Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
955743d9a31e26f4df81bbd608d93ae6_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
955743d9a31e26f4df81bbd608d93ae6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
955743d9a31e26f4df81bbd608d93ae6_JaffaCakes118.html
-
Size
79KB
-
MD5
955743d9a31e26f4df81bbd608d93ae6
-
SHA1
94a73e16494b236ac412c342e49c3ee652be746a
-
SHA256
f8052655ebc60563d222bde4547ae3e86fc5a9ab90c0c2de37bcf19889c49a8a
-
SHA512
5951d4324fa83c1dab31f1e8f52918cc679b016f4b068be76ee3459d66f58bf6b315be47171170f30cf46b3c31dcb94d1b8b972ef61c1b8a37b93c3b32eaf5b1
-
SSDEEP
768:FlkDgOriWNcaSoagG0kC114rrSOun2De6VSZ3zFwNTTtvG29rMZj:f/CkCrOuKSsntvza
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FA0D211-2286-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009dcf7cd55094b1c9c9a920a583461d254fae9fccb78f5a8431e591c0f6bbd514000000000e8000000002000020000000167e3773d0b3aeaa7a112e90115f0cc3859f2ab877acb0441f4ad4f03f016fba200000003806485d73dd03533af9b9559fe9479564be57c7af4ec53376c645a521df5c5f40000000c61e0787d10fa8cb2eb7464522919cb0536a3843e89c1f61028150d6c38e1bee47d8517df84735bc387b4a1186ac226b5fab1db1473f2a00fdfe72bd0a80ec38 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007bc09c60fd61eb681744d4d170aa96009e3367ecdbac68bb5bb41e8766aaee8c000000000e8000000002000020000000d470f12c3fb1d984c3ab59288795f6ef4ff83c447576a725e54d0644547073ff9000000093159599c1847af4311cff2b085b0075d9457fd7f7aced36970ea100cf597ff2eeb510083fee09d14c056422b6325ca327554fb36c92c65b54785d5ad1e0e9b2dd1d01b1620dc8af00ec87a4134a8946d71ffa5360911286a7846ad4ff9b79c93f805fae3c0b851714331b67182d5e0be95859234fb0f64dc5621345d313b5ac2a1f0a3b9160659aaf02863b5e63fb1e40000000c092d7492600b671e74ddf4c6394f44e695c97acc677f7af7df8c2f98666293d7485defe9c18079cb30783b325b5690f4a28addbc3f08355fd363e33aad783d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ffbbf592b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423676361" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28 PID 3000 wrote to memory of 2948 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\955743d9a31e26f4df81bbd608d93ae6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD573a4503a3564112e44f3aedc8d2464db
SHA1b5051468ed902c8ca8a5cfb679fb415fbb5fb2f3
SHA256626f8c5c2290d964f83a1b8170ffac704840c7fa92e3a873bf2ff2cbe7bd8297
SHA512ec5aff16819cf6553a6e862dabcf094e2106058d97f32945d99744eb284d3c6a2a277233fdc267e229847f04383be09f16c3068d0891a0560a1008bc7d093e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505eb879b19f04acde913f407c048993b
SHA150a06d6eb5978c5f77b140809b80743d3d373df5
SHA2566c85c0e3f63b79d3c2e0623e486e49140250bcc99b9e29707f9ea4203d3bf1a1
SHA5123413e9fbd13daffbdfebd936290bd1302594bcfdfbbd1fbd9ce142ad18f37947b85863e3df44b48c96966ac7fb41beca65b4541cdf0bc7b0f50d0e4850f67bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a714070a24f8d71d03d4513a5b8d40c
SHA1321adc8e7554d54fa1acacff169a7cb6b92d7c38
SHA2561237ae1354a3722ce5eaf8f47194738a97bfa82a92000a127c3ecad9e72523c3
SHA512a78bdbfc8987b035dd94d181a29865799740f8797574b2ae74f103d510fd10ff61e5219983d448f4d265be65b77904e4bab2dd5c502d92a9826ae889743d4db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519633ad3b43e8505c9c6c15c590cdbad
SHA1072f40f9a2f7ef85a8c6aa53e43b488af7d15001
SHA2569c0cc38318efa933b7d39a9cc289a89f985979a5c015cd677976e7411f1ac1da
SHA5128b116c64a5daf48b28b9bbcaed91b659b71c2d7aac2b13419ab5c4c891e971547b976f3851ebbc19c40bd523ef6c1fc46c684a7c2c69cf5dd3e6e79f55ae0e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502a125e9c53e5f985c639ecc27226c3a
