Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
93dc256fd42ae202f077b2083e5a5a6f_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
93dc256fd42ae202f077b2083e5a5a6f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
93dc256fd42ae202f077b2083e5a5a6f_JaffaCakes118.html
-
Size
251KB
-
MD5
93dc256fd42ae202f077b2083e5a5a6f
-
SHA1
2ede2de587e6a66144220969e97c0450cf7d27dc
-
SHA256
5d42dc56af7134294b2f358c1212a80cd537a9c870739f73d6bea1a7ff744fbf
-
SHA512
4b90e1e42901d6bbf26e66cc986292db5138cde048156ef6965e493340d617504ccd2564233d3157557dc9044d24fd66e45d1e5d97f2bdd081bafec16e7032ad
-
SSDEEP
3072:PON/VxCIax0ew7yfkMY+BES09JXAnyrZalI+YQ:E4BwesMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423644171" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000451fba04ec0f764b8b4fe07578947f7a000000000200000000001066000000010000200000000eae94e41a7fd7468353d669deb5304034a91f2ee85ed47369ef2ce2c046a496000000000e800000000200002000000085777b78dde7b8c03fcde489de33269f88276b40104dbe986156c8611b396f6690000000ad4fed716b255a5e46b5713a93ce1016a76ad7108f7bd4167dcb5befbeb222d9ff83956beb1e934f0b407bb4b3af0cc7b8df063d9d140fe6130cc4f2c24cca9db6bbc7f748a4c33c8efe890eddc8605e17956ddbc026ff34c145af53598c328ac254e3cd1d8803d0b56307e3723ec5fc7163ac78ef3a292643d9641f5ad98493e5d562593333ac82e67a839a71ad92cc400000001d5d46cecd73bb7177316afaf30cb556b8e8f3a1abbd2e051253c50df71237a31930c76dddb2802ae69281cd48add0a2870fa342c5676ef0d7b93ecd552a2e0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D7ABCC1-223B-11EF-8554-DE288D05BF47} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30918e3448b6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000451fba04ec0f764b8b4fe07578947f7a000000000200000000001066000000010000200000002a77b36d3b26dc7911ff2baf0c6f1eee93e8adc07223697105bb2e7e30c86cf1000000000e80000000020000200000005812ed89adcbdd38b0d871708878a40b0016709bedbeaac04d0821775296042520000000914e9de48c0fc6e6021d03227e12232f87043b24987234e7381e9e1e646b50604000000013ade3b5e1d44d6110f4a446ab478a59ffb7adbc27fda9d59d17877c878d04668353dd89657fba187a0ce63b8e418768568b7859805e5bf0b6be0258000b0a6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2144 2364 iexplore.exe 28 PID 2364 wrote to memory of 2144 2364 iexplore.exe 28 PID 2364 wrote to memory of 2144 2364 iexplore.exe 28 PID 2364 wrote to memory of 2144 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93dc256fd42ae202f077b2083e5a5a6f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8cc4e766229cb2788f3a443b7a848d9
SHA1be2c70b92fa3d8869eb92aa1b82f42d7fb1cb292
SHA256d2c82df24939666c708f4eaca6064d40bda8e4ef5edabc0e1c25e46a9ade225f
SHA512af79222768b09eb18593815af2dd3396fa258e479e348aac22e884d14cb22fc8368edd99da37f00145e59145fd65bccac787e4e6948333960b6684b812f0d4a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1f939b83255f324f1289c1dc4880fc9
SHA193a69d267e0932a0af08630a066e676d552deef4
SHA256609fde3eec48fd8aef6aa9312ed8338ec6560a0053433e974c2a86685662bc7c
SHA5129207ad52461aa393c696452bdae5903b9e2070792cf77bae546f43e8ab7e83ad8874476e7afed357498b1ee246a5087612fd4e5f2fd696d6fb77c6de74eaafaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5242f8d2024d791bdee40a8a059aa1bf9
SHA1f65f22c73d6e3ff21ebcf03361cb8111e7111e18
SHA2565799b9650eac6a87693e0ebbfceb3bbe65441aa00b996b84460a4af54494e1d1
SHA5128783fb3ee8c647cbd0be4d2031dfe0c1c8b3798080341513bab0746df11b0bb2096a8169b56724837757f58565a7ec62e912f34959a151807d093c260c140e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2396d890ed5504a6e74868f360a41d5
SHA16e762114c9014b979ea93e2cb830fe280f87adaa
SHA2568ec4004e95d374229bd6c3620423e98ce6c096732b3e327d0f855955b2cfc474
SHA512a16949ba983420be0a3979281e374885554ef6f8895a982ec9df859619150ebb84a444fe98a928808b50de281c5a16930bf8624b007ce0d377f8764ec9309615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e0ac57427dbb0a04047a2218cfdb14f
SHA153ffdfb9815727d94d53be1a6687c27b3ad66baf
SHA2565a63717c469363de374c868a84818dbe0d07b7455528c1beb0c568da06298576
SHA512e0bafc41431e9398c206bac1d433cfd29013d538517bcd069b86499ecb3044b9ab239f59288730c40346e98505e59257967554e0f8d8c836e5991e0f26f4d621
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5939fda0be9cd50a9f8d120e59a76ba8d
SHA17cf78e508eab7c985209fce4cceeabcb84965edd
SHA256b5f203409e635930076c8610fe8877ed63e59ccbfc84e04ecfd7da0f6a80b471
