Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
9d6d9f8a39bb3e5410b47cb73008c70b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9d6d9f8a39bb3e5410b47cb73008c70b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9d6d9f8a39bb3e5410b47cb73008c70b_JaffaCakes118.html
-
Size
12KB
-
MD5
9d6d9f8a39bb3e5410b47cb73008c70b
-
SHA1
47316b0551575b4b623d1b3249b67497f4532b6a
-
SHA256
4dff47e4251565f457afed5896902008cb5bb0dcdf277c2cb4e4c1fa58b3b53f
-
SHA512
5b6942eb069549ef8bda9b4759c7f8f6eb1cf3cada6984833153142bd5395a0de572c230d7e8805d2d4f2d229e1c264974eeefdbca35d1eb6fd703be8c2814b7
-
SSDEEP
192:CyibRXEkWqWHDdjbXO9hv39uwQFCVCf73xy1wSMt2VJi7t989DWhrpl3UuPb:CyiFM/uzQFAi7hy1wSMt2Li76s9j
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D3BCC41-27C4-11EF-9AB8-560090747152} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424252847" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d223f468b341d1458d8482f3176c33010000000002000000000010660000000100002000000056354a0597c11fba648595280959bd1b9b6de2c4c645be37dfcc37ef3a437ed9000000000e800000000200002000000001557e3f29072b21ed51e788aa565f0e623a36f9775861d1afc217e3dbe4409090000000a113c05bf2cd6a5caab460b77413d1a12fd62af6a0b89a1b3405ec9ea1c0d7af0a6fb67973c7714b088512a4076544000f313a6bdf5b70887d5efee34fbf8717b7974223946d3ea44c3a34ab71021d0da48c71029a424cb35eb9720bdc7fbc4cc19f1229e94a0b15157d2abb54a688e9d017663b7fa2843f3a42a2a708408f57cd2d4a4b7abfc596154900f9854afd0f40000000e89c5bf1cf7deb412c255ebe415bda38a539456f66a3a3b7c3efe2efaf0484d7f61895594e906f1d91b9741edde4408e253cd1facaf67696b2afdccdc30b83e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d223f468b341d1458d8482f3176c330100000000020000000000106600000001000020000000c6043907da454c0f147a9a1f7893b27ba85539dbcc80c5eff2e3493bb5204856000000000e8000000002000020000000e6f550bc026d91b2cf9197d360a991216ec7fe0938e105667e54fe629eefb153200000003df646e7f6dc1f98a988e965ee7ed5fd145a0a3031319605a838e8a15e6f02974000000019953388fc461e06cc3bae33cf66c9a64114d8f807440135aca8172de968407b9590690bf40b0684c1b7f9c7cd0801d8b5301b6cadb299a9c8b41062f4937786 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bbf931d1bbda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1996 2272 iexplore.exe 28 PID 2272 wrote to memory of 1996 2272 iexplore.exe 28 PID 2272 wrote to memory of 1996 2272 iexplore.exe 28 PID 2272 wrote to memory of 1996 2272 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9d6d9f8a39bb3e5410b47cb73008c70b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b0116a9758685a72442cdd611063457
SHA104e3dc6d56678faced72e726c543e937c4f5606f
SHA2569efb7b5a568b6cc5e0d98a0d4bb5d1bb11dc4dfc46766a1a94f3419d0f58fdc1
SHA51297a6ee0546f911344c5927e24eeb3841054ee795390a62d08a6fc7a902aab8ca2a6755bad32bf447d0f80400f901f4ea35e3f4aaafb1af73864e7c4cbbce69a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5342866ccff4494407229d15e142d0e57
SHA1e8609cb28b940f80b393cdcd207d0728bea91873
SHA2564e433cde909bbed006006cc42405fccbf8b6ebc52513b2b4003f18290c5d1a52
SHA512b4b98ae165cee72a504dbb01a260e7d786796cca6fbe2119aebdd252b36c343adf94ede265cfff5bf66a43cddb79302314e60775e487858342a22c9b818273e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539f5d3d50fee652ad9d98213af1df30b
SHA196c5baf40fc68ae6b5e3c00e595f29cb87cbda9b
SHA256eba592dc5b8ed4cb2262027d367dd83b7229c06b0b2b88247b04617133bd41a0
SHA5124f1786e598e892ac1f7b5030784bb3d1b562a49e5c0501906b7e9896dba50c81ee7d101dc369a982e40907ead4211c38c6662eb60987f7ad4d1b3decffa40505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9475615ca13a61763dfe297ea50bee7
SHA1ef7c1dae59c073218e173e2d6929d76f0e495c3b
SHA256941264f3203aa19c49b76c2edce8681e1df311a480069211b3390af3c2c9e5f5
SHA5125f0877bdbbc430ee6e2e90b08cbbb134f467b0f96eb2ee156bbc35408768a9ff041d6b0d1c2022c7710df2b19fc38225c1541f21e37a402fc12f63e9b7fc8c02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc0346b800fafec09bc343b1c38e7bcc
SHA1435f35754b27ae56247df1b5004e72a69664920a
SHA256c80eec2b8f53561631b1b885e9314d2ab36d67a224a4542691ece3c33ffaee85
SHA512aa90ecfd9886221f996a23716035e9da959851bcc3a5ac4a574e55cef71c17fed1b50fd4e5472da46f5a660654612f19f40a1648642163fb37132c508abf7d3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511a4405e3bd5aa058a088e6b444c9148
SHA1ecc01d06c936722e22c930f32dcedc8cf15b98e4
