Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 14:51
Static task
static1
Behavioral task
behavioral1
Sample
922c66d041d642c06d238aafa6aa2c55_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
922c66d041d642c06d238aafa6aa2c55_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
922c66d041d642c06d238aafa6aa2c55_JaffaCakes118.html
-
Size
350KB
-
MD5
922c66d041d642c06d238aafa6aa2c55
-
SHA1
610e39b54d1dfe808aa4378332499a3a6d1a9727
-
SHA256
e09cd58a717a1353feebbcca7fe43d49dbb8c8654df6181cde0baeacd871b3fe
-
SHA512
454e417753f57b47949f6e7ae891bd07c48a36bd2262820ca8a5d2918de60197b39b9eaf2d25e6dfe22a9024d9da5aa61242fe43edbc40708f2b2545d268173e
-
SSDEEP
6144:EsMYod+X3oI+Y3sMYod+X3oI+Y+sMYod+X3oI+YQ:S5d+X3l5d+X365d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ee867acf6983e4c9503daf685e3d422000000000200000000001066000000010000200000003886ddec9d3818d39c6b66a6b56e3a9baff9852c024ab2fcd7e5a71415675324000000000e800000000200002000000095b2689b778ea4655e132a545c992080b20a6cc1c36bf32812686b32b9fcbe359000000002d6d234ebe3ffcce9e952cac3da6e2dd9931a3770b4deb15cef8bb2bbcbe2dfc0d85818aaec44df8ad205387a88e09e33aca6efba224e8d07eb155f45099f5e6374b949e3ac71eb2a81cc0609034fb15d3d10df5593c13885ebf78ef93bf98e1e65b402945f290ba5d0e2a1dc4ea05adafbd79f43e854eb3353d018b9952e887ac0768feefa4977e262dd53232b80dc40000000de55837b19f7ae2c3a8d062aa5f8eb25b89d021408fea475d28e7c3aa7b6df96bae0344992f32be8be71e50cc19accdf1bbb341a6ef82fba642c2ab825e494ef iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D593E811-21B8-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0edbdc3c5b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423588192" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ee867acf6983e4c9503daf685e3d4220000000002000000000010660000000100002000000043a04475af0ddfd361987a2d90724e3d15303aec1b536dcd8d53933bf6beba97000000000e80000000020000200000007dcac64379e60b643fb0c56c21d7146c9177a5bb60474e13e481e0a42c4d4b9d200000004edb0b32a14211dc9e3ce0e9743fb121cce988896b820b30a6b6ab58baee70424000000083721d3de8b5b0e574fe1f8bfd5d4f5145bf8f6fa188483557ad07416b00eb77db23869ec4aff6dce97e5689bd61377f2de196ff8dbf7bb42123bf44482c95f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 iexplore.exe 2076 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 1056 2076 iexplore.exe 28 PID 2076 wrote to memory of 1056 2076 iexplore.exe 28 PID 2076 wrote to memory of 1056 2076 iexplore.exe 28 PID 2076 wrote to memory of 1056 2076 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\922c66d041d642c06d238aafa6aa2c55_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a9be6a3c73771632cce9f1dde0d028d
SHA16ffcb284d0e66013bbbf297f7ea0e26ef32925a1
SHA256ad61b99849ff9df319f56a3c60eeddda1819f8df14242501fd14e40dfa89f756
SHA5124d34d2fb9e7de15d6ec57ba17f9204246e5c263545df73df7c7fa4d11b371b474797e5fb9265efa71189c75cc169a6e5d0062a413ece5110a064cb53f25d1916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eafcc4db39da3aa5e9c5c48685c1f05
SHA1a64c1b46d973a60a19cec5e92fa5d751215c48d3
SHA256d3ffeb9b30408d88ab4106950de63843d88cba8bc734c767b00477b2437f2e82
SHA512ca35a289839fc69febc23ec9cb6ab2d603fa66a7f8a85299030ad23792e9aa04825c9598f79ed6983803f78918aed9fc995515736beb61279215803ca6d55ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52506fb2a53f31549feff308cb73644df
SHA12804d5d762216313c7572670b31e0bb7c4319564
SHA2562763d9996aeb7474a208062467401deaae55a24430505788f27702dcee295d8c
SHA5129921687d58c17ec93781d4c309e9d03b5be0398e05338bc64d659b263dc44b3439d5b3cbbc84571e22d39b14f405e97ef5eab8387560f593a422f582d1e6203a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f0baf90e394ec42c73b24949d474253
SHA1c250ba765d85bbea2d3bc9379974160ddcfb6372
SHA25668e8b1a03f126d182d252e1a45865cd8b5b040bda27deb5629dd629a4ff121bb
SHA51260d5baef4be975a975e815819467113da604ad1d35bc6070a54ab0a0bf3abc45eebaec57855e1a71891a600055ffd49f65c7588848d2e3c41e42546329ba3f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8ee0db9026ffd1528bd5560c0cd8606
SHA1005c3f76d463bc542db8047afdc2c59213958226
