Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
950aff2ac93ffd0b44c013c17ae26fed_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
950aff2ac93ffd0b44c013c17ae26fed_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
950aff2ac93ffd0b44c013c17ae26fed_JaffaCakes118.html
-
Size
6KB
-
MD5
950aff2ac93ffd0b44c013c17ae26fed
-
SHA1
2d512fafd45fcca624da31aecd9a6b707fff80f6
-
SHA256
e81e7b7315a9ffd2f2e35f8b22600dbda8c3722414e3bc7d6604793454462161
-
SHA512
70a245b7b761020c34a5523ce9f46b7f107880956c2e204ed0b4453a612adf6c20f9ee6e3758c82a2e415b01c41a47bde564bb825f4a1f4983efc615bab99d9f
-
SSDEEP
96:SXKJMa5d7ZC1dUHeZHzqGzGVyjdSq25h2LM6vf3Cn+Ylx:SXKJMa5dsioHfzG4SToLM6vf3O1x
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A260B21-2278-11EF-931A-4205ACB4EED4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001ab7f5b06c987b9b097c1ec12ac06e561c9e19b0f61e399c7039e9e36400140b000000000e80000000020000200000005d52aa3603c4bfa5ccc307792b68cc5433dce766b9ac52e80e669b9cef1145a690000000b07194730f72ba2d05b62322d3cfb4379d7111eb09f201b03e009618738de6f06b077bafacb659aa14c62a446367f7cca9d1923d3e51bc83bdd4df59eb2ca15cd7fd78fb9f9c4d9aafa8480200302a58ec8bd3697b5af72965aad0b5f65649a8203d376461a525328b209db02bed3abaf18727009878256f6f3fce31fb51b73f95e05bf8213b4abe748a6f0951acea1740000000ac487c43c3f713262133df369edc1ee010a1b97f192ebb2a15ebc1d87c8230794f24903bee1a123b6e30c58d44a4e804f7faa6ee4b28837e265611340554b912 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a594df84b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423670311" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000abee887dde3d8c7f7177a29cb434150ca2736d863f0b35b957bc5b5d1db3bcfa000000000e8000000002000020000000848a8ab7717fba375a12b1128c40b443e6e5fe061f670d683fa783261ba39ca420000000774e419691f57df2533fdc7ae324cb9fc1120616dd56d198a591cc5b19d0bd11400000005816a5b17854b3bc8c7adac443f96a18de0e0a81792c385b301aea791446ef3c4943564b5b462839d20851d8bc9d07edce0a46ae1b11a49752181772dde0ccca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1836 2180 iexplore.exe 28 PID 2180 wrote to memory of 1836 2180 iexplore.exe 28 PID 2180 wrote to memory of 1836 2180 iexplore.exe 28 PID 2180 wrote to memory of 1836 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\950aff2ac93ffd0b44c013c17ae26fed_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5697a22df2aa9074c9d497a0431af0c71
SHA1afcf39af87d52a8746fb9cf006bc79d4493f4dde
SHA256b356b175df97cb0fcff4de91723cbc0e56405e3e2bf235cbab9a20b6bb04862e
SHA512278fa2a244e59f955e8cda3f073014dc14832e932630d20d64207db0aa108b05f2de73fea6af2ba7c0e4dba2703aa5fe31856aa1c2d2f63828757c95e4e87848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed69717777e06692a07ead1849f59a87
SHA1598c3af07539b27000071a1b967a739deebc5336
SHA25626a7d523bc91314943507b1f04b9c9fc31352137578d8756f0f63ee94ff1b491
SHA512ec836e9a185593bf8ed2bb5173b63d2b83b3fcf2ddf5f9b2e32d62f94a9bb6af9eb4ed6239b2f793dce79d42a3034cddb515800373b2bbe32ef9147b504f2855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c01b6d7dd35a9991a31be594bc2875cc
SHA14098dea5dd730e2e395deed59ee2356f5cf5d13f
SHA2566617c414413e725f34d7df938acff339ef454ed7de93a1137e9e63c828a07993
SHA5123e58ef6f3b17b69b8b300ee7d3a06c741073983920e3c70c6e3124eb15e11a21e48007cf7a4a33f13f1319e189c4328c6fcacd77c30ca2c2aa6683d3febce66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1b611f4a558f881a33835faf3a2ca49
SHA1cf7eadda649a039ea7b3d65db4c965cf05dc1f17
SHA256d7a0970902380c738f37f926c1785f649b611d6bd4071ed6203a9ef679c70398
SHA51277ee3f29f2a24de30a03632c343d3c199cd8d1ea4aa8d35821f3221be17df900d6ec33de6d2a6bb197994e99d7badc771af8d05d29501812af1afa925295f3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff6303ccab281335cf2fb3c07f04c984
SHA1688ae14ee56b6255a13430f84270bb0bb9aafa26
SHA2563931323a0fef7422c9c2f3f1e2627ee289b67f8870515fcd1ea318f04dbe695c
SHA51205c1da8600737c35ed59c47835451e0ade36e1003e3cc8a21200c4b2ae5e82bb21b338bc48cb1a3789ed2f257ecb33dab86247cef79dff1155d90413d79463b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a21f81bca51bf56943bd463ee43f8f4a
SHA164a95119546316059631dd3ee32cb812c2ae3d50
SHA2562d07abad9daa8b7ea93032fc996bda61b5a0ecc7be2deee1518b93920673e1de
