Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 16:39
Static task
static1
Behavioral task
behavioral1
Sample
958d253d358c5aa4a570bb5dc784c9cf_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
958d253d358c5aa4a570bb5dc784c9cf_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
958d253d358c5aa4a570bb5dc784c9cf_JaffaCakes118.html
-
Size
10KB
-
MD5
958d253d358c5aa4a570bb5dc784c9cf
-
SHA1
23a0b0ced7b748797fbccc835264f194645bcdab
-
SHA256
e15d5f3020cec5bdddd95b207cb473024428b33bc0d4a210adf57cdaf092f63d
-
SHA512
68d6a0279c86c2b5280a2cbe4f9ed568effa37ae65e42a5cb6c1a5d7159a969ab24298f6c6ef50783f70d2cbf24b1c7d1f1979fe512b239945267ff10bc74e92
-
SSDEEP
96:SI8Lee3Cr3jz3pfDgELcTN3AiUFElJSRsYdk+4s30TzzCn3GfblL1O+:SI8ae3CrvvcTN3LMdKTzzWaL1Z
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ee62160afe44542b7b74ecb2f8482130000000002000000000010660000000100002000000000ff504a6ec1dae4000ca5b46bfcc79cc5654bd9827e35814b6fcf8f16242343000000000e8000000002000020000000a9c7dbbec3cb9b414feff2b717787b4faac0d06987ef852be72aac527f36b76f200000009d16d821e38ea9c25edcea0d8dcb3ef1d9bb660368890a0cb59da74f1b2fc04a40000000d6765e50951e9d0a299225d129aa67f7932aebbb0fb75bf8db04ee8f6707c96c268e59b6f7f3878d0dc68f354ad3b7b99a343b34905048e1bb2303a1ded2537c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423681020" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F88E9E91-2290-11EF-B35F-5267BFD3BAD1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06ef6d19db6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ee62160afe44542b7b74ecb2f8482130000000002000000000010660000000100002000000009c44e1959573aec1a31d1ae6552c4ae0c8de83dc9952891f74e1340c870dd4c000000000e80000000020000200000008283cde605ff1288c98bdcfc4d36f8ea31466086421a55aa7572c32e7716ad3690000000d1b538023939a3df786a9d8d36e31eecf7edb58c04d2f41fb741a926cb0d031ec3fa0e5d969fc48ba520b1d81de6320fe3b640d33d38a90ca60440155e48612377f6c0d5de042e4f2db5360f04f8ab7db12cf9c8953a3a3b2f132d50160a7ff21bc9a72fdadec60ddc84ecfd2ea4f6a7708d3561b7ee18dd919ab335b9136a77a5d6b85fc19bf1a4945ea677f58ee27b40000000cf85238a09e43c3aaa98f1b83aea721b2edd3bf5e3fcbf8a03158a0eb336365fa7cfad138f041c88fef3385c14478089bfd35d63fee83a207d2892a8216a72cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2084 2180 iexplore.exe 28 PID 2180 wrote to memory of 2084 2180 iexplore.exe 28 PID 2180 wrote to memory of 2084 2180 iexplore.exe 28 PID 2180 wrote to memory of 2084 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\958d253d358c5aa4a570bb5dc784c9cf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7ea2c4d3e16b014b9b50aa782c7100e
SHA186cbda74006fceaaf2c88b887cfbbc60897b41a0
SHA2565e9b42875379946484bb1b07dcedc0317737c4f9cbb8af25b01dbbc9a8d18744
SHA5124c1161cd46bf163b1edb4ca89f2e6c29546b22b2bedf8ed7f10cde7fcf42770882bebcac71bbae88edf0249562ea9beb7cdb46a1bacdac616400882f2442e376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f10a01fbbb9ffcad7e44d3f0a2f0418f
