Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 22:23
Static task
static1
Behavioral task
behavioral1
Sample
9c22d21779a8f6b031a5ffcd63b33862_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c22d21779a8f6b031a5ffcd63b33862_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9c22d21779a8f6b031a5ffcd63b33862_JaffaCakes118.html
-
Size
15KB
-
MD5
9c22d21779a8f6b031a5ffcd63b33862
-
SHA1
ebfe5e6244fa4a3ee1befc3218895493e9f60416
-
SHA256
d364120200609327115b8923057938dcc2d191d340174463b753be7842ccf525
-
SHA512
5cab0e0d6ee5e30399481cda46bdd43f6a4a89430e189fcb22bf410bf4505100c850d04e44b313e56f691579e97d996d016e6e26a592d6f7384fd75441f076e7
-
SSDEEP
96:BKLVValGZ7r0VnoGMVT31dQwhe7pnVFg2gKuP21gk7GAltZrJU1i09Ab671D7paE:BzlyzQxVzuu+k3rJU1i0uoaBs36WNi0
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e1fee384bbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005916bd1b0fb8864092e5c9758fdf278f0000000002000000000010660000000100002000000041741d9d14e4ce725c4a87b522435da68c1ba142e5bed3481ef9c17314b96839000000000e800000000200002000000042d5cd86e4a2c6451df21dbc0d50972ce57d39e6c04c966dae90008f5cb12bc92000000074a23632d70407d57c5236e719f1e5882ecb52d58fc9410b8d58463761f8ccf74000000009223632657d2959074c3d722f417786b7c37ef127cc1854a40c0961395926c552b0fa657b93f548e98bd652f6d1670bdd153a2a385485d2aaf5684447725e39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F229491-2778-11EF-9201-6EAD7206CC74} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005916bd1b0fb8864092e5c9758fdf278f0000000002000000000010660000000100002000000076683d2c389d9f12181e963ae8b10afdbce0fb697a0bc1e8fd4e4b6849d6bdeb000000000e800000000200002000000056b97ee080c703152c30900b3a2187ff7ab4b5192b94c4f3e9adde4b8a6942189000000057aa8d45d67a5921ffec2a8b049aa33bb245e8fb2a40b3c28cdc427d105ed73b3bf068f66f461b0c302548a4fa5d050b58a6165842f606e9eeaf6c467e2c5bdb2252378e235ddbff6963ba17631c4d7eed504e105e5eca5f7ed0f0d014d5d86d4b62c0cf48d742c90deef927cc5f626bd5200597293e8a3d8f8d02cdf01248278c857e06e5294d7c05f3c05b65ed4a334000000065719682f703ccf1cafcab58c580498ff4b735869963490d898f5e2014fdf71b1767127dbd18757cd02f94674f3a63e643352b12b114276bdd822f4e8c8c43ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424220076" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2996 2488 iexplore.exe 28 PID 2488 wrote to memory of 2996 2488 iexplore.exe 28 PID 2488 wrote to memory of 2996 2488 iexplore.exe 28 PID 2488 wrote to memory of 2996 2488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c22d21779a8f6b031a5ffcd63b33862_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5c9b45ae96e3eca7355407008de6075
SHA1db895dbfd64429d22c9a4aa28620ba1e972515c7
SHA25670a07ce36f7218d681523a501c4ecdcaa62a4ed69ed892076b141526377486d4
SHA5122d30670f78e92ae196d130d64faf21dd70dad188e59892932f498a41285b03ccb2f1e3d24fc74a835aab1f130dcc6485b90ead9d49e29dfea1d71ef30b84d82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5883f99357fb15716f0e15ff555ecd6c1
