Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
95a9179736a90af16a9106af170f613e_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
95a9179736a90af16a9106af170f613e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
95a9179736a90af16a9106af170f613e_JaffaCakes118.html
-
Size
77KB
-
MD5
95a9179736a90af16a9106af170f613e
-
SHA1
b4b27dcf2011d16888f91046c9fe57b96d1b86e1
-
SHA256
74376c1303ceec018952a564fdd39d2b07233cddb5831340952275d268ff24ed
-
SHA512
a090775a9bdc56ab91771d03d98c5520780b2a6921ec192efdcca04fb0b6b38ac179d9d68b634795b8a9df8cc1f33f68ed6a938c44d59eb8f54f7eea53411426
-
SSDEEP
1536:CoEqRTvMKMaCy3YbcrMjk1CmTyKXbTePclEGs++OWCkGNhZqqqYqy:CoEqRTvMKMaCwYc4I0mTTJNbfhZP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206924ada3b6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8668961-2296-11EF-A339-D22A4FF6EED8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423683542" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a2c41c5f2c70634a86552c8bde0a5de8000000000200000000001066000000010000200000006c1034e9d93cf46640cfb761b9029e4809984f118c669dda2117ffc130951fc3000000000e8000000002000020000000dbde270084485be45bf2595de629f45c2b1426af9f3ae88621f8ff79c2a4efaa20000000acec11e3e8e1315079e43e97a94721dbe4a65de3b34a06d795fba0e8c4b9755140000000c47a94ebd60d29efa489fa01f35a99ccc1aad706c180feb02ff866299569a24110e90188e3e04902162778a65cd50a3f6a19ae5d81cbc02b84438a64178f0f4a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a2c41c5f2c70634a86552c8bde0a5de800000000020000000000106600000001000020000000514ab5879bdc7955209b491c2cc7da44e9bafa258b0c8cce4243a5c66da77478000000000e800000000200002000000042fa2f76c0eed8ad8911bff703e1935b2a633edf8e2dc044f5c619a31f60e64890000000286d56044a11e654e2912429b59fdf892faf887f41bc837ca86aa5a874245020fadccf7428ec60350bf1f1786b8d9fa26d433fbb10841e7a782de8fb0b7f444b3e744857a6c25e1a11b7404016f934ba05d5c514d34749b439ce640b00ce44696c7621ff1093812f770351b9ab7fef47d3f9706799e82c7daba9a48e0f8e84faa4e11fbb7fecf05021f735caa4ae6840400000002989fc2ada8df103658d6bb5ae0b7cbf68721fa40ad8cc56dd6baeaa4a710e91d0b7d88dcc95eed476636b65fbd80b00b97feb694351be2027e1bd88a4ba3680 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1948 2080 iexplore.exe 28 PID 2080 wrote to memory of 1948 2080 iexplore.exe 28 PID 2080 wrote to memory of 1948 2080 iexplore.exe 28 PID 2080 wrote to memory of 1948 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95a9179736a90af16a9106af170f613e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8857d768d4e4832975d307313277ac6
SHA15f43019b2cd622b86b833ba0c9dc012783265179
SHA25624b458eb011d9cfd476e4089f29a42f8021224e3306b1ecd76214a68ec4c8353
SHA512f28bea8597d41a40d619d8c517fc14e475e54a55429ec8e75f8f62ebea0cfd0f8ef3479b0470a71a24e9569eb8b1f19ceee00c05acb88f8a7be17b812d1db07b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51848ea52c63f9f959f763462047a19d0
SHA1e169b5d836009fc618241a1404cb628805270e34
SHA256ab01ba1353c8c63d0b6c965357dc4a2c988720d44453d075795d892c4462adad
SHA5128c9486532b76cabbc77dd1808eff87eb38c1a8e6dd3c58ff684ca385a9ae7efc0c837b001073e340510e1b09cc4c4db5d0236020eb5865510b5c53e10a8d08a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524689e039659aaf1a941e270824ed1a9
SHA1a9700cc45c393a7b744c7bc04b7b1a5d28cf4fd2
SHA25673b07343689c5b8935485cd9909293137618e32a17d1a8f8e9abc761d50ff5df
SHA512a4fe3d070f512bfa6d089e351eec1a0b6b83be6c792ef91df6ca473e7bf5358af3c469d2748cb9718139dad172847e0d7614ea32996794fda99d39305ee34706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531b520c5198c3b676d40ffe42022d420
SHA1409a9b412b0f63ea74640ba5a97d48dbafdcfc23
SHA25604a65de944cc5b245222d51624621b03c3d0b809fad6c6a30a778a742c7c4e35
SHA512ef0faabe4096ad36aa29c9ba14d472b465a4dd159a13bcc9a1fca95c958ea7f9bfd1a8f0001edbb030181ff391983dcac04dc99fb58810438b3b5c5c5138403a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576b04b229223658641b803ab55793942
SHA11f6632cc49f5e3594053f9a87336114453ee3e9c
SHA256348ac3154c3ea5173a799cced21ca0a46571ac78ac81449d20b5614359dc170c
SHA51243da97c4955f24cd0a81e81fc2906a60db8adb01c6db97809fe4bfd4e7856de45656d9c62124e8d23d08644174cd8364e67013e1b1a2d2cb5a4f5935053dba2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590a8f76953cd996c423e76535da501dd
SHA1a787eb9d18e182fbedbbd9702645aba1c60c2308
