Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
9d05092ffb7d7f92176b13f2c114b0b1_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9d05092ffb7d7f92176b13f2c114b0b1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9d05092ffb7d7f92176b13f2c114b0b1_JaffaCakes118.html
-
Size
28KB
-
MD5
9d05092ffb7d7f92176b13f2c114b0b1
-
SHA1
959a8476c5a370d62cc797c70a4c915573274905
-
SHA256
86237c97b4615c49604c97f71b03cf58545217bb2a035290671638147353180f
-
SHA512
3e9f35ff4449230a02c955c9d21693748c39308dbb1e1c2a491264551387fe7c8dab6f081da2fb810d5ac7318d29446483ec7272dbabb1d6edb2efde856d066d
-
SSDEEP
768:zUp12MZWElZ7Cf9vCMPmSWbwi5ligkbfAK0zt6:zUp12MZWElZ7IvCMkbwi5liFbfAK4t6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDA38F61-27AD-11EF-831B-46E11F8BECEB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2d29a20297663488b75e52cdd63d2480000000002000000000010660000000100002000000060c0d90263ff544af9d434cbdbc300e2383164244f26a6c3e20d85c6c2928017000000000e8000000002000020000000bbf56b4ecb8b5827358824f86f73c4a8a2506836da567b5d9c3afa9a2382bdba900000000b258440f69cf703feb444022ecfd08acc7cc577e69e3e8af5d3deafdf2c05aceff4ab0b82169e0e897c96ae0324c50990c24bbe1d70509a45345ab3eab54cdfd52263f4c6652384d04814a67c3122afc9dd258b789717f06dab7f7d7ae346747d7ed35b01b89e1e948d0edb998709f1577c527c6582f70769e1c0a43dfe731f0b41ce5b28924c1f7b87cf2f3275d44a40000000b3668a77d238d90efed0b8af11f205b8397d570f7fac6693af7c2bc3d17ea095e886aa01c03614442b1b53fc6e3616fe7a5e9ac5e0c49cb5f0aa5f5abc7b2e19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424243185" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2d29a20297663488b75e52cdd63d24800000000020000000000106600000001000020000000de53a58e5f1804e77665e42a37667d82c329791ca2ce8fca57d9f9815944787b000000000e8000000002000020000000fcd7705a8aa60ad7608c3494954e7e11ecd1fa92786b192ef5ec50b438fa9d4b20000000705b79ddfd5030114fba0ea9c972c2d7be677fe2ba74834a4a82d06d9ef475d1400000004bea0b8606e9b59056013940a67bf4185c3ae7ad177b86b2a11ff4e9af26857b43254cab72608f92f0bdd3f0372f2c53e5fede691ecd8175e156b385eab815f7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fa17cebabbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3036 iexplore.exe 3036 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28 PID 3036 wrote to memory of 2884 3036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9d05092ffb7d7f92176b13f2c114b0b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d31f565cb150bf19885fddf9417e856
SHA11a9c765d141cca98ccacc50b929c57166e58f199
SHA256e31435b9ab5d461a1e9b691cd76ed4417b85ed4e7165862f6c407b4f6164ea30
SHA512e488bc32110082463033d480fb20d8a2f927906b96b80239a380e80241e845c28301e2814eca303e228933456e3345212f0920cd887b77072c72ad0d28372855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f180bf243089e80d185c613591ee466
SHA1f4b91cf9f5bc201f029ca68c17bd50d1108bd4e0
SHA256089e76f0c6960147dc878f38f31b6d78086541924cff83692f0e197cbb47d0ad
SHA512fa00f018443ccc1e82d255e8a97bb44091b5a71d0561e422d57c9dc22141b6bbdea2b13905acacaed67cbd1c72095cfb98240a86d7db52b77e25dabcf00a8edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dabeac3d1fb475515e818afc415848a
SHA1f989305b403e971a46a9f04dbf77c198570f5d6b
SHA2569e3160bc630b049cd448e97558a7e4e84029c32d894db66022878f13d9364796
SHA51266f347f7d123e76b81a4d78f22980e29a311d31861aabef6f994c079558e0e8dcdfcfd9876ae7e5c5db0e5490abd07dbcf1acae2cd65e6e30cd54135367a0eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b7fd9ae9c66f0f4f9a0486f54be3dd1
SHA12f4d75c9b721374c55a7deb9d386041981baa333
SHA2561d122d597fb50d78a19e01f3bd0fca613d18a844f5f775441abe8c71c4fed431
SHA512647690cfde955bcd967c9dc845e6222b8818b38d91cfe05d27eab546f316f9c1829888434f2bd62ed888be04ef0fd038c84795b35a3b626d6a2b98c3d7cd5769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6aab5c5cd157fa507aea0b5797bfe8e
SHA193f5a245499328983f59db22edacec0d8ac2f945
SHA2561813f907933d4f99ba874d98015daf63a7f6e005991a202f5b3c83327e7401da
SHA51225081f68704f6b1047284ec81f8e017d22079bf6b05fd073ce1c7cdd839c0c6022eae57ac6b5effa9d56729192fe21828bad3d67a27fda02fd9abc2fc856e9b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6cc2470f97ee63c15804a630cd2f511
SHA1672789a40cbc30737804ee6796d3194bf66b63c9
SHA256dec764ad1a654366d317bd95313624a604af30d86c2e058b5bceadff88df1ae9
