Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
9cc73dfa297c9c8e9e8336aa44e37e7e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9cc73dfa297c9c8e9e8336aa44e37e7e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9cc73dfa297c9c8e9e8336aa44e37e7e_JaffaCakes118.html
-
Size
12KB
-
MD5
9cc73dfa297c9c8e9e8336aa44e37e7e
-
SHA1
3e2b7fc872de89730fde7b628f1598c54975441a
-
SHA256
32005c1cdb680fd8a01b05245ffb5db5536ced9762ddc207af661e0fba106255
-
SHA512
4d57f56114e84199032ed69d4571e45a03decbf3f6fd998c8c520d93687ddad55ea8da9a9b2b864bea462962530a7dfe5133ac3fb95aea57e236b5c725776c2e
-
SSDEEP
192:W/zXLYAyr54x3uBMCT77FAgwkcjlp1gsh2Fsh2J0zMz:WLLAr54QBMU1Agwkcjn12Fsh2J0zk
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004218c1b2c2c7d942a6b56509306abad800000000020000000000106600000001000020000000f989f92ca817e40a3dc862eecd34fa320e549c51aab10f44c0aa217d31c2d89e000000000e80000000020000200000006a750637b0e81a79ddcd324652a27d9e3de76c83a6fb40caa816d4974bdf46dd20000000c485441746a43952ed5012b08f7765203416a2b5cd5432e169f357f793dca6dd40000000c0272d4a4e973efbb365e6ddc88140061be3e187eb5811b87697867d56be163d0703d14e4381fa28dcf0636baa71f3b7c324ea8fa7576ce39156de9508ba5681 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009a3895aabbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C06B4151-279D-11EF-815A-6A55B5C6A64E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004218c1b2c2c7d942a6b56509306abad800000000020000000000106600000001000020000000bac7604fef70b68da27ec14dd80183d749184d8f82001ff3173de144727e0307000000000e80000000020000200000007c04d1e425100abc5d2073ea2f1f1070576dc37e3bc91d7aca5778a0893903e8900000004f2ffaa189ee702ca4035ea577fa405a762c5efedb958fdfb70ddfeeb8759e8dde11d57c90d09ad65a6d8a88c8618d41bcb79e2f734949e93438bbc18554c9e2e814b1882e4362c095894acdf586b4c704f81c5cc48cb52bc9b662247641a0c0157a2374a0401c629b07e9d482552f41b2af0dcf04eae9520632d9f9089fde6cd40084b23c93b813109129cbc5d752a3400000000ed5ede03c98ea692f6ae123e8d6b75820d3fcb796bcb65cece3933bb7b99f910277d97c03010b3f7ddd9654e3e1ecc5af2d54ba1c269146b33b30848a6a8cc6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424236264" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2748 2244 iexplore.exe 28 PID 2244 wrote to memory of 2748 2244 iexplore.exe 28 PID 2244 wrote to memory of 2748 2244 iexplore.exe 28 PID 2244 wrote to memory of 2748 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9cc73dfa297c9c8e9e8336aa44e37e7e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5671c2d5a0a8839aad4bbbe1d484ef5f1
SHA17ff3c5e7cf2d83de49f8eedc61c9c585ea3b2c6f
SHA2563f413475bd497ffbec45b6cf9127fb62f3ff28c6211aa1777ee077876fb6b9c7
SHA512451079b74369a76aa091fd73aaf15b7c8eb412e70fcc08c557ed2017ea1b791813e7821d4aa28f3d57f1ea9cbfafa091de93471452a5157d84aca1c54f988fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5102c83f450d8675a29ef7ac436f38fee
SHA124bf45df163f013c0f8782ee9dd574b687fd8bfc
SHA2562a9e62108d252cfe244cf0c2aaf4b0c4d73450d9523a0abb804c2405458b7b25
SHA512a307e506881de65738918367ab706b3d5b175a69c9c227e1ee4e1641ca720ff4263ca7d4a8fa230a7e12fc1f5dc47ed3651a6fd8c79511a4a092af2cd1ddcd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a9a4fb6ff8dd4fb0b28aeca905f0f6e
SHA141920194f3af4aec7a6e8f470ea4fb7d2902104d
SHA256a563208680fd2202eb2b358c4f99fca74e4a9840843e18d9427cd1138322532e
SHA512abb454ecc8b4ec430378b2221cafc240326640ec5030052fc0536586850ee90b87218293f9d7966bf3a9a2c2fc127b22d13297dc6dbba2fc77101fb6d37fb243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a6005d613d4764b3304429f4ce4bd56
SHA1701254a5fd46593b42e06cea9390435a4e1310dd
SHA256c672dc944c7756372d1d5b36ef2499fccf93614bb627cc68849dcd60248de234
SHA512615c332633a2347acb33b03d18470c60d0b1835cb7f58f6ef6679d82ca73bc27aeabfb664a9f832726432f695abccb189cc20122373b22a97df5501a97de817e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d62959c7bd5e61d370c28cba7a71090
SHA19ecaaa6f53b65137bf06ae6b8d85b89ab178d3f7
SHA256452c077564403c891e356b6e43d65461bd4884b419447e0ede86506d6a95be3d
SHA51223042ab5ee6f642b922d9bb79b2be43defc14fb53ca1e4dadf61c1965d1841a2ac5278d038c2b62b73a06118a39f3379e64ba2e463983affa9dd24bf7e8999eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a037de9a920dd13bf5216fac2b65bf5
SHA1614c93fcad8c29cd5e247fc9bbe5d9acb54cd437