SHA256ee1dfc9a02893cbe978a0a2fd3d961b3124a47465f576846deb2b4bcf6bc8d44
SHA51236a4fd91bde8b933027309f657d6f0d5ad207c34297c20a913822af17b6f81fc85de6870cb8ca148e08faabaa65ef89103bccc7a8526cb0a7b6d3f3cf28a4507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c9882f88630769c0314a2c54111e642
SHA1d60537310338ff4c0a32e0390e17685fb0986772
SHA2568e58d1e0ba4ef145f555e0b76712d9343eaf6a46b6b66f8f794575a27e2df5f1
SHA5129ec17a29edd699398f2805c37a9cdfa4491e52c2dd82194c862bf354bc72d1a76907d4f8989b94dc74d76ea3f4f4eb2c053581cd6a45d16c80791695f60865b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54634f1a005da2683194c9c0511e10984
SHA1d7759ecb536bf388684373b3e4557b7bc9d37a80
SHA2569e01d5d7afec90a988f0ba1dea3ec2797915812ffdc8fad8536611b35dcd0a88
SHA512dd5b2f90f666ef9ee1baff028cb5d525b0ca5467fcb6efef75accc002fed6ea09e4eb0f6cacfee1500447368a7776ac515ae960441a8f3c2e33be69a96f4ca19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a72279f4be9b79e01d17c9e4579904
SHA1e352a63c09a9fa915c6a0c019e05e639034f687a
SHA2566291151af7f49caec74f7c0c2fb5ca0063e3b01af756c40c2ab85a370ef43e82
SHA5121fb66b4e417f835ae66329554245d9185b0be0b752f5345d5f4cb5f627632352838d811715fcb133f1957d8bbdedc28b5abe6c73f645ffa3397635bbf5cf078c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9876ae0131d7693d38af1136f528b36
SHA1058b9efbd14c59b6598d7ad9afe0cab273c40d59
SHA2563d70ccccfb05942a7ebff1b31398632a0511209090f4b47a1c6dcc1b03980e68
SHA5123430756de4effd5658089b8278b37b60b06ed6bc2e8947fd8b8e102bfa2ca2071173a59d289626cd4ddeb7bbe0044a945cc1b5b92a71e22aee3f94f02ad96283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5179e062c34b092eebd80608b021cb033
SHA1d41636ea86963a255755bfe576a9eb8ad21ebc9e
SHA2561771b3a973decda25cc9ed8f4f82a077ca2c839475300aa84a41763ebd451fd3
SHA5125d2828b9be27af463c27c1f4dcc5f513cb9028911d4e36e457c6b37e3dd3dec2f9d2859e831e2b4b7048f29261acb136ea9b8af0224038cdce5bc54c9fa3266f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568e5ff3333fcb836860c43e99a05b36d
SHA1b306dd209b49a5007b4f0fe6051d0fb2703faf0a
SHA25610a3d2ce2c188ea39e5915c681b927f588cb34a14fe655331d5359d05fdc57b2
SHA5126ebfaaae923552a5afe61f8e24db86d65f540d3957592dfee991d50cc40fd761c5e6b5466dceb63b71277124fcf09355272fe6acb39d5a1879c54157c086ba5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535f9451058c141f6301a6523f638abda
SHA115c63d943c4676c8db63cee8670df3d07225557d
SHA2564dd2381d78132e1add764c6b41042fc45faf7efeda04924a04439fea7abcc8c7
SHA512e84d2f5f34ff5c9f10ba371d19673b7a7cc08e8e73a54f5709e94ae01d062c2836831234af39083446cd46b14718d5a12f907b22aee645b15951429ef3efc5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de36e425f05322ec2d61636fcd26aad0
SHA197444e9beb7a73edd3452fdb61dd232bdace6681
SHA2560c6fd49a5f9c390dcd5f2ebbd7505e37156233a06ce06982fc5cfc10c057f08c
SHA51244e40ad4c3e7505ce3f83ddb84a433424eba84d9dafd1d539beb1e510406295c1ca0db045be76e78c69a73636541180b12e106a057b609b251586d1e883fae23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e77317c88b2eefa56f98f38725ee3169
SHA166f0357c38a61663c24e63d6e2ff2bb33204efe4
SHA256167aaa72dc618822e2ccc497a7b1c9709bb85f7ba076b931b6bd48c9cc032997
SHA51204924376903921e7d27c82d387d41465a4c9a24b47668e14a677239406ae613fef3d1d4b35d6e4593a70961527a6861ca2c14a60d35c9493796eab67c47f6d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51948e00655cb823f61af993bc1a76f9f
SHA185bf9464c3dd1eb6d1c4d0a498261dc7f2ac57a3
SHA25663ae295e20fdbfe84135600f46b755c9818e1aaf82025e9e38b8020dd4d3f584
SHA5120484e77840de97783d3d808dcd1df2b2788a2a6f20554224326db50ee8f9261023290a5c7acd0eb9c6496e9941bb19f6b8d901d409016ae91cb32749a3bb023d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589c099dedd25b0af14cb01c8780fcb14
SHA1048f1d1c10cc6214ab6824c609215993ddb97d78
SHA256e7634e664764b69c7b71ad0469a9e1f59dd16679db1b383f084a1b69ba4e1455
SHA5124d31d00c52af807f2970841c6e0470ae43d605297755bdab635aaa10ab587c166406bbdfafc265910c8da9a9c84a5e0adbe41a83380d2112382e2ff9819f0e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8f5ea34fa3ca77974ab94448f10cfd4
SHA15ebc7035937f734b3b9365a851dd00f024cfe682
SHA2567d81ece7ab2bc7d2f9b41875112bc8aab6db3a72eb75656698f4be50cb01394b
SHA51233dc013972a7f978d68c0e95684eb139240454ecfb5ab61358e7fa64e9c3acaee280003d33f19c9cd3eee00d0d0b00d60b8727dda96106b525c3ee4a22e14b38
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b