Analysis
-
max time kernel
67s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
9770850e5c2e0c6329b018fba949344e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9770850e5c2e0c6329b018fba949344e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9770850e5c2e0c6329b018fba949344e_JaffaCakes118.html
-
Size
4KB
-
MD5
9770850e5c2e0c6329b018fba949344e
-
SHA1
2d9adfae5a135e5dc9809198a277ba1b1193b062
-
SHA256
dd60a5245e28142b43e9438fd07b67d61154f3bc72804e253dc9673461f11cae
-
SHA512
c2cf42a06b0dc1365696abed74e07acdd0a85e95207ce5709b1a871b53214a306ecc77348db354c8bb8610fad1868ba6fba3768a7babe7b64b6d51d3a53902d4
-
SSDEEP
96:Gf/KMJwtGjSwhc96txywJzYn8EHhZinkd3tKf0W9aP+M:C56cSwG96XywS86Inkdtc/M
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2913B5C1-230C-11EF-83FC-5267BFD3BAD1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804b07fe18b7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846d3cbbe833c343bd4be90f5b9c4bb90000000002000000000010660000000100002000000060fb478e5bc7768a110d8c9ffeb85f771de4cdbd3545bcd3ea01dc61e8370296000000000e800000000200002000000050e67ac3699f8a965dc6e43cdbf219f9253ba67eec85aefd945c92d420aae0b490000000da59fe3ad11d7951efa0412bf66602b58e31a79203cdf226c74597d64bb016738b551a8e29d7cfc3ab33ac3562af0c90e357889ffbc9fa71088c75ec9ebff2e5ebe3736b065ab4b2e0c0ad0798dd01a146ce644a730489061e6b157292ff50a87014abf19d6ae3d26fe9909f6deb9ecafd528cd7e7cf783970de59033661bffb781826a49cc185e6cfb24575ae27b83a40000000c28f467303e8509920edc930572db257a04f976708f3254f85e7f7f825455d6a10afd931fb6d0a26b313b64c8975de0738630b5a635c4013f9d9ab7ac26fdaa8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846d3cbbe833c343bd4be90f5b9c4bb9000000000200000000001066000000010000200000001b0d489c8e37453cc19763daaf08e897d45625b2ef1b9685e940c5d99cc28c4d000000000e80000000020000200000006415ebee51676fa1644fb21506b6eac720ec8408a71c27fedc57b633b266ade5200000006cad5bd85672dfe9aff28b3b78c8c548a193f02613b43284c2ed18e1d0b7b0cb4000000015b096df37d7d9616b3a6541a82e688ff1c64c962fc7af79512b3759780e36a81411466ce4f20b9932ff052300697896a3c6410d487ef7edb785d1d0b766e267 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28 PID 2696 wrote to memory of 2228 2696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9770850e5c2e0c6329b018fba949344e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5956b169a49b73ec9d8444fd55aa0ca5f
SHA1ec1ed61b21daabe0fc51efa223ef0029b86ce46c
SHA256ed37331ca7ce7c85b814065e914c727e321fe30d9b408c64547550fd6a7e5c51
SHA512bdc9349de696486efe3d0b4d671124d015c0fff3c74760f1636696f0b6d14388894b7d8c4611569d69aa29b7c97a7f4cb5a5541bd579be03077132dc8e0bc647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e648b771dd6c9f5bb79091603c2d3681
SHA1ef0cca0914e0e62aca7f6b96610d95c1df24a934
SHA256da253cd14a05315d2942db96d155ee8612dc4890c6a9c1a2d7ec7b4a28223fc7
