Analysis
-
max time kernel
138s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 21:20
Static task
static1
Behavioral task
behavioral1
Sample
964c5d18cba0578a5deada9335d860d5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
964c5d18cba0578a5deada9335d860d5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
964c5d18cba0578a5deada9335d860d5_JaffaCakes118.html
-
Size
21KB
-
MD5
964c5d18cba0578a5deada9335d860d5
-
SHA1
deaf9eb7c84c244b62ab2046d31b834ec7ec50e8
-
SHA256
70d76193cdf95595eeac726e94f744c4576bc738a55e93937a0b70878a62c2e0
-
SHA512
9c3c96d5cb53e153039a119025e8e79c7e1e4d628727f2785f799e65c96e28ce7ec10479873a7c79a0e2e9b492d24f06a9843474439024ee59835a19a600e7c3
-
SSDEEP
384:1+rKS511SgLuyDW4EYRwKQDuS2VHFZrI7svQuQnQgQDFQ3QkLCvV6AnfZU1fBSp1:1++S511SgLuyDeYRwDuS2V7ItLCvV6Aj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423697876" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35E5DBB1-22B8-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cb5915aeeb9c34ca5a20c0565290e5f000000000200000000001066000000010000200000006c18b19d98477e226077744406ca408819741e78cec0741541ba8520c0357352000000000e8000000002000020000000e9071f1a20e405a47d14bae197645eb6e295204f5ef3817ab5c7db7de73bc43520000000f4fb84d70ed919952e087bccd1435f949a9c862bed4d46a6897f15f63e79c13940000000c8555e150994b593f747ded1820a4648c7e5c38b255dd6ef3ec0a721a8fd8d40ecad21de9683cb1221a69132d608b3ae8d309e6bede8265f2d941bee06108f75 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d066ce24c5b6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cb5915aeeb9c34ca5a20c0565290e5f000000000200000000001066000000010000200000000ef61003e2c17118e69f4066470d97f6c35431e285f2dec41f62998d6ab2815e000000000e8000000002000020000000f98fe0af126b3c52628fc534377ef4a712cb0b3668156b79b5176879658f339e900000006371ff8512a37c487da17c2d301f8c8c709a393a9d38969f6405436b318d37fad0cb480aa34f6d9879adcbcfbe6d7bda57f30bc58a6a98bfc42bf1a94de929f2b8672023706c920259f7f659765f2b6b57c28ee759d3c61134ac58246836f131e702941ddc1c389adcbac6a0f12849cb01a2808e2a03272b97f94c95203bd7a32af7251f2e6e20a37e45d03cb5e5954f40000000000c692455038b60610781bba37f85b01c3633a1a772e3f4cc25053485e403226356f36020c17da0718525373ff74c22bd5e35cdceb4791efab1bbd0057e3ee8 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28 PID 1612 wrote to memory of 2744 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\964c5d18cba0578a5deada9335d860d5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e61dfbc8be65e985f68df7c1660492ae
SHA1ffbd3a309d51f6ece8e3248f5f4010195f7d1e2a
SHA2563abd0bdbb29a7e984760d8331c26dc99bf7f6f862346cd7ccf52b7bf87e56511
SHA512ac72e8fae916c8ddedfb2cc55086c45700305d2829589f27baf18c228f27526549465de697825e5157420fe91fc04c67ffd92a6256aaa154395ce80dfe2c0e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531ea3071eb957ff4c3d42259229b688f
SHA1f1b7616b2a32eec6f6164a458bcd3bee60104a88
SHA2565e0dd14ea53583f2371c4f85eeb01021e0d36add58d6792f68e060fc63a652c8
