Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 21:42
Static task
static1
Behavioral task
behavioral1
Sample
965c25ee136a052c1360c3727aa39856_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
965c25ee136a052c1360c3727aa39856_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
965c25ee136a052c1360c3727aa39856_JaffaCakes118.html
-
Size
6KB
-
MD5
965c25ee136a052c1360c3727aa39856
-
SHA1
db14030d65687f0a57325da93e503f22a2be04a2
-
SHA256
262b214411372c4c76ada3aea59ed8953ac92ccf0c9646e64305383329d45d79
-
SHA512
b918d81d23407cd7c4620de694ddced55fef9e94fd07d1370c0e97b753b9a2fcc35bce3e6bd44c455a3d0d0bc52b0f554eee996ce4031f41d9004619c3b26809
-
SSDEEP
96:UhM3sHf38GK/HU7oG6Sz46bOgGdWhWJ2FfX:UhM32VKQvzdbtGdWoq
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a5579806cd1c37438858c252de0913b700000000020000000000106600000001000020000000c3457c0a35df2a0a9b5bef7431c5b233b89e15eb7eb2cd49e704967c6083692a000000000e80000000020000200000000b4d9afa37c6e82bcf98773eedbe8923a3f1b766cdc1daf48c0aed241bd5ac7090000000541ba8f5618a21ef8d79cf8d0824ce5e5c2c142eb850bcd2e7a4c0cfce752aaa91213e14872ed4da2697d38c74036c387935da388f546e97c92403f8a7f616ef09838901633c30f4b72fc5816dc4f18209b7d31c8d237bb0ab7af18de770b1097d07442ce331cf41b0f1df5c74cbf3fe356eca788ca842cf62dbca3729d83e88f495a91f872a83982f672b4281e3f55b40000000c2190b079c7964e4852948767e2ed774abebc41765be0e6dfd97c28c0954f144666e09e70a94460f1dd5b544545ab0dda655b5e371adc1b7324dc4ef6865fc3e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a5579806cd1c37438858c252de0913b7000000000200000000001066000000010000200000004d906a70bdbe8c58dee5696611c5b50758f5ea31b00fd19316d4357081253fd8000000000e8000000002000020000000b89b8804c638d80e8ff2f1c954fee350988f81db133fe3374e3be68dd4163b9720000000239dcebf447e0d3cb35dbb02b6ac218cf5f59a4f88ed7d8cbb89c0dc87f92a8f400000005735cab7bf6dde8fb324839f18ec66c2dbeab52651e0f19107ca45b4d1a6dc4401826542822fbf23ea0e43d57a64fb179cbfc51b26c99e2264578e8ff5566ac8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f020eb34c8b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423699232" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60645E91-22BB-11EF-B411-768C8F534424} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2992 2980 iexplore.exe 28 PID 2980 wrote to memory of 2992 2980 iexplore.exe 28 PID 2980 wrote to memory of 2992 2980 iexplore.exe 28 PID 2980 wrote to memory of 2992 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\965c25ee136a052c1360c3727aa39856_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1df0dea511db2a85a8becfb51856fe4
SHA1f9cc40f7b55811b0a84a26d66a5a2667ec857d08
SHA256e858ef11691677b9453055628452f1d67db533158205aa46b571d7fd26a2bd0a
SHA512e40506d3f7bae6108068e72434907d18ec5c34757e9f7efd14b6cf16023061e62c067cecd8f6e41fe084ae4b6b1d4417f4bb5b9dd0f15e9c6638b0075d681373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2272e232a192f09cea959df2d55dbbf
SHA181a40f1207c5f82e424432a46b461a145af8f846
SHA2564bfc8a151637197482879cedc390ec39b9fdd3e1945e128db5b4c147439683be
SHA51280831ca53ea3c5a5e66a814fd3aef7b672536c19e181035b072811527f06196737e01f0919ea1ca01df09376b59cdc1a31375bd9fe92b8c9abe1e69fa87bd8b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c465e320e3ab46c0114e101efa1cc155
SHA1e80ccdbe7806ad17d84e1c671ed429737815d5c4
SHA25657f95622a48d03443e8f823993a4a175d31c8d4b75c9d0aa0d039a82ddbaafa9
SHA512aaf18c4243282f6f8645eec83de8ad6018e0dc6aedd72367cb984ab544f91a573f1b9a805abc58b64842b986a3836a6c36f2aba3f32d259656c2f6762a527f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5450c4a2643ed06705492e21567131128
SHA13feecd76a9b706d5f111ef8019e4212886d8911a
SHA2563bd8e753965eea6ddd8f2ad4bf4614b374658e22757b1867c1dfef1835ea5531
SHA51232d2fd11bc82af3ddbf43241cec536943ab987fbe80ffaa587e20baf1735fe718370c6c9663297988f0c635131c40e211b7cad9fdd9c8ce0571b66227baf1587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e292f80955cbfe6450cf9ead01c62a9
SHA1acb8e5eb1970b427c0cb6a962e4ff380759097f5
SHA2560c414376033c9e5e58b206a02ce0a716731a7bb20192d373b0fba0acd13f367a
SHA51212edcb71bc078265e7d614ee36c8f46156c362ef8e6e63c629c90c2aa876e96610b1e3e2b2556df3504e337b5e491696efc39589c0a5962112545aa7ebe2f2c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54e296d3f9f2721782b882278c762f8
SHA1f875fe50491ef415ca1e94839a7ae63112d6ee20
