Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 00:38
Static task
static1
Behavioral task
behavioral1
Sample
96c8bc6af3891be7277d43fb2a83c890_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
96c8bc6af3891be7277d43fb2a83c890_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
96c8bc6af3891be7277d43fb2a83c890_JaffaCakes118.html
-
Size
111KB
-
MD5
96c8bc6af3891be7277d43fb2a83c890
-
SHA1
dbb90391808954dddccbbfae333d17108a5164df
-
SHA256
d45096a0f8462214b1f03d5eb408bce00f4f4d524ab8b2ca1535ffb20a92b4fd
-
SHA512
08f9335e4ebb15454f1c4cc2dcfe465f4e6809c2af6600832e40f4f10b3fccc49c1b3a3839c3abea416304d55ae843472ecc49a4ab272630fbb0987139def1b4
-
SSDEEP
1536:vyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:vyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303ed2bee0b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA2C8221-22D3-11EF-A296-4A24C526E2E4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423709771" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bccfc5bea2e6c47ad11bd34b4488010000000000200000000001066000000010000200000003bb81ca940ba62fb6ccf2a34acabe04282724ab4514eff2a2be0d0fefe82e8cc000000000e8000000002000020000000445cc61a8ff92e2f0e6e138c11a8a4e880936ebd07711d8353e4c0977b3ecbdd9000000008fa49e01cfe6bbb9acfff68ed18e15490f66252fe74d440fb5685b060f94834eee6d153ce268a85f548aab9ca347439808f3cbf16817446cf43443952bc421a765394cded5130801c13d2f08e37addfe4d6003e523f0147234ef5e8e5e572040a5efb27a7beeaea831f8e232c60d038f54e360eefd41f7b6e54cddb35642bd02bfe120a4dcbbb0233c3cf3742657efd400000006d4b552514664582bb441a6687468518e57771888c172cae58cb93f9cb3532deae0aef29a13a412452c00427ed73c47665b57fb81106c26b913099433c9ea1ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bccfc5bea2e6c47ad11bd34b448801000000000020000000000106600000001000020000000a6b9cca3cbf4c5bb3a62f348b0fa1debe03d78e187b3479d07e6a9f870d776be000000000e800000000200002000000090d3ab0415798f5406feae957041433d58b587f7e462986f97342b3a0ee1a9c42000000041e7c327696897824966d5477f2d7e667694cd73d4e3e3e954ac79aaf8ce26bd40000000eccb5950c89f9c64cfd3a05ac34d79347ab087edd71a8fd1f0d670a24ec2dd46466de1afc164e9b6ad50eb3752b1794c76bdf5a2aac8fc42c32c6e2d2e06ec20 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 352 IEXPLORE.EXE 352 IEXPLORE.EXE 352 IEXPLORE.EXE 352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96c8bc6af3891be7277d43fb2a83c890_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f712069a4284c0b3e31d5fff307d59b3
SHA185785c45bb3ad13e4153fff50290d95f5e6c82a7
SHA256fdcf6b20218d25f5a7089a70ad97d2d973698fdaa6536b06e84183f2204e66ab
SHA5123d085420b687bf8617d1c6bba6339656df6b1bb02bbe9a7c536a45de81639929f199fd984af80ac044a43d475d7b07fdfd08534a73f3b104506c363d4254addf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e53d33d542a2fac7757889a7716faf4
SHA1f1dc87ea8bd7cf21d6066d325de61f42e9c44d0f
SHA256027d7adebfdf2488a1bf414dba502ebaab4e517da14441e8472dd82ec75b4fe8
SHA5123a8cdac7689efbac3a5e52ea735bc876c5f38d849f588c7c63fc1b3fa92a63364979d7da400585367a9e83c5177da9e9e5db1e3d5d549eaa34ae17b699a7ef79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5206457f878c56486948b1992a5da903b
SHA1b3cd2b0df395e0f19e1c6008ccddc2449b1133cd
SHA25654e0438d2705201d608310d4df685df8824cd280e184a2e2cf06d8dd361b343e
SHA5120816202e14407ff3f1fbba2161ce0825d6c5c4024d84b04700ee89f6433ce4c95b0afeff2e68b1cea03226f9bcf172bfd12e632813bee0cd829889cc02823284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54280017673612461737c47c426015ebe
SHA1f1bc74bb4bd049b759059f4f1de52f6c685d5c4b
SHA25647e9b44793119deea1f81aa3f47f33dca21d8c42d0d4cb84b2617a34594fdf7d
SHA51240cf5751f969ed5755a4357ae123618d9be0af192100481ddb7c0af3827379940484fc71cea9c3e37fb82983bc7774c3a795656b32f7ab636c4fb9fc88c1f429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0e4b8301a21bdda1dae60edc528a394
SHA1837bc426e6779e464bc401504f840ef23e2f28d3
SHA25697361f9941d1793fc91ed98b584ba2a4e1a3b33489e03b4b8a87d6f59067da12
SHA5120ab330a5e1d8dd40a0eff7f227fecf0cd8814f773e4275211096f45e6a9e311cce75dcc096d9cb139fbfcf8e40d996ff5e85845324a4033dff32a74a350e4768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e04bddafb062167fc7d102a898ce6dfe
SHA1bfd17c5651c01ae3e811748c330f2d73481f149e
SHA256871082627ad8848abf50a4d84c605c43da9eb30b721f0d074e6c90e08582acec