SHA25642aa0e5b79f8ba1f30fbb9158215a20ec4c2bba810c20cfedf7d971e6102239f
SHA512af8db5b4bc328547ae1970f08c3ee0442ff25b91695feaef49bbe381374a6a0fda817beef040501456fdef7db68207db82cab0647ffd03d57fcd3ec47bb11c18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f064afc535d7d98b6d9cfa81bb6cc09
SHA1fe7ab741cb103bdeb0c288ec31f48181f6e8402b
SHA256a882f9e7acc3795603a006c9a7f92ac8495fac1903d679f055d2d3e575f3b951
SHA512a45a9e7dbedd7f3a7d27c276b1e8f9ac3f26000404b94fa20f07d8e813779df4c5737697bf0e2ce8d8176a7ab5fc7ea5d11d5ad7f548102b706031d9622667a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529aeba435ce0a34e2512dca304c1feba
SHA138ec5307c2a561e820efb0786c5e3b63797f80f4
SHA2561bed8535b4de308c480d1e9dd3d598e228577ab969a554251e3706e378c53cd7
SHA5123225f5362b7c93fa89d4016468c5a61a9a21f56c50c9314b34bfcac1fd8bfaff60c280991f919a7362ee01e5aaa4cdfca8acdf60948189041d4e8ba36ac6b04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59eaf2d5fc75c223d2dcfebd9def1915d
SHA13247a81633198c867dabad56eb8def7fdb87886e
SHA2562c078d671c5ecd1156ea76b61f5cd54dd2a2202c4ddc61ed75b25f599908e268
SHA512b635000525952a421cfd293794731d977017832538e705eb7643bb5fd5e861d6e101cc2848d230bb4943d22d327c715fdea230957fdc0f6db38c232aff4a9a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a23d083a687e23d62fb2f148ccc5a44
SHA1dc03bd86e6e16293b3ad2f58ca63ea88ddb2c35f
SHA256beba3893bf458b389f051a888395bf874d9fdc6ac7745bef18fb1efe4e62158f
SHA5125a664191c4fe7ff8a7c426e422e6066be0cf93370fbbb2596859873dbd7be42b86a29f0986a199e06eefcc9544381e75b10aa33630db4e2007d1972696bf7c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54686d82687145b1bd38139796c0e9d38
SHA1d7b8419cff26afded6aada7339bdae05c5e97b08
SHA25683cc8e62e762e8a8421777bbd58520d04e7913b012864ccc172e8cb50998704f
SHA5123c5da0ba4375c208a125bbcb31d5615fb852820163b0f40492a2d7347ecf2633c65b6db6cee4a79e5443bac85dc9bc3985721cf872ad3e6a8c028be1a9330acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f6c688ef5f1c42a6c836ed94f1e5537
SHA1694f908f4f4c7c0326f69f08d46cd21b154578d4
SHA2566e929347029202c9fcbd2d48d5595c636b82c6a1d75351c74624b603ffb6a335
SHA512b56bb30a75ef4930cbc4e2297ea9c40359319271f2cea099667c2cbf3afd10a2ecc55b2094c4a169aa5c11678c21e93a0d4c3c762a2773c06ec2178ffd8c8fc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55846c92b4075241d70eba9e32c4398f1
SHA1d9ba4ee25b60d547256b4aab7e7285d165a74a28
SHA2565469b391e56e43d5a7cba4567549503cea1feba18c2c9f5d2c57beac429520e9
SHA512686434682460e9316c31f012eea0755df3b1ec2da00f7435e3ec6f612e1f180edc5f297a35b0f40c90c3668ee3a45cd7e6814ab63a616b6f25459978d4154956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8d0671da456bafb0f0feb33c929ab06
SHA151982389aa48843a74d138297a1d57db263c084f
SHA256db9d54236d7307fa7b6512f4a92f392635449864e1fb5b6699bea04f8da43f3e
SHA512dbb6a2fc5104f62841773d509348614867cf797e36b3c1f0d68a815054bf325461d2155f1fb78b700cefa07c4a7ae2ce77fb10da7892fc36335a20469e2c563f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521eba5e7d03d53169b2aa2b35d8d7a80
SHA16763f40337815e9118855e379118722fa465c54e
SHA256e03157f281c6337cb4bc81bf635725c97a2f71fa54ef12cd548575a0346126f2
SHA5128c33b04579cd1474b8d1adfb9e85cd2285acfe860448e57fe5258491faaacfb8caf4f0c0c07e6f807b4f8c162a2f62904dd8d43e5512004593a8965753283583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57184e40bbb36426e2a1984c91bc2989f
SHA1e91f653dea1c37c66ac39445bc0fb4936c844654
SHA25612dd8b0c3320b30471d80c30c3689db3ace2298d06b7b245e1f15ee9dc0e3f00
SHA51231a7c278ed6a743e8e86b9efbc3bc289a0fc845661bc3450d3563f82955583e226fa681ece326140216d28122dc609a908db3ea559ae4b643f6b70354f3fa9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561cc373c685e9009442060af3a915230
SHA1ae97985bb62b6d5f264b6a4d614f5abad81d9691
SHA25642e45c198750520670bb53dd4b8df7cf017bd13d90120bc408a07c23a8d9f595
SHA5121f8036501cf44681a11c4d37d4872ace73024c1fdd4498ffe329d98ba633de1ce0041d567d14b8c0ba0010795ed179fec4ab8820956a3411ee75ecddcedea88b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b