SHA512fb3532f0a3ae75e7b02e3eedff62b3aa7f9ff6943e9d3b4c94ba0ed1bbb8acbdc280abebd19a344cbe4b723f4cdbece7ba0189c5b7f00120394429c51001ebc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1607a51439835af7e7166a26c4b88dd
SHA10c6bcb50d3f12b4b0ea441b1f854df4ac8763259
SHA256e846800ddc879ca2d223ef33b9c64598c60ceeb736f47e7d80e7478d5325ff32
SHA512ed89df5e48847c8b41e3bca9e2f4ce45e593f6a8cf650b7a2936898ecf5012c5d6f0698d7411713a29751ce24d30a5832d2702e0338f0fd80d23092b7ef1e734
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a8dce149ce38c73c53d48af08229da3
SHA18706805a539852e4ad55366cff1f2b6da884ebf8
SHA256b24e4314af17af530f17ef94be2b47bb659456b0c1147fda58f5f0f06bc136fe
SHA512239688bb5e07bbb5f2d56a75cd151d2d90d4bd0cef5f974a04d97e96bb3fec8163945ad8cad7f7b783e3e5d225cb648d90e881860f7afc3258b77b84a3d851be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bc05c101581473ca2bef3d95c4fe8e0
SHA18acc10ec5085f54313dee5ce671e4afbbf3e211d
SHA2569aed1d4d8cf70756249a1ba936fcd15381f0815d6a3be6142fcee6ae671fe166
SHA512592af852da48f250e99c330cfd03b2a8bd9cdcc31bc0d21d531604ba08e683e4bd544c6b6e665e421c709aab7e406e26e4bc517d65121b921aec6f61fd98a5de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f2b62c46553322f11888d0de97e621a
SHA13a4ed04ddd6edd19594ac4fd7f0dde6a1425f834
SHA25669f773a262eae094693ef2949e9b30bb38c45dc40b3abf8ebd1372b3f27fa174
SHA51202a3c00f405065c961f4c15080809310072f1b751015878051ddcf6770c56e89cc5f2a14cbe14400f67fd80c04c362a1383ada7bf3fe3bef78368720942d61ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5992efaba9ea2a0a836c1088b103dd589
SHA17d05c723fabb2fa809c33f0851c4e5d3dddd43ce
SHA2567c4aa0a27151f458ec574799a936d901f1d1ad33d34107b8f2d302b124cd3f57
SHA512a04d4b774916c5c2147d4744ad59546533f44b0e1232577e5b161417d70b71def503f78825ef3ea4e262608d1e6c3b406f02eea0141859df086695c57b00dcb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e896fa9f6c33ecb6523607adf884401
SHA14bb5f8ccb71e6b125fdf7d5f0d7ce7aa59188007
SHA256eb245966c426a0ef3035d1325e1cd53d5497a60561342d49688a6bb42595e8d5
SHA51231438cb879122f3b0064b500ee8c100cf0f9e7c1f337b8436a6eb6b4f80d5f2b32b0efa628f70b00e74388ccfacfcca062fc4d461ea3c8b2796b113bcf08d221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5bd10c46fa5a3fd6c5dc6b439be3472
SHA1729b48c72774bb87c5a7ea68235766d4253d2f3e
SHA2569966ac0cc7d16caba8d2fc1f1f249fbdb0652a588395b9c620cacb88eca21004
SHA5122afe98885e2c1dcb6aca93062ce52253a6f01cc0d53695154e56925edf07dbd710260a3c9f4766886b6d319062ab8c59edf5877db3bc77356d32a3478e394dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef3bfb8dea60faaed14d16a84f8d6a1a
SHA1084b1286045211cf5bd729ba6da47aeb33ac2873
SHA256e820ba07c09edf0d715b4fe36c1b87e60398e455a86ca825b35f81af2db76b22
SHA512d0438a7e1b88d7adff804060a5244033b003fcb4b87262dbaae43d90d1a40dfd2125f3e03f041cc13c2a2e13766c9112e9769be9fa2b5458149579ebbd780543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e94ccb2019a422055a997569927797ff
SHA1db8053179002bcfcb38bc09b070287b086dce6bf
SHA25654849c90b5c1cf6a807821807ea73517b1631ca1413b7407e5c452e4176f2d87
SHA512a5f12dfa0b42441d8ccad473803f663df7851323a75b79081ff8686351c8988fd891849be322618998020246ead3b1f2b1396cfc17f49051311eb1f18d332275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5664693563dab8c62ae1aec4f13f475cf
SHA19b943d3db98990c7843158e3711fe6024c0a1ee0
SHA25668d692ea64a2badb92e0b46289e1a3c36a67bd10601409951607ff4516babcf4
SHA5121847bd67eea57e1a558dc292942b6df1585b6cca8ff578c1a1890f6e40a6f01c086c7df726c0e732b74f3734cbb4f70aabe97aa82b978e804d78ec418e581a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507dfa33015173159ca4d41bd3f36b034
SHA128b58573fe05c635cb541ec552783c0f2c8b8735
SHA25687b9b8a808d252cc952df1b127a058c81c65035e6960656c6177d6879d496d09
SHA512f3b7c7d73609e1692d3a38845216cd4e88a7b61c65661d164fba4f059ecea7e2fe5002aefca141109d9d120d88af16bfe11f0adf4e821b940cd9dbe12c716c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522fad3e2b34f1d41b36659eb0485ff21
SHA15c15be0997e21c3b5d539d4443b1bcbcb1f8ffb1
SHA2560153eb3720813f848d00441ece129588c599b1d6f0e95e1eea7c092d98fbfe35
SHA512071af67f272e3f315c499a4471b9825afd3cf86307ac26dcb667f790157bfe09ce3e2ed5e7d9dce640659f7400a6dbe666021a6820a07fa14c9de7d78bea9a36
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b