SHA512e9c51564cdae348b93ffded6c973865fe3e6d17478f72a0919e698f1e0179bce7b33878297f667216803db3ba1b74230fabacbafb8263806af0ce2ec65b78b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a5e0423cfd2b94c7ca48222d6d50281
SHA113e1d8b9c0501c391b58f9214ee484926547c40d
SHA256b36c1e17f26eeb0314057df67e9aca7d701e65030397e74fde20584477df8a20
SHA5124642937e7c5ca1fe4d632025a091023ba32fbcab982dccb27040c13c73bd327fd2ea52f40ee32d77c8dbfdd5d656b69ea3143b8380c599dfd03c93b0a04589a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bdb740dee71d0aed8e58bec6c4ba379
SHA1f92cae68437799621ea6a20158c5679861857c52
SHA256eda5ef368ca0b30dabfb525cff7deb9eab7d263f491b8bf9d24cba2a7f057cf6
SHA5126fd7bce2b22a81eb39749278057db0e6bf65af4b91c461cf6d912c2c60da061b85991c11c57bbcf4cf1bd7b72daaea58cb7b757fd110f1cd8d87e1d4e01858d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b640459fe198512cb3d15fb64c67dd
SHA1dafa351f3a3f3706277bcf7455050e2ad2c86e76
SHA256d3edf616b4a9cc09121c6fd477124adad9ffcf06f2e3b8cf402dd13b3e754e4f
SHA512ec86c465fb32b0ec3da74741eac78bbf675a04cd2e2cf0cbe46ce0773879adce72a23e30310262f5474dcc78e170c8731acb34c2dde0e5f860f1f73cd832b5ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f887568497d67cd41a86181a59828a7f
SHA1b70cd5e1f4bd13b2851d34ed079445249843ddbb
SHA256b3995e9f1ea3dc89c3f39d4a45d75b76de7463b68ee63ade0b15c1ad003360d2
SHA512ffa283adcaba48aa2166e1c215b1c407b400c73ed6a957215bb5e56eadaba38cb3895252e5d4146c35e81b2b0a94d4d19ec28ed1a561040e7f963c64c0447a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e738b1f60e85f183eee5034c306d6872
SHA1e3a1148ac63193bb4bc24f21407647ec67340690
SHA2563c52a16dbe22140fc6de2fb1103552848496eefcbba2d425d0139befb23acdd5
SHA5127d9a365dc8b5cc69de5ca1e40fb821f19664ff1951146391d35a2ab543ed9cc9b6cde10a6445ff7fda2b028be5f24b63d6229cc345c0ac3051844489e85adae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baa813fc6176c276631e855f6279dfc1
SHA15d8582aa4ad3856596446fcc38a9ec96acf12312
SHA256366171cc11fdae1e021f2093add7607e0b4ae2a933690fa3c3310f1abf8b4992
SHA512206fd3f34320d5a3492129950ed1499245546f7347b432b79c1d0b65edb763120325c0690a74b10d00f591590784ca047f8b730ccf20fdf6cd29c702b5da567d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589d17179d3d7d89df9b222762e25c77a
SHA19c337b514fea2c027301f02400690bf6ac9d628b
SHA256285f63967dfdae777bfcc93836b809e61ff84a8d31307d0f2d2bf87facdebc2c
SHA51242bcd4d6f54738cbfeb9573dac0c329acdd0bd53e671944dde02ba14ad25cde62ab3ab4d996ef30386f01f882929ad0b89e448028843c284d54e8498648d5662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c10aed81672126034a0cae164ce345f
SHA1f5a3089930718be0a0d5578b4179abf7ec292cdb
SHA2568cd056ba98e3d220433056baa4b7def0b3bc157dba4c1de91e12bc8d54fc8baf
SHA512bdd3adb010799010bf0e0e86f82d12d8bf9685a85836bbb0665a48669124e15924774636a848a31cf35ef18762189e5248eeb26c69bb24ca3572d2b58a0ab624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592d99c286d3d3a9ffef2d23707e9be7c
SHA18086c1b99490b2f4f145f7110c86fcc103916d1e