SHA1d55629174bcffd83a1f4c885e432886401005d4d
SHA256a3249d602f16f19a35f46b0967330e5ec063622e5c63c2f4547ff115b5f3e066
SHA512324ffb1058fccd1c343bdd1b7df009321cd93a5d1814d3594bba5cabc0edc9d2de4d8099eebc8c40bce293a7e703a9f5f4c3569ae53d9dfd782c7a8baf82c694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f569118590ed2fdb4e6132d2c7072f
SHA10971290553777ce1bfbe44296942615dacf805dd
SHA256814ef1fc2b64550373be4b745918911d647572b6635692fef47690b69e591197
SHA51236319813da87968da90a8249952243b5f1cf1cc4c30eb0a9172a4163a94a8f742d012d972a7ce887c5d86ee605553a1188bb7347fd1aea20f1a31a4bf0c2326a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afb97b0fbedf1c74f86dd4a362491868
SHA117243560efc14f40f34854748fab0ca6a3f3e5e3
SHA2561c2a9861e5db148aa79e3cb4ccb738cd2acbca81f0c7e10b9fd7b811547ca183
SHA512893862666e0e3a0fd68904adc3bd5d689f88674afc9409b059e2572aa7f84ddb26a594c1d03a33aeeded042b590072175cdd3f9dc0a3ffb2ed43591b0d3962ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c879ef7471e86c7da1c97bb29b340033
SHA1683a05e1707c553add8ad41e681a48e3b6a1b467
SHA25629ea8ec6c8d4ebaceac78f919a5f27e6c77424758b4ca15b1435dde16b46a466
SHA512f6b498556bb2c244c78b985c9ba2cf5a0dcc95e7362068372104db24c6635305793cc316e562c32037ea8234783ee456a8ee956615dc012f84592295b620e54d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5cf70421c518223cbf664dde599f5f8
SHA1a12e3b8bfcb89fb2292b6172e8eb866a1b4cb134
SHA256d19770a7f8e9edfd63e8756fb18a7ef3ffc7786518023f8a3025c8e97bf8306f
SHA512e83941ed99436ce00c05f492b5ec5861653b3b7d8e53bcdaff6ba79b431db297532d9ff8b6fe9b748c4b69000638ba064890022bc02391a3b4a611f0fc77fa1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cdeaf21ee218a0ad38468bab6af7e79
SHA1d88b897fa4d588dd7591331b01e848601ef1653f
SHA2565055cc8d83b7b399405f4e2ef8bdf3a9b21a0f376418522449c779de3cf0ba91
SHA5129c3e9640a01ac47db714896aee0e7eb763e9d22cfc64e5cc75c118f2b98ac2a90d7c80729ee53dcd5934916bb4cd2baa57d582c63671fca031a165202ab2355c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaca418a93d57cdf78300955e51bfe2b
SHA1345202fff85039f5c68c9b85da10954dbb8ca9b7
SHA256ba2220d96f9fed454febba614820f4f7f06b8a44ffed661bf5ca00f16e77deb1
SHA512a1beb85ecf85ee35d9f5c15e3692694b03f1f2cdddfc77ccece8681e8d5ae99d5c5a5bfbbbaa7b7ebee0420863c9e7e195dfedd7d0d38c8be920788f62d296aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a735a6d7f4a5d967bff690ef81f2702
SHA1d3d1f5b0dea04ee736d777af76e4ed514d31cf92
SHA2569f82ddd5f784a4076888a2a29034ce682b91169a4cc9323190cec612915e769c
SHA512be61bb8348db1f7c92e0dfbd35c0fb7d3a7c2d954f4ce05b0529c7856672e9a386e0e9489fe48f28f3a87fc1acc99ae5263fca043cb42abaa2edbb263ff095bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567e0d401ce26efe246fbac12faa7b78
SHA113b7948cb743de9b7f3d1157c6804b6cca6727e2
SHA25650ef8dd6eca1d658e92877ae9dfebcae6d746a9c10c142b845d1f6e924b15b64
