Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 07:52
Static task
static1
Behavioral task
behavioral1
Sample
9789945ba585bbb3ae6496ef1f15bdc2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9789945ba585bbb3ae6496ef1f15bdc2_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
9789945ba585bbb3ae6496ef1f15bdc2_JaffaCakes118.html
-
Size
461KB
-
MD5
9789945ba585bbb3ae6496ef1f15bdc2
-
SHA1
969c397955acb6ae820af8779e578187e98569ae
-
SHA256
dfc8b5864c98604eb3240b1a32d2c4da886fea847bad4fa56b3c4e01773c77cc
-
SHA512
d65345258ffc18c899885f218b29561864781aef34de796a2131e4249a620cc9f5564e31e24c04c6b42099bdb06b2f43d9b22cb904528823406913adcdde7a2c
-
SSDEEP
6144:SSsMYod+X3oI+YQsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:H5d+X305d+X3S5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423735838" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ABEB0E1-2310-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507d9a731db7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f39d034c5c37041a42c719e637fed1d00000000020000000000106600000001000020000000d33f2ecdca37ddb3cb04172e435ec0640b602fc3a715c250f4ddc34fc8badcb1000000000e8000000002000020000000ab36a70ffad5634e1394f7f7b9ef68fb979e4917014892b2b136243a6903081520000000b22943e1cfc71122c7153ddb52254c080f56292f020dd4ab7470d4de979ab1e2400000005ba5f5e1853d9d87b6f18633aeb6d276bcf5d386f4b01db329a9fdff6985197a105cc079d19791500bb2b4204a5df5e49b16a4df09dc825154799649eb0bf45b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f39d034c5c37041a42c719e637fed1d0000000002000000000010660000000100002000000079e057e598c70b6028ffccb51615ec8b47ec104b24e6f65733e9ede651f03732000000000e8000000002000020000000278b54e0352de6aad7190d8f64a0c6ad5f5f534a5c11e023cee0ac98a567661990000000f19aefa7daf688d517bcdf8f7445e1cbd3b862668f71d9b40576b6217425c01f3ad7ad555ab54ff6a4f1cd2c33017a322607008de4d8b28922c639e7d82e48cd51807065236475daf70b304e3dbcf16f10e12408c4bbffe9981c8f670cdd0bba3f00b0072169695222e961884e4934c69edcb2d08aff428d3b52d6924ce4be98af1cfb1a78eed51932470b1c70f2de2b40000000080a2321ec7b65b2d1ac03b8ee4d58db60da0c7ecc5f6d46c292d09b0a4d6768e3d0cd7e99292150e17a5ec7f214a6d5bdc1fef5eb6f8aacc9ba3cbf4b047d70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9789945ba585bbb3ae6496ef1f15bdc2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d7a72f822196a420d7a02c0e786ce19
SHA1a2b8503791be31cf3b61727e8a9be75bfa168619
SHA256893ba82f08a3f482e7bb509e9f740ca2b635c140645e5d6dc6d397a7c3940adf
SHA5122217c07d1ff77993eed28e7c9b0122ea05e6588d4f434da56e28210dd6ffaac6ec945d7f53e4d467281eabf74c51fc858f5812f1bf10f992e414650d8182eab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d716c62feedfe8c96e028c9b9312d61
SHA18f7c6feb89b7f856df60d340b2a6adbe75c846cb
SHA256a67137ed25da33db3fa179e4819648ff2ed16112bfabade72ffad0988fa0b9b2
SHA5120f0f67d473946ff9058b258c9b925086b0c535c9b8125abee0bfb8646bed8eca8e5dcec7968f096482020553b6c9bd052571d604ff321b11c6b9fa92fe4d657e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdc283c28327ca11cfbd34135e4e71d8
SHA1fe007605af477f327d2a34dcd034325414d8ff02
SHA25637158f40dd15c78a4724d364c0090386e7fbd4803f51a0258edb0dd31e272f94
SHA51234f5b3a8c27c6544349335b6980310725ff9000f5fc6cb0f9782f985fabb4afcc891a680c00cbb2b0488b0598592e855249d32fb23a2af7e492834e9e1de0602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3f50640449616e47bdaa473452caaf8
SHA19e47d93643294cdf27ff8e6620a8b5bfaacf90d0
SHA25624e91d5c995f1424102e7faf2cd4e3f3cee8210c40d2445682cf8497c5f4179f
SHA5127cbc302fac801c4368c94349ffdd47f90d524944e6334eac3423fbf7a1d9f9f6a8036ff6fb9d0ba5f902b64d8c245c6d5282975402d89c7a5ec396f9ef82f35d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a862a3c6140018aa525d33f523552874
SHA1eebafd37f6e82d8387ae57eefb52785b509237c6
SHA25612eb7f2ecb34c3f6c4fd020477b61562a272c80583ad70edab589776852a0478
SHA512b1ba6ff8cbef4460d88b6cf546f3fced7065a52f0d76a77a73ed4b138910e0c8bb383ad9b17e6e11c5eca611d8638e5ce9ba629e479c2fb1474d09d93551ecf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0638c71af4a4e0aed8f33663cd0ba36
SHA11026f4c92a667f36653d6f6dc0207d6e731b8169
SHA25672724a04c5a579100d032af6d57abeb9466c1109f1a064a618b8e3640ec4f9b0