SHA18e1e674c65dc461216fcfca1810b1b5631931629
SHA256f38afde80d22d171beb9099a9022120e68bb8a8d14aa11ffc73147a591c81b1c
SHA5123f98a34d5ae436552b25bac5f35951e8095324964d8e853a26b6a2f27b72e171aa55d8386bf12599347efdfa22fe8fab2cc279059d2a3b5a8b7daa1669f190dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb0616257f64647745796ecef421f515
SHA1ac33a90103a7de17d24a3a684258cd23a5def70d
SHA2562c674f7a43f0f921881750dc5145049ed55e4891c6941b87d7bd7ff2b9f58662
SHA5123cac1178dcfb920d9a8c9d187389e6c1a2331445e4ee9e06668c3c6e9c40de4fc61ca8728272ec1c7b5e34844a65609fe158042017f8988922e671deae3e16a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a34e6c43404c0575eb3d47a3a4e0202
SHA180a5dc1b3f89ba62699aef8730ff824485c8ab3f
SHA2562f8e6a667b96eca59dc18984d2973621cb4e8a660b7b3b9b00fc42f390eb87ce
SHA512ed868cd0c92cad17c47b2d229ba2838e490f36cdf0b2ad2797cfc14b013d03979f965140ab1227bd15ffe87772cdafa592cd434881e6ba6da07083199fece2ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6b248c72622d0eea2fdabf214cb190
SHA1091d3e4f204db36e0a14c046ee620cf79e686f8a
SHA256440681f3c914202572fe556eae5ce73254f5d2fcd100dbbdcd192123af7f26e7
SHA5125351237db23adfc149bcdb6c0608e8750a3d6dae3d27a2b190f572619dbcea368611360883d46c78a4c2271a45ea0bd1c71b5d536f3125c20eb805c3752f41df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db45dd7e9cb8ff512b5a6e320949191
SHA1d796971bc28c7c1be03ef834f5c9482f6f37e525
SHA256338c04cd233bd3665adfffc7f4d75e3ad6670d07a0061193b945f9527459620b
SHA5129daa189a83ccaf0319b5847d7164e058edc03663109e8ed0776f094c4a0267da580961b00aabb73fae1cba9ac56a087f17362eab321e033420331822b3e86199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584b6e726cb1f3dc90c8f970a998b0886
SHA18e3dbb7ea626fd825c487a0ffd4932b1614c0b36
SHA256774013e9792be21f0c917974a624d12434c65249286702a479d9229a5016365d
SHA512bec92f010b2c8df5a56e24971f234cf5d7b08f60231553f08789839efc382a3eda8712cb4421b0cece381fc0931462e1f270f294f66735df2c54ea1d9552c80a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5dc78886bb863df4d0f6b73588f196e
SHA1d5da4a8056c1785812b01696bffbba461f963869
SHA256c9e044a2a9f51d9025e54d083035e0819fd05edfd269ffc9c75fb87dfe33c32b
SHA512113d0974fd0955f2827d3fb81d2eed54b4871255a3888c74eb1ca3534ad29efcfe153f5cda0f9bdbe3adcea8b4e46638f32f82f9e60f36eb3817ef03104923b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5afaa59672968417c4e81a08f69fb7a
SHA197aabcc8c5a7d59db59af918918ea712c4a3fef1
SHA256c19c98216e817fd5658b71108946e2a8c34922a7e5be113387ed7731cbd06d8e
SHA5127360dc2f02bd7c880ba8e2a941add0f7456353e600826fd3fb3ad6fc65b35db1d505d281530e01873ee75d9072a310b4ae170a07cdf881ca6fac9b08d062c857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592213d3fa8e72dce51309c4bd6ab390a
SHA1fe8114c0bfa3cc724bd4830782f48a6b4c2cfcf4
SHA256eaa26989d917eadaf11b0bc414042f180025448d94dcb158f2ce802b7311222f
SHA51210d80f8a6cc24a9cd9b28e39d4489d7ccc2e168baf01c8ef5ddfffb51e89d35d5b8cd4f2a3a1dcf7bc1d0f00ee154013e8c9bc5c29b88faa6580ef08c9ba0365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55aa530d27a1afcb2548aff9c52a50b1d
SHA1657a546842e51776a4e94b96747311fc215359bc
SHA2566f9c1a2605a0a17e52a735946e03da743c83ec8cb110657801c81ff34428f331
SHA5127343a1597c27acb92c74e003104a422f242d7249bef3551e9eb76bd01c2f6afc3a555df5c28579a730a6d2465bb45e55c57bd93360280cf822b05a51ec96c605
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b