Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
aaf94993216e11b04a722aa9b8b74af4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aaf94993216e11b04a722aa9b8b74af4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aaf94993216e11b04a722aa9b8b74af4_JaffaCakes118.html
-
Size
142KB
-
MD5
aaf94993216e11b04a722aa9b8b74af4
-
SHA1
ab79a159c05c3a7aba11e8e372ef4dc3a95917fa
-
SHA256
ae01c86d7a709b055ddabf7c1ce507ced6fa055a8faca7f8fbcf8c8727137a19
-
SHA512
7ee68ee591a808b7641d711d767f506d54ad7b37d49928f9014daee1a749f7bdcadcc7609501e1032459a7a29a115462c9fe1efbe55dde1b5ec57e8cb65d46d3
-
SSDEEP
3072:SLkQnACx7dyfkMY+BES09JXAnyrZalI+YQ:SLkQnACx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424549029" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6DEFDA1-2A75-11EF-A8CB-6EAD7206CC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1156 2352 iexplore.exe 28 PID 2352 wrote to memory of 1156 2352 iexplore.exe 28 PID 2352 wrote to memory of 1156 2352 iexplore.exe 28 PID 2352 wrote to memory of 1156 2352 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aaf94993216e11b04a722aa9b8b74af4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57103d4c06cf902ffd8b5cb6e13b2988a
SHA1b7e4469699e64d64a8511b1a25eb409a4e581e2f
SHA2568852f05e9337ecaee4587ecd1e09d5c63b7db0e1d78f786cf4dce1c3d387b679
SHA5126536d0c699d8632a189af3282ef9f09395de42653b4d084665252de76399a200f450b126f411a0f9783344bd945c7e379d2d5a4cfd664ac48a50d5888a437fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5265340c29d9d0cf60c38cff9a37ee57b
SHA1362955c3e76d38268255a3842859fa824964e8fd
SHA2561d159d330a8c0bfa3f7a83288bb55d983a84a1dde950e2f1b959ea0451bb9ab4
SHA512bd19d9bf98891d4a0bdfbdd0cc4457c7487df78eaea9ae7a139f1e66342929ca2108be76b2b726136f9508604c467ca0841c8552edfbe69b43b4bd68db584f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc287f821df58ebf467481f4a0d1ae89
SHA17cbf7a1fc6923cf22a6100a0fe6aabdf069030ed
SHA2569373ba18fdef4a7c6f3dfb2179ff31decf64580e63baa0199b0988329349b74f
SHA5126d947787fc82a46968f73c383acaf9a71f38ba2d11c55fc175a908d726f8355aa882f00a1984884b05c7706eb2b330666c80ee655362e2b466d77839242b42e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510d02ff00ba100fab4cf609ba56e9ea6
SHA1108ba7acd0e0f9b3b16643af6bd0db9cf9856362
SHA2565faa7575c478d687be74ffae6e41108673ebe166df432d21d9a251c0fdd58aef
SHA5128199feff63df5ef7694855128b08afee8115fdfa30c2c5b8cc376048f77ecde8bb0dd6f79ea1526b3edf0214f87c8116ffb4f240018b46b5a19d6e04e5ed3c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549eaf1986894d6f5c7c130c527df2329
SHA1982d66dc2f3219b454d630574f26d2f917c8dbf4
SHA256f261e2ed2b7a09fd788a937d3af4b4cf5ed2a2799aed136e261da28c9906bfe9
SHA512524409ee9073578f907de30559529d50077f32f02530ff53d3439101284bfe203029ae87e9de71da5d258236e38c2980cbb6ff1e308681eec9325d305bfbf06d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a99ea890ee23389742a5438b4cbbaf99
SHA180e096e90d7c8eeded03e65f56c87d7368c0da40
SHA256b54cfb4ee13b7525cc1fb84a0da448e0254b43eda9757c90b87d904fe1d31b11
SHA512d2178af330e0352c0ecdf1bfde71cfa158b9b6d1b97b25f76e2b796dbc8318ee82d741ac7865b51d5ef848a55821f5c65d9c8bfd471fb4a0413b0a90d447a97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577791b41275a79393e0dc28966ea306c
SHA1fc82192014f1fd16dc908828f6c1a60914d2c5c3
SHA256804a4e97266076ddcfb90c25b42951387895539ffe2214ec5cc7ab53931dc771
SHA512d075fd5d99a45f117cc69ab1484e30c98b4b00402b48e8bb5d5fa7a1f873c09fa44390792ad2268f040cea97c273fe13125111a3ff67c7bc2b061afe104bd02f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f10f6c991006d4b733b07e93f5fe75f
SHA114212e15540f95595f961b6cd915ca9f38a1b4dd
SHA25676f35fce40493c8212568c59d940af7618d239358dfe737a47379d60cd5b5709
SHA512d21500920ecf3f72741c0ec77e0ec3f0e07822f9e060ddeb2a2d39aebf9b5d671d2bf32bc4642ce48b9bcc28ac668cc1f54d0f4bd903832932bb2dbce12cfbc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cdb6628461d6a2ba20c2363183a0c60
SHA1eee26a5d4ee3e414189d6883e2c1c3cb68150578
