Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
9326641de10ede684d81036cf21ab0f5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9326641de10ede684d81036cf21ab0f5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9326641de10ede684d81036cf21ab0f5_JaffaCakes118.html
-
Size
205KB
-
MD5
9326641de10ede684d81036cf21ab0f5
-
SHA1
bef709f829993063bec6c561891bf2372277a567
-
SHA256
007dddd737aac1880e3302747917025ab23b0c062b3bd23b93f4a2fec5a9342b
-
SHA512
a9a4e6456e513616d5fe8ba6a5f14d0ebf0751cfdfc7ba34ac5dab5160022f5e45224b2ea4245cf52ba69a4e90083455cfcabaf18edba6dbfebd1c405998c78f
-
SSDEEP
3072:LMQjLyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:QQjusMYod+X3oI+Yn86/U9jFiM
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71953561-220A-11EF-ACCC-D20227E6D795} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423623242" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009352b07f52a43040a964b9d6987bc28c00000000020000000000106600000001000020000000ba2b0d1ec5cc5ba2443bbe62cf36351f200313b37c6c08e6b725fe5d195c3f1b000000000e8000000002000020000000639f456806a4f81af31e1a8cbaab6746635f7b4946053883766d697e15138a9a200000009c8508b159afd01e497c2f41f28a56bd985d15f5c00f3f445f6ac5329e859f6b4000000097cec506ce9591091f90ae7cb0932562bb293d4cd2ea9097af7dd052125dee240e1af945fe2b2a28d0469731f67d5e7c7616d46822a22cafed7a2ebc306e3208 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6033e54617b6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009352b07f52a43040a964b9d6987bc28c0000000002000000000010660000000100002000000082ba5cb649b69eaf2ffb5fe156066996f24811c9df6f9be095ebd123cb1ae9c9000000000e8000000002000020000000d74d569d6307909618e244a32c5ca4562da679eceae7cc14fea9df69699836d0900000000ff43407612bc55c6c5fd6480eec33384f4fe0729638baa14e5c050a5029c17510902dda37b728dae78cc1e5609f79872cc9d77858f52c89327935f28c1cfd1319b145ab27ca4cfce8d4111d584038ccf883a1651d5769ce11eb9c8739bccc974dbe1afd3dbc9acaaeec90a379d1e24ae0d848ba3f505e8281ce0ca83d5523e3cd77ce63cba95f88f631628e99c8daf1400000003f1548f77af4e4793cc13534c31f4192ca900988e9c032837a5084e1486f2d8fa92462f1f247b5f872da9f713b33607d5a2ca00cafc9467574e7b7d261668bc6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2864 2216 iexplore.exe 28 PID 2216 wrote to memory of 2864 2216 iexplore.exe 28 PID 2216 wrote to memory of 2864 2216 iexplore.exe 28 PID 2216 wrote to memory of 2864 2216 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9326641de10ede684d81036cf21ab0f5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab3fe4f6cde8c893753500bcae8cdb3a
SHA189972033abfcc51fa782c201a6b13cbaa4246123
SHA2566577186785783213c1dac6b3d2390e08ef894f5b73d56fcafb6577db223c3258
SHA51209e9455ccb2f2405ca3c371a6f5cd110e3f3c54e114e693afd4fd63cf15e8ae33c4b5fc0c98bea83516fb5855aeec1a312e0e8de279709272295291b9b2f7bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c40cd8283d9ac4bd35ce49139b089f68
SHA17150882dc320f405e9c38416bdd0538aaadd9530
SHA256a3555423c0b70516650bce768f5d57ca3e51714f3e27409d38f7d557b9a6b68e
SHA5122b0e39c9ac4d5187f6c4af0cc5166d2255a9ca9c31011a735db32ca289d6b2749fcaf9f8aceac271035cbf4aeb0788fbb1afee384a7a8a68af69a6c8712e5b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ae5978efad209278113a7a623a65fb6
SHA1d20271b44c4d73957314fdd92d9b172ea6fc6da8
SHA256a782d69090a7b142842bcbc13e4e25f992fad84b9a1bc12505e7bc39073907f7
SHA512032b94a15504ef4976dd41bc3b76410a871fb7a117fb8bce754803d4820f7553ca46ca3ad45e50031bccbf42901d54a6bc3550e3a18c8f664a97f6bd001bf6fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51268388188d898a9ceb67c8e015dbb13
SHA1ac073ea71e46993fb43040e78146c66ddf41e7af
SHA256a8af870cf298a38e1113ec30b6e194b3dbff10c027810ffa922c5130828364a7
SHA512a4ec2a5fd513d197f938fb6169a26889f2e27345608acf953f0f19d37c5ab2684438abb6417a307d02800a229b0a015d4830dac891f9952a0761a320fd04fb03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdecd17dd07f4b7ef570d37af9fc768f
SHA19dc1c21668e36e1f427daccc49206ad4cf281be4
SHA256ae435fec224041070650110bc4489062ce96983a96ed47a72ce0c8f47f8b81b8
SHA512112e3b5254ef98996005a26767b98ceec5b28e3d6ca87c32bbd31490ed94871a71626b662cfb91c5fe9c464adc8f35ddeebb7e274f36b2904270776c666fd38e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51aef2020931ad03d0ecd894434bcc2ca
