Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 14:03
Static task
static1
Behavioral task
behavioral1
Sample
920d16df26ee14d2088a0774eaf6eed0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
920d16df26ee14d2088a0774eaf6eed0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
920d16df26ee14d2088a0774eaf6eed0_JaffaCakes118.html
-
Size
13KB
-
MD5
920d16df26ee14d2088a0774eaf6eed0
-
SHA1
e482150d5dd00955bac672f5a17f32117cdba537
-
SHA256
6fcb2df547ab60c3061b83e3a1b2671233c0a1a0c5f4b1b241dd82334dcc59fe
-
SHA512
fbbba295b81400fb5419e229497f0f064173c0c94d9ac3c31bcf50ec8458ce4c6e0258ab2e00a5289b12e9945983b34fc26b30fe73257295e2b57693a2a65207
-
SSDEEP
192:CyiYr1FkhODdjbXi6vzrwQFCVCf733y1w3EMy2VNwcdX8C8aW8/SzkYeg7:CyiCEA/RwQFAi7ny1w0My2kcX8cukm
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e0000000002000000000010660000000100002000000006f34c7b98b8d627b6545b88c04fb669aa3fc094f1a1118b88f57c5201ea5b54000000000e8000000002000020000000dc72fe2822dbbc9a1454868a43458c052751762c9de65776f46659d4cd28c6f39000000069cc5c3666bc92dcf6b7c38a957baaa92e416e9b6594815957da497044771e15a90ffd9ed4dd98db68eb43d646dfe6ce7a71dc2fc0d43eb48782f54769a46c0f0abb1297b765b48a7ee3454c544a6ee9a02999dc9809d8ff1647da6d300375811bfac4788fe415b2e34280cd10305e024bd6fe7a731692e5e4aec111a6a2b20ecd5fea707df167c7603d05b9f7c1c4ab40000000f7f84e824906e17714d8b85df4c75f42d8255b85fa1cbf0a54f0b5479a9810fc2b1cb2dca7009204a820b8e3dede909170365c1f80ce18b06dffabc57161dc4e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DE44631-21B2-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e00000000020000000000106600000001000020000000dc2a19e504f9e1b65d62392d965d31b3d0f7410c0b40a18dbe9fdf14ab924d8f000000000e8000000002000020000000b9d85d4f754e4b18d08cbc51ffaa8def095ea1dbbf60f0ee188cfd60628f868d20000000dbeebbb613a91d60f65bd76c5ba4a9f16188b65cc9e4af61ac6c783d9bf18af74000000007ef0954062e0e083706158d50194074b6564355273c63e15af4abf25a9235fd5b91f606dbe427cf8e4135984070c510ed40dcda1a0123dfc72b23fe4dfa02b8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0451be3beb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423585279" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1536 2696 iexplore.exe 28 PID 2696 wrote to memory of 1536 2696 iexplore.exe 28 PID 2696 wrote to memory of 1536 2696 iexplore.exe 28 PID 2696 wrote to memory of 1536 2696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\920d16df26ee14d2088a0774eaf6eed0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e95e30d7beb9654253888f408bbfe4ed
SHA1df9976f7be94046263c7df87626f42dfed017fc7
SHA2565586a6fbed3f897bdf8e4052b2dfe706be34c91761930b66440bb848044c344e
SHA5121528552c191ba15358ae84d9cf470ad050cf6b20813ca69fed2919ce0bf528e51896cd7ac0a0d6625b36057213c381232c291c1447335a6326179b69b6a8987f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f1d43ab014dafbb313ad4ce94522eb4
SHA1a41baa35b0e54aa9f17fe2b9ef1df983b205a7de
SHA2564cb50b87c45ca31c182e57f707d6fb64d7f8f8085726b9568bb0c53b249e718c
SHA51228143543370889692a7daa66dc0527a60b32444d32291627df9ca97f63332b5419e112cb4b47bf4da9d11cfcf3f18a24a213dda28ca7997b2a9d9d2a776e606c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e37c2ebaf8228254e9843d3093f332d0
SHA1b18ae9c408a2ba03cdcdd9ca9f6d7bc4a873e468
SHA2562bfb8192cd243afa5099b6b83b01b22210da2511e11a5704acfb02171b99e8e8
SHA5128e1f65f10ad30ad3b62019833e65421b334288559183876e6915fad805955ded02c7180ebae5e05a4cc56bb35a3485f947440f28aa89eb5a04682ef037bbf78e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b8d3b89e601995c9b1ea58474bd4583
SHA1a8340d2839ca1906af46709d177eb4fe6c67bc54
SHA256f665d3f327ea1cfbc526be86d275a5e89507b221a0795b94e66652f7c54e33cb
SHA51287cc9c52304ef555fe4815e8d8fa38d84eb2566ce5790bf2634d09c1d71b1ad053cf101990aa97205467c114d15f1b0e73ce443cfbfc752d5b6245d0031f9ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f67fbb535486d65b79bfdb86c06406
SHA13277395f2d36edece21137c57460daea4a6da5cf
SHA256f1f3bbbc892cd9f5ed103681a9a19a087bacad62411ac13c15eea27b42059014
SHA512e9a52608a8d21537c1d3476852c9b2dbd3851f1a7456097288eae8aae386eef04f50d2379ef015544caaa018c05a7d2a143311a4c97327aab4cb0f791349670c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59375bbf75ab847d1ca4cc6b2c721b8a5