SHA256427d46a60cec86801da4b3f1bba21ae8d4a7483ce8c91cd662d55d4cb66d8d50
SHA5125c6d8dd2bf1eae03547d6df72067635649a721272520c47bd1b0c3d37c8b069518fde2692cfe663ca8a5bce7421bfb608fd5c67ac3aa93b3b160fba4e09ea6f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbf19c98a70d4299d058384759c63139
SHA13fecd22f5977fc40c1225371b98323d311ce74eb
SHA256f2e4245207e2caed368195d8baa83cc9fdb1eb574d28aba08fb429b3b1e597ce
SHA512f5123f19bb2a5a932f7f9a439023268d71f2750310c9692df2d49f3bb8ee9abb20d5ccca06e96812bd18511883c73f3d8b31318e299687bb4638b4625b4d563c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcdd070e950599d2d3ff12fd1a2d8fc6
SHA1164fee016f9dd728e8a1c89a213909bf8db03060
SHA256487a507a229fb4543debd10fd06df12689366ede574ec90a35ae67e638a31d7b
SHA5121b56a004f1c4aee2bfb249fb689ae12dd21e1fffa564134782151c91f3ffaedf86b2c09485f6dfeaee92423a77c74220459fd169019e9909c86d516aeba692ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cfd88c9773ff9fcf90100e5f70565c5
SHA1cb071a113e705065a56bfa45a92d31f5156e48b1
SHA2568863a5393832f70024d04cce9f20bb46202c98d19b9683d56acc905d24d86d2a
SHA512784d27a269ff61ac81739d2d308cbf6755ce04f9d628740fc6746b4fb19a330b6ca67c140bb9346f90a592fbc9a8d41b6d287c490bc0a2d6703086b92eaad2eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6e3565d971460c758311faa375ca5d8
SHA1ed5fe601fbea57258b6fd0b26b604fca3daa1b33
SHA256b7afaa40b3bd6e0d58c7f609b7678b981b40af002794d29384be04c577d7259d
SHA5123b07ceef38008a8dc64d51cc0bc46f7858be50ad7b00d6f36827d4e54761263d11168df77e32867ca892336eae460d0ee999990d079f5bc27956522af21037c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be1722ce646f1459ceea061cd67e7a74
SHA1e93e58f2ffd5b89b6f7d418b7728de4518e7e11a
SHA2568d28140b2532c1c304c91fbe5bc460de931d6109b2018cbfc8d41ab7fa46fdc0
SHA512e79d5272027e34b12d9517d915055d273bcf8cdba84d6a09faa0fd4fe07be1efc38bfec41dad463919a247ad028f123978a6f9aaa0c198c890d787fd5d46be39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b594e8992704faa136f394b9bff2742
SHA109d2b423d8756ad3ea9642ea047195eb6ad5917b
SHA256c09b24f438f5d8f351b4ba40d5f9199fb859bf67b0cbdba21c73688856ec6162
SHA512f607381910cdcfd67ff6f4ab354e8bfe2cf6dd6ae876050038878a688f31d5ea9cd670503d36ebf85c41eeb52f5593525f50d3ee20f9251b9aab38d1b6ac340d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecfbc8971c43d1aa5ff3394529c66bdd
SHA1ba7f636160d3e27e5cd867a26866d345ff250831
SHA25624f2cff134228dbf7c5aefbc0f6c53224017c58edc167c5eac9b321c1fe41b02
SHA512a5db9f8080a0026e96c9723c5e3b9010fa569309dc003dd9231c3c17410e8a7b8eab7dee0e26c5a0341251cb69188114a92b9049e756bacedb8fb2cf60f0afad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e3a26a7aff297073c1413cceca2ec43
SHA100cb582c11dfb6e93767614c3210ef9705d8ca20
SHA2569850dd1bc999b3a334da1669ab6a33e058f70dbc8d6d7b7f9820abd6e002b0bf
SHA512ddead2d5881a4d688ca8e88f0a968ea315028fdd7d0af3d325c869ae12ad84957dcb63795b14766a5ff1e3cdcc01e837c449e704524bbea39cd823c816b18900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cf2ccf4ad3ca0e733e838131ee0f73c
SHA1ee2c5afbea1843a13a4b5b97d2589bdf041c208b
SHA25666bf34bc8acf9542bd66d56a3fbf97c85ca34b404474e07e35a90da1fd9debf1
SHA51220c9cc3ab48833a36c8fbd8aecf244edb1b94263fd5ace78752e551c4145dc6c462dd162d896515d264d3bb90fe4f0051e5cc7b2f4e1b86e061c4814f72e368c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d653f44d6687c83f041915976cc533a1
SHA18aad2969c62654aab7a301b4a14e1e6608124dad
SHA25631066ab6251719c67cd42dc5b899f0a830f92565ae75a393bb39de1acd818032
SHA512aee29cd2ef01438071b0f77493ff58f12460cba968c4c8b71d6c5d5166b414ee113afa370c263fea6154da3946009faafdd6f0b431cef1cda12ea567b159ec68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0d3abf0ced1434e835859f35c53bebc
SHA18d5ee9d971aa72dd022f51d08cf17f30fd4abb1e
SHA25609a8c3d57fe2275041581acda03370cbc7018d7746d83cc6837d20df50224458
SHA512dfe07b1c7d4426188a280a411d8b0122d4904e892440df0d2ce7425f2de27d1ae1aa18861957fb0a1891f616eb8fd0b0960a95a49984ce612747a1a5a9cb41e5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b