SHA256105af028f5bed515b84c170fbfa3e7220d4c8a9e4cb2c17a355b86f0fdb5b2aa
SHA5125e82c8ad90e844a2ddf9dd07eb4b6715d981c67d84eed89479d99a640b57ae42bd0d18dc4cc0a55fa2aa210c196969064c5017106c6fcff840321576c753ffec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c715b590a80b314315baa773cf8930ae
SHA1d8747fefebb422ae8c9debc8ff185af3ffce05bd
SHA256e20532ff8ad2a60861ff5a002249cc2380083d58e967570a819194f142b25c18
SHA512fcfc42710d7b927c903641a2c50c7e77235d791c1572d3da223347ad0092718caaea1969b11bd28014c886d3cbabe37fc2783ca807dbe1f8c3eb8e5f3207fd99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce67efb687a28a1be890d1852d54b7d3
SHA132764528843659bcbdddb03b96256a4838ed8343
SHA25643394111bf2a3a33a2ba8f53faddbb22f6858f59324ae76163ca97cd03f0d084
SHA512bda4dcbc0cf805340ae1645809580f024855f526fc3cfdc64a35ef7d138e2705bf8508d3be83dd67898f2106c748295c6e84e75f5c49a7ddd8d075073a0c89dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b86d9cac60ad445a32552751f68ebb8d
SHA1f500db46f280bc93d1a30a1fa688c2e712bd18f9
SHA256d282541befda6ca4045110c5f83233cca5583a479709db57d7a9375bb4a508de
SHA512c1c149aecab957c8dee5369bc7813287c7ac51ecf12dfb6b9f504d31083b4fe199322e86dfff151d39a7da984382f377e8b20ff70cb6abaab0120d724b25f6d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6cbb2fa3a8dc6ce947092a62df3771b
SHA1f03f575e46cad74b8191d66aa664480b8e05c5fd
SHA2567f786004945d7ae7ef35598b017774d514c6724da00f22dc02dafb565b508de5
SHA512a697efc4faa1f17f00e26469c91a404ee0d6a95db8458b9f2419b12620ccee240d2ef5ae47bc16cee97f32f7b47ec003a82af6e013584a1916416ac0fddf12a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5234975a9c3bc9eb5990079db29240679
SHA1e6b7bd296deb12d0d6887472bea720bd305f809c
SHA256754073f4d173be94a65b24c1c8116fc1762e90e7491b95e3a1724bc7051e71fc
SHA512578f30475c921d1a10134b600afd6092102706a987930fc8eeefb1ab64008116e50ba765ef59df8d5363553a55dec2c4f59c11fd00f7c13fb4563c198a9fa7f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cff721f96ca1071a93ab77b68498a3dd
SHA1261f0db929cd24c16261e36c66586da88e1ee0af
SHA2561b420293005ffb6c4dde96741dda3f1ae6deaea0477f2c0fcf1a51d694246524
SHA5125614f4def1a25e77994a5c51411b870d794e59fc1144bd1cef9d95a50bfabf1487ff64ddd63ccf026c7a6f9875a63709a3bab6091895158f9704b3fe03c62bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aca49cb2241de1ce7baa1b5b61b65672
SHA1920a862ec2d50ae65bd2f6243d2e2e88a8692e55
SHA25629bcc197980900374cc6eb698b63488438dc77567d2f66908b86904b3b832843
SHA51246777982b1ef4bd0e3cf1f2f732b937ca55896944d378e27a66661a6b68bec6a2f916fb40bb5be87f35856b6969109c9800c15deba97b21bc8ac6dff900ef802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548b46432009ed6e3d6a748cf46b23ec5
SHA159129e4d8533b77b28a59a81a9eef5bbb46e6fd3
SHA2560d73684de52d824e8ab640f603ab44286f59063045f8858765f911c990d825e5
SHA51204fff2cee38cb8ba687e5b604fdf014edcb70322aaede62c1131d9c83b8ab449e616ea80355cf484cf46173f3814a88a4361433734180563a50af0eda5b17d2d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b