Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
95586c4cdd7189f196ee6ea827d161b0_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
95586c4cdd7189f196ee6ea827d161b0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
95586c4cdd7189f196ee6ea827d161b0_JaffaCakes118.html
-
Size
460KB
-
MD5
95586c4cdd7189f196ee6ea827d161b0
-
SHA1
e91bc5e654b3d781d251679e7940e280e845b607
-
SHA256
750f91d6b31ba4931abf592aa2a505ebb58b90c66b1240ad2b92677a17c0b416
-
SHA512
4fd3564ccfd83f0cc00fb37383b5939cf546848ead776fd57a27bd36888ec1964d8522229f39dd5ccdaa2862c1bf965232ff4640702974428316f3cedee7a556
-
SSDEEP
6144:SQsMYod+X3oI+YmsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X325d+X325d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55D5CDE1-2286-11EF-8F92-565622222C98} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40715e2e93b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a89d12d03996c74980013eaa8a86d9b100000000020000000000106600000001000020000000d6cf0d7f7194aedcbaa24c7a8db58c7b5b573949d8f6a19e23491971afd84088000000000e8000000002000020000000c43bace70d6ba962b179b59e90881246981c1dcc3e1ac480421c424f7216f97a90000000e87be3312fd6d569fd5d58a2315d856ab11fc8c1b2c009acd8c665b8c4b0d4d758dcd56fa8f9db7b65771ebab31c24a3506f0a70a85803b07427d62e87c3a8e5491bdbe1f13712bd97f8868e432b83b7acecc0afd4df8e097a422607d6fc04b95186968c7e84bbe5f1ce96d1deec804c6e4c95bf1765e63697fe7ccb550b546dbbd334526d49031d860c1af77a9a32aa4000000041951411224963f5cc9eab4ab42368e00f37aeee0cdeb4ccdfded5bf304d4fc65a425974e816eedf2178af2be43c1f320bb5654e14c9ab5ccbc7c73212aa8a99 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423676451" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a89d12d03996c74980013eaa8a86d9b1000000000200000000001066000000010000200000008eab1e6aaac7302f309a5156cefa096e4b94cf11410b9cb801ac303f7b781ed4000000000e80000000020000200000001f632b2469ef246daf66d742cf8b395dd844dfa995af6f1bf7b4245db5de53b820000000ca3a40f795142cd6b1d9716d7c57a002516683d233278d1a4ab2f6c40e8976384000000076996f9708748ced634ccf9c6489fab99b2932080d4cde119e07f9e3af6e2ae56ef77267db4e4456c8c39a0b1e4e989ac81300e9ef316c2895bc44b23be0f938 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2492 2912 iexplore.exe 28 PID 2912 wrote to memory of 2492 2912 iexplore.exe 28 PID 2912 wrote to memory of 2492 2912 iexplore.exe 28 PID 2912 wrote to memory of 2492 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95586c4cdd7189f196ee6ea827d161b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52465a0a3d39d5f76c087b2535706ee
SHA1f781abb801134e86f2754b33fcaa26ac72c34770
SHA25699e7af1435e601a597647b7dbaf76eda194ce7b48aca6f8719b68b9bb51e84a0
SHA51278051426039e918051258997252e16996adf9eec7707b8b9a79175e77ee52b01693d5868cc9ec8fa5fafc5f42cd9bf10cd782630e8d655aa8ae8bd011585afc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5339860009288e514603e652cb7bb319d
SHA14f62e33d33e108c2f0ce852db94ab309f22a7cda
SHA2561e597ed27201b175dcafe9b5148d6f81ffb297eb3824628b99c5478af45eab4f
SHA51244614cc5fbce2413616eb97bbb34966e77e1634697e11d22d0427f2c6f3dca6b5c8e182e8c5b78bd174a12cd7d751fbd481c05a8cee26ae4e5a4a82dfe2fbc0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc126d015d35f9218ea0a689da43d21f
SHA1eaff7c2126154390a81a872de9292cc5d0b7aeb3
SHA2567d20bba8bb242896ddb3dfee423beba91588dac2bc8dd3c45f0a1a4484561905
SHA512fb3864ef7ae9816f88be15f51b1508d42f256e33f894e7b57ccf6883308f69c1e54988bae3abbbdc86dca1c9852eeb27fcd071204be36ac250c50640e7930392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504172bd3edae8bd8073b9aa3f8304fcc
SHA1f3cc8a1cc993a6d28260be4d458e51b9352d58db
SHA256e0cc10e627435cb3e6bd80349cde0cdfc8b5a70c3e21927992de1647ec154e67
SHA512151cebbd7265839645b1c02eb2f6181a7666f801c917107f0cfb30c4740f41bb76ec4a26fd695ac99db2ac65569789b5aea33fc7b4a03d97fc4cde24f685dd8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5041506a159b8bfebefbc446d1dd53633
SHA18b59c72dbdc94452002cc8a0681e0ec6a7e83b4b
SHA256bbd85d01f735f477cd950846c1b0e6c8f22e37bcf0145aaafacc71965bdbe4da
SHA5121d71396a8025c4b2820e47e33456ae3d036b4aa5b6d1bee5362f426de276664726d843954d27a6fb8c736bcb205b1f8082dad2d20ec9058f59b18eff9e7749c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a693f77fc5bede0f4d405c2d007092d7
