Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
aa185fb04e8f34bdf22bf9730c5d37f2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aa185fb04e8f34bdf22bf9730c5d37f2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aa185fb04e8f34bdf22bf9730c5d37f2_JaffaCakes118.html
-
Size
226KB
-
MD5
aa185fb04e8f34bdf22bf9730c5d37f2
-
SHA1
ef2ffc74c793b736b021eb5bae5b408775a0f41c
-
SHA256
8f18b8d711fd7a79d4ffea9f4056e5bcc3932b0d73d927914ac888c0ea110384
-
SHA512
90869d7dbba8a71788bcd706deb7a4a01551dd5ead21434432aef5b5674f1dbd1ad98b1c53801b557a12f4afa9ea3824b23008e8b1f97149f86db81b949ea020
-
SSDEEP
3072:IJtyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:IKsMYod+X3oI+YLsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03ab36664beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061c2a8ea9aeeb949924c4218e5181913000000000200000000001066000000010000200000002713f0b2df4d2159986ea2737ea226254f28f01bbee2522b3544f62e05a22110000000000e80000000020000200000000bb71c87bfbaa461b2508d774ae2f263068f83c4bc0df1e1a8f37b7bce093f5e90000000e34fbfcbb16baa666c662f57e43b6466557aefa455478259717e94041686cd34fb61b325662a1a7b80a5fb9fdb88c49db348635e4f84f5c4e937236a5b75c81355d3e60962c828c6396e744b4b77b5f1024ed1da98ac50743f116d60e0e1aa29ef5b7cca67e3b1a73bfcab924d07a37b6d2470e4f0a1905a197321f71de162360b33954fe09ce4f4b637edad1ac9ea7f4000000077be9b9810b4788f920c739a521f3c2484428188fc817785aef5056a415c8ed59a35499ba9762431e3faa23efa302f4be095de36a9e1face4441627729a9c738 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92149331-2A57-11EF-A293-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424535975" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061c2a8ea9aeeb949924c4218e518191300000000020000000000106600000001000020000000d7982f56d20e614dad6f48085afbd2d7bcd9e50ee0850e1ef3d903d7bfe3378f000000000e800000000200002000000044de1e62357beae119be0a3d184d8414b4c480d8f675ad2b8e45a473f6b38ecd20000000a2a4ceab6c90690b906ce29e024463ac4610d003e636bfded5693f1ec5447211400000007d69f713c01f410e7841b46d755b9bcd28fbfdef76bf5421eec7e38964b15b876af3f44ce337daf7369e6c7067d738c31d041b75d5cc8ca34be44dd5dab3f6a7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3008 2172 iexplore.exe 28 PID 2172 wrote to memory of 3008 2172 iexplore.exe 28 PID 2172 wrote to memory of 3008 2172 iexplore.exe 28 PID 2172 wrote to memory of 3008 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa185fb04e8f34bdf22bf9730c5d37f2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508625e7e8941ff0e38d261bcf23237a8
SHA12cfd7a6d1db1c0f154bafa094eccef4d72decc79
SHA25686a0f63d2e464abba67b7c849c2a7aff205eb7e243857ba4d09cba4461d0e281
SHA512c711f526185ef373be12e9d0a0cf18d4fd12f72951fd289ab07aeb2b231874f121862a0d21b267c3eef9304997a3a34803ade7f57f4693c3cb31a343a15a9e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a28e75dba6fd9c5b533032fdba2b1d70
SHA13d0527776712f2be79588128f399578bb09fb77e
SHA256fa45afd508b9a71c8aa53a01d3cfd2d004c0f0dcc13292178cc131c51dd245e9
SHA512baf56f298d0cb52dec4a202d9e54559cfd2a8e58bc4d6498589405748dfc656b6846f073b5e0e24f7eb974f66708ca33f80534d9773d6a0763f483df4cae550c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c3cd7a583b4d3d6678990a2bed4fc3f
SHA17db0ffb953ced29ae9f272fb58078fb411347e6c
SHA2564195f9c8ba12cbf029957ff6be93a5fe02743d03969d29f673dcb510053aaf22
SHA51268ad27456c90caa032c0f7b321bd4a6c97d64b8221cc4edebfb185f815a3b67b31ab309340d649166ddf663d6c9439a5870afc3acc3e30eb1db4ff5b70af0569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d08a4d6a8b8a61f5eab12cfb47063a73
SHA1fd9a58ebd6636bbc026acf2ac092d8257f8b0489
SHA25632c278caa57f2998a384b50dd4447102a4f16f0393a1809020e7eb9be848b9d0
SHA5122561fce49da1db01b8cda4a2d1f03eec272f27402dace1496e84462fbb24f0921946379ec527b9aad96eb4de9b31aae5acfc88df55cab7d329f62956880eb3ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c57d7f9b238f5ddcd6d7b4cb3aec47df
SHA1db791828290ecd2f815962f175e111f67827014c
SHA256b981e0934c551114e9403f3337955cf1ebf71ef0d8c40d995d44df856f7fb0ae
