Analysis
-
max time kernel
137s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 13:45
Static task
static1
Behavioral task
behavioral1
Sample
9add5292a11726e28e5231ad25dd223b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9add5292a11726e28e5231ad25dd223b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9add5292a11726e28e5231ad25dd223b_JaffaCakes118.html
-
Size
69KB
-
MD5
9add5292a11726e28e5231ad25dd223b
-
SHA1
23f0ee222f381ff368dad5c9a4e200f25dcad1ec
-
SHA256
39d42593b7e92345df65a95db3fecc62ea608b74a16055924c7cc5db9d01436e
-
SHA512
503bfb91f9d9833b08cef91d7087e0cc447d0052a8ce191bb6975c82f998f66bfd5cc8a07026251be2704ef60f3d7ee6102a2b62fbbfbfd9666f48d21be5f483
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sH6zIOQuwoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:J3rV+TzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbba24e278c2904399f733f43556295400000000020000000000106600000001000020000000888859ba6442b01bbbba93f3e88ff22bd6aacd563b5a41f9ef89f6b8d2e7edbc000000000e80000000020000200000007ae4927d0f92e7fb314d8151a8d881bc86e0e930885180cf821413a1a2faf70e20000000766f24d4fe5cdf0230a6e9e68bd3afd4955eca4ae3a9d86cf923c96cc2d3922d40000000db7c38bac86477c1cceb383f0968cc33a8684cf559d31a0d565554a24147cb48eafe26ce817ddcce3b766008ac6408ded3999fadffc39e035e2da8b02ad55989 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204c2a953cbbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0398521-272F-11EF-822E-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424189019" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbba24e278c2904399f733f43556295400000000020000000000106600000001000020000000537a10fe3fea3e23b2d99e2c8f8f1b4e92305a6dab9d097548d2a5591020fe5b000000000e80000000020000200000009c27cca7a6653d9d1c4db79e40705ab8c3563386b7c71be067de1c0c206a75d590000000c356a55340ff84e09034f21d9cdc96e143b62217d1280f4acfe32e59c0365545b13c894740d281b188459590aa0f79cd0655b051cfee9bc465fd070973f2fb983c95bef80ff8e76e28975c8cc02770de7932cf677c26407b735013961275b1f78776b268880f9c8501197ea186cc98cb5745d213d0ee8e9d7ed357d45473e16ce86ec82448c6fd6cd039dff947ed3f2e40000000a64cf5bcb0a8f1f21eeb24d7305f8b97afcee55d027ee5dc457c4e6d445491cd16c2d3e9e9cb8d38086efc9049f9c0275eb50e2ec8aa9fa2c686ba58122920f7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2344 1736 iexplore.exe 28 PID 1736 wrote to memory of 2344 1736 iexplore.exe 28 PID 1736 wrote to memory of 2344 1736 iexplore.exe 28 PID 1736 wrote to memory of 2344 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9add5292a11726e28e5231ad25dd223b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501f5cd79f6b9b6f3fba746715dfb982e
SHA1a3350b4180d4a5de0830e7ada43fb5eb98f3b783
SHA256ee1b7078f8d58a17db8208264d765e9e2e0055d7c048e557dc57b891bebbfa51
SHA512934c00340690328709b08d5a9e0382f5b446928e3cf44fc4258a3355ee8493ac4960d24a940305936982594edd1204da495002071f56ed541dd4fffaac2301fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1effc9160e650eb5384e9b18f3d8974
SHA1e3c3a7cef65dd2137b633cef07260193ea9b2856
SHA25628586d7681f67f8c4d08e6902421b71469bee61da9c2e19dad3a97308560a4e3
SHA512bf2ccfef5d6d068d22f261fabc5e52769fc85534eb3e3b1017c166215955e082f25bed80d30ffa96affcbbea22c7663c806bb1e37aa3932297ff3a8b2173eb6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5554a2cfabb4c01a41c3bb4101d2e4802
SHA147abf719a2d89d85c98b2a0a0d199964511a20e8
SHA25662400e967f8ffc9c4aa80d687978dad9b162cec5a1bc19a20424ae5afabd3b49
SHA512620f6dadaa1fa89de6943aef2aeeaf4e32bd33b33c159e3a06b1925859d090c505c6a3b5fa6bbf47491742d96a0ff3d22cc14df3606b904b2d485bf846d0bf97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cc40cd11d5e98db7986d95421ed6af6
SHA1b52ae8897733ba10c0e09b168de4a92968ba8e9d
SHA2569091c902a8cc604a3f515a0512fce64baa9b5d7f4a4071326fbd609dafcb4f85
SHA512a8b7fbe1cc0535310653ad7e981cc72d87151e68e5a4dab6febf0dbe60766f9beca2f8157b0ab0a8144caa860b95bcf5bbc702159dbd2b16bae10ebe3241f246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586298505fdf3ad0d7cc38f95dfff9c8c
SHA11a11b8097f3421aef7ff188ab075c0cc9e8870a5
SHA25637160fb692ec847b097fa8714a4317dec69caf54849cf67a443b71c782db98c2
