Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
9ef94c4bc00d14c5f9a711986f6b66e5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9ef94c4bc00d14c5f9a711986f6b66e5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9ef94c4bc00d14c5f9a711986f6b66e5_JaffaCakes118.html
-
Size
4KB
-
MD5
9ef94c4bc00d14c5f9a711986f6b66e5
-
SHA1
2c00a7fefe89444b8f346d777e4bfffdf40a5f75
-
SHA256
a07ddf0f1bd7e1a90727e35b11e32387615d19da1eb87cb1ee33cc5cc1f28e0d
-
SHA512
7ec2518444208ca6e51ffc1e3518b935b0ac512bcbd61fc5c878614018f7d61d635dd7b8efad805525f73cc3547542f7bb895d5ae04fe6d781d413cc6e183d4a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oMjd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424288606" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02fba7224bcda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c768f0bb4574244af78f20d16679a6c000000000200000000001066000000010000200000009c899fc10cb10164691a1bc2611d927451de9d9c4f13fc1e578e8dafd18a7122000000000e8000000002000020000000b2ca303928630b2b77a63291f7a68616cfd09efe4d904f4f3e9613ce086a5b92900000007b527604e79970be72d75c6ad2b91471d0e5047d2977f7b16c4c2ff53adba376315ead392d67fc2d0336c202e6860c509edd565d52e4c3bb8f833ed16add8b38e1394cd7dc7094810db2e77ad006cc9a58f249bf0b4eed6b0eb4ceb649f5cb1b49788c2456714c7bf0cac02bf21e415e5254bedf50f1f58c05af2804994d355fe5e87247c7a643bd87bdff1e3709998640000000d5892cf4c11c96beedd9aa0aa8ea404c52a48cb99d3af0669c4cae4e2ac895b0956ee9aa1a246e09f0de91b913bb8a3665f1ab58a218366d951a9bc621485b40 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D777FE1-2817-11EF-9F3E-D2EFD46A7D0E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c768f0bb4574244af78f20d16679a6c00000000020000000000106600000001000020000000938ec0fae2a75eb0183689f5314736cb7b70f49aba92bf71bfec93406c1d13ee000000000e8000000002000020000000db9fab58724f1660f4f44aa4ac6e41e951783fa309343999563eb9721a7fcd5d20000000d7dab2f5d13b038df419fca91166595d43d26546f8eb269884b4107522fae991400000002f8f64313d6ec84f737e4e05594244fed3fb8d8142d63d92f4033b201871b010be859a040610a6b8af84348a9aae07d013004ccd2d8f62fce63daa2a4e9da302 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2788 1664 iexplore.exe 28 PID 1664 wrote to memory of 2788 1664 iexplore.exe 28 PID 1664 wrote to memory of 2788 1664 iexplore.exe 28 PID 1664 wrote to memory of 2788 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9ef94c4bc00d14c5f9a711986f6b66e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aac0ab86743b38a6fc3a6928f5031951
SHA18c62c145faa9caeb5441febd28f6a46433da4bdc
SHA256b3801eb393d69fb897091fed575ff72660750c483ce767d04134e03a488b28a1
SHA5122c6cf038eb8844961d279e50b380f06bf582fc5b6156e4d37c6fcd928ca5418ef238c7649f386f793ee1ed4f959269134b148807bd7dbc2c34279abeda84bb7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566fae8642d16735a419bf9f5ffb6f3a0
SHA1907ef69820b33efa0e4a5902825116968b85630c
SHA25698ec3952b6795a5f33b36b4dc950a958a014f6aea11b8edb970287458a95ebe2
SHA5125e4c5200b98124a3c458042dcc65f104fbddc421486c0d0c20a69ec4a8e96da2bbf37bb67a106b5daf09f7cc74b4e076754a71940210ded525f1031542d301de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6cbad5c849d555dcdb2ae2e4a0fe20
SHA172612a6a13cd7ae9ab02b2d2df8cd2215f3c85bc
SHA256984011f577b4f640d10bab00b587d9ef688debba5e375ed679e2d4c27f8c784f
SHA5124690f79925b727342e2ea4289eab755d524104dcf7cc9f596773d2e145ddbfbaa3577297b7edddf5c1256bbd290679d569844578234e4c9d02790564181be718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53366e2ffcfec2b8baee3ee2415088376
SHA1b4034bb992dfd616b1a03aa7c9b1381844b51162
SHA2567bc45a714ce607fe67e4f610b7186f065c650bddd013e6e892d1962f5a652ca3
SHA512671ffaf9f2984e3cdd4e53d92f67805fb481d52d8e4db16c0b2b7a8a78723ee08782f3ab45efd80039e7642b599e89f05f1f84c57d4a1da77a8a3b493dcbc998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d18049dc5c21fec5f33508cba6c9ee3
SHA1cfcacc5e7159bc2a96d8e48e2a17b6d9678c3660
SHA2566c1483f57afbb1c306da45b3ed448776c6a8420f7d673614e95ab5a77e6c778b
SHA512372166a1de20efc11f837ccfb12605062ca66e01ce293b16ab2c71088c7a0131e175e304d428c4cea3a43e45d4cce497a0389b12aea69ad6083eeed773db6c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b0c390fca9081dde7fae98ccdb3bd09
SHA1f6fd538ae57fe469a3218a51a6b0bd8e8bc30960
SHA256f60c08a44a17c0cd6acfcf349b35990215c409396a15ec005a026cc35a170bc5