SHA117f366391c59e23623bfd7ea30d4d8961a2ac97d
SHA2560e924b0de3dda59dea6fabf284d73c9f27a7c6a7a9bbb8339fe6ac2b7c677770
SHA512fada4b992346008d8f4baa56293d6468977239f9099fcd8eef8bb99287c33b38b31ac72b8fef9d71a443989cecde54842868454570d2f5a02a2e7c2832a3834d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eac8aac1e65de8c64eadc7448ea546d
SHA1a31dbec4161e6899917458f0d2c36859c9d3552b
SHA256f54f5e91d6a5fb0473c86a7b834fe8a65a930287a53be5fca1f59de1b59a9b3f
SHA5126958d89c4d7493961ad888b38c2254365d152ea41bbda725237b077657073aeb1667671d4a0a0c7800dc28fc5c4e5e2e889aea5be9b3f1f03fc69187041ce588
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e4e6c21e439152aa370027831d56c1
SHA16c4d27a4bb01406b4e8edbc35d4a5670da006374
SHA256ac4ae123eb240587a92dc5934cf6582097fb4a5291413bfafceed030fe556fe4
SHA51281ce0f7aa9930025de3efd7e18570d9fe5b8b35b4747ad048fe0772ccb7c6c71dd317cc1ced6945683606c9f87c668c48d5d49edd7f20d5b0fd9b13618f51d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efcd2c96c09669837d796b790aa9f078
SHA196969f6ace180a0abcfb28954cc338430d02f3e1
SHA2563f997a0dd57aef5c153802814c524e4e0dc17c43abaea00c71605d737e975acd
SHA512aadeaef5cd74649cf5b573383ef51128b29fc6d0c760d68a01eed4f7da0931e8838816610ac347a709417a7edaf35281de5253e1ec32019274cded9330fa3182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e650f80bad05b07f69327d278618e1c
SHA1a448fd75f9116760514ff4f4b6063d1e4a482df2
SHA2569a05cde4b36fb8bbf666e151c60278c8871bf8d3a9094025379a38087a7f0dd4
SHA512f393dbc769a324c7bd10ff90e0daef22838f714a6b3cecf6d8941b0097d25c67933823137cf197294a0ac22955160ea4bbeb61aee93a1ef61b24077da5d64cf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a8fde68e6107d6d2ce1f07a792a9514
SHA133302409deb43a00ca0da6cb10c0af527accb3be
SHA256960c0678ec410be21bc9032779fd0e6059c9c7cb0d0977be78dd3a855e9dcce6
SHA512c6850aa0e4322cb1943eae4779060a1e88b57abbf1c4e35f1cd71f310a32a6570962dd7b901db071bac0d0bdf5c19333aae209dc3cc083005228005cff518ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a26b9788a3ecfdc23ef244d2afe7e78d
SHA144aabfee446465e970620feb758fb5f2f0c6259e
SHA2561731227fe861cc258cc2d137c883177dbd524acd9531f11c936061201f3d7fa0
SHA512a4b144328bd788434a7e3b70e3968b11b9f26a56e328a55dd0b92c9e458360963a95de8771409db626419773922c09b5136dba6768dad26c2af2378137990915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2561b5ed0eaf4bf6dcded4f5aab95d0
SHA146a8dcfcaf99b0dd9e7edeac48213d10cfc44403
SHA2560168941d98d4ecc25eff94e577db4c3e9490601418d4c4e211c893838c18fc8c
SHA5123239898645ce9f6de791b8f6f7a6f93b77cb1fb4d28f99246fb047fe58238a9ad10f56ca1f4991ac9f1fbb567250a0a2300c069587d8c53e30cea4f5ddfd1479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f3cec57fa8538720eaf10317278ff14
SHA1e5de2c67182edc510ff11d8e2c11d8c8f41d4430
SHA2566bbb33a9e207164eb9265b575447cca17ac40f4df2a4df2d76f5f67d01d75749
