Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
9284a414efd62e4cc30d72adbcf9e458_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9284a414efd62e4cc30d72adbcf9e458_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9284a414efd62e4cc30d72adbcf9e458_JaffaCakes118.html
-
Size
220KB
-
MD5
9284a414efd62e4cc30d72adbcf9e458
-
SHA1
b95482f6a6e3bcd20f0509ab92c6444afb208cff
-
SHA256
68839f1ea7e55e820df76c672b22f98cd78769025e2a395aacfecde6f6a1934e
-
SHA512
826f565d98a468612922f037038a303a1a6ca503e953f7ad910b4e7bda0b37b3f3c1595e69e7554e14361acaf5e5afdd469dd638c2fd824a8f04b91afcb8fc68
-
SSDEEP
3072:S/FLkTVdqr1//AKyfkMY+BES09JXAnyrZalI+YQ:S/KWB4sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423595640" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EC14841-21CA-11EF-88AC-F2AB90EC9A26} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1824 iexplore.exe 1824 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9284a414efd62e4cc30d72adbcf9e458_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0a35c6959a31bd013a0d049b26913fd
SHA1c033119552d1ee636556a2ac1dd7f0f28f2d9674
SHA256b7bc3df73f58ed26a772fa1a830541bac1803ffb1ba460ff9bde659b2d43e5d9
SHA5126410ec6ec5ace4bf18afd1580f8da204a7d66dc3a6c8e72ed560b5c5847e3f14a1f9933e9a37f40008300f6133d94284ebe5b28dd268ba8cafb33eb9090ce0aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a9420306ced71f35fceaaa67faa6b4b
SHA1d9f8be528655424b1688ded0dc39f53ce2a42421
SHA25629c9d061dc6918809a1d7b7ea791d3bbcc5f0c47fc35fef0b66bd6fa2e81039c
SHA5128ed0822cd42996f3b3b6ec15d85345cb1915e1834872d718608bfd4e5ad476249cd6e56fcc58e74673a65bc0747744abb9e4ce437b4fa6a0fae3001ac947de2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f539c15f6238505e81dfdfb1195d19e
SHA194cf55ff7cb5ab1fae5b23ef592139dbbde8d7f9
SHA25696803cfffa2b9fd1a1d1d98ed61cb4020a393169ffdd32b587e5d7c13a1b5470
SHA512d77be24d15e3d3747dbe9113192105a2c2a8d6140795a3ec4bf48c0b2dd9f751e2d288848c07dc069422ede25ea5f9835e444205c2f1d392aad8999d0918795b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e0e30dde152b3a6d6a9b7de1d4eb422
SHA13338ecfe9e855a2e74d00041d5270b6e1bea97aa
SHA256230e4962ba28f33aca0128b0fd2fe807e79103a34a27cc3fdc148bb5980973f4
SHA512a440515b7ee4158b6b443b719fb8b199a870dee4a6433e5129ce00312193cb74ffef72833975c7b38751f234fa7aed6e26568d438da1b90c0bef407c2a12329a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9744cc4511a50b5d4ac9d3afae06fd5
SHA16e0e51de15c0f26f2e7f247ecc507fdef6f083f9
SHA256188d6f74b158bcd3797c805928f20d0da0accd881243d687fcac8e1cf3ed3a3f
SHA512e80b5462798793044d5b1de231a67b796bf04e1c716f93de81cfd95beb15d25a804181170e6aa44fddc99ccbe16735e6ba5793c59710d48578fa844ae6fe2af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565ed5df0f0e0c15297cc1dec2421db08
SHA19eef140efe3c82b41507e3404decb47bc4a8cd1f
SHA25647864527ace56f021f6744faa28d75a18b493979c998db8e37cdeb37212011e9
SHA51282d10f2d98eff5c73b6d6c01061c0af9536cacfdc0fc3bc4563ae9685bdff443603d090a3b7d667331bf1c5da6a413b17a0d34595d0c1c40a11c7ac451d6d2eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b73aca7bf84baa64e178601673e58d0
SHA16d003d69176fd10b1a6f822ff476a3ef4a9f0ca1
SHA256aed03823b1e238cb17c2986b7175db9f38ecd81db0c141cf57ad20601ed0741b
SHA51275b362f369c377f768a6da2c57be6ee4b63b59fff1c468e380afe4586bd055e652989df2c672f0c91fade4359b94858e32d5d3d47af1ce7af8e6e133ed1a153d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534f8a21f27031972c0cfb8224f368a58
SHA1f742aac7a4b0b4fa274ceec90d3d1343a07198ea
SHA2567e450cfb917f067f71d16db8a6bbad5dafabf3faa325aa3c0414a6d92678549f
SHA512754a440d016d973e767f8189173928f19d8c311c18afb1df846c3a34b65c007be5bceb9e6dc29e3a068829e5819431ba9c0941685a61c05881c61753b226ee07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f51b0cedb7c339c3a4237c8d2549d0e0
SHA10a5dbc1fbd7e8f31225477b5c2863c59e54526c6
SHA2568a2a3ac0b172a53f0dcd2b559797ffe3392fe6f6067749608b891e70ae5042ac
SHA512a1e2a6902b043c5eb6dc1a12f92fce54290b08337d0e7dd487dc628dc37185a1b6ceebdcad6607ed5068621ad464e637984582ff5ed45863fb34ce2b78ae6d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8b975a9852c19698bd3386512440d66