SHA512c6473c5e32dca90dd1591ac186786744586e3a72561a686a467749553fe9afc365f3d69430328385e9233abc1a0c24cd0cc30c9d0a2500b2d6bb9eb612da8730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f615fae833076ba4e53f6bcaae745d9
SHA1f3620fbc08fd345fd7b42a4e9bafc2c2b5c08d72
SHA256092e1c20d378a09e808cbd0f4ffb8a958610e21c31b069dc4dd36a5e2b673920
SHA512a6c9a48891f07e6518340ec18e22c2348c21f05abb46c3f640e5a08a715e6ed26851cb952bbc7a5c8998c7b19a9446cd526ff6bb5e78450ed4960f9379db777c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506eb532b42d843df71dd60bfdcc3ca4d
SHA15cc124e4897eb2820db0eb7338397bc9be04f1ea
SHA2566767ce72b471806b5ba2e0a2056b754235cd19897e640847a15835d2d0515bb5
SHA51261acab7dc6dbcfe015258b023272af2c1967be5d3cb3ff98dd7ac0e4d18ffe9026c33c6d0e3bc05dda9f42e6ad6ba463a05fad695a6782bb7ca4c4ba7e122726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d26dfd3800cc091050f6ea18f9e876f
SHA1f57edb8d26e437d9e5bf061a0827bbff53035b2c
SHA2562716b9d2900f1705684847e0117e82d8ea787e2de59a97dd8973ca909553e49b
SHA512fe6de98934c388404c241726457a77f28db1fc43238a55eb155462e394c9bc7e7843c835cb92157420a2544ac2db18fb163db7d6782accacae868c740a783fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c24b43ee96cb228ea69e753e345d4412
SHA1e9893482b27ea54eec3954d54876bf6a4f7afc1c
SHA2561b97b883f4ef286a7cd3c75cf5de2a5e839ac09d9c8e84c17c038aa27865f852
SHA512c9fb8eec19b2f95b6ec1cef8317dc32508e2495ffbe6b220b275e3c876c4c863827752edb6d7e69dbdd1562a0892d6308c9d024d02911a5e60a6b12a9bfa05b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580084ad63a8887bda6cc1f77372f9a18
SHA105c30e41f44c39c1be304fb4b1eb1b1c7d2edf4e
SHA256126dcd706793f14babe60c95504a4231334116dc996906397c85e03b77b77b83
SHA512eeae5e750f4b7eff36935f110607ad915d7d938daae68ffcd62023ac9d0ed29ca67c182065638013146de65da5e715a41076204b05152a5df3831469ced64a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ccdb266a677929bcf57b1fbdf44fb6f
SHA1a88dd366d0b192fa1c840b037abdabdc59f4021b
SHA256f156d60034896d92e969f1e4d6038278e872a35b69cfc6b16c0c8b0fa90106f5
SHA512b589d21af5f904bafc20522163b881159877b0a3a67c4fbc816df39b746e1539a73b7dc3aaa96843f9064c3d46d31a0720fef25cdc06357151ffdc3eb684f564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56909811d8e21000f8539ea6cd131cd7f
SHA16ba2a9f6097a530531c9f7c4a37c023db4a98341
SHA256f545154d0432214cb74eebde8be495ed29fc44c84779a99edf7e952b431f2e8f
SHA51247838f5162a791451d23f041138bd6d9daa8b2e20463fd0d1c66aba7682ed71ee4790ee8964f9fb5437bd73e6f6802f3d3d1b9ede6302232667459d86526d0a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50651ce45d0cd659bdea936059081952f
SHA13a1e8dc13f7ac184f5163339924b53a0b3dd3f9d
SHA2568736eca207ef7adc10b235a351516959e2540ab6b455cb384b879eb20ff8f622
SHA512027fdffa8eca2ed4ffcb2f958275443b38b0dd8829658f92760dad87c343859bd7d3759855216ab77654a9848d6c9d0d0d2e63c97f687eb3fee66b4455d9d512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ada4e9f6496485a11870d0de7713944
SHA1d1256f61906057a818a5c84cde69bdfe58026a74
SHA256f8636ba3839f982a318946d24e51871531dde246b80c78549b2eba1c05caa2bd