SHA2562e1b3fe32bf718f9678c3dd4928cdca97feb7c2151bf75e10380488e187cda45
SHA5124235cbea7ed6bf13e93bdd5488d7a75fe392c88f3ea12f1f106642fc5c25d45953927582def37664174cba58e34f797fe5de1c28aac3218a053112f7b504d737
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c89b4b6b7c66a59dfe8e2231443c528
SHA1b6977cba878a1077b7d435148bd23adc6a0cd7d6
SHA25610017e2b8232e963239da01547f1f79abfba0e81042e47f5ba4eac55f6bdaf50
SHA512790878bcb27787a454ee785c582f86f6ea530ec9ed45fe740b7dae5918d391f1d350cde185e8caa0f7c1d6e34ade7abab89c030e1359300c82e9e8e7fe3dae14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a81cdd4cbbc2c2ea921856c31c82788
SHA193fd320e953ef6b1808c6fef4ae1150dc9129adc
SHA256cbf29d6ff7e352e0504f456486570b932909944553566ebc1e84bc7fc4030845
SHA5128baac6fd92f3ab48a8a10e8191cfa6132b91b8205a5a6804557d75cfe161212e0c3b7d7ab254bb3d15acbcd4c55e0264a57bc8f02e5dc260509a34ead4b96bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c706fcee3a1cc73ba8a7449b35c95fa
SHA1c1f6bff261fd6f8fcdc66cd9409baa45827e0e94
SHA25629f6ba630bc4086b1d6971df3d5ee46e5ca9bc7a51ec2dca0d855bc53425b323
SHA51275ca4756f8cc88e39111718b23b56efed86a80e8a80e6fe6371b393981341a3a93c65e60aae681139ef406895e9489f9f72a06ce2c67c4e4d81a8bcdabcae9f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5848b3a9160b6a255af1f54c80bc9be30
SHA1c91d2ae986dcc5fcd26f39b4a9346ae37bcc0b7e
SHA2562bcd2f744fd46cb2482698396eb1823b0c22bfdfd86fa18b41b367dee02e7a26
SHA512b90bfad94f6abd85d761a4ce134d7f636f6ff68422c41a1b23ef2ad47cfe6a2a9c88fed4f2dd4d2cae5091b665f888889e3d15ce0ef9c3b369a5402fdfe448d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5529999818cc9fb0fe24fbf024cec892e
SHA12c5eb0d1174ea13e48f8477c7ebb39c01b0961af
SHA2560982094178fc294b367deb4154d1f1be00c271475607625654368224045f4fc3
SHA512a760de806dbdc80813541cbe7373478f01c5c73dae66c87c2bc01a0960d3f3c2f62ac61403a83f7655ba94fd09c33bc463103ef7f3d48eb0f233edce65fe1c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8c90e739b8e02844b93cdca8a6cadb1
SHA13a18f2d54ec39c1eb8a6fb53476813c9226874ef
SHA2562c9ca5514c0a3ce5216e98307931c718323d32daa9fa3ca1a6f31e011bc7d6a5
SHA51240178ef4cb116083f2ea798337a093c0b3efa3ff7b917b9c15e1ef9f0f742b9e5368e2c5d944e7a1d18bea8e426897bea4e77aa0646224cd74851c56ac38634e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac8c60f2f79de3c15778e13382b67a5c
SHA1f37c9c333a3b84653412ff7794656647a11a9765
SHA256444127c15c1e59d719240243f47cedc6f67967294337f7e948a3f2c75ba04666
SHA5129acb4d527a941998a419cc1654962b90c133aa21f499e62305eedc377101ef292df5f7e7b2e537885825537a987e8bd66a5fb73948697e51d5273a17c954f029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d067d1ced42d3e80c40196363271bdcf
SHA1053aade0cded768e39f27b6275ddaf073bd0aef4
SHA2564e81fa358e89c229d13b0c7a37fa4e1d32db9816919e1587735faa77750ca56a
SHA512cb1afd9a01fd0b60b0a5b26ad595a07bf6f0ac10965344f798b8739657511ba25079053f957d1201185a42819e465a7effa1238e5c22962d1301fbc7d1ddbf45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df38eea812533397213e4de1fa42b786
SHA17a176af02668effc9eefc0aff175083b2596ea3e
SHA2562ba595da05f7edd047383611482ab2c546cab626e89352ad82c134994eaca7fd
SHA512a84872679838a83df63aae42884d654dfa44776ae9bdf1b9b9ff8e26408f32e4a2d57425d50faf8119f09aca3f928458a5525fcf4b99fc077f73af7cc679fb2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c62c475695674f1dd9b769434107be0
SHA12e1f4fd58381006a3587e127e92e3023d9350a38
SHA256394b8e827e3e6adf57e63dfef8a59b16bda52be52e5f10b409db18a3558d9294
SHA512d8599e264a67847b5c8f7a8baaacfa5d8793905a2adac2cd089bc771b72adf81dcdd69cdc454faf50ee6ac0ee9c6d22e4d4726f79347d56891b87eb5e67d77e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524b7627c2539bc4d7e2ea2a2bd2cc09f
SHA1f9ecfdf6f6fcf5239ba4fefa90101769dd13db18
SHA256f05ea6846a8bd1a2f8751911c3d0fee36a2041cca7e2847450492ad419c225b5
SHA5120850e3ecc929bcdbc616b010c827e850f5977f7dfa41e632e219bd4ae6228c10a5c5b336fd66e88f0434abee021e68e8ac32bed811116187f969649825ed18da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c5929c95d13946a338167b3fdeedebb
SHA18b251bf166fa6076e9d106b7170363633a763b44
SHA256b074f95dcbaf6756357636dabdca89de3d772ad961a021c5877f6ccbc03dd0be
SHA512ef706ef7e92df6bf46472e01ed8c8e9d2861e57cdce651174c01342413126c396e588e914bf2a2b4c588b4dd330387fe7fd56f7f0e540f504918cb06753e6267
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b