SHA13fae4a1ea1f10c5e9b76a17708718cb5aced136a
SHA256e96f45dac85c29533cfc61cb74de7ef298a5cc241fa0b65804f6e1cde9cba22c
SHA512c124c4fed06272efa365df09fa8f8711d877b4bd0ef22b6c294824670bea840c45878238b07349855d8a49863971a9b1953415ae7370b3d320448005953ce188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545e56fc7b1cc36f9ea68744572b235a6
SHA11ee4a094c8802884a2ceb5a5f7b20f1248dd246b
SHA256b36941a321e222ae878582f2cfe0546a3880002cb163214260fb3d841cde08e9
SHA512d2e902cfd940441712e37f14c453dd11f8b1e6cc47dea05a582d5adeedd11c69e5341b8fabdc9b4005ef60c8844cee1af40d2032ac64e8eafbc022e738a341d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d64a874f22f4d404d79ccd1e4564366e
SHA16f9c004f88b09fc633819aef04933c59e104ddbd
SHA256c2ba5805cf52bab8a7c60b271954437800a6caef7ad464b5bc56fa746b9812af
SHA512f902ac21d0f67b1a82929eb8b093e7cd5c9932376ecc8ce1e7b81f7339e24bcd12fe90271473142004389856eb090c4bff7bf3e455b53f78d95002526386807a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577edc52766581d8cfa65a21684511256
SHA1a38b8b66fafd6449386a27febf5b28ee53324d70
SHA2565afbd9bd88c68c8f74d0ca32ceeb6ff3b1e73907d7300635edd64bf8dbced025
SHA512e3d1407c2359d68110cffa7646dc6612f98fb127eb36ba14ba9ebcbf1520ec77e53b0568d0db9e0925ec804657f010d9653e33e95c700bb203811576f5c4daf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51db9886611bd3467295c947cf178b9d8
SHA1613db1856a08802158c26a1304e31e2f40aca667
SHA25608a609c651d31d0065d9a8aa4040e1fbe0220f8b5094001c329a0ada629a6a69
SHA512dbe3b6837501b9200753e136863ca15d7f156e059617799878b3b27bd54f885d345758cf2e4668bf7b375e4d097ce45a64ba60651b05a733a971374ed5851bb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b67f496e5037ba7dfc6b4fb87162ec39
SHA1cb443c351635cb6ec8ee5b11fafedc34972aae4c
SHA256c6c08876be94538f537e64c27c067d28fb71dd0cb3d7c8641fc0dec0907e249f
SHA5129532ddaacb4aeff647361a8578ac7321f82e25a8ccf40dc0aea535e338c2670e5b8b2ae373a44e26b6a4483800e889e219181711e2397fe29d5185684ae29168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a18b9867a1187e7999a480627c2f24e
SHA1af3185e5d9e111b94d7d92dc57098f52e4a0e1f4
SHA2569ddc97e4b42cf63f057f017ed864a927f52d467484dcb21dade44bce672d571c
SHA512cfc51e404594d966bad6a88242c43c03adc1f90a70ebf29f40e9f598ae7f9d8fea2c331c936090ba9c7f1639a3ad578c71a2e5d52205f0811bbc30122b555fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58299a966ddceb7eb438a7b0599e49761
SHA1363caf068c3d15de1ed4d4e57d23205fd394efe8
SHA256aef26859335f4a7686f20a5e4d62ea3c921e57fb848bf47e4e1053456e60d4d7
SHA5123894bb7228e090157104510db8f61fc9475185b3106ea7953ac5fdb4c8273dd8717f46636d552b0a566b12c9710fa60e66ffed9e56d3d6e0d2af6d0a06fbbaf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508db67edbb8d46f62617c50163e73e66
SHA1fbf177c16f7385f2bfd65965df832183cf634de8
SHA256f4f7b2d66d1d999bad8366c92364cce7f3ae59cedea8d23b338a3a972dc5b9f8
SHA512136313d6f1e827db749048956f5499f7e786045e1f25a2806e9adbab087ab147b2ec7f3b90891c09acf8e7dbf20c318646edefdbbd4b164d239e080965bb4f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b2fbb22810bdc1800b5e2d658b8bb8e
SHA176c749ab8d426e879ec7883658a19b09c94ed955
SHA256c7815a3b4f405b1ca25b56db18df4367af4e5dd9164a4d1c534ff9c09163ebbb
SHA512ed5df8e5588238143709b571b9cf98ca9c49436b62f7f6f70f72bb653e08169fb120a94153c555dde9c1f92483aec8d941a3e9a03b27419f43a09eb50d4016af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521148ac42358e371cd15bd836934c262
SHA1bd7bdf2909764c8f229893538d2ccba1ef783bcf
SHA2569566ca2c8b7aac659c6512a8481b134911318dd624768aaf239613a20520fcd5
SHA512496071f40327b4dc623bdec102ca02c8108ccfa09b908501e97bc69155a59d1caea4fa3a15066f36230cf2b622ae096ff22dba175bbada08fcf836bb8f452447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faacddbac3a16e40059f9fcd9242e135
SHA1240ae2c80ae4041878a88b22a0da7a6aac8dc3d6
SHA2564c8bd770f0920228ecec06663fa3e7789d491db93a4a87cb91d26af56ed3d53e
SHA51242bc35540ac77df71c5733dcc0a3919ffd50935b3fdcf211ccb5ccef3d0e27fc21ac57705ddc5c6dc10996e51f2a88428056c9b6be9d468081d4a0d182a70bba
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b