6b97a8ec0f0a85e70e303aa9f95c471b15948ddf35c1e3a85a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5935bf43f1f94c03bf71531bc6d838c61
SHA142d41e2c90fce9f68a353c32f01ee8ea9143ebff
SHA25621da376e16dd03ce0911b1b1ef35869bc52be6b60781f3e237d7e13529c33754
SHA51240325fc796535a8c12cf5d182d6165ae7d0dd95cca11dbd23f6409ac07aaae671795607f3af2a8f72e4cbb21c31b63a90e884ae085170708f4e3803097d75016
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6d8406181280f7ac784fb8441d8637
SHA1fdca9ab625c7b5fee113f1f1e92e0ff59b6d389f
SHA256da5a1ec5f5aeec00733f701b12d7dbe492963382182fdefe24598d47c41c0764
SHA51251dc845224ca0667ee1191be1467517159a01a0c7ceed88ece8e7204d779a5abc90802e3f2270e7417c806daf60eaa149e2895a5702b4dea4080dfcb51db704d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3f8757531d33d0ce58b1389db562e43
SHA102d457eea6ab58415f866d94ab7538a370af2289
SHA256cbd3317b2e6f47ced4cc3374a44cfda925faa21f0c9206dd2a90441c3d00e30c
SHA51233ca54a74b3315215ffc80e42fe20b4c0f95e71cd2a04c8ae26a6355081a103fe480a89aaf1ca3a1624599ab1eca94387db87a5d3eaefe42b55fe47da7cf3c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbb9f310dbd79cddc060a73ac8cfbbdf
SHA1d4bf6b2d4108a531984c0a1f55f69568f38d969f
SHA256cb134821f1526d2c7e353879642b02100f5ca45cc2a1aa1108365c372b39578f
SHA5126c9a11da2a0250c6bc86b68d7b2bb677bf014d576475db344bdc140d564422b501a7e8c8858d5e73d887c5a5ecdcab5db15beb72f11362018613a0a089360d2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f745f84f57acdde22c2245197467d7e
SHA1f3c6d67f6160904c5fc2540b1882e363833b98d8
SHA256731ee90ff9115d6729862ec63cd4f3abc71218e4cc25d8dde1650e2cb53a9d1e
SHA512878fd2a838253201ef0ccd4145c5efd256a34d3bfabc12a5175648297528b3feb3aae3e5780215ba0afee3c4ab387a0ac067708469e30c8b29108757c69b3144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a4e65499ca244cee04859cec3315885
SHA1214fd55f87d9db8f76772645c1f899e462da4f97
SHA2562ad13fd34e5469cfd004da5920020b8d349c2e6d809d2d96378ab78f9cdf5200
SHA512518f34d340d79765d754af3b78a73813a4ff0a87e56dc70ac4953168de3150e7fa614bbe31db8ce0da76e243c823e2fb0a267d0e0f748f8675e0c600cb36b5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e62423947c0df0547b94eee65fade4a8
SHA1e000a75a72df216cfdeca93d85b8702f2c1e3feb
SHA25673d2b12a98b166fb69064ee4c2872b6c2ec6e9bf643f5de15d0cd00fec7e62b5
SHA51215460a0481dfba8f4adf4aa27ee6b388b2caa209658263145e29aa9772565bed4d42690a144b4d7fff2d9972b88b0d03c991815451852b7bfe5b0a2375162efb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551c574063fed89e3a421ff05de28478a
SHA19c5bd67dafb5d0648e031c73efa5ac2d0c0c79a9
SHA2569c2d09f6da9a1ee99f33e230ec86d40a4398a392e125ea58cf4fb87d6cec85d4
SHA51281eab76c9b2adfdf119c13a790df33674cb4eeeef496c8ca9b32965e857ed772ad9ddc7d2960d8301748bbe662ce6dd3d6360dffa820360c97021a8e70cb2bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa47e1cf4ee20584e0019dc08ed58721
SHA13313538f1c00d58e52e0c2642afe358bdbb18fad
SHA256479d09ed24e13ef9e8634e310ab07d10be251679a108562cbde5833e3bc0d7bf
SHA5129044af926c79caa2adbf61d700c830508ec7654f8fdbb413c36976c6536f92898754c3b351b5aebabb4778de2ee75786b63ae6de88ac8b6cf488ecf174d1787d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec15d527c700ea9255ba3f43070ea1e0
SHA14c74c654137a3ccf960f166a263c7bc842a3cd23
SHA2569804e9fea17ba595669698958e48a146fd2c21a4604199a951ae49e4c461b1a0
SHA512b5f295495fcdc81aafa51a6877b84c6587ef6530e31f5a1127203844eda84b299308e4f16cdafeb405375b03dde314e5c2da299081817070d733e29c4dc1647c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eea2f93766c76b0e5c7f61b3a0273cd
SHA1f1ace79ad16f8521a5cb720fcd7ebe52716687bf
SHA25680a6c8a313f1bc3d2d8d87764e1a17694e16a18ce18386505f398c8d3fe9da18
SHA5127307babb6af6908be91568b2b8bdba7547dff85b2bd9fe8da044147071cb61bfc9436709ef677f290d736864800a109b460e8bc98a7ed59bc01fcf587a59f878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e67b091983aad0e4b4fa79e9d832db6
SHA1622a52ac7522ce5f5eea237e8f60f11b72f97a98
SHA256c9c1808da34483cef222dd43836926b807a13d5ad06845accdff280af8431281
SHA5128ad3f32c0005161bb2ec566ddb3e5e0e4eda9f1c56b69dca4e3b98cee9e3aa0c7e29be4a5ff0d4aa19565f20be530b7f9cb86043304eb9305d0c7ad56a8ec0e3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b