SHA176000864361065c7e1b6d62dc2334bde0463bc5f
SHA25615cffd8f10346e9716ac58c8f5d96b9f5247ec61a1d97dd3aeceadb402e46c3d
SHA512b9965e5bc05eba85e955c78a1a8dc3a7a831b02c3256f080841e16c72e5bc4a14a539e4965a70ca131b0d762069868993ad26ea89cf4023bc6aed09b46600b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b891fa4f7ace8485bdfd2e14abece80
SHA11f84aae9bdc32de0119a49f01361ed9642494645
SHA25607ff7571fa5768e5787a133092900a9a4e30150c5754a1fa326601c6b95be2e0
SHA5120ac8101345715da3230af8eead8712c9de29c7fe7274a384f6c1aab1206ff2a21b96093e494c24a259434c86e60e5fc3f1ea321c03fcd6d27f96dce69186e73c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597bcacedc3e0286b5764cab9434e54fe
SHA19a17c5e9b9e8cfdb861733e365a1aecea8fd8b51
SHA256a6d4bcc9b99ed2d15085563f08cb0ec72457daffbe80363f06a5e8986c37520b
SHA512f680e957a01165907b117b9340df625f7b148a9cb8c2a182f6967760d678ca07c06b9c9d21f7fb3b275f794f7871906a126ad2afc1b49667e2ebde885a059c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4b708e1cf5a8509ebc7cd2a179047ab
SHA10eae72a3bbe5c3c78b08c60a88d993101200fbcf
SHA256c051165728bfbd9d964c74942a881eeb24a7c57975f9c18033a633a632fcb543
SHA51236639091a4cdc410cf95daa5e7032a36aa768a2eb1359553190a1b639922cdb0d85887515c293af2eb2806547f29b1246a3d2f78d96bcff00dad7494956777c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585431f665fd612afcc5e3b8fb18bfa8a
SHA1ceba22fd52a40adcc7d87cfefca6bbe669a47f58
SHA256d10a087c5a00d642800a468f5a1ac1c81570f1b2d1c7403241c287a86a80330c
SHA51218dc0bf7d1d970a0ba5722416a12d2ad6c5c7b08914f15e74578b271b5c4a1bd56cb89edec659376fac94d292e71bf9ec9f9bad7a2ac18b382c3700dd5efab58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2c3e733b8fc5de368ad74078177b85c
SHA1a4cd2f0a5a5757afb661db4995a3db4a9c47f10b
SHA256e42d0b8b41aeb544d2a00b00727cf062510862136364458a3d898c2ff0376dfb
SHA5120f894b1b1524f6cfe9e047b068af4fd0e7956f259bb934224a1e9e74fd8b232b24548d09da8f45158a565c3735fd7c30155959573825ea0374c3fd4075412261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5089e4cfc88f88f8698c2a25dce725078
SHA1dc5b16054ae42f0de673d34b79bb7b70d6d56fc3
SHA2566966e64906d3e09bedd8f902a150fe319bfb37f256dd078446b452217b94dcc9
SHA5125da146d460d01e0af3b3e7eb110d53f351aa1ed82e146ac5b8c3b68bbb60f63c1a3d1b8f63186ba89abe798a29af0dfd357035eebaa15b70cb867a18a95fc41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f3b10d1ff08ed07c9f072c59ef207a4
SHA14986c72ac33b2fc2efc95b9c3961c1e477ab35a9
SHA256698406eb2b045e7b6b05c8f745754fbbd158ad72bab8bbb101a39a3a5dbfa693
SHA512434a5322a5910220fd0c6ca158a36ef308fd5e789d8b672ffc3f1ad6324d112f1556a91a51afc4fcbc6bb1f720ca56e4967694a37f56d78e28735f59319ba1da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ed2630bbaf27433b757720d9b3f87a7
SHA12f2cf98f9620fdd1fa2d8b41f4492a7749025053
SHA256ba747afa323d82dca3053a4b3a494ebcc990fb761d56870fad1025410d0eb443
SHA51245f20d26990862818b960e5be7c8ae00e2128aabb478ec587c6a65eac208e43deebaf0f983947ef5258234490d4be10eb8eb572945e4bd610f64696a8fbab700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ef39fc093735ff757530af5dc3a1b0a
SHA15e8428c7e86d5a38bc4d1eeef859323f76475b37
SHA256d759ede1d72182a59718cf489bf61bb8c0ad43e12a7176663c1a179f9bdca4a4
SHA5129416b7988a59811e5033c584f35b004fad8d7e75185f0d93084ce8bbb5f58356f4a83ad839a8b1847109ff087219bdd4e0e1808e02c8f3cdb3da57d4c6336ea9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550f744228f5070b771a0b3a7f599c50c
SHA1af7b12de38f82ded0f551814b48d76f1884f7dba
SHA2568c7d8310ce602a5ea7d559ae3ca8337795c939f9afc007c142e18c35d1b3b8eb
SHA512a44711843f61849a3fe89db99e1fbccfbc69396872e3aa03bdf2d8516455ae3553c74ee1467016afb54e6667623cdc1fef4e696edf202286a416cb4dde4c4cdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5122cb0d135e0464b24aee43d4cd6709a
SHA1992f653860905f416cce2f65cfe4c759aa2d8542
SHA256f60869f1302111d7229de9ce8e6f6b9a1d7f923a6c981d206ac13031ccf2728f
SHA512defe05a6deea622de9c4d0103ddedc2d8fae5314b5ce64debbfec0f0802b14601af1487c54bd5d46cf9bc999260635e4cb810caa5514abff37a31184e47ff612
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b