Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 19:47
Static task
static1
Behavioral task
behavioral1
Sample
9910cb08b9664efc71310bccc5d318fc_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9910cb08b9664efc71310bccc5d318fc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9910cb08b9664efc71310bccc5d318fc_JaffaCakes118.html
-
Size
33KB
-
MD5
9910cb08b9664efc71310bccc5d318fc
-
SHA1
9e6327ab384464fc36b105272d5880c08b1a3b67
-
SHA256
f4d06507f97495935176cfa3e9a0ce5360bb2aa55330d7fe94f8cc6d56d0450d
-
SHA512
8507a3a553f4b137f319b5b2d132435a629261a6ca4b1c0807edeaf4f0f9e3ddca2e0097eb02b7f5966c2c5f1b6046721a67da6df80a7beb5b386e3345574ac9
-
SSDEEP
384:0bCvBDt8iHfrOdSZSeSySWIaE9VyEFxLR:0bCvBZ8iHD5ZSeSfWIaE9VyEF1R
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000036e17b4cb8217f4e861e8da686daaeb2000000000200000000001066000000010000200000009115f29f732cf83671ce2a97a174ad33081e33017c2bda247a358b0a5cececba000000000e80000000020000200000003803ab4e3e462abbd5bd359b94b3771244ccfd91245647b40fb0aa1e56501193200000001e5b817f4772a8bb1d66a820750e0113524d54e1292ef2a83097f7c7fba4276d40000000a95faa6837b1f499090fc73ab8660bfa1d4972226c071d7e2f71523920496e0bd93fa481121068c6461390f51a0599774b3fc19c6b749e567e80445c6773f15b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3040136781b7da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000036e17b4cb8217f4e861e8da686daaeb200000000020000000000106600000001000020000000dde4638d1fc29108f6c7707cd5e69019754d7b18bfc3fabcb1e15654512fe418000000000e80000000020000200000002a0300f03b87d150059933ba4404f7028f91461c0cd333fb839fd30420a068d890000000bce74817f23b1f41ec86d618475125017a8969715afb34fa5096ee188081d5f959b6f30afee212ad8457b156a1f69a954ea6915697625e5897890e33eba4a6119427039b90aa9bf07c0436ab035b5e5e80298db217e61c0b577db3d4909a39faa753c90b2309fdd2a2adde81717236b0549adccb13ed820709a969d5222651d6a25271380398d8337f8839e249c3f3fd400000008df56e9f4cc8ab83c37ea423749e261df4d4349339c788cdd5e987b65b70de534993f0c2fb969d78e26e4dd27468bfa929c371fd3fdebb0410415cc49040f8e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423778770" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90C5E6D1-2374-11EF-A339-D22A4FF6EED8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1972 iexplore.exe 1972 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1960 1972 iexplore.exe 28 PID 1972 wrote to memory of 1960 1972 iexplore.exe 28 PID 1972 wrote to memory of 1960 1972 iexplore.exe 28 PID 1972 wrote to memory of 1960 1972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9910cb08b9664efc71310bccc5d318fc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571aa11acbed018cdf2ef5a61076ef79c
SHA1a3229f71d386e661718b077158171ccc9997e15d
SHA2564263312261b53778fb0a57177b0d0d1f3dcef9edb79a92fb85f24769bcb4497a
SHA5123b4f3421b8b078e20c90434131bae4cbd113ccbc98759d6125dd12650a8895c800e929f5192ef7bee37d375d894d498c09eaaf0fbd7cef16f9ee5985199d84d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f35ca5f3a7d75708f470406a3eaa276e
SHA1b39daad53ae2c41a7a7bf560a7bf250c70cf7af9
SHA2561ced6f6f6d716b6b887e27c5afbe64790a5b0aaf5ce6980f535ede75fb915613
SHA512c97679cff5f4a72b824df4d678c2fdbda5db8dc81ae45d62bff5264052b704a0820e88cae512cc4428551768afa1b25005cefa718e3334bb484a191025882ea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5628a8783e2d9c9ef461b7de064d7bee7
SHA1a13004b23fad7f7ba3bed42c95325be53a962921
SHA256f0e71739105ea1f646c4f9b193dc832242771ba4751ef96dc52266c59a4bd882
SHA512b3fa8eb8e8686cafabb17d3aec014701ccef1c6b9ebdccf929e703578a85b63ab0a58b729d795d5691afe279ed4504a33642db45866e321ffe299441089e5f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a02260cf1bbf8dbc1015c40dda8ccc2c
SHA188ca016d88cd56ea2681c4b0272ce801b33aa945
SHA2563fbdf9f0337844e7421ed173d8aa8a35a4c494d9268bd89212e6f96836c09edc
SHA512ddf91582769eb208de618555274f0c04719516b844a0949a642946cd516215433e4686bc2a74465df25104b2cabe7f7c5267fb42dd956ed8b0e41a61d2c4072f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594147d4b4050b1a10dc0c175c3d7147d
SHA12b9af1116a0b5df33444e6bbd566d39e5b92d662
SHA256a9d0f0c83e8f0492bec5e46f1ef5bfec50d64fda31ef0d100149f9e0c263d62e
SHA5123e97e555acc77ac8a633cbf17fbb9b8f4ee69d28480f15d12dc64b8525d45b3c55cedcdbdfae2f634869b979dbb81e5caf0e8c5647f7fe0364942264f6d737a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9cbc6e0bcd554659d372568568bf7c9