SHA512a5fd86c0365c978fd7dcee27b975882ec1530bcbb86596bd8bd77ba11bcf6b8d5376b76a1ca9ceb0c35aabe5df1652553cffb2debc184b12a0a77e8dd21107a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5127f25facff1ccd40a7ff18e284ce8d7
SHA129c704ef929855db10d3ce68515977607cc4b2ca
SHA256c5f1f4adbaf09ffb9c0926607b7790d97aabf04bd3a33c3d74641fd98906e9fb
SHA51225bb186dbcfb443c6db14c7a290e648ceb232c68127cf446dc352c0378f919b47bad0cc35b3a6b256c13101e4130ff0af91931985ac899bdc047cab886aedc56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb2ffc019b5ae7e1ce39289f0491a3c9
SHA1d2fa71d4a31d2132d7ec0b094ce4c9f8490e81af
SHA256d0bee7cad8ec62bfecd5dbec2a37bfc58988458894fbb41fb505f9280ca71c41
SHA512f5a80ec65c3316d4a6c2ca2b0630056884f9ebd42a4be9de7993d1e7c4892677528796f115c051ce4dfb0594f7d079b03c3ca212ce7b8e0419e3b0df6f5f07c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e037c02c456a1ea318ff2d3ade20422c
SHA19a78448959626eb2e036d255c0a550c69b665566
SHA256f0775c48f5f120a4d48ad071600d1afa8c5e2b4b60750f83b6070f22a18b15e5
SHA512b21e4a946eebcda7e697c60a87fece7cf7c53288a8a941a7631b6daa14e6f41d3ce7f185484fbe106d1e6e6d4e9ae5f2e1603ad5ac94c0ed2861863390e18b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57551d200c08ec971e7cd62886909e345
SHA1d7552b9b2685b35f9d231fad80ce5fcde8f4bed6
SHA256a68ce996f8871271380e619c7638b55c217be7272003fa261cbb5140eabd9dca
SHA5124abf58d4417d930dab7734e7a664c712b11df49e0a559663173f5be8966ae10b17a0343f5943d4162392540d39d08d0f71119e59f54c210e2e02801b98120663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc18ce630b5e0548230d8e3251f518f4
SHA1317f0298c4799574f55d1b040563c1bd93ec3728
SHA2561a9608f55d4e8a395044b1966b78305a50c8e198db26ba9b82c8ad2ea0baae48
SHA5121fe335b160050e1c3a41d975e89a68e29664956f8731bf6ecad5174c32c9da0468052839a86a940ba20f36b1237a17f59424698155b40fcda176cc593761d5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dbdb7998587645cfb9626acb80228a9
SHA135bb6795c057480c8427ee8ca9af3936ae976197
SHA256835af2a7d4f9758f583c69cb790cce45eb1787aeaadeca37962bff846cb4246a
SHA512991440cd61cee3b0e9f3ad75a59414780739f987bc57f5ea32a54d4adb7e319cc3cfbb9dcfc78c92bfadb24b57ee248f95657896ff369d2261e9d2e0540b068a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e1a5200c1e458a5d55644ac0e19886b
SHA1f4deb88818c64103fcd6b3436c5bb83763f1f334
SHA256c22f86133c29c66c11af6a51a04547e3c934ce75c6cfc4fdb4ef99e08047d522
SHA5124b6e12fd1e54c42324fff8df4020962d0a6b01f16e94bc1215d641d0b70a227be08bfebde106ef673269f6f087d920c75fcf7646c30edbe6dca8b415f71d35aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d0586a628cc5a31fd39206f94b97bff
SHA10792cc36a36dcff28a36e5afb68262f414350fc3
SHA256922dc5d61347e91186e8be7b765cdee49fb465120ba410c6b56ac784836632f4
SHA512fedbda32184b773d1727b876b2b4c483437b75f1c181c46c0014ae6e8116748b357091ff4ff961c77b7f961d3b68675d2827ac959b9847b7be69d43aebd40ba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bc9ec4419952c18463bbe155c7a1bf9
SHA1410a6ff3c8dc1a1b9f3bf71f860298939df461fd
SHA256b40ff35881adbc7f01dc597c22a3cfc9d349d2838529a300ce384527870cb13d
SHA512b25cfd86280bd40d7605fd81f1a5a5916ee82d9ce32a1c9d247d32b2ada1bc9a498e69b9a093398ec720c26c9bb5ca0144ad671aed4ceae8dadda0a66a9c2a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be47ab41db8ef3a39016562493e38f78
SHA1feb286290554449bc0520124067827b8ae12dd65
SHA25623e163c904c631195cfae5c43316adcae9e54922d687dbca54a3724f886eaa46
SHA5124e77dda573e43921cde633c84ce2e200c0bdaf33dbac59038068e5e6afaf772b7a61683de9482a7654a072d9a8ace3cb2558d0cab2e5c233783c531e86ce62bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a20130bfecf70f81ab2afbb29415a939
SHA1314a01c103b97dfd3002abc06860aaa2d4e7222d
SHA256befec3ab6b74c748ca9801b22c2ba52a4ea22b1a48507817990b028590b682c7
SHA5129ab34f9744371fc77b6c4a1b2673fe652abdb8f8341f2b4497943f55021e249803b721138dc991125bb59b9a70a6a7d2d27b3da1cb84664eef6c61a0d5263280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f724334ee1d293bc2dc439c00cd6d3e2
SHA1cdb3ad9062b150086d11ba3bcdb79cd032f5c9d6
SHA2568531b67de324a25ddebcf4f9f7506db4c67db2ff38b654625872ea07f5bb6d1e
SHA512f1f57569d47d2c46ab92e06ef211ae2f3d16afb356eff452b132f3dd26596422a23b0327881c9e9f99e85afc5d1ab24526e9a5d6e6acb8acb3cdb17e25b0c398
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b