SHA512bc01fa157b7cfdcecb7b03b3815829b634eff00f8bc1269960c3c930dc694967b35c7821b51d78998cc2243883bbd48b5dad2cf6d7479a02895efae951364f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d9a0601b65e13337d87376e671f22b8
SHA1d27e95ef1e93ffe966e060993342adb3c94f8db9
SHA256ec132f9c3b85dfac2b89922cfe96a3c0ca96590880576f75b378e22f1208e5f5
SHA512b507593fbbea449a345346a4d1e6156fedb8fbd94a076e3b43d6b3acd50b1f2a022b31ba2e24aa71e730386710990951e67b15202409b9256f7c8c85faf2a63f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3dfdea0bac0ad68d3c9d99c2e25b9c6
SHA15c3372d06e0bb42e8d8b4f3d913c2d4e8fb428a5
SHA256286a73fb7c1bcf24f6c0ad6b438fa2d118ca4edff4cbeecd16cabfadf9c58a34
SHA5120fb0caeb86afcdf5b198de179b1cb3d4fe3d893857d3187e7fff1214253ca564013bd20d8b795a167d68f29661bd83a043bee86eb8badfcec3b52d6defc6bb20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cedd28906a052ad8eeebd1bd2a3c78b
SHA18b5ebe5660baf518d24c408647114f8d491ccbfe
SHA25615386cb2500d833fc77886aeecaa1d07e105f0b1668418098a218715124d4304
SHA5128de3324b034e45aab70c7634bc5d8b75fb7a9a602f1ea876c9c12d47c87112bd261a237f4776fa679549d1870c4b4aaf3d7858c7b4b6bbe0ab7c9f32761e7df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51321f4dbba493e4198c62dabffef4b36
SHA157bac06f0a4c348807073e6930810905798b2772
SHA2565dac34a42b96cca0f63c09fedb4f18da8816add4c4597ce504284f921b897db5
SHA512643b02c7e0db947e6736e7a49cf6f8a39fa62eba41f5d0cab347274b660d79152df426898f9c4c0369c12ccdfda6b9e5abbac667a9ea52e82c24eaac79024e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a04abf3a27d2333f9895e9ad8697c04
SHA1dbef553d0e92c040e5287ef0e95e76aef935a87f
SHA256e857595a4b713f3068ae3e49ca0f7454170435c018c83dc505074ced693a358a
SHA51205b0ab08fc3be88b42dcf65d2ab8d62a6d247bfc29543ee11cc2bcffaa0bc9e303dba2abbd77e1eeff532c033d2bd313def84569fd20ee40d4a6d276ca8802cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59314251dd72dd59adb511514726fb632
SHA10d508d2b35ff8977c5c74f9bb13c9b22936c3a0b
SHA25657d7855b62d5d5902512571a24c0b79a168336955bdaad4fd59920ee4f8e98bb
SHA51278f91511d19485c44629ff3699817083f4b08c6c4b1162b007d931f06a7e037f20c51a44265fb94afec93ee3a24f3eceba62dedc48b6e3bf8615c9f7ac64df9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faf6e0a0ea99a91d37dd7714faa0abb6
SHA1aed0b23e0af17699debd610484e3a266c43a4031
SHA256aaa2d138f14d93b8e4887fd8243dddc81e2933b52ae63f71779d4cc49e1b11a2
SHA512470a90b5a332a772062de20298a5181bf855559727d067bbe4e77e0269dbc1109ea8a74c18f20c15491716646eeee5426350405b0d42c09a84dd3483c715c84e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d010eec9fe9e170bfbeccb3ae64650cf
SHA157de29d3f41c7abc7f6a48a53d6e117c5508711c
SHA2562788ee8296fb3dad25b5034712e5ccc8aee8655e4c15975c765875468abb8741
SHA512d174fae41ba9df722fe4ded223045e12466557caa7a48d3af3728dbb8e8b027bf3efd14afd07c0314f460c336cedacb0040309574148e806237da6d90e17f030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b17b7cff16e2f4d5c3f875b04a78a548
SHA1b3fbbbddbab8f398383071d1a9a385ca782ceb03
SHA256c6916b4861e3e777cfd3ed2d519c4748ed3af7a4b534ffd6d0d22ccdda7701b0
SHA51232513899caab9a4b558cb61ea04dabf7c2344a7d52aba6a8b0c10fb10c64457612dadd7ad3b40163307eb5de318ee3927b06508e9f44c020db7555dfe56e7e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e41f7ff5b19fc398527fc04eb66717ca
SHA1a82535ddf16e715219ede03f6ecf8c23d1570298
SHA2564ce5d9f5c03ca59b60d732ab8c0346556dac1f7cf852023dfbb7fab509116f24
SHA512c3612e41c6059e8274840104d2bddaaf109c89693e04a793219aaf02a2d2b09a7c5b8c9459a138ffbeea7a185a569e463e28e8997877deab75673b31ce7681d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e22f421279360cdeee4a36825fc62b0
SHA175c3853097738f5968edb8d00096a33ce24a5d03
SHA25602dabdb3a1aad1775ac3c2f9d75e0e5267d3092a77228e907cdb7d617cdc6a38
SHA5125b133f675a418fa5ccd893c4e46a775116b82887801660485f7a007792a5f8773dcf237fcde88e8a7adbda960f0804a93f7d8e4a7246bebf0facbd815fe84630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dc22267824af9de7f6abd8da3654726
SHA188f9aa947aac23f28b62e1764d25c0fe7915053b
SHA256436d0b49a1f6cad4a2653e3075ffcbd1a722684103dd7fd6e61d3547424b5635
SHA51253ee6f4a9d5a0d6e0f6954cbcc7f70678c3347c4afc916851f2734467cdd25404dfe97ed334fa0276b561b308c24b78fd70c8ab8c8d1608efe61c51f0dbe2778
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b