SHA1de5f1a97f1dcf87b5ea8c5e35214ce9f77c18ccf
SHA256f26a65acec2fd4556bbfcf5f78ca0018c2afbc4e0e5f9c798994dbeceec02501
SHA5124269462cfe462926f6162207ff261b61eb0aafeea6c92ca96bdf4a6094c16abc57101505025002a7888839e0c002d35f097c9ab35277ab7108fa782ba6bc349c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566ab6e12aa634f3f53242d7d140b3cfc
SHA1ddd011b384c55267ff235cec86ac07b1a5bcb4ca
SHA2569da464ae3e970cbaeb1e3849a54ea2bf15d00d67a28cdbde6b9c221b13f8819c
SHA512c9e8a243d0ffe105a07fed29639ece4dd099208ca23d412fd1dd16c0fc9752e3dfa4783203c4645f30b4590a865d7e76a95c08da06171d054d6b9fa3aa877e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8966c78692e5826f483591f7062ec3b
SHA1b2bf294d709df066f20b1d017a9715a1b97de826
SHA2563d847445afa3809cf864920133c9e17893332ee6fed694b4b485663799ac2ba5
SHA51220405aded3ae48c4c003ca7f1c6e9392cf9f3e47ce106de9db87a98b473baab13a9917322ce342e24984112995e4bf04a99c9d63544b4dc6ed06194faf6523aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd9810ac7343460f3df7c789d12359dd
SHA1d57f0cd5eee63371a65e1513f3e46c5cf9c194be
SHA256bd427298e04ca0390f5552e5842ea1e07e78db0bc1bca49671be0b2bc2eb616b
SHA512b186814f703fcbb000c792893e282e783fbed96283f14c17a5463032223a0506cf82940e8e80c17befd05428f8dff0252a75b721707fb2f91476990780dc9cb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9305d21f266d384d27221b14457ead9
SHA154e61f5a683f8bc8ccc1c6522abaa988a635b946
SHA2560a2c46b00d6e9fc46e4d4cd540971809cc37f1ed80cea5134db6b5a6b09003f1
SHA512d0bcd6434e1e3bb6c933806af6f0ccd2190fc73ff16601af03f7c5674f089467e1e2e2e5df45e5163e93ab08e2af9626c49b4e26e818d1da9c813cdb9dea7125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6d1a5ac082142e20c7027d235718845
SHA15ebbf68ee21f6a9fdcb9d72306b456c2ea2832b1
SHA2568f86e4b45cde2910a181b402f94af6e0498966e8bf66e6405388c44feaebfd6d
SHA5127e10641103b05bb1e742910fdb8d2cc1449871042ac156093c0ae27dcd34c693e4fc94aa2a6954d5922972f8af1c962e25b5f9574e42b3cbe4e077b91dc64400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d581ecbd5a2a5afe69eed81ffddbfa5
SHA1fc33028b5b9b7278f7f682e3ce50c87942401cc6
SHA25682e45b9cc5c58181be31f75e51e1f31645244f63599c39bf091c367f88d36e54
SHA5128c26234eaa04e50e3d9380e2c4c23f303f0e93f5159ccc59ac42cc86242e9effed2e9a7f7a33aa47de6c29edf4580b4009de3528984a6dc8652df3553e90f6af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579fded2ee05156cab4a4de8e3a873b5d
SHA1100cbd3f7de168795ac4eb7e83abb838924ad21b
SHA256479a037c97b0ad5962b72b9033a247cb997aa6b73a89703e7adbf8dc9a36eec6
SHA512577c730e2275be28886a22f3499e50de7876c689497d750b937e7ea8cb01524d7af93e3ef300ea31c4b4a95fc2ab334752717e971c583d22f635676414aa417b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5308f0a5fcd4ba5b9781655e5dae023ab
SHA1be5a9d71b3d6e778557b457f8581e9eae531596d
SHA2564f4e23de3efacbf8d01eeb912c3e4d8c08087dd53152c5d74a688f320d44b3a1
SHA512f20bd99323ced6ffc8d3d3bc5d527413a843ea6c45a0e2fd7e62655d7e8f8bd0352326a6056123f6b3ccbc225158d422a66cd00c345c4f8e7d5017b51dc6696b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a8226055f4b19672b3263c180f6f395
SHA1bb16379e1885350dbe473e20ca7fcc1d4ac30a68
SHA256f066e48605f60ee24eb3b1efef0a471b3a8ca51d2babe7b2d0dc983973fb2e97
SHA512b3052b1067d0679710d681dd7cb2be2d712e5b490387355cd2861df947f20dedb780c9fd7f158697cb326b2bbacba06f434db0ae4310486f258e3c8c318220da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5019dfeda60faa06a2d96e70884737b19
SHA1ec081d4b9c936367b4fb79dbd01fac636d8af023
SHA25652c5dcc4a34810b088e6e8995ffccfba96a6b417e0351120cb71db992050d1b6
SHA51299c629e0d4bdffd1f9dbe8e83987ea148e8e409d9ba92cd21f918922045da875b94ff2ff1d149c98283abb1b542d7d30c6e8d0fc88467b352c51deae0f378986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f232b19edf980fb53380014305bdede
SHA140ef7c636b7dc0426916957186aa7a2ea18005e7
SHA256562dd2640aaacf3f695929e1f9f9303808f482eb1501f5ef38f92fcd23c7789f
SHA5123514b8515ebe68c649900e93252650a159eda6cb7edecd4ccf24a280ea55c208c98b183430bc3e672b6aed0757232f07ac1d800c6516922a7af071ff3ba12d4b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b