SHA512036bc36f25f9c8b2527085afaab099045be3769bd34b64a2f8d525f72ba9cd0067220eb9fdef418b26610a1c110ba9f557fcb819a60ada0058070e3869498c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2279f66d98fe27481d7daeee868cdff
SHA1b7b52b193ba2fbcaadb0f80588be2c4221f9ca8f
SHA256dd746459ebfd4beb382713dcf561095487214cd5a6a8eea7ee356a2c38645e93
SHA51270a1bca9d6b3aeca4387824fdc1f27730fc67a703b2ea04df6a19c6a48fc68548a4f5f35e15b886bb8dff0096aebced678525ed20dc0f3b517b01535bf51d1b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530f8ac2f248e6217b61e782ae540c516
SHA18edac1757508cd6db48b2ce8142e81fd4905e12f
SHA256ecb11cb8c5ebebef07ce87a5d5105385c77a7d68ec27a47f23479a9e01e24cba
SHA512df5c30b230cfc1b57ed784877bdd45b19dee3610cc16147933a17dcb0344a2606ee0ddb188df57e9ab7cfccc42d681f19af438b2cd92657ee8614c14ac7ccb7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534c65623398b000cf1465f748c3ead5a
SHA15bc8518e099b7bf27ff0c57c977f2077327fb92f
SHA256cf4f28d963b017806b785208991d0db7f26b5055f856c6f8984215da1bdf4b8d
SHA512e5f652ab1063164b893345b6453cabd309be05b8f67517d98c516464f90749a4fea2aea8e60016e716deff152fc0df25f762df38f85e9f006730959b0c972661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3707013cf4c03f8d35441f70e7cebc7
SHA1a21177dc0002ef72e738bd7d87fec58d336b1bf2
SHA2568d72a0db7f58c9934ec4d5e65cd431583ad5ca300b433c98134620ca19aaf747
SHA5122e3efb950560b738d5d3a055e47c37ff27ad71ef550885f09092270b2da52b6df3683e7abc3bb3428805d60775cc51bcce3f6dcaa941ee3a139c4aefd81b0bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf967b582fc7b9a901772a9c551477a5
SHA1a6467fec980f11db7c7108fe489e4e90536d15a4
SHA256fe7991f4f72d4a83d4b852a1b214fe3ed5db956771006e2d038fe79e31ab2033
SHA5120d0042d5ad00af0128702d4c45a6f92c2a451c22699cbd040dea64549a514ec6064da6b378ec176fb6373eabfc22c85339a8c61e08c00aad98f64113c53de912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53556635a90446ac7d20016ffcd098c41
SHA146c1bbbfd4f8e66e57d66d5914459bc861241cf1
SHA256589cc6fc85216373573e73964e3f57f6aedf43fb69bda9b42dfcc4a6b248bd91
SHA5124a5719da2b57f903d8ed3766609916a2a144f01a1d7f3b7ad5e5ff2deee59ab664089126355e440c6e8bad38d56d90bd4fc551dfcc24a57446442007bfd6c18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567c17220f3b9cac79900a126b7e44fc7
SHA10cba41ce03ae5c826fde4be2baa58dbdb92b371c
SHA25629c8042b19163bfa3faa16140a09228d225ac1fe470e949f9a6b499abc3fa15d
SHA512774cfe8fcbaaf833a5884cf74e7d5e61b19d72a49ba613e783df0c3440733c39a9085d3dd5acea60b46d8773d874254488421510ed3513f046ac9b2ad95e95e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504b6d79987351f5bead938d36549bcb2
SHA1ae2d2c8328141df21b4097c89e4a43199e14f644
SHA256e2b6b91f7193c58e5a52b872a965ad9707d97b441d720f7602b7dfdbde992d1f
SHA51265b03760e10f0b08f5f95692d5ee9e840012e9858364bedbab7b59725d757842df717ff94d4a3a535945e64ddbbf029a069cfb898665bd93261cd38e76c48a61
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b