Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
982ff322b7a55e1ad23500bbdb93e00a_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
982ff322b7a55e1ad23500bbdb93e00a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
982ff322b7a55e1ad23500bbdb93e00a_JaffaCakes118.html
-
Size
73KB
-
MD5
982ff322b7a55e1ad23500bbdb93e00a
-
SHA1
1cbc4856ee937398e7c927c4785d8c3e75db5155
-
SHA256
5062f9624a4b65a8ccefd29d54e5c048d778a37ab1329f44ee5d82f7d15f0f99
-
SHA512
16d783904e4e936e745f84bec1df779a9f3ce9beace9c6e302fa1dba1ac3c89a0f41868f21995c4872350c3f66509082212e83c201f5af3f6f8f6a82a1b51ebb
-
SSDEEP
768:JivgcMiR3sI2PDDnX0g6sP6kVAKJAqfupvoTyS1wCZkoTyMdtbBnfBgN8/lboi2h:JplN8QTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00716c8a45b7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002769c2f72229ab4ab124a34ff23262b60000000002000000000010660000000100002000000057977b3824aefbb63c10981de8f8ed58b357ce06a0306c748cee543483bc7d97000000000e800000000200002000000042282b0bc84d5cbb937f990ae941070e8e2a73f7724b75e5c62d05e4d77a680290000000709f23bd9ebfaa2497fe9f7b19cb8595bccb5cfd88ec03751210a07b4f61e90f1368225b75ea0bbe56d2304346555f1a7dd9d0b6644e8dff48be1932e52447dc81c46ba4e746cb91f70fd6a1cb915f27a0a156d61d2c6186af7fdd4e70b97c398307408afca3b3b3ddbaa0494e565aa26aa41a3effa3cfbcf750def6bc3a46b9b86ab6cb399fa10a638401c71341c80040000000e6b015fa841d582f9656137fc1ad7b2f9dd7008e9398ca50fd08dfc27b5c99c46b9b9ab44ff63ef7ee421ea565acdbd22b9558a2d1cd3fa4f3790f680cd30fd7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423753062" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002769c2f72229ab4ab124a34ff23262b600000000020000000000106600000001000020000000bd5276a2573ab1d8bca5a9ba04afd802f4781c71ad04da57d7fceab6451da889000000000e80000000020000200000006c715f23fb71e6f48b57b8d5a67cca350ffefcd5749ff2dea1581384b47eb26d20000000c6bc88ee7bc9f200eea54bf32cbe9fb483ae5f511f940dfb6f610e507e6504f140000000abbac43c22d971875b11e537ceef433a0d0ec51e529ca844060fed022d9e957bd063660e3c52cedf0b942f82146e25134563b5a8d81559a10e7f9c67476e872b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5929531-2338-11EF-9A4D-7A846B3196C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1936 2924 iexplore.exe 28 PID 2924 wrote to memory of 1936 2924 iexplore.exe 28 PID 2924 wrote to memory of 1936 2924 iexplore.exe 28 PID 2924 wrote to memory of 1936 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\982ff322b7a55e1ad23500bbdb93e00a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa2b56411335713e5a414c106aad6686
SHA164fa4534b319399e82c2cf7e169b7921c6df485f
SHA256f24e371d579897280de21b45e0d682b7f3bd6903efc29267c65f49ae17b971f5
SHA512482e155275d852f265a6dabecf08e1f3edb234b051d67c2261b7557d98dea0c4927d25f9a7cbe595cd1011f27b6f9d1bbdf498a55b817f190460a9811420af8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b4cc993a13631870c158e51e2d26bb9
SHA1495e6e47487f2e39fea61f34e59138de5dbd19af
SHA256a252d109973c9d3cf96e7d18adab5a79547b82518b8faed32b068b0fe1622993
SHA512acbd5e54118c991f86b03b150e8740647d866552da098998f667cff82ba5a241439201b8833fa7ac1da17ffe5ac6fb8264671c4629e0a8ee6a3827b2b947aa86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b22639633315c0f6666bc83af8ea88f5
SHA14d51c16b83a567d7753a43b485310371c5a66fd1
SHA256b60d03f884b34e5ec52deadef2bec36d092a055cc01ebdd49ad49a1effac7e00
SHA512ca4809f8446b5d9e0a9db922b4ea10e974c00ee0658e087c9c3d6412d03b1aa19b8b20189813a10beb8bdd4ce58116783061b5a3b7da7f7f251ab950e76489bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9b96949111ae63066017a9c70cbf3c7
SHA1217f7cc1852a4bc2ca6e9aa346bcf0948f047df2
SHA25660f0e32500f293668b5d613ff6315e7ad8db2380c9f95ed7da132a916a11f08c
SHA5120b89822000e35eff6081b057123d44afca6e1fa157da1df8b020f83859171af02646fd1f057de9074a365b67ecb16ebe6164d431c863f4a4ccc8cb15af27839c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5751eb8790508183a294ca73ea957f051
SHA16b6a91cb2178469bee528e18f6b491a115774dde
SHA256feff31ac7e8aae2d71abf3e201de0f0fcc73458355c3718856c3159e93c77a20
SHA5124a5fcd8ad666c5dd10037caba87eb5f7d97b2f497c191355c8b66556721077f42d4183491ebbc486e8ccd4bcdbfd43250be80374f259b7a37b810a606d0b90f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5556794a0f6d4a03028b31838f9cd322c
SHA10dc9d824d7001965bf67ad27a2790ec9a9a1e2cf