SHA5124f111016780037f50637febd4da44a52093f2fbc7e08b2e6c28b7f0fbd67c099e952e258e7c928d0788127700f07dc68bd9192b03b2e51f44b57daa2b9c85ebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed45d68735a1e7381100a2cbdbd0adfd
SHA1b2b7c2393ebf6132fa0411ca3c8baaaaeaabe7f5
SHA256ac58c24e0f360097c3e22bccb9aa811ed8e853b10365ae4e9eafb5d7e06acf64
SHA51204596f2cab610f15312dad3618d477161ecff8ba4ff7009182b2cc23da17f24e0fd4d58d825ee42cf97e99c9b7b99041ba756d3ce5d9428121a06b91411eb23c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54769656fcfc719b5c0a504e718e6938c
SHA1409a944cc1f3cb5ba9913d76259551601584f419
SHA256dca943441d1c00b82c0ca8e753d6f2e20fcd3817a93e8f034a4a2cea35851b33
SHA512e2cd1b9ae21130ba6712bab912a555864060d83c4d1a609bf4dcb4433d0bd8768e057689f86fd53d49243da4d6ae0afdca1da9fad3b77f2d0d9b382bae3e50c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4d03f59e76f5000dd3a44fca3e47691
SHA1dd7fd4f1597ab15f99b31ff8a011ba76eca8aeac
SHA2562ff7afae08689f65d7453b505bb91f1871201c77428314747f223eaac36991a0
SHA512f14927485860fee2c5f58552372fc94ed828121a9a46df0ec23e364658918a04d2d87b9cf64fd8b1b49899ef21bd930744e9d83db47f5f3aeea590896c2e860a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553568db18b9aadb2a4304a8e6dd0a287
SHA1520909d3be7324f6eaf7f9fbf592ffa9d9d7ec2f
SHA256214d67cb8c486fee0a578ea7f48652fb71e88206a7b39412ab9247a028b74dd5
SHA51245aeadf7e1b48366483d97a228509d4af7feece59c067a23ffc076a5fb03b3e062064558392aaf1812011cc2993fd228e1772898f117de6702dc766b2ce18e94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5bc157777b47ed58f72d7b0d57e103e
SHA11405f7b689cd8fc172b5c5b4d25865122da7a901
SHA256b151824c02363e08b86b624d7233664c8ebf1c56f8851b365ab2ffbe8707f72e
SHA512ebe320eacb9a08fbc4386eb821fecc17ad88c1f12d7bf22e93875c090bfbf95365c713e5b811786045b491e7dc77279b61dd9274bd0757098f35b9aa3dc16de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564ce3b6f04c92b73aa8c90a6158da0fd
SHA182dc9484264e5bfcc50a5de45ad5f43644f1a705
SHA256dc04abaee90c329cc4077805118289c47640f64c93d4c190f80742840295001e
SHA512ad7d10a3d5679c9c06d4c1a6cd6d40948cb558e6d0b90007468c4310999318248f1265ae1274dd0e39b1e5b28c9f8e98465c845325129b8cdccc1a926c7c5573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e305f3fffa3c1c424a44dbd5c2a95c6
SHA1d93487c8c1af3c977ce88297808db8c95dab4ae8
SHA2567936f10a8710025a8c7f977cac5549558885dcd92f4adbba0f4c42b0bee78be3
SHA512157c8e29dd69b5d6ee8e19fb12b9e47da6f8cf4c01bccdcd6a2ce6b0199cbec9578bbeaf9632be904fe7b81de5c81bd36ff8dfe664e0c03c899ccc4828360bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59335688a3884ac763a0f9f0607659a23
SHA16b4ae29034f55ccd073892ad6ef6f8a7eeb65642
SHA256cb21fad8f53164a116fc8ce8681aa04ab815e3678a4a169851c8f58de3545f58
SHA512d88d1a481c1d06e1f53288ef7197c7e380aaa3030d2b9e2e181eea6f04f50ec243678d53abbd6ecd9954b4b042fd61152efb8801cfa3e239e49180dae4de1968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1e542c01d58b245a5e2062bdc46b22d
SHA1a3fde5d61d96ae48f8d9d62633af5e90a2db8c44
SHA2566dfd6ddda1878d163f5c01d1ad01b63489b11757d21f7ad3db912de67c073552
SHA512a018ae413ebfc3ad8c8595167933b49742f9726a1a7ad1c388d1efc52981f1e719e9fbb0e7ad1bfa8297bb69cabe97f99e43c034b66727f49588da24741db427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea37d3bb33c8b7406cc6279290daa10
SHA125e2a2dff091e9b2e02ae014d155732c2b870bb3
SHA256ddb4fab9b090a4b86187330cddb1c2147014d0b6a42cdffb517c60a7e6cd78db
SHA512a3512e467e33005547565c8f816ada8199b898376f60994876f6b2365b4b1d2b7a4a2b635203fd607bfa7c2c23c5c373f616f7f19134d533711d976e0748240c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4caa8af6a25767206d3b76b20a7dfdd
SHA13d68ecd6ae9c6b02ac051e5c0ee26a769ec2a6d5
SHA2562e2dda4b58f83368b9b8cb776ac89dc4eda6ab542e69de353987da45cd259e59
SHA5123e341a54f141a99b1f8c9f98adb045a76b155866876f6588406c66668af2e1d729ba8138a087edecd757885a3904a608f7b8fcb02d43eda632b2f42fdeb80b8b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b