Analysis
-
max time kernel
66s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
97351a8f030d9f0c187398f0c5c87ac9_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
97351a8f030d9f0c187398f0c5c87ac9_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
97351a8f030d9f0c187398f0c5c87ac9_JaffaCakes118.html
-
Size
18KB
-
MD5
97351a8f030d9f0c187398f0c5c87ac9
-
SHA1
08802672cb215b03297339870ddecd672b70deea
-
SHA256
2392465af16f0066693ccd98b88d9035a503379660e9bcfd8b9ec717efbed485
-
SHA512
1dc38a3272eb1ec1c6a2c674269a34391c7c2928f4a67763185e86ff5c05072d658c59512db1dd576b531b2a9e4d259c04df8df77b3bab131076b234203c7be0
-
SSDEEP
384:SC+4kEWue5pFx+hREykWQ21PXSv0kwwxkzB7Q31271Fjp:SCvk3pFx+hRELWQP8/GliTjp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{768888B1-22F5-11EF-B7D6-72515687562C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2836 1708 iexplore.exe 28 PID 1708 wrote to memory of 2836 1708 iexplore.exe 28 PID 1708 wrote to memory of 2836 1708 iexplore.exe 28 PID 1708 wrote to memory of 2836 1708 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97351a8f030d9f0c187398f0c5c87ac9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5314c4db7d18b989d4d562fc5630e4373
SHA11925d42e41ea84f2748cd9ae2d07abff2bb6542a
SHA256b6d6109fcb0d0c222f20f64ad469a00428cd0fd7eee4b1aa6c622a9b8b328a9a
SHA512cd26db7442b14d324ca4c0d2ef6f51313bf2938b490e8bbf6bd8e764406c6d6729d1068eb51f6625714045064bd32a1b9ea7138c2e840cbcddf915aed187884a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514313495ae78d5afa2a620214d79fa61
SHA1aca8b404cf051af92b517a795437645eb392c895
SHA256f0f6e03a1ef5c01e8b9cbdf3d6404caa6c47dec669c426265c5e2b1079c8b244
SHA5128e9b363f3edb6612f7f4f37bd6bfe2785747c3c68748a0fb8706ae1c0461b0ee6a9e5ccfdc65795a9686a8f592918104ed2acab76d1db621f19247c70902a395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b740f5c4b70f2e4464bd5e77f6ba8360
SHA12f28555e199b93bb7cbf12c1d16d374b81d650df
SHA25666b49b52fd04317b62021fda53090311750743d10d18d666175d173fa1748157
SHA5127d84b64783915784b7456c4277e45562269510e33bf95915172a2d4647297646909c97ecde41a47e1993ad029bae595a58dafe62adbbe91386c51cca1f8b0a5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5a3d1ed8ef38baeeecec7c3effe2421
SHA17c7c33615353644f9af7e6dc02879b1366d5ade5
SHA2563d16ba26b7e078c04d397f203c8005b09bca319719f16a2721b7216ad41966ef
SHA512310692d3d91c5fd8751ed4b2bf18855c85af28c28683399c22a9c65e91ca2eb6d7ad535edb6ec7b28b9fe6044c522ea4f277f3f26a854f0b40775488bea42dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58468630e1e987a565b9f90c1fd08caa0
SHA152da60e6e7f0a978d461e96f8274a4c437e8d24f
SHA256754e76abe2470594f113488b6b3164ec7dd88c330de3b6c8e6b61472b4afacaa
SHA512e686f306515b9b75293ab38a1ec5a07757562ad1563335abb49db3f488fe3faa7252a9ecd14e6a9cc03f98b7245adfa936338b49ee959a20a4dab285ffafe738
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8436e2d9c0af3ac9fdaf879dc4501cd
SHA17029036e79164e71fc0d4f1365ecb5d14dd23384
SHA256ae9a5d1d8659a5ec60a3f1527eb5e707622ba58e7efbf798f7f08115ea8303d2
SHA51255162f1fbc186cb506cee37ba463a70d7fc74878c2212544a3ae3e884605aa3c20ca22f91c9e323cc1075cca54ed3289ce662568a9ee8ef33de7249c6a5a2bb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564573a6d96a67dde9ba9ab6331e37ea1
SHA14f69f4400a1387595374b4e5c9250c11c905c652
SHA25697820746e1d8969c1eb1c0f15a1abc77b77af34d9d56ec1d3e360e4fccd664a4
SHA512a2d087519703cf9e4a68c8d05d50b475b3f48cc2677b95aa98c1efdc098a9fb4edb19469c48726d77804422cff05cf3e3f5babfaa1223625be4955e3cfa7fdd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc17ab99a6ce4226c0e67f3ef4bc82e8
SHA1dc190e8c80ef32c53a19997c04266d6dda4a7e17
SHA256f33a04257635db88b77cceea30f6ea8837b5e5443ccf3292b8ba509cc55fccde
SHA512c3394ac870c7d2f62a188ca0c1515bab605ff4d2c1f13718464d728b13600b7542354f2012f3e079188adc5b63124af4878093be530fa07e8f0f3dd9e22d2db2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd214c7f70e707d99b82119ffa0c7e93
SHA1ecede301b0db469398def4b2a459922384e6d4a6
SHA2567362a9ce9fb1ae422d3dc2d5bc7e622d3b6369f7e889ac20dc4be5dcfc036695