SHA512117ef70a634a05b49ccd1acd61aaa9fd014c77a0063e6bca685f95cf87fe74a197cbd4603d441b7b4d62d058541a74b0da609f1d0bcd387cb8f4343f78fcd6a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521b62945d70756323f976abe81fe5146
SHA13acc1296f3877a54525c34f2f0044bbaaa896003
SHA256b0aeba41cb6a3e16ec884b6a826ccf453da0a3ffadcd86a1573736c9dcfc1699
SHA5129ec248310129026ebaee99be64681027225833a8ec29a8f83903bff630a6e6c0173670b2f0e94b6a60f21a4ac8d3642029e12c9b8f9c73dbbe7f7c5e9b4a9efa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e481e57127eaf63c05ec8b50230ebae7
SHA11164a778ef11a7f756d7a95f6e9e9a70c38d1940
SHA256df8172f1b46e16c4405b2c8d573a31077c38122e085ce25579689bbcfc1ef351
SHA512e5717f00c00daab7544dc9e073db89c29d7da2f8184a0c859b76b0b361959221b90abdcf6c370d51f7f8725ced523ff6a0c28cccb7b6108aa37dde38a53065ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c53c2adc9ee115da9ce9f880799e8948
SHA13ea6057e233cce8697ca780629b78d7c421ccb33
SHA2566ee6782b766ce61fbf10a777b40e270ff255573383a8c832a0a3f6d549a84c70
SHA512c037a4baa8427307ed66e7f24eb4a8257f23aa4c3878307f807627a0a99d0a554faf5be4f0eed04b975f75d411bd8209c316ea001c603f9dedc0de3e7b35eb4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5137c32e0091915fc9e8715e94f656740
SHA104425f81e9484eeb5603f6a4527e10b567dcfcc9
SHA25679e564269e904ce1fbb08ab8138bdf0c324aa8adabe6f7fc7963bbacc02c27cd
SHA5122bd29fbce01adfa22ba3aa0a252408d103f93790e3c28195d33f6fdfe964059f9f55b9a73f7bbefe61b32d8067e51a5ef98caee9cef28e761c62fb22aa91c1e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59832ab42d9b074ce43267183f3199a22
SHA17afa5a7ceb7934658a800230ec19f39be0971436
SHA256f23962cf8c09dd305183264900fcbadbd697ec266926a8df0d09a25772851931
SHA5124bb8a89d8cea3fd228109213c54df916e3b38261cb8f2cf88a25fd6aa71c904a0843ac852143fe71eb8fc79a6de22924ef5e83510610d9957ed24e2c08cb9f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e113c6495469405ade529ded0ac32642
SHA13d5623d1b5a6bc3aea742b39feb76584e7220e91
SHA256f0c7ad3025be40879deb3fe1dc75c8244916dfd6f7c50fe2283c09e0f6cc5301
SHA51279fd6dd5ee1fd22f6519c8c390e03f6bae9831dfd040f1c3ced853ea1492b5af635261a54a43eb6d7591ea22a10c0be837581cda58a7ffdc2b1c89414ffeacdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e160e75c5715ac90825f51318a819cc
SHA199c9fed017d5b5543a5f17c58a4b339132a4d5cc
SHA256306464a2c81255536bf9a47556d62485ce7ea536c242f30e7dc9e9efff3a3763
SHA512fc94d4c342ba6a6173dbf0667d7a76862d6a6c1cbf4baf7940266e93ac001bcd9b9da2b41a22e14b62af4ac001eb67d2af214bddac8423e94ec6a9dbdf8532d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8093a1d93f04c2e295c68689d827688
SHA12b00ebe6cd0fa0c79d689dae2200a9166bae2005
SHA256ea2ed5c2df8c16ec0a7277cdb386aa410b099f956ee8096c3d9b7741c06435b6
SHA51228b56663cf56ef7df93dbbe0e05d4b0663af165ebf7797f3d37c69a69fba14a9f2a269ba9fadac0f50e0124f6613559c435e5deb589adcc1ff7ae79658be8c8c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b