SHA51284f1e243556f6890b2413e11d363c7686c52b87c2e6752fd2cddaf9db07c7fe7880601cdbaa7befa2c5503e776f4f1283af4516d2095a216bf596feb43a83822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50108d8cdc468b881fa5a08c62e177d54
SHA1993df69e6c39b1042fcbf7d80cdbd3314be37cdb
SHA2564c8969c29060a8e5a5be9e36e808171fb1d9c8b3bf3c88a08d0b4ff149bdde15
SHA512a18491c594fcfe920fe293185054171e3b7575c26065b5741ab96590123671f6ba8ffb88ac959b8a784a6c789cfc8bb0539f0afd965b100a4fd84b457573aace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576a2d49d2dcfaf3b3eb1711b45dbdb87
SHA127df36c33df52cbc07f46573cee321671e5d6f80
SHA2566db3b80e88e8c877271c344b8a43c64520a735ba4ac175a6ab71b5c52b115435
SHA5121f1cfcde6cdfb494e405d87142bff2456145c55c598106db7e2d22c2ff2ec4fb634cd75648e4307aeedd541b8fae537e724775897a38bae73a8c14d66e0c8fc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5a12d210869eb7b0d26e70681be35a3
SHA1e3bac59b108dde53298fc7a07225a85cfc86bc0b
SHA25675d22f71e6e7f5dc8def9b5df3901232b9caf834b8f1e27c5207cc4409d912ef
SHA5128290cd01727abca6eb6dd3d8c2feb06a1dab939d44e3ee45d60639591c1f8dd884a6114c5ed3bcb84052612d7bb4251eda742897b7d2ed66f7d23c4f02e829d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ce3ead4dc6ad7e120caad770b149193
SHA1582fc747f6edaf02db29eaad545b28c492c95e39
SHA256087498a749bb377cf302e8a23a16d68817feddf67c6e9aabca4178782aa3f0e7
SHA512494939b9e7fa62228d9c8114903aa209e3f0a59f939570e69fa69c5597d81dbef14a8c9131bd750569083d43f1142626e7beaf09432c9949b2df8a72e4036442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c135c4566b3c4738a24b81116e387310
SHA1a5421844af624f015b8f43efac005ef2d9a3d00d
SHA25679087e46163ea4ad5cb9304e69b0e598014b2484e5137154e7043be69bd6ed4e
SHA5122d5ddfdd97cec8ceb523e3381712828c7b1ec1904b37a4e7588d9f29e642943e8a5d1e5243857491298fc539189a488387b31c5192a51ab9d478327bf3bb2b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddcda4575aade92831fccee5b31ab30f
SHA1bf18afe4e229fb6ceab30dd969962d7dea7f5888
SHA2562ebc486a92389ad64400d82b36b6e9bc5c69008c80594b3141362318b3042d50
SHA512fd0d4ebc2310790ef1f65765b4f419d4f12f6a94d69ab25e3ed0b323300b1c37e33035147d2fb988f2bc63019a9893deac1f1258e9eda4cc6453da7d5535f70b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c45f7e8a561aa90151cffeaa50eef7d5
SHA1300151461ab41824c06f007d3f1426ba10d937c7
SHA2568bd743269f4ed3ce3830f0ac743c8cc8e2169a153088c8913e570550304b0c21
SHA512a53a191a56e377593cd964d9ee76dd107cbcaeb2bc4d2acec0792436b3bb59ec68cd640a011f5c757400545ca59e515874917a58c0cdb3518e73ea3c7fea538b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5314f97e41376a3b4b205d00f2ee1ccb5
SHA1a36a9873ccb8276455895a9b3e9e2d041ae06ad9
SHA256a75f15108b973f3b17fc9b246d1ba6759c7835088db3efd63a8dc42dbfbfbf48
SHA5120639e62876bfd8805f9349cdd399e7049c4fad8abe3eba1f3012382878d30346ac6a56095a8c7d31302dba14bf3b01ad26ef8a37696d378bad8dcb5eec08c431
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b