SHA136adf3c87a8b74a933a6fca1a6f81c8a4f73bb65
SHA25688cf815815dee85a26957151ed74d121b7705d05bd7612f6b46dc570385f9163
SHA5129ae05bf886e60c3fe11b50e4bfd073e32b3f03a738debb6503ef1d537951e583997ddccb03a96b12ccf94eb0790882aa7e30e69b188325e89ce954ad9401ca90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f17a4684748fda3d06b099e4f2f25a81
SHA1b638d3d50a7531fe3a49d8c725226e58cc6c97d7
SHA2560cbad08afe6404e4f4af16a11ad907bf9a2aa5f123d7fce108880430d0a4f904
SHA51201dd67eb6fb2b40820a8ce87e312fabb86d94b045d40ad4bf1780697bf665002f3efcf8ea53359c147acdac0bd7b31b6c972bcf2a857319ccba56c0c799df10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d963dae8dfc35ecfa111fd8499394be6
SHA146ed2bb33de0ea14cc516d351f311bc112b8a553
SHA25697728bdc5f41c1ba3ea0594b58e0e568b73b9193db522b90a820ebaee8ad4eb0
SHA512b0b7e691c1ed373c76eee2fb1550571c2aaf066b93deedd13be87820c93186ec9f1d4f43e99f5c43f3322371904bf8e6bb44c72db8398e64d8da621588fc143e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560591b3b9658f6861c0db3956f4b1fea
SHA17dbef9339c09781c240535229679cccea02a91e7
SHA256b77d9476cedd2250c19ae36ed125edcf547e637c43f56dd6bc3c65add727c63f
SHA512b7787d78712c8b23b54fe49a1d30157150b4c03c4d77bb95d60531b780759204903518d75d750693869f1e2cbb189bcad36a643994f92aed7112d2017667d7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5293e5e337deccd5c1681e1ce048c1f53
SHA13df8536165bf18d7629bd0a6978db1c015ae4baa
SHA2561c4641c7b4d5b67c204e72f0f64651b7c7de79575b28ca003476220ddefdc176
SHA5126f08de4363de61254c36ce1e24e3648780e55217bdab9d76456badbb46eeea1068012358a1023199b6967eb321c50825ef6d8fc2688c08f99431b1aed743ea16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b19ddf4d4ba26f6034c40b2dd4d1468
SHA15691b824b50b1d26c969a2407313e3c05cdaabfd
SHA2564aa502229175799d5272518159cf9693728af21b52534890ea690f35cc6bb764
SHA512869c8594c1554f9ac53860106dc1a58dfddde3ca712d55eebd14f6a850b8bf9a369f19d54c0292cc9f5c1697123e22d7970cef9b571e1f75b9ff0078be4d9ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c486d563bc7e2b6ad66c61dd0055249b
SHA1db20ce0d87217ed5fcc68357bf364890e55543f0
SHA2562cd6900d01f211a6143318bb00e671de2060df7a8b10be228795a9e552633ace
SHA512b97b8cf494fe83b47ce34699f3f6c55c7d0a408697e126c9d105ec9c5f7d8595acbfa612f8ed915b9104b4143e9028dcb0682483720a51637e93a686541b71ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5003244e48a8a9e64146f692c41d152bf
SHA146b6b7c8c8a66d02f23330463bd66902dae9bebe
SHA2565c102028ad7543bc6bf6a3d4b6f48f11a0cd024bf926b43deab4cf5ed3ac8e84
SHA51277e1cbdd6ffea158ee8bed38324d9c233f665b853db3c0c4cb68c042bea24d82a0e5f14dd04edddbdaf54385e0c12e5ec0c749b4a9d4349f8961bce2818ad9f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523f5397ee7d04b798619080365e26996
SHA1b6021a8f8154acde4a7b0c2de6d608b455b801c4
SHA256ac2591c2b3ed2f9ec2696dab8dc7a3660afe73b7e7dfec0bd11608f0be5b31f9
SHA51280beeb08223960f7e32fc068bcc5c80d56ba5e75c39303db060e0f27c1c7a02b0ff60e3f61e60c3d35c0f2cf05ddcfecec272261da885d7168c049671706ea5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7efdc61bf4a984af493a62c21e45bbb
SHA198147f8aa185ef67239c6a2f09e4bf9a15edf36f
SHA25602641a8a3e83fa132c34b7cd60380acaaedc200b0a2646e2551a94900adb0be1
SHA512caf01ff61a5ddded9329e1e7bd25dad91166e2dd8d834c14718a3c585aa5fc2dfae322b2281290f576eedecc8e18c5b6803479f7b6a94f2839070f2de7102546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55322a2e9d63771a3ed3bdd12d3617e2d
SHA18fadd57bf5d5e6f041b8294341e196ea07b166e7
SHA256aa9306fb548fe2ab36cde3810ca6572e0d9cc5fca7c013524a47f22840dd5d63
SHA5121260836f325f25a0f6068cf227eec3e16b2399c752c9ff5bfb5e0fe8024010e9ee763a0d3a4fd6b0a034902626b4f5e5f6762aa76580af8427cad2c757de4461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52010b2a0c95f473911e9f17690c6ff4d
SHA160da3637fe620a2d8bdc25f6af4e58ed60ed6320
SHA256fca80c9bcca1d520c50de0c5cd5c4de77a7b69687a24fb41988e1518077464e9
SHA512567e1d8d60fb33fa9b5203870a6bcadee4344e28b24916a3358e0bb401d825331f6a97bc8138830cc137f1d6224f6828195aba250c9b15776121f95317ba7fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cef590aec648daca3d9bfee1fdc2895a
SHA13112a12405b45a602e9d0e501851a0b21195d8a6
SHA2568f55987114d282b73f39b1a5f3cc2c3af8cf0fdcb49dfe3d9c077e16e7de981a
SHA512e58899a16e37ff7a7ee74a96e9a30d657b2f2807b247b087a27ea614c11dc372d8db5d7455ffcad644bb7634908b7c7e87f676a924fccf097b8518d565fc9a8a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b