SHA512ca98f2ced2250dc515a71310166c40dcfac311fd1bdde4d381479f88ad67f1f60276ba79154c9eb38a9efe63e9ed91b5263114f39c979aa44e4bda77d6f862b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7efb03c886d9f14f12dee2334fab972
SHA16eb55640e2c7dcb3950f7c9f6e78b65e56e5b9af
SHA2560037b7822d4f7c9974ab8f6654996f478d07a79693a63689178b4a7f65d092ca
SHA512c4e6376ddda34c0b330ec69c02980cf978e8324f1b882a57a54f2461f90e691e501225f733c7fcfa35ddd661fd32a0a8d67987cbcb62e04059828ff22df06704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d993a8750aa610a4ce9355b7df6e6729
SHA1e508e0f67c0510b98b7c7c5e0599fde4f631cad4
SHA2562ba8fa59789a1579af0700352d64417e591995c562fafeaa901311a538a29fa1
SHA512ccecd395ba858e6bc049285eb34d0d49489cb0f8c3f89ffcbfe142f8882751417333fbedd077a6d5219b42fd51650c936d498e6dfbee22ad17e6287b8daff237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559f2e0d034b6e5c069afc8c66f940b96
SHA1bd9d91c48bad4023da8c005de414c0256e4df3d3
SHA256c717c20058f32fb15fdcdf6410c78e4a129a83ae3337f3fca5a736b79b10a9fa
SHA512f25edc0321b7263daea097d653401071c972c7fefaa3162b269c546c354692d161dbc0e70e7a7fda274b082b9c261bb9216c5d41755e3f45a675bbfae7e6111e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b45e098bdae59bf1537e96dd905d3fa9
SHA11578b2cf59983bd629aeda7c9233599d8f36bbff
SHA256c05ae3cc608d01fb8d6595fa9ab59c102ce25f6f76ed5cafd0039e6d390b3e91
SHA512ec2212a2ce3e3cb67d7d10f848fa0c74a21536575dc2330f594c2f0f4b305ae2d4ba6b6679d594317d2375ac0bb6e99a52f69acda5d9f280b84c1e264c4c4446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b865317f1ba80c395caed60434f3faf
SHA1f68104ec030f96ff1a5adb1c2bdc49a507373998
SHA25635f69e3405e7607dad02a0725d139aef06bdabe4b1d2499c54dba7e87751a967
SHA51242db3bbd057c2fac9155d98720c90e95d6f4c099383766a6cf07a7b4beed7b71dc72bb2579f89b33b5687e1889eaa87d469d45f682ddd7367aa61062dbc899d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e3e2fbb090eda4620557d2a985adab8
SHA1071d7a99611c3972924e5fc02827d23126a13273
SHA256917d0d3e67049ebfb2d9f77931ca5053927d895282b6180189800dfe94f86935
SHA51234b2239181f7f48089ff15ae9c23c05e9d2504a3cbf4d1c0b24f4f9035c2f743532bc67d642020acd198289613c253c485808391b69e4979f3879c365cd8b4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8227cf336ae306e4712706ee4594666
SHA1a25d75692899d846843af113b68a48ccaf10a7de
SHA25601ab403e730648728471bb142126b72fd182e904c5490546a1fab567c416ad5b
SHA5127ca75641967278e2ab4f5bd5bd9a0e02138d3bf886cb4e7e677c42e2d3a15c6fe6ca49cf3d0f6423608820389722d0be72b9bab402705e0cd62c04c08b884f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c04106b89a3ef33900b938bcd62c50f3
SHA1e02b9955f23833a8d07977347b8245093dcb3f33
SHA256cbe2b7a315c8bea088535fb5064b09458af01dd7da2503b4eedf8cd637fa99d2
SHA512aade4220085b97dcef029296d3e6ccf7b27f2b95a5677941079419706db842a83be5387e9fe5932541e0a464625ada95e763dafa7bedb2698231c3c946910171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe9bc5800c646a27a536d6c0e755b856
SHA14749494f9c1f502e27d26744e3e9e4471186903e
SHA2560872fa36ccc2b07557fcbb498cebf6a32580189423a559ea64e4a63f8f7b8ce4
SHA512ae27c9e24b1912a71b699ad58f1cfe8a933175899e23cdc920ca3459091f58a0432afe4b2b1d29e62bd6906b235820ea88ad967e9083e707d8b8c1f8ccfe7393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133cd9f134a736b9ef0b4ebb669d1fe2
SHA198f34a763880cb0deb9e385e8f16ddc1a9d2338d
SHA256bc9aa118cbc45997fb0dbc8585574dc14a4616d37f82e8b0613436480f8df735
SHA512b38fc478e0b8432a69487034fe9545eb7c82f1ef4f1984538578f8a44b5470003b01f2223585e510a17db52e9fc72698f140c9b15fc067af2536477859caddfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e5c932f12aaef5ac844423045e9b339
SHA1947ff75d473473729367080d5d526fff4ac00067
SHA2565884a003d5e974d76e506b07f8357155eb885a2a4176cb043a450c5cd547786d
SHA5127334b65c2a4434ab50f705d9533b029d151124dac77701ba4920858db8d25d24d6a4c09f9e3301c4b68180a147b550ad800b4841ba3cf7f622bcc7bab5a06960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ed10c4755345ba4afdb3356388fab5a
SHA18a839c5b01a285d28abf286d03387e4231a957c5
SHA25617bb55d89ee29dbc78a8088a5ef86d7920372f1d5119ccd4a2c31da51bd61f1f
SHA512216695488fd007e350e1c6086e92650c77b9ebfa82442a148c8c6cfb082d9f1056fb490d654a759122efeb206f49f2f0ff060399d4d93cfcb4ceda591edd421b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b