Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 22:46
Static task
static1
Behavioral task
behavioral1
Sample
967f3817d3cc9d7a094f91f2fb027c6d_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
967f3817d3cc9d7a094f91f2fb027c6d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
967f3817d3cc9d7a094f91f2fb027c6d_JaffaCakes118.html
-
Size
4KB
-
MD5
967f3817d3cc9d7a094f91f2fb027c6d
-
SHA1
cef068f5aff3b6ee187fdb904eea7b79fcccd711
-
SHA256
a6de9e9dd610ed9568b691e06e15f0bd04da6d60d68ff64ebb1448e2e05d1a54
-
SHA512
5ff086e0aae7fb3b2580b21a5b91ae0c3a4b72aad57f3a9e19c96915519574357c21d5546b1f651045ff05939bcc5ff5efb0066a3d71180429c731c9cb92c82b
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oVT9Vqd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009812049e62ebed57d5c9b3d2436bb09bcf230a67b980c8d1a80a45ec1ec50c46000000000e800000000200002000000066d08f6adf37e2bf079ee2d4ac67011adf60edca5b8dd1c2fefa0c769101ec0f2000000044fcfe355d307f428cb68278df9e5a1216b641bc344fd6ac8dc33d6e505ab43940000000c4e74a9ef7232fe7d5bcd9e250dc667c0bbbc70f446d8472099a417befddeeb527ee449bcbc215d2c269856b6e2e3af8874787bfddbfada4e106493dd63a6e26 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e7ae1ed1b6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000edf4ae52c92de2a3230ea736150c38f64f821dbdc8c350703211e269ae4124ab000000000e8000000002000020000000d6f54c6a08a5ea3dcd3e9482c0a3f0b0afb6479b34543558a202b9eb89591ca59000000095e4c32d042a22822452b1011e443aa6d5732980e7cad89b64b79469ad1abf04dca0fd3912a3bb9008e4d8718ca4746a1211b4be23e208554144f18bb483bc699644c125af47f5cbacbf2f899cc8296badf722bbad9fd2091563b0b3c5f4fb83659c65870a427c445f4cebdf00cc6aa8a491dfbaa8ece215d05eaa092769296bb2a48cd620c363cea2155f1ba54df7164000000098095c8b961ae7847cba607deed1842c980e822d60c12313bf8febdd97e7f0cb3f031ad1a48272c201eaf17c7f6905611169f98e72c6bc858ef2a9e889f6afd5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A13BA61-22C4-11EF-B5B3-EE05037B2B23} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423703059" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 992 iexplore.exe 992 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 992 wrote to memory of 2720 992 iexplore.exe 28 PID 992 wrote to memory of 2720 992 iexplore.exe 28 PID 992 wrote to memory of 2720 992 iexplore.exe 28 PID 992 wrote to memory of 2720 992 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\967f3817d3cc9d7a094f91f2fb027c6d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53547d61920c37e3800cf7006afb5c659
SHA12f9af952d30f0dbce6f0144577c05eff22a3abd0
SHA25618200706a6f803faff4b702475d0ee499fa0b3475aacf2b3a48144ad0ed55d9f
SHA512dc3b32a853057540863284c8f6a51cb1b9c35fa74ababf916b0bb70ed8a616df76466898369f594db11400c162d846d696df4421549472ff7dd1774a0c08cacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5032663c96318c5a2e2ab65483e277fde
SHA1ac09450f0caab69e2e6479a9b9493d6e2c46f519
SHA2565cb27e81d6ed7843fe7cf3c86688f68da377fde0a440ae6007e3337507e5ae42
SHA5121373055a923dfc7f49c743350020672c1f6045f5ece2167397ac169d4b4707c136615f5ae381d58046a62142b5b40dcb694e319cb180c2a3d70b10a650a49f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acf6951af6d150c55e82a53cdc8d32b2
SHA135d687afe693c16672c406c89c15d7cc92a765fd
SHA25645ecdcea5aafe53539a134c8b8432134ae63df970f5e9e1a3bbac046036f91b1
SHA5120947532ed5f6735c2a42f4052ed7ac84d30fa4a642c838454fec94cc62639038741a27d27dd42904a6a61ac5ced377cc235a8ed467447de3921377af6eaf9332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c1d4b9a4dba038c309efbe2cd5866f
SHA177fd417fc552626be62a393f3f8057cdbab2cee4
SHA25660884f05d9d9f156050534abfd574195d904645d9c889afed7f5f0a8c737655d
SHA5124af13103cbc3735db07f92fc471009b1005618adc3da0b8f2a1d2b144fd7b2bf7df0b08f02a63d8734facdafc44189b3a93c527ae45010b3d2a2dede53e0a2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b75531151e4d3dcbf9714fcae2603817
SHA1aaeec9657fee292765d2694d9404f86b019146f9
SHA256aec226d0bb2bef813d23628ecc80992ed0d206d9125d6bcb623237c2d48a0e7c
SHA512a28ac96c549ad691c4e0369819223ecd2971ae7cf81a662a8199e963328c87406c8cf8ecb401aebd7cefca7bc15ad360471e47490485f063ff9ba0cc24ed1e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f6f3e7c9e821c914114addc1c87c513
SHA180fff56a1ad3671acd837c8702d8077841233ad8
SHA25605968e0f99088c0e81ba49c45805547899678c07417ed9fe00831b1b6af1f2cd
