Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 02:10
Static task
static1
Behavioral task
behavioral1
Sample
99c799d84f432dd55611946ce1a7ee80_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
99c799d84f432dd55611946ce1a7ee80_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
99c799d84f432dd55611946ce1a7ee80_JaffaCakes118.html
-
Size
125KB
-
MD5
99c799d84f432dd55611946ce1a7ee80
-
SHA1
a244d9a91d496ba3cf032d48cb3681821e6fff91
-
SHA256
a6d909d5384647d941b3c776f1cffb098243ea1957d0ce1b2c9cce8ba301733d
-
SHA512
b31fa47c76e44708f82b781098184dc34be3699d2fa0a3f8873d7ab6e45f27c87be3ab23f599eb16e829aa1760605400fd66e8a8898ab2fabdb4176d86e872b9
-
SSDEEP
1536:StlfX+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9ds:Sv+yfkMY+BES09JXAnyrZalI+YV+p
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000031014d20c7852078ff933cb126aa088d436b1e9b40e16731733ee7fae04b5fd4000000000e80000000020000200000002804dd4a7d79435deb1764ef8a61f098eedd8e720bd77bfaadbfcff96e67d25d900000004f2a859b6099421672afb456807da45b9729ff97df0f79c26b9e793c304aa9a846ea5d40e522c51c4c938aad2d5c5b568a7e2bbfbb79aafe84501e6eec1e90346cb4b5bd6f3850fcfeb0e595ee0be82cf1826dcd80340e43ba33d8812974ade158b422fb797f462f18deb7c1fb69688415afd0d22fede2e91a8efb9fc4dc38ef5b2ca6bd55dcc9bf8477b913694ba8254000000057657123294cbcae67656a5143156a8168c22039875e21d8dbdb685f30a52b8e0c7d14dd02fa239d637e1f43d0960092c7f22d95cb9018f25ceccb9395a71816 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0068cd7b6b7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000be8774f727a11af1dfe0b9dae9d0f166331ef68c0875486d3f58765498f718a7000000000e8000000002000020000000a8f92c85822a41112a59a17c75067f9833ea084b74bc8e306b9263545c8e35402000000023ae9e17709f08823e1b7a64f6d2776dd3f09aff9b481fdc88e90276cd69166240000000ffdc1f6efae0642a1046c81ac66a1a2d96767066b9d394c807593f22142a8830a44652adf0686573129c8757615d190ceb1e2d072b4489a0cd69e8523b75e691 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423801722" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01C56971-23AA-11EF-B195-DEECE6B0C1A4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1832 iexplore.exe 1832 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1832 wrote to memory of 3056 1832 iexplore.exe 28 PID 1832 wrote to memory of 3056 1832 iexplore.exe 28 PID 1832 wrote to memory of 3056 1832 iexplore.exe 28 PID 1832 wrote to memory of 3056 1832 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99c799d84f432dd55611946ce1a7ee80_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc4b21a31712fe8ed52832eb3f938afd
SHA134b7447e5d8ac7691dd349e1a3b32e6e87f36f6b
SHA25662c29119fa5b8fb6b0009edb051aa9fc3f8a8869cba1a8dbfaac7202eb0bad6b
SHA51214f6fb26353197efc422f058aa13a2d1a3e5510e8d13b3a4dcbe307c5422015485c69ecc86f2fe3c802bc963a243e3bcab0da1f8fbea67888ef302041432ab55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f3908c21786fc279625928aead900c7
SHA1bfb3df58b9f209ddd82fefbbf9bc3b1f42c64e28
SHA256cc0e1d37faa4ad1259e5a40b97faacd6d7b8a3829c0310f68a0caa55ab15812d
SHA512aaf4ab985b84711554565295635f7c029c5d741f3885bff4c84186a67469fbbc36d1e7ba8272049cd0f0a59b8591426d668dba998f304ffec694219a6d7debce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562d195377f887e31086703229967053e
SHA103e901f1de8de4053219cfaaf8140140a2885c4f
SHA25686fb489e2dc84342c34435a6ead5037137edd6045846fdd8270198db92f51595
SHA5126ff7d8fefdb0923e5cf0a01cfbd34f7c5a5ec4c0e34e939bf6d955659ad341948d50e8d6350bcad8f75a5890c3bf1edc7e802d9978536ee0ee90b42ae4bdfa03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e91d95f2c4c8fb12d66353e097f12ea
SHA1d4c53d7f53909abc622f205a9f78217a6424b7ba
SHA256096b42d89728622d18303de354940685ab2daefadf95504fc71c1e994d615d2c
SHA512b11a186983406eff6fc8cd1fcd1440225fc0f800ce2f66aa2f73651759d5eac985c2d98fb29b7db73aa9a969b21b0e24f593d75e8d620368e779a6822996a2c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59eece1a31482bcd3349ab7b4e35f2c97
SHA1914cb4eaa637e7624b4aadd5b16fefe4c10ab110
SHA2560bdef0155bcaf99517c803b2a928cc4a1e7cb340d6709878002600d41e36230f
SHA51261bc9cf3f27e64b67656be608ad28da8ca4fbe19da910d274d7850c52edfec1e1f1339452f59e8ef7f85598ca0a499bf6b970a3b571f637974081b579e9009f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5645513686bd24b68a5b07f85e192e8e9
SHA11dd32a1d2ec86c4c37d9359cb46ac924041b1237