SHA512bf44911a44d6ca3b6acb0e69277ab34370514ed554766a11a65ae54fb17c2f4c074b4b25cf6c43694bd4af2976e5ca7acf07c458cdf0450f8244f66bbff17e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523a44c035aea6bda78dc9805fde8de88
SHA1024fc8ca955084e4291c6a419004a74596ba8683
SHA256d9168de6079e183d1d7974eadcdd28ee0321cc6163cb1770063b7831fc6d346f
SHA5122976a79e4f27899139437dcabf3a13e743580c8e2cc072f418ee716870c6a6fea5daaafea720ff175430b73f91e5160bca3adf0ebbd337e49ab4a2280d375ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c63964d0af920ac062b3e7440fcbaf2c
SHA13a80f977b2c041cdd8e32be9ee0137b540d62794
SHA25626aa5dbdbc2b51df221c18d86b1e5d1ba13e90328915d0cdcc3f4557aa0b3414
SHA5121c82b407269a7fbfc91456e0ed26385ec2b9b0c39c98c80284f9cd21e9b197f56c06e7b198254df7750b2f538191dfe727984accc39b24a46c93c15300997a74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ff0ef4c5fb85e355bd42862f66d4516
SHA131739b97891eb3013d3df5f7aae0acf95ec2fc5e
SHA2563c47d85c74de1e5e84f00a01db4c4aa18a1560a27523966253c63b3763bf3029
SHA5127bd399e3ce2c1326166960b4ad5e11c77e0dd9af8ae0e0eb12f2b6b1fbdd2645bc31f4b85a1e7ca2e6221878be30f9d8d1552ca3ee0e188f337e6a4d5487abe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5479ca637617e8bba74bb198ce1c5d9fb
SHA1f3408c144901cc0031c4a58fc7a62d81bda4e499
SHA2563cd42c9f2e0b97b15348cbcd6beb8e1053f674962ac74604fbdca943fde6e561
SHA512f8d392c922443073adc24273914aa54df25d01ad0094ef6664f092f6e4b1906bc40d14afa3106290987766763a89313433b187de8f8c81c697ca672f16996b81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c777af7a85a8169e41e0fa2916a65de8
SHA1b49a7f22735731f8cafb7cca96a71ab16e444f9b
SHA256f86e393c27704d2e4ec7b22f15d16bdb3193bc2965e1e7f25ac4087eb970f32a
SHA512c57c37d3c9c2ccf23174aa0ea3dd976a56df16f06b605063caf6d388b481c39fa659e76e50a9529a53ac2a091327bf3fc64be152ae0ca84728bb1b08671969eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5665e920d6e98cfb49753d096e71cbb3b
SHA129e202b2afabdf3874c26e60f4a56d2e6d6aff58
SHA256511ef2d2b2e59e5708b7588810da1f86a0a1b7590c4e556b820223f1f7d3ee72
SHA5128fe6e3157da1f0c5bd2d1de4af5158a47943066916c7fde5e777428c1a39b9149c98296006fef673aefce10ae5d3dbefeb05132d3591c968cd58ace80047ca57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aed942f2eb7772a0b1f66f2183b119fc
SHA1c34b2f26f7b5425169b061b6e0fa17dbff23311a
SHA25678faadb427b17a8803bcd59bbb057eae02ea9a44c8318dc7c0639a4b3979479f
SHA512fc4c6b7d62d058450ac3ad7842fd9a28014d1dfad5aa383368bfe08472d33733b23e4c6fe3e75e7c9ae13a3ff67b2c50201f1fb44a0a0b928ecbc181ee08d6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eeca68183c716f66748518974d3f2d5
SHA181256288d422d33faa76c02b1d9e77d4753ba80a
SHA2569ada08492cd54de5b2d9edf7160226d5f5fce6b3acef83c521f0677f6a2cef75
SHA51268e24e32598b82217e7c6b8d7deaab6184eb4cdda1843683867f9308bfd0a2b2cdd5fd63423832fde5c5c3f3b505d1e9994db28a7fe6fdd3b3461e2056646308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5444c3cfd4c707e651b3a90cbe13a0737
SHA186852888b7c8df4d348baa8414cf3e44d88c0139
SHA25656f6537b4f40e073061192e9e55b9cccf5c3d421d1266965d9345ff120b75083
SHA5127e6da7c34bfd1990f97439d5525af32ac6144afb7303bebada71e38615bb69f75f1ffc7fc15fcbfd718ee02a9dfe194abb71bb9aea9ecb449299d61f414224c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd9447459471b6477378e81f0c4e3b68
SHA18d1ab381b7e6c13be182c6d7bdd735746e6327a4
SHA2563559b0dc8f3ac28f546601a1a539a2e5c6cd2bff8841c6d9f6bda91c07976ae1
SHA512e3c2db137403adf6eafba583f7cc2d7a78ada5c128ff4fa74418dd7f5abb8cc04459242626a873bab73158d5ce633fdd2a6fbe434d0556d249b4c9844d8ec230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8fc202caffb6a08d569af4b42ba1182
SHA1f75225f8cfd726d0d38c059697639fbf3bf8e37c
SHA2566c3014ebf74bf0467a10317ea85a564654f9d12e59e143014d55e3c0d3f36fa0
SHA512cd5f3233c3928e46ca0fb0512f45ad93b445765ea60e204cc9224ffe96298d49eaa8c9b6fba70198b335ab39390153d5a60c7194f9fa2fc658e7305c7c8c6c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2d804008c85614aad9139127e69d0f7
SHA1612ecd676f05caa5d042e4342c7bba8be1411a67
SHA256128c76b2668d69878ffecd30abcc4301c77f81b0b1eaf597f4114778110d04e9
SHA5121ea50480355ec1d7209b699538678b8179e3017813121d19c8175b46a4ce656e3ca6f42a2f7b20529873c1be97e28fb4324fee53439b65eec5b0f484e76cdcb9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b