SHA512fcaae2a1517cfa7f05e4121b98344b319b3f9745043a72baa44122f4a06b3a22b42c87486c96a258fa8bb3c962bae0ed0791525ff6310740e42856c10768c8cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5421456a6d8bf5d11aa0213982fc40e07
SHA19fd444d1448f19d8efe3c91a674054feef505b85
SHA256e4b9e4fadcdc7901c33decd8c8380853fcd7c7cca9937c408a2d3a8f9abb6528
SHA512450dc4805ab91ee3fa7cfe5aa1283d02b194556e3188f2d735e0df223ea925cdd49e73ce5ca5fc24b0cdacc6d562dcefd9d2b1443e09da6866c9afa221503a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb17f3f2983f39aa630edaeac888d706
SHA1239065aba89eee602ed53702f27ec5d32f7a78ae
SHA256546653b5cd301e9f3dedc30af25257142651674bb1a35cc22b9bcc5f5d17c91f
SHA512c41747cd8f2e6f3831aec5453d32783f1d0a318afee1dc007ea01ce7a756cc0d7313e1f161b275d4876fa9a95c4dad1c444d4c1d047ad4b5139075611c26e268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5121a2163336473277fc0c26b62feccbc
SHA1a0862c456d8a813d4e7577d568f9b2975e547919
SHA2567f3810275265131e1bf1967badd794d57218a83015d68a1d02a150a25e1a25e1
SHA5123cc1581c4d1399af79111730750d90d47ae1a5a2665bc25bca1ae184c2d073140bb287da1582ba5243ba01bb12517be65d761091c2a0f89fe23920a626b2e8fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff6f25f92a7d81104112f83087e8ed0f
SHA122657289351fe89460976399110de1150f7bacad
SHA256bd55962f8084c4771c803a96d9ab2b7a45ca22a3b14606f017358567f50636be
SHA51206fcaad31a649e5937589ac0682fde5f2a31f476542fb7bf73c8e28f4cd580049c476bcd692fcf2dc895bd0cea60f78f0453086a88a5d66b4b28eee0643b9a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a17ad3c62309498bf81a5de0181e22f
SHA11e474b6d85636331119bd18c47c022c1386dd52e
SHA256c297387e961caae2d8ccd95040895fc00987d8320cf53d2d77317aa0c516a346
SHA5126b02f8d48a25a84087129c00dfdd5a3af0be1200b7c6b2b3ed6abeefb67e57e9d9b497233f83b8d6f92b952694e259312ec18a2015b3e2d18bce27e4eb77b36f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b52d9d64a15d4d40b2a72abb02bad304
SHA11c004941bdee15b4b468f88470272be0ea3c246d
SHA2567627531054a0f7c52dd1ed024c0be09952c8413c55d6a6be50939ab65879f5d9
SHA512f2e6216cf8134ce3daf567232e12b4f4e6b687b527dc020f0783428799175aefc7f3589b56281942184895374cb55b03178a35e9e0a03e518814d3427dce89f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffc6b40cf1fdf8683db50847f77cd793
SHA1c3e26308a85a6a8b349f01166892d4158705724b
SHA256927cc41d8d2e6b9b4a1905abba4f569a01d221d2d3b431e11c8a84a0ebd52857
SHA512728f916802b664bd15d628c9ae81cc73d54accf387e999940ec85fc162c823313dbc899d5813dce06be19c759c3b123c0107a243d54860dcb88906a6fc94fd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5834c42c9b557eedcbcea5dcdfa485495
SHA101e02a3ead38b002f74f96187ae9bcf069150602
SHA256fc0b64fb3da09f26baf4edb566e72021aeb6f1f97c36cf780a1494368b118c73
SHA51263e16ff1ebd8f6fd57362a5ef98135a75e47a1888f2315a71d5a3cfd99dc46ddf86b22ed64e48747a33af3a84aceff8b1f26b20c45a74c1260ab2df77f26db83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e858d8768224d3e210611e1f6e3480f
SHA1e9d166b21ae3aaf55565218dcd624553404e7d47
SHA256ef4b4e22be635ee82e2476222a456c6b71fbdb36069b8ff0beb52a0fb83df21b
SHA51285dccfa6a9b38aae07176db11c56310d068aa9a67fe60975f1125e3f31d3b954fd4f4e6998cefeaafcfd29ac49aebdbb93fb58fc9bab5df59652855d2aa37f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55afb8f7a470c95bcef982712a6d9cf09
SHA1cfee5bf6ea715d32e6fafbab7e2aac293a47edc9
SHA2561b9dcba99d85d0045e3b2c4c5f4bbac63a62fd91495e7a4a2c7ded293c5676a1
SHA5125980b495ef6519fda3ebc6bb198be4bad8f8214e1093c6668eb36b9577b2934098714b244d213f327f40b27009755886e69394a1308ba7d631eddc3f05bb1213
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0c41ba6fbbaa48b070fcfa165897bef
SHA14d039820e312b517ebcdf3cca0867a10df6e0bb6
SHA2561eb6bc4e8026d745a6937d56e8b18624c5ace2bbc11a2c143ab1efe534bbf25d
SHA512987f2ff476696fac381c1710acda977c0ce00e0a0d96508c5d146991586bc8b7e3bd6fdb160ad209141e5297e9c9133c3794649cdfa239d4ed2f7a76122d8664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554a1b99bc1e1ce3765a175f4247d0fc4
SHA14a5b5e7fbd1bbb762e1b2c02e2ef4e3757078207
SHA256da7dd67d203da2a15e80a838e08e7553ea261e966776461fce8d70ff230fccb8
SHA512d788976f1763f942646970da09ee5d591b7759e4a4737b474ac6abdd49f688947d83df949d986f3608673af8aa498f02e1ae006eb5e2f1dbd1182ac551245481
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b