SHA25627290ee70347f2344138a774d269c15dbd9b55dd38cd6cd642b401c2a76ccc9e
SHA51290109fec735cb9f48a615eb2911d67ccd633439a15fa00c79bcedd8b0d2e46652aa0f6edda521918f90073383ce3fa1339ae6118079d7afc19b1c4b917c33548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b0fa0f7d38461afebabedd6770f2159
SHA1b0e2ecef37c5f0ace4822e5e9db332d1fb1ea768
SHA256f327d524ccf17323e3b021f8bb8a96c1f9ad262440110125bcac02f303a8406a
SHA512886a37181a9defc867571802e833f7993624b6e9a5ff1eaa7ff69ee2e775a147bf18468eb91afac87dd396aad5604ecfb214cf82b4010f0e8c0023e207001222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550d67365b29cb66d25b40bcd1ea40344
SHA1139280e150c34138f30201dca4c9ba7c9bbd2b55
SHA25635e942c67f36b63c81bac95019cd3abdd600dba5bde65b7f62002d803e0f3ab2
SHA5128391caf81d98cd36d09c76fa89d23a3fe87ce55dff5bd0a6a34f09c3a18cd2c5b2ab3e07318b64704080177821fd6ff450afffce67c39923f60a4d900aecb1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dda9a1d37bbf3aacbcc5b00485480556
SHA1ed12000ccc56ad20980b1cd7e6f5ec73fe5e524d
SHA2566f8fb414de996ad7d8641a0143e21337a10230dfb707ee5abb5ddb1502ad0561
SHA512b9c4e2ab9cbc5d49b90e2e79f0fa066871ac4445f10005577b4ac840200055ec4359c101f4ab9af2a9b1e66a06a50e474fba4e03db176b9c56b0fe37e95c9156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e41efcf10c6ea8e4a95e179430d11d0
SHA176e9b410fcfb015ea8077e2557e78a3f015dc2d2
SHA256cdabbbc7a14c038742f540b521e21d4a77ab3e87957c987be799a67926cf1c65
SHA512f286a7a2671aed86f6cc1a5343b52976d333d98b3c8bf335528ef6527954a6c62090f2529fa843fea8cf6fcf3ced8fb432481876d142dbf5dfc2082e185e4703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540a0444d69734fe8616622409eb5654f
SHA14b9032f4e9f54828cc99f1f119a1753d5ee804bb
SHA2561dc82c80552b1f6076ca17e161b87ec3e4529bf851e6389d6e0c7258b66ec3e6
SHA5120ab08abde3a30c533cf065630afa95fcd50eed496b311f13c70b13d9b824e2c844242025b58b9e511058595a03b8473f5b230c55320aa4000d1f6b98d1317b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eac4305117541be8bb722f9d0c9844e
SHA16d450bd9f3cad8d6c32859a7d46f9c096fee9708
SHA256f24651a014140b0e7c598dd54db92c64ecdecc003f04ed4d3f6cf4f79899d2c7
SHA5127c4e19404d8f5be1d9b14cabc7160fbd1e801651d158b4d0b91f32837575bde2c48205d7074d87008c019819876190539a4cd45758ec55bebc2b41e1bd27d899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5470071f7204e5e7a080b6bed714db89e
SHA112b9f186091e41049dcc508aa197d83919025dcb
SHA256e5c68edd7412ed75b1bcd1c3bfaf5d880c7b7d0348cbead028ce8880a755ca3b
SHA5127cd93a72f94a22e598a1c3268e509466d61d23811d1f954499f86cc350d466419043ac34a4973071d56ced8827ed4fdfacfd1efc47c7f9306655bb944b64dfa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5349bcc44b87bc266e21cde913bba7a83
SHA1751460efd534134ce9c88a7adf1f277727e87569
SHA256c1af78551579c09a9bc94ae033447b08f125f409fa7dcc9c2e96b8bccdf58734
SHA512fc756772552e8045a45627fef79b117748114a5550da2e82f1e91e0d72a395732d79c98b4e65bcad5aacd019435cfcfe42739b05af60ca3da4109f04739a9e9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556354f98c01e277c3b731593e33edc6b
SHA1a8ae3432c017f69c4e5c0c2310686b005bd515a7
SHA256083803f8f3cfe05e4283bc1d45a301057c1acf07ddf76201defc626e15474202
SHA512bf3fe6674e81fa69364cef8f3b30e7d573ca89570244e6b6b0ac31f60f18bf4f35bcc27a51ee598e981e745362021571389cc157d01794c8f896f7c56983bf5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582763adada7abd78da1bfb3c9b51eb8d
SHA1d7b04e385a77da9683934971b92eee287ce1845e
SHA2563d6207685142ec8e86b3b2dc8787f17f34d23a719fdc9e9fc7a57ca4df2cfb99
SHA51291b8571517467667af1395200024d1e7d886f0cd6d1f3a24bb40c900899c8ff2500ca3c40071d1aa4615e62df003f5e6c25ad9e5bc6b1570bc69f17cee400f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccebdb659ca7017a4d7ba2b43a909748
SHA10d83d4fd0b8f2ae3b5fae79623727df73a884fa3
SHA2561cb74722fd9313f88bceb6f826aa0e1429c8f4e5f23e8cd64819d31085f0f27b
SHA512336cf6563c88b8118d42a8dade7829e127319e1f1207340633b8e4bc84b6b606258bf38d034188c79ca0c42292c6fdbf62df4db5a8040236997ead5964dc6257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd3a079b0ad0197ee68df86d0cf6678a
SHA10a94c766804eecaeb265f9a4132487be3eea9702
SHA256f59fe9847d95e02822f87198257e8d61537f2f516cc9f11dfd55b566b9bca676
SHA51200a854184228fcbafd253c0c97374c5b41da23f6ffdc89d143acef342e647ce4cd175267b4a3e3262e17abaa5e42d601d9dfbae6f4c9516b22e49eceb9c9ec8d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b