Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
a209aa2a81a19dd4172ea53c527d6fc6_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a209aa2a81a19dd4172ea53c527d6fc6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a209aa2a81a19dd4172ea53c527d6fc6_JaffaCakes118.html
-
Size
462KB
-
MD5
a209aa2a81a19dd4172ea53c527d6fc6
-
SHA1
4f48d0b65608ed0dd9746661d7c60fc31d11900a
-
SHA256
a04f5033935821dc43d6f3f6ea81e80b4fbf538523402c4040a74f32389f3a6b
-
SHA512
7468c4607ef7590cdafc2b25a36d488550c4b675a9cbba608e951b73b13a08c311357d5b8ce076eef4bc2e8fd3061563a96ba1d8ccc20bdb768be3d0e2ce1de4
-
SSDEEP
6144:SusMYod+X3oI+YZisMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:R5d+X3Q5d+X3G5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de30d5c3e523f749aafc5913bd5f5d7a000000000200000000001066000000010000200000007a7538579768cc99eea8be52e90de6a00c2789e18c3626cea25ba6da6f36df41000000000e8000000002000020000000b091592143b1746b57473198a33d4e2306b5589b72e95bae0b703ec47a7b075520000000442d9600cf6b59953fd12840cea649462440471baa95011004406c1e16faa059400000000f8317c379f82b0a5ccb76082efc280281396b7a28f917d850ffe75327369260e2e97c94137971b396abc60a7c47b64f685c10d2e62dc00b3a11d87c7616d4ae iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424383294" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000de30d5c3e523f749aafc5913bd5f5d7a00000000020000000000106600000001000020000000730edea274e39e2dc9ca631bdac699f7db5e340d8fd70d64aa703429d0e085f4000000000e80000000020000200000004c9f20ed58acd0f32ab90329c8243d1f458a1fb7994ec85cff12ff638c166e8290000000ce85e12551ec8405a472947fa5a82ed1817ade3375c1dfa3033c16c80b2252dc8b33919bfc78633dc462f427ea54119b6dffb699beb76b73c9cff5994007d806495fb7a18618ee14823705de25e52199793b3101ba6833d5c5763023f451e74d2a2fdfe28e46bd9e54ce51bcbdc3b1688c85168381d3634e518ae28fc4ca83f4abeb9733a6971454967cd1e32fd98e4b4000000027f7ccb9123223b41c5b78477873103d01ff3396ee5d060cd201306ba54eab41dbe6b303a8769f1f3f3460c8618da399fd4d5a9ab01d7f172084fe374491bf56 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9090aced00bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{151F1AD1-28F4-11EF-8CD1-FA3492730900} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2200 iexplore.exe 2200 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1680 2200 iexplore.exe 28 PID 2200 wrote to memory of 1680 2200 iexplore.exe 28 PID 2200 wrote to memory of 1680 2200 iexplore.exe 28 PID 2200 wrote to memory of 1680 2200 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a209aa2a81a19dd4172ea53c527d6fc6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5925999f314f714b9c0415132c16e9577
SHA18747da8a04a7a94cacb2e7a0ac84c3e98fb53ca5
SHA2562f80469799b5b7fbbf0764c04ebd9aef5afcc9b4a6eb13c044c974aff0c7656b
SHA51205c3adfc6470aa039b34151644336026d324c51343236d1028359a2390c92074630505540985c939c6b016981451f4a2fbad1a8871e09a2c5e992735ec650025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509714f2388420ae82c448bd41fd31206
SHA1dd402be6239b0b84051c1a3499e9cd01d4b05d32
SHA2562922098dd8acd291c3d5ce608ff6301b524fa8b1e4c44eee26ea240b2efa229c
SHA5127b9c69c7b7f90bc52cf2b393dc222a0add8aba148efa4e5d30d7d64a89ceb1e6ea932d250fa5b77d3c28095ad4098f50733da77ab6f0195b203b98b154577bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc36eb45c06eeb4d03e94ac63d33ef4d
SHA1dd9eff1f65ced77165b03d56a7c5a34ae41fb6a1
SHA2566061e88ac8cdba6cc995cce50344a23119ec0798df99777b18daed406d37492d
SHA5122a7178acce0657fc39dafe75aa2857154baddc94532d95517d1aaa22b5bdc3883aa697b0b95841a944b83a6b8901ce2c268c2559e22d5d0511de284bdee89318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2ce42beb5c2630cd7e9e870a1468da7
SHA121a7e76f231405a5b1e9451e90a6869fb3f1ab6a
SHA256078273c168eb00b65e0c063524a7877d82c4a2dddcb2410e722dacfd3100fa39
SHA51250f9b2cd0518ed8a504b946247bf38316ba9a1a359a98f8060f48832cd2980f3b06084a190f977e3b42289d08b3a909b0480682deff0f9daaea9f974d63dc11b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e54b167e46293fb81c37acea227ed6dc
SHA1fd6c1e8e08d1346a60b188fb18a0387038724a2b
SHA256872057866172663338dee697e7b7937288cdc8181a7b9ecced2185ab522808a5