SHA5122c7d3a1407ef6c5f6f1d6c21f805a9dab1b57bfbdbd08dcc13f41b24b219736930a6d696230117cdb3139902b5e03aa77b89b760913d06b153557f0b802abe13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5043b8f3056518833e66a11c321e9a4de
SHA131831477a99f4934b0d51d0aefd4cb28880c0c7a
SHA25628952d1bc66b4b913142422f74c8392c1628faaa96f4e7b1a3b49d28165e8c57
SHA512ee900367699138968d8ae32235b54dc30d29bcc2009a6648277a0ab56af3666fd6be7b2641a673e84da383709f4316058256fad51a27e6d2b6d07c7ab6f15af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c67202cda873187e13b799a3ee3c08f1
SHA17e5e5097dd6646f59dc0e01c14f5c3bb51a92917
SHA2564b97359bfff5931f25d8c36c99b0793de2c80112c3417e7be66b87904385b01d
SHA51261807433cd23e50206901a4d1e490e5bac6bdf3ab02b82b922d8695e9754605d56a071782877ba2ca1026389fc634554f8841b593bed5251d774624e26530bb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7572b89f517d47ae3061b46330a6060
SHA11aa827c60473638982bf146fc5929ff2ca697dda
SHA256073003d676cfee02da9a45f79455f118dbab1a5bca92ad8ccefd602f6b3e3bce
SHA5121765ea5d35e68bdd31eb50cfb4f75efad944bf4554e513821a911bf387d1e5bbac402d2c44caba417da7dd120beda65a467b159f9dd9365d3e20e572d60396de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e037d6714ce38cd4776de55445d76882
SHA1fab35edb76854f1e87a0bead1c65f121b9478abc
SHA2560c31d57dc3dd956306907f02311be28f13dd6f89ded988afa380530405c8ffde
SHA5121d5073fd4f07371e31fb71714e35ed8c5a71f4914bea3174312c449226c41d27e9aee08362c97c59bc6ae693e9e4ee94343d8902060c84bd368037d0e1dafd05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3acf8a804a0aac2909e431bae37f044
SHA18765e976cb8493ebfd757c17899e9df74432ff93
SHA25611f082ec7961a8b80efe2ce55d281618633fa0558343ec390a9f9140acafe59d
SHA512ad4e292be79aa33ff540a5635c24b988a1ff278d8112d6b5968b85739f1a0c89a020e8acb205f23d681999e460dbf62309b1186beb6b97b2231632d9219d14cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5147f758dd8f3bc40401f80dc5ca290ee
SHA10f7b0abfa8b0890d94d42066e434848a1bd46632
SHA25695685b6d5ff10c0de971c6f9f24f13fedcc6e3cec8c487bc44450485ad42fbb2
SHA512b11765b20b9bde367663d2ed2bfdd061ec18e0f5ee713e2dde92a319110adc927afd749e7866b3fbfef875f95bdd6026e7a12f87a77d6d642ab6cf346314e895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8679c71c4081b46af7996e948be6a37
SHA1d341619a86aa7d2d1febd5ffad8544ce0919c5f5
SHA25623ce5ccf1fe2a19cc4fa6397d7a2b106745ab87e765d5807393d619ef43d1963
SHA5129212bd18133c25991d7b50242506f2cb18f04f098b6b851e632fcc0881e189bf69414e9f6c1140e43f29109d33079ef35742436b02593649131894ea91ce3ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5995a9699af3b8185ecda752b9a616f47
SHA1a1596ba0a2a302dfa257f376f5879e6abd5e490e
SHA256142194ac45c8db36904a77334a7f196962982acce453e64b8aafa387c4c90629
SHA51229453988067f8b0b52af79174af9e745f68e53aa972a0b4e34e3be8329905ee65a538ef4c4c4d85bc3d0fe69cb29c9a85764257ba06f789e4403453ac2923bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a4fbf997cded6bd7988b9eb86a33527
SHA154398e91238e99c47965d26aa2ec10cea7bfad21
SHA256e09bdf7d9a86df429b85800d96fa94e5f7380af9003b595231b3ce1e80f6e750
SHA512da4b057881ee561a38425f574567a8d8548b75fd0ca64748d87adf1ff484e7add530b1d5ef084c5abe1dde7eebd5ec01fb5366aa0013fdda40ee6e5eab8b8568
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bd0373ea6dd6ae3608105198e1b4e68
SHA128411b83667d335463e1a60aba5729165eb5810f
SHA2563e1e0b44a8269d5953b78214d0381a15e62c4ef0513196e67d8b1aab0a60a3d9
SHA51239d8e4a3cb83c5c35782d1133e6d7148c7c52a8e8400e3c2853cde4a7c4cfb56aac67d7b71f8dd8c9e382e403a470141a38ba9134694c030c2c228f65e982af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c064695c6edd3136dcb193d932ab0a3
SHA1f5ddab3d31d56a2f1a59e4990a2a8fc6787cc0d3
SHA2563c3f1d28bfb65ca24944ade4a274baa23be290d064ca60742c6b2315a7330acc
SHA512bbdb4fb6f9ccef626ef66e71913ce840aa778f955ed5b19da9daa127233b8ea58046f0a98dd0acab1c67b30ba2ea00d7bb65e3d2db7c4b788e9c23b1b12fb306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD53ce71f07c7c08ab34ad9053db51a8220
SHA11914f28b8a54724075611022f1116a11d7fa7e73
SHA2562990608751168cdcf853dbbee0ad40ca53f12e62edae6f7592afa833b8ad0349
SHA512f20e41c72870fa045c85d9489f798af2a664d0e6d499a9e8af89289e12b112a1eeb75281f8b8b200b5f304eb10ea02d63911479868db0ce19fc942bb26524032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b