SHA5126ca6ed4fbb7f29d84379d0e018fadaffcb522ab01dfbf8f21de781fa0480b54c636dc15cbf5e7308e40ba81b180133595db0521999f331c3b61bfee4c58bae22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7b63f5116444d61876b0796233a4017
SHA1161218ef09104b6e55a70ddee1a52888aa7740c9
SHA256bc940cf10a160eaa0bc4655f4440cd1efe90432f8598b2c3b9403067727d31f4
SHA512f9e78192d439f58d1db4d5150c2d1e7559d504968d84b0fef2cf94876b9301db9713a5d32beb98ca8d7709a53007e3cace8cdd2f9b56fcc08f289be97c35c2ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da335153df242bd693ae842c0700b81d
SHA1a0b04cdb94807d7ef6f6baa19e764acd58b3cd51
SHA2566e8d250a5cefc49a70d3dc14c4231c9e757fa4b13ea3b3d8cbb0052e3da0e345
SHA5125242a0d0e2f499baf065d56fac84080ec511d9487275079498244ce54174b9d7f8d762eed8eae0e5804f710552f9cba7a9050e89c6b9dc32aeb796b3b0956c3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bed5d7592273dc7b6093abd513abf00
SHA123de6b33cda3752c8350cbb1555162f801aac72f
SHA256b44f42c68721d40292c683dbc552a54e92f4cf17912750bbb43086c8e2238b63
SHA512d0354d6542ac379d0616c02a1dc5cf8eb1e68132cbd60d76385e2e98bb1be76b38a22f84378adc476d58b5ef62857b6b7cf0ce672ff33210934dfcb1305ad680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3a86f4656118af096fd2a1f98c9e7ca
SHA19b57f01d7e2b1a4295b31507af6da2f37d441b04
SHA256fecae0795f5026ba63062495092c6c067ef2bfe836bf075c6b33e98ec467d15b
SHA5125305b0c7dd72d91b71ef46e6f2d823e045f22fdc8bd967ae2923f9c6af25819af56a3aa497c605eb14d2baeb6b841e9167423d2535a1b6548ebe59bf8e9c329f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9d537fe201e2e08bfc9b527b6699e56
SHA1c29ccdb384e9a4cb4cddea6bc6b286038514ab95
SHA2567a9388864ee9647189c9a206425cde2efa93a06a29da2288bb5e02ccf632fe87
SHA5129f8a2079706f65908586e06eb936ce9e95ac789508b133daf12f75c9ed4bcf7bff4a8c152eccfb20c20c89f4d2c5a06b242f418fedec23f0f63d336daadcda2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5001488ee2ad172610eeb2794f692a935
SHA1995ba3b33048313093bd19e11145688ca64c3aa3
SHA25683c896d3ea19577cc483a7c296412b49c575a7c3b96a542dff9e2406fb6c680f
SHA51280f1c3a06b040dcd1bc85f1e3de6e66ef9be1c60f55d0564e48e186b37de70a2d783b25b6eaa4f3688f81c1b41ffcc8029e643ddf2e049fa135b2f78d45267c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aecf7dacabafd678d940f6f83dbe197c
SHA10d212a5ed6727b2bc4c85ebfa3c0811174b08c8e
SHA256eef6b7acfa1881d26f1eaaec6d69cf0e2f817211537759c59b108c758cd56668
SHA51221196697afb58727d0d45632c8896b0004ad1ee1f9cc1840ee306844452eba7ca7b5b5e20b48dd9be86aee0dc5230069611a817584959d338575fe639d5e541e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585b142a3b690fea87e2efe24c0289ddc
SHA15557e57d2eaa1268cf7f0052d6cc759d54de80cf
SHA256c4832a81e7989e013b8dad95c5e1b621ae99d9a8c9b958ea13b8a43e808b75f1
SHA512caf97a7dbaa6d49c7e8d25cfc1409f0ec184712f1fad429c4837119538643fead3b22808005659be2002dc459145945250d45c2ff0db0fef7b5d06b8b0afd7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5226856ccdb3983e420738aefe508c8b7
SHA1426580a636e577c3088a07e87c1b8b8296dd614e
SHA256ea5c3517a0d4ee077fd81dae01a91d7958f83435b44f908f68526e89d2ce62ff
SHA512d5e526f8a849d24594363ed6d47a291ff7d14f871321505698e5089f68efc1ef1c8436e01b15dc83260edec62020b47da0891093c7b6fcbca0d304b28aab7af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5939b46c70a338b1f529e04fec017794d
SHA174b503dacfd7cfaa7a82cfada00111a4638ef8a2
SHA25646f42350f3b8c91c0b78b94d737158e5049797959e81b3265ee597e850b20d7a
SHA512df1fb1d76ee1fc7272f8c8849c9f143e99dc594d1c4f07d2f29657651fe09baeb80999e07cb24aa16bf4c5b9fb62991afe49c0214f0013851bbcc3f4df763590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c057231f6e665e84404cfd8e887ec44
SHA1aab91ac925e754076a6232aa380543bf2cd03270
SHA256388eb1b1a6dfb0d97def53297196d6c74040a285ad04c3871929c16eb35ed9de
SHA5122b89944eb6ba716fabb258eb6a3526bd3a049a366cf2467cb51d8e823ef40484d61e0cb921f78aa57e84d9917afa5ef1491775e51a5adc8bbe8c3f13af66f933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0f8967192ffbfc3c28d30e2b6a93115
SHA1363e352b20defb45b16f9700a0abbaf24bfdca3e
SHA256c10c552bc5340071f10c8d52e199ad702161477b37f77b32122682957b430b0c
SHA512677b3bd8396c5f3d4543c6698e38dae3691deb8fb5a7a5e2ecc63fdeab4f73bbcfdbd3d35bfe478b59b4d616387d8383fbdcf616d1e1fde35c9270d425454072
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b