SHA1f80531c3d1d46a71ab099e5cba3bc900972077c6
SHA256a0eaad0d3f813e7ce6f9a7b431b5258fda3142011efe16eabda9572911ffee94
SHA5120ba6238a1b59c98b1d9fcf47c41fba9c2fdf90fabe1f7f5cae523c9947a9b13c34ca0691c04a7b5afd70ee33ed49b13bacb7ba3f51adeb4afa16857ec27688fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ba6bc5fa90cb1e5552e7edce4a51d74
SHA1af9d2ca2fcd0e897fa6924289c556b182eb60c86
SHA256b474f51050a0cda5c8e8583ca6a2fcb1930a8d15acaef935cd4e81aba9343d39
SHA512d6fc8562e9016f0358bd83ec36a846c6ebdba0aa8676674fdfa773613d21298e2e5dc48e1ff9e956a817796b125f5d28ecce8be611032e45c598b99287c45f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2c24e017b6b078a497cb5067c916039
SHA11f1ffe0c7166e0b1b8371810a63a879e4ac58f3e
SHA25623843072784715103e7a5d981ac5dc6647dc92fc323002ce0339577256ca738b
SHA5125fedc139a5c9720c09a85765f7e8fea9f25703cf99293ef13ce39c8ea34edfbe5dbc1cb8db9bfd3d40608a92b780cf505cd399a360b2e32709901768148ebd62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576cf842ba5e3386c1a969e06787af5d8
SHA15e8cd9812f345b565d04782e802d0cfe95b59243
SHA256af2feb84867d10dc20dde0993568cf7697e76fd57f82e8f54d772003a2f03886
SHA512dec06563db7a919480b365e1f08996da036a7a41c26f9dc8107778707ef8d5862fdf3414e130ac964f02962a970b021e268f6205f8570597e3f55cc271bfd920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a055282102f86100c3a7822b9e6f2a60
SHA17d1743fae790e90dfedf68346035119bf2d3ac10
SHA25668d3ac071834b72b8eb5e5df7c73d2e3ce528ab43101d72cee38f882adb520d5
SHA512b0a1f335a3b7853943aa51f8e7b41427b289388264c8b09a24bd830c1b8b9ce5ef14b5f9114a6763ecbe8a0c3a7695b2e45d71d2a81a615766775f5d635cca1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54649ea1fa3da1e3b4af499d635f9772c
SHA1ab94b6d76a6fed35363e4c7439ef888bc23e7cc6
SHA25638aa99bce610ac8bc69f6ae77c81806322bf961ca813cd2559b081563887374e
SHA5120b424835fe88798fa1d265549f46a6373b9d30f0429c7840c1129c77e91321ed0694bd0b7fd9506671a93be7a0bb0c9d73e1573fb44d57dc1ea543b21ab071e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5513903e85f7f3e8c43622a1d2004377e
SHA11a37f4f178e419eb67fb2e361784306217e300ed
SHA256152ca3aefbc51c87678b9931693ea7bfcab3549622ac32a6409469fb9439d611
SHA512b8637105a41815b6a2fd4af964910ce29942a213198b2c120c6e9360160dda5c8c929745474f2bbd1a93e974ffb4f2e1b0bdeecf374cc17dd589ceab50a16aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a343dbc578f6ff473954f815dfbcf9cd
SHA12c2dc46983cf5d1043b32885e5c3e50be0b93b48
SHA256fcac288290f906a6216fe4efb8903f9565a41a929787b8662bf16cb5d243e5d1
SHA51296c94e9aeecb1edf91afa4f809db2c11a3ee0651bbc8e2af887c3aa22869f6cf419727f8e3cfc2f3b700fd597beb15d003179c3f5b6f8c5113e68eccf9771991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8b506b5d57c914ddc1685dd74b8809a
SHA11016e000c564ac6108b84048512ae2157b60aef1
SHA2567217cad9ff5f1295ecb9dbefd94764f5e5060bcabbb5cb031ff87d40c27a6a44
SHA512b4f1023a25f8255ba37f27697e4edf23bb17332dcc11aab948b04c9cfcc396986d0dd5db69765617aed77a1b40b8b62f26da1d341599aa522c4a24c83fe7eb30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fbcc482a9f986aaff1b80050e055f23
SHA128a2b7b5247cf20b44539c0d7f9c4b1d78e01267
SHA256d934b0d2708dfc9cd4edae3bd4789a7ff55c4568f26b22bb63bf6e6643091ae8
SHA51276b451f2dbc647d933813c88b535b75f0aeb3416c961c87c9d983816bafdaa88464b45bf38b085981935122cb7b1b487a6f27837407508c54c6971f76b588b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54172845d0cb4f240138b918233fd00ba
SHA1e91ec5a82ce6b7047b0700b50c37b939ea2315f1
SHA25689ea14fff97291aef27a8648cfc44f57f9b8d6457630329ebfe389f549349e92
SHA5122a458eaeda1b5f69de01f7ed7a232cd5b40ec1803788acfc7455cfe2d8bc3052d681137394118d526eea9432a634ad7c9c5a143cd4618db6b14f19234ea555ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f169bb6a5dc041ba240756b51cf8ae5
SHA1ce272fbf90063cce54d5cf865990b3048fe06890
SHA256975715924d70a6b2e7bf633bc07df2c220e1d1c630d699af81c80be7fdb954b0
SHA5125660b2d0f3a465f65dd64d0ef8ef877a11862372482edf88298eeb0d22d186fa481d17ddf36e1e370f9f556819ce6264bd5855b015b778e417404c5aa154e926
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b