SHA256cca81c9a3838ca85ba749259581c1defa3baf9e8eaa68ea62f3dfcf96b1865e8
SHA512621affc7b1be5a7509efd72d96e8fcf065d5241fc1b96c04a6cd45ee3ee68cb865bd7b4aa585fbe9fb09ab2137742cfded859968cde792b0eabec82ad094747a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1956ba09f176ba0cc5fd0a577cbf9f
SHA11ca0abd35870fc91116a33e1afda425e617fa6bf
SHA2563bc0f8930c5828a60a530c80eaf277a35bce61b10968b3ccd1b333931344c2e4
SHA512e990699d7008137c39d09d15160f62eac464ed19c6f78fe66030bc4c064ef12b414e350282fefd6cf9a7d090fec47a1a23a541b142b7c0ee0466aa36442190fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567a634fd8db6b38e1f80824a75ac3cd2
SHA1f3becea14233e5ba91fb444bcf22a2b3acaf637f
SHA256a6e2b9317c687612bcc26d38a1881e7e13b1f8043733f13016632444c8f6a50f
SHA512319311137d901c63c27196114c93fa2a96d09bbb17efe24c45ca0108aa0f7ca193b24f46c4971a9e9b3679c4d2c4edf13ff701b7625a6519ec8f0b698eda173b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545bdb58d705a795284fb4a04196038b2
SHA18b4cad4692dc2832504741b137dc7f76ba8a7f80
SHA256977bfaf459aa9acf1ae34e962e6e529cb9d9dce8a3e1ce41b9d5bb41ca7411c0
SHA512f49be47f18bd9b176cc9843d76eb9e6e0a1c9d7d21217eee6815145870c339d245ddc9f4967c7b0e946635e7814102b09d84e54cd516c4f30bcbabd6f088bb69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5609573f08d3dd4ca2e76caeceb4ae30e
SHA1d4935dc015029bd25d27f63f751f2d97764c505d
SHA25644914970ef9be598b506f90e459b2d34cb1782b3a83aafbd3274e3bda87206ee
SHA5127c8860f94ed492d11ae92f137f3bba22b9ce8dd8e4eef600dcd7d3e5baefc0f61db6ad8fab3c55c3dae0bafd43566d4735314dfa03fc14925f56c37c3b10dec4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55499768dca3883eb52f678b9d820b595
SHA16ac80fe9432a6bf52dcd9476a386861faa8906fa
SHA2569a81aac68ab8365ac985a393f6dc69a5b220ec33889d3583fde8f0b00e227a10
SHA5126bc00e09ebec61f16f700f18f1d447259ab392a00f124d12e6529dfaea15ce702fafb4a996470329a1720506cb0dd4c52870acc02050002b539274c2d2f3040f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54816aaed164282f400e244e63898258c
SHA1dc826e5b21c0e82f3a7eb37d881e034dfcc8200b
SHA256c8d09043af00be1c31902a950b11fd32e606a572c3dac030575d02850ffa3d08
SHA5127ef4f26b4ba58512b26f6811d18dd44741771eba0085eaac803e837553224786a35d8ab4347562f2d038df96d3603d3d63f6cb1e0ed339fbbcf51e2ed2a16654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596d39d6380033cb2a2a910b1c8b1cd42
SHA1197723e1568f3f26ba4740724026e445b1fae98d
SHA2563483f6061fa28798d4da8729f9df586d482dea16490d66dd3976be1d00fb6534
SHA5122a544ec3185c7f9d0de4f8b54918d2a72d7ea4625f261d7e418ae21b483ca002c0a061f8d2331705b4dcb1972c6d87c680a9c2e349d8036d36136e2ffbe0ba79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a3641b7fe011deb2da8b5f8d3188336
SHA1087d0695465bca36abe0aeb0cde8515a25968760
SHA256424c9a91d4329e837a9f786c2b241ee8a8093d1eb54f032e9adc854f45cbe51a
SHA512edaa0c72bf833801824b2128120988ec6dff8532c0b20b25c116f60d0d7f7c2d50748e6685861151f360bbd8469c41802a41a80ddc07d2e3193db297a44c2514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537ae15028fe5f3782cfa51c3029f78e4
SHA1b68a99134a1f0319f820d2a4538e3d3b5cf0eb5c
SHA256a3775b03d66e31d741b30c4db503418cffc64a3e4a71e22122d862b555abb64a
SHA512fdfcfd778a4301111ced32cf94916d9533f5b7bbbcd6a8b9e74797064ea89c946ac8ac716524de6c7f91cfc9ed24ad989cf14628d731f287ce4c0ba004653bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e3fbba88c3632cd23741f5a57bba8f9
SHA1f3084461de1152fa03ec7042df2d96268fb9178c
SHA2563aea7eeebb83e1bf1b703d32b6bdd55f8e36fc37654153ab57f43074eb9b3575
SHA512a317a178ad0b39399cee5d5503c3eead483ce5e7a243bc52891201a8ae8cd5733eff5316d73f0f29cf577c097f7dd4a76f5e44cd0edc7a1ea1dc17b321154d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff4a872c1c172cacf0cbceaabf45eb51
SHA12b3302efe7e9981066c1101452c6f1a905f068a3
SHA2561a81180ca83fd2ceed67e82d2d8e236e21c9d1478911ae0edaf0b2b367679ca5
SHA5120beb7bf967f74b851fa463f19da6f01c1440bd634b1d58e51eeec978b3fe05c363674df3ac5a41f3ea65842e1fae0ec61bf086c1468de214f10dd61aa98f5413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1b3bb3c11a4795fce1b4617afdfaaa8
SHA1ebd41570f9843644c11b5497620f3fbec9bedb0a
SHA256ea135cbf847d6d2f500bb26a7896f16c28cf977374b6445452aeb1f0d5c1f18f
SHA512b402e8055039a5fb430dec84e3acdbb39ad7f25a6793d541563db29f46928660d81518a2ad2cc0e6ed602d6f2fb1c082c3772bb75ddd58896723c57ea77acf53
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b