SHA2569f36a1dbb3d87e49bc41acfd8d0586fdd4090ab261152331048b9cdd5506537c
SHA512138e90ce3b09ff8fa6531f2e383834845e0825705a48d054fd94bf00092b329a737787eea8e2ffc37155371fc358a4392f8aa618bb5532f739b7e3b7d489b72a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddb2bc200cfd1eca3c994af15e4642f7
SHA1c7ac60ab7caa62fab903648098b6e83c86ee09d2
SHA256b8b2a3398a58f5424659a95e825c6c7e84c3db224a2f551677ae31e90bc32f4d
SHA512c851e40cdb312bdfd7f4157d28be6ea68070b99ac03329a0ba7936d0dc47d6639370f8ab405a7163e345ed0c224a448cc3cbb0b75809732fadf26fff313b3a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ce29011390ed0080e01f25345679587
SHA10e6d634668e832862c071039b92f5851d757ef3d
SHA2564a2898154926b81c6a1b368f24db08433fd5edd48d763a3819e249beb3fb9fff
SHA5125eb049004b5c579c247247d3041d12675d320294f07e98e86d31e64a6088a95aaa9e2af4c9b1236abb036f39978e19b5f77c49ccd39eb0baa424083e4aeb699f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51caee68b9b28ca7ffc47d80cbde840ce
SHA19d259a2a7661128c75f8d2b984b5134e31330d58
SHA256ed9455d284c391e85b0d374f11c32292695ee6e3e235ab8fd1f8adfa1d621b23
SHA512df3b3d6b40ca9c99ad74118845912f05cba939c9c0df5bc19b5f5f27396848e7767cc717ca5b8794443babc5d191302e4032ce79f497f1990976838b94c98ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ddc8b02bf6a591d8ca11fddd31a7374
SHA12f9eeb826f25b8bac8a532b508f06e91a009e17c
SHA2560e7bddcb6d6c412ad1d5f2b25de5c6dd1cf1cc4b1c627afc777221b7542f9180
SHA512d075169558ac668cda2da52d22446cd528d0d3dc9e182023a627457d29fdd104b05a7040acd95a6e1c685cea2de4562936fd25267e9e855f0bfc73b1aedab46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575641a2463e90df69c6e22f28f92bdd1
SHA1b145ee0346de6b3c291ef5976c326e908a9ced3d
SHA256a23d448d5fa6a1103704c10a3aaa2754694dd23b8caab50e246edff7605411c4
SHA512ed940c25c02cc2a18be8ef202b454294eb889d135799665f38024f8dad813d01d8dc2f56a6ebb58a8bd79b47eb96b4bdde2ddfa24df69b474a43d11a507ccb60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03f72b51ee1b88b0f1df2d8e9aec638
SHA16a4457e2a34466ceeffe038638abd58d4d621c2d
SHA25632e7b6baea6f3985b09f61c2234f348a656e43e7f4b1012653fb9caffc7be34e
SHA512f8ba64d15d050c89637a154a760e057735a8d8f1c509d08dbbbd7f1ad9b58ef35b49f69022fa27d3d4e75af6e87f5708b399e36fb0e0c438bd1ac9a6dfc75a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7b98cf0f03459cf570249b5dfb32b13
SHA111b1d46dad768bc9871f3cafe0ba3442cae98318
SHA256868300950fff74414a674261b9b02f9dd688bef52963e5f740b95b9e79b169b4
SHA512a90f7b63a420a495bf399ab7765aa34d1e0dd6cdc506676c44a98346d3357335e7722e965e352a9e173f719d9c1f0989efb1ecc58e75456d419e89c1c738a5cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a660f98c76eeedfd27f15988a6769b5
SHA1dc5ea543ea00adfa57ed931176211e4fe027c22c
SHA2560c690a7b001916e737c2f2769176cbbc2e77b56fa3571f0794625ebf94e160f3
SHA51224cfb66b49345beabb72c3c40d635ae8fd2dc2d46bba9645da3e590162584a9d5fc84b7d1404f01a639c8fee61f93153f5a4949a3ef43c02357d3ffb72921053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5252f9bbe20a18f10019c4cd48a4af99b
SHA1ddc26471e1e7fb6e6d06faf4dd16e8ddc4ba80d5
SHA25635ce1997f172051d0032a4c44e46ac439275c8327106142f1c5bb9104e741286
SHA512f8e97eddddcf8af75dfcfb0deed3c06bcff9616548c5372e2c7948206af0a7ac0580ba4ac0ca6f138655a184a737cf02ef07b92d17f95c6ba9a5042574cafc36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51267ccd7201dcfb9df7f73f7d828516e
SHA119ceafff4a43a1672de52aa7384c569e32577eb6
SHA256d72f7984d6c1fdf93767f9ca049cd2374e3e4eff72b298b1a2a16389bff3b140
SHA5125ef7ad8bd95ef7a943aa88a1865d0247e6a4a5592d527ccdb1070b41b4354da3dcf7d40f964a20e9ac45814ffc5463cfed3490d79844870c299abfb6ba5b6590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b93d78d749aff7fecc1e4c8d2ae19dcf
SHA1c0302be31ad6e154547f2b40e327326139e474bf
SHA256212e132e07da182dcf3ce9b819f38112f5bc6196a55d2722f91d3347317a9d16
SHA512f0ec20c608afb1c32075e5fdc80a582da4fcf59a166721615fe6767a8e758d8ac05075c94e7cd67abb9ec243b7c301a237446262ed3448b29778c851df5aac50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6f14bf1d7466bf68bb483eabadffd38
SHA196f13d6f9cb66df1f0d607a9715d4f842d087198
SHA2561022709266c0b3916ac3366dadd527abb51fb68facc81c872c28857e98b4b337
SHA51275df0a3d82185ab8ea596f2eb72cdcddf07fcd85a7cfbd2a199121a672692fa3c6dd17740a3f8aca5c50198609f7eb8d8a57b4996e4467329ed9282c6f0729fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b