SHA512551afe43eb5689c37f64eaa45fdb83a2e4676cdae910720d92ab5b6c57f4877e9233f743af8e8f893bf6b2159da1424be28179fe6c79b73d910bc018607a12fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bea90325ab44413f99e2e3824af998f
SHA1bb506fb06b190c74ef8ad86ef1b19dfc7d263027
SHA256acc4cbbfc8ceebdccc2aef5910a35fefb2a9f70dd7d89e26f4c8f40196315488
SHA512e2295f5d5e899c1e3b77a6da43b601faf081c1e1ddb7321036e43b27de2fcea29ac4b2d249df68a81d179cc3f8dfdf93a59e7a293ba57cd6f98a46bbc6186125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547b1e405e65faee4a514091f031618a6
SHA19016e2f72be985bcd94e306089f5e0618d5944a6
SHA256850c64a0baadd3f4f81270bd17ad2dfb3784c9beb215b04b715296b956913053
SHA512b28b56abb6145649ea2412e8426abf397989bfe55ce743c1815f1aed36961b58976ea656955dd830300ec81906dd485cff5388af47000cbe714d76edaf49701b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58defc92d5c808caaa0dce6c45694c84e
SHA1ab8de1d1bf04510b71d96e8258bf29211b7b93c5
SHA256c13f8ef6c513b434ec207c02f4bd8e40fb594e52f881af4e60256aa978d5b893
SHA512f2fe0110428924f81124f07836452368dc182865c803956dd61691ccfa8aee58b8530ae6ca9fbdb9d639dd047377aaffb2814648f4e1130f579ba0a289acf3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594fe7398d5bff2a33303d44898825150
SHA128b32e2f2294c3dbe2fe205348322d769f34aaa3
SHA256e0e407708028646f73884305cf88301ac9ddd2c4d6d9cd4b2062f72a9262ea6c
SHA5129800fbdea59976f95998c5dff9253d99ff77a0bc1683daa72c8a7b0c6ff828362b5f63ddb0a357d18ab63676cadace04028e55c14c894bb999c6aca789d8313c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ab5dc982874c189593ccf39faa5572c
SHA1be2b8d17565aa534158ba9a50875321d7a1b3b15
SHA256b899c316f50c76ebde47bb3c60b81e5af06433414a8b595540abcc42ca8b962c
SHA5127998317efe4f349cb3c1a3be439dbeb14869255661c00b8d09bd7864665e7ebdec57858fe33fd40d5521c1d3834790034298a43ae0eff636edc417ccee26a156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f76b18d07f54c4e01a67b3d55e203ca1
SHA12907f8abf631c577e5c730cb03d935d84419ef14
SHA256a03779fda37bef7d3e1b7d4026773dc320ee36f5d10d0cf277dad6155efaf930
SHA512b32c0b15e42ea3629bafa62ea73cc3adcdd8699e43e5820da2c49bffbde07a4ade46f031769ed8470d5f018424fc7072fcf7686f418248d2bbd99b93d0d3661e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587740451137d0b167d4c3184f363a4fd
SHA1b56276e03a37725db42545693d7a1c529d7d8bc3
SHA2567c90976609543d53b8d315fd7d4f87fc4e2c35681a2cc34be60a03c51f39559f
SHA5126550da508535fee3c259a9b47f1af21df9bb4f04693d72eaa20ebc40a041ec6f55acec98150fbeac9bf07f0224faea2afaa84481e35486bd36d8f07eccecece4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5813731af1bb90fccc5668555f8ff42f3
SHA1b14a9e7b5565e1c71c3194149970c26a043d637b
SHA256bde0155286a76b362e2bfc6556a5d0143292126c044f4e1a2b7179d279b53059
SHA5128726c3e602a626db17391bc2267835b5c451a6ba250f6f932cf5c2eec02778ca8b56091e74b76d15943820fc0b0c1b73c59eba3ee643e7de45cce4e11bdad723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039e887c5a7b254d66a85a6134423846
SHA111487ccb816413302d8b41942f06f91d69a89cf6
SHA256b561a7977efe69ddf51b281e637df071fd2463adf44010d350c7ef48fda47728
SHA5122a58348d5cd63011d65709ef353d026e15e18162ce9f37b5ac156edd63aecfa6fa68d698d8a5aeead74058f340792e809ca34f16872123c73a69e7b463620070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5658c10834a0a9d60b3c413c73e59f28a
SHA148bf113948ca34880df72d65a7fa1aba88aa9abe
SHA25685cb5852b6735df8328408ce1b16992fdd1765c731e68e7d5381487c58426d38
SHA5120ceb3ac2230e4be61ae5523b33f3cd22fe848c08fb0a34642d824854afcdc3153c000bb148250edcd6c0c1edec1850e8c7549c559ddf64fe55ff613ca55ffd1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc0f12efe81c31ddc09329e63bee6097
SHA13fa50cb99f135f4d15328aa8d349d229728a0f59
SHA25697b588392726fb63f31d3a259d194630ac50d7f6cce12aba901b3933919c105a
SHA51250cd3c9427f7c0b261e1035eb5fff67501023167fc28f27ab7340ab127868d12c8044ff95cf15f30bfd0ba7efe4769e3882a3db39ea632b2dd4a8d2d79037ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7133aaaf2dee63cc492c77db8b8eed2
SHA1a192e7c83562717980a86955c6a9aef8442bab75
SHA25638fd80961472d4baa8eb4b93f3c16d22ed1c3fed612f0232b9f99a1018a5a6f7
SHA5125a363ebcc99fb798fc4e0732ec41d835b1201e6ead3cd6a1e3dcf37c94ee113176f27f4c75b541574348c5288097cf36239ceddf07b2f282ea194eb8e1e6e726
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b