SHA256f17307d06d57559e46ab1d641ddd0feda1955d5038ac562ccc10fa3842208fc3
SHA512ad236e723453a3acd20df31bf08dedfc58bb5daabd721d48828a0273af2eb7c4f236659a4e3d6d98e6e8c7c7ccfbf8ec7f5ec8b4b8bea7c887bc3f67136a90fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d681115978e20fdb3e6a3fac099f8cd
SHA109839798642dd57b21666f3729068924d8c195dc
SHA2563752307fbf5d682634287b1876ede4482482deb8e0cc28f5407dbe61dfff727a
SHA51282f4473de353b288014c3c896f33f03c928b7b4321394e0ad2abc0172acbe53b63d6623a1dc17babab4bd86330939b8602fc1f899097254a2618fa9a6503f8a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f6b22c93f1ea844dd8032f63970a9c8
SHA1322dacc03e3d4eed7f52b160efe0238903378be3
SHA2560ce598e9ff2c775baea2a561be0f4b9bc1c90ad76b2a60526ea407da888bc027
SHA512ff8f7c6201b2c2db3b6d7f30a6af3129e8279f601b8727c4e75dfb0501f8b39587f44544c63f0ec2ef6d479428db6017cf033339740ecd0ad24e29bed2a3dc6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1d2f409dd622ce438778d882cda1f54
SHA1c8916b9fb3d23f15bacf6bf62964347efbf97b3b
SHA25624744f525d72c384f0eeae4111410c8f34369b1fb65e3b70a27ba286e85a3917
SHA5123c56dcbee227d30bc354255a01de3ee463ec976dafd27a7a14955042cb6599254128aced34449f4b770ec28c1fad41a1efafd5582d48c2f3a6cb78ddeea586a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54416b5edad3696e385308c7840332ac4
SHA1011c061f89a48998ccfa9080f7381d4ff2b0f208
SHA256fba64f97820b9c0810258b59097c7af12f6192d142c0feb37cfeeb4bfb4b1f4b
SHA512bc7d0f015abe68986d6d8ddce2db7f44a2a452db917cdf7fd17c19983df4a137303114a6f896633b401ac1a56f7b4cddf994d23b253664add783577951fd83f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54281f45de35093361e8ae9ab6fbd252b
SHA14c7d87c7cad41baf5a820b134477ade04cd44129
SHA25685190d3191531d3961f8d5f8fff21d5950213aab2e074e10c1fde644b2d62422
SHA512564b036bb8921e7601acaeae3a82a43945fec0fd3365bec22e5b8213d054346cf40d79974fe58ef37ba12c80a5a75ee280b2214c924377d4a736c98d82ae84f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509194c8cc572a615edc8c989d2cdf5f8
SHA1cbf0c0f2bf22fc29d499959387117dea57128a3c
SHA256816539805d0463b5e9ddd106cf83d877b83636e019af3b1a7ad39eec89b88844
SHA51253abc7bddb45bdcfabb660a1e193d6d2c71ce4351da0d602e94f3e5120286338a687d47fa73a6ab394289855a3e37577f11d4b7a9fee82d9f253365babe2456a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c915263689001344a68ecc3c5628a04a
SHA16ab7ab8f5cbeab15a98f34aaa0259233a03a46c0
SHA256e84987389b3ca7579b3b0294af37913cbdede83fbb92d12943beaaf342ded303
SHA5122d098200d06ec7dd19323bdabb39e71446dd78cd8cb3b124928f15f6fae77f368265085e03b174857e9b41d2023fc222086005ee5b44960bc85cb24860caa1b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534e9973b2f282a1a1b6f71900c6710bd
SHA1b15c0ac690d9f7c857ae4a27727597c3b927f7ed
SHA256e8200f22c2c97896374cd002ae6775e888ca1c0ef0b3fa88d866c5ec5699e850
SHA512d1087c9744351897c661fe5778989cc52aac4c589a5df8a32877d540a0b478580c722f6bed266bf2c8f9ef42bb51c67363c1b248453b94552dc4eb8a0e400b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ba4d88446d61d7fa8a2a124c22f2248
SHA1d82c87e581fefeb2a12f6d07fbc5109331302b0b
SHA25636071d12ebee4bf31e325363c9870a501e4d8880700c0dee3f9d648c8ef26124
SHA51268dff837cbaf0523f47c4d9060bf3ece49497840d43b0a2fc4dda07bfc34d07910825f99045d9e72bf476d7330a8c870f51502c7caa5d7f71805d7a07796737e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f057c4cc7fe68820f77be43da842c87
SHA1e276bb735f6a4406fb0e8c88b401aff2ba7e5d15
SHA2565bc663e6641256dd3832a96870a8d15e88cc7f69c9d452cba4c1166d7cc70dd4
SHA512505f241ad0a92bfee9c8c7b162d5bf35eb373f35cde4a75014fc99016790df96e31e75ceb689383d97fe9010d12e6e92ff8c1c121cacd782db4a065a0e11c7be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ceb298071629fa38de4acee2bfdcd00
SHA106fabbd6f913dd13ddf8a26a3cf928320d1d1e69
SHA256f7c3187553f2696bdb8045878148158da8bbecebe93ead5d84d67c2b6ee41af4
SHA51295e820477b9e351a923dbe748054cc4c475dbc6fb0fb1728ae2a3e0306a073445703738f78877eaa68db2472fbffd8fd988309329700bdf312c2d173325bb16a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59da2c4645c6e4a200c323b817398ac5a
SHA1f9745c0bbde00e144438fc0ae9925c0d1ea30cfe
SHA25619a10e507cd07019f4706736e4bd5699e007ab5c6e4b6e8297523ef226f4000e
SHA512aff843a22b429f5a68835840f09a9414993e87cfdccbbea4e42cb75be03797eeb606443ea2a064a17d46d556aaf078f8b2ba3ad01d3ac854828cf0524359cf95
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b