SHA512f129772817fb641c7e8dab2d5ddb084e6b0c1f128b2ddcf87f154064c50e61c5dc39506687af3d193dcde995afcc7aee85dc7de829d48e6657bfcd0b4ab1c75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506250354416fd04a4e400bfdc6be1a69
SHA130a654603f6f3b5e204f6e344cc114f31ed0962e
SHA256eea7b41d380cb8752f53e1f3f1b51b6ae9ddf9ff197bb02636c7f10470a4fa21
SHA512377390d1fa66a8d1cece305f1486c51ad74e968a6f9fa878920a870d5ecf4f7781e9d8f6014a5d316d066b2a4d3d01b5f90b6c0fa15e3212511df69c2fb8964a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e91c55f286b93173e4a92532f5b51df
SHA1aae82f511983aafa62d1a7dc06d428736d136496
SHA256b3014c0631ade05576ad8f2385691cd523a3e67f98b0e9df78e87eb8c30fbde1
SHA5120cf679a24373320d7fdeb3bd68ad91bf9f7b740f93922285fd26d83b5171fd8d652db3a3438a17fd666783591f3ba4fd1a66d1b2f05a19e85e4b50173a3beb9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fa3055241bfcd9436c853cea47401fb
SHA12f0cb787f2d2dc70b6db2c30cec7d6a25ff9a2c9
SHA2568ed098d79965149b7ca52505e77dba3a110c36d6dc10dda0c02a0ef9e81096c0
SHA5126f5efe6e91ce0a951dcdced10322961ed5b1b027533f9923672728e4ecf32cab67b2f5bac4a09773a1076858930a5ab688742f59e30d0612b10be21354f023d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d2240b926e4841f1b61b2456fc4494e
SHA11c914c95cd54f8455d8e8020caea708e5490f0f1
SHA25691f274731f0fa8dd861fae7df00525c2f779606430b94979cc55ccb6e12d7f75
SHA51281411dcedcb82284dd96464e7f950afaa956443705aa62a06d742ac17dbd499fc3b77db128e212ad3965ed9b26444d71189b66a3b1851baac02a5ae2884cca3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c0774fc331ff202178d5dd32d982faf
SHA1d92757769c0a420af92cc4f83c3e51cdd561e9e7
SHA25663a4eee15ddd77ce79fe48e3117eaafed32fc8924bb6d8f01209271e61c210b7
SHA51209705de35b813a227c4dbb32f5cc311f666cace7b9c911ec1612d9b43b53ba2549d230610f663951a1d5e32565a37a67069628e6c6785aa3589bf8b2fc7d516c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c9e5a9e49794c3c98056430e9bd391
SHA1b0f5af78871b45e73b294d97a0ab31243b4591d9
SHA256768b4e4a40a4f2aa26a62db88c1570cbec1f32cfcbe708cf096ece1e8e3404c2
SHA512333f2f02f69a81878ec4d6f4bcde14e3a85b40349749416f9fe0e654394f498e12eb4c374ddd250f04ac8ed26c4433585fa0e1984e18a1ce879887616bed2f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb415ae9982ed25eb9063ecc397285df
SHA1d67cdf2d72ab7b179203c492a8ef802bd9d978d0
SHA25686afacacde3eb0f15cd02ab9e73c18b2c8403fd9f92fd39a656056b262f521a0
SHA512b58d652694300188c78c4884504829fb8748ede798c163f878298d8ccb2cf1ee529e80d108a12514ee9390f6b9a749d034d9f293fd64f88cfbb61e0c05731e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572ec47dc2fc11fe10aedacbea3e552c5
SHA1eccaa803dcd9ae25f5cb4dab78695bc0ef3fb173
SHA2565252d42a39fd200d47bbfb4231ebc07fdd53aaadac330a54f18133e1b90e50b4
SHA5123ec57720f5a075949b4c09a5f011b121b767ce984c7b2b4bb905b0f0e42c12cf24e5a6a02bac49aab9cb5acf66e87bbd0aa31f055f5feb9788c1e58637d6c854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ef5560b6479710a2820df97402ad6bd
SHA1be974bdf3340380b6737f006adcf1efc7862e329
SHA256e0502e64227fa7c8e4ee7072700c4c548fd2efcda5c066288cdad321538d059d
SHA5125dcf2c7758f27ddbecfd8ebdccaeec63d06b7ebb0db7bc3f1e2731d69907dfad83791a31263e4374a3e4d1af89cb307df97a5d797e67d2d45e89ea5ec5a307d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5332229c03f0e1c1c668a9e943ed311eb
SHA1faa16a557dc0765e6fd494c79e9885e7006fe161
SHA25649b6aa94717ec6bf5c24cf08e586962a47f860f9d6fd852c5c202113b659571a
SHA51233c55e52ea703d30b3a6eefb044505d80758dc24e2e49c2b8ed6f06b2df25c819cda9512e102e70e27a572214da57bf264e78f93682e9f872ef07336bb8551ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eced88089806ddf36c0cad692cdf2d2d
SHA1c57086c23cf72b5577fedda6d7af4a5ae16dd4cc
SHA256f69fd11a6322feb3566380115295802e1b4e18cc9b074557c53f44ca69b84807
SHA512aa16a7244e3ffdd2e5f4192e5966ef87847a2526d00adf01d305bd5106f64ea11aeb3db1b95ca33ae85f70e6c8e186cf50431d92dbeed42d9b0b51c66c4dd183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32a60a3fdd2173687a5008a49a226b6
SHA1189ae461b7b43e8927b6fa869a0cab9eb67344dd
SHA256b78be4096565c5bf8ef4e68d656b170aa8336560c9e5c3b8f72c2cc52cbb9826
SHA512393a4901a5a8a048f7f51165c14c2b707bda4bb0e7cbd818c899afcc9300e73cc9418ddb358ba75e6db8d83b46a57f9c271b98b6f28df68c652d059fcc62e86c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b