Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 10:45
Static task
static1
Behavioral task
behavioral1
Sample
ae0d42284646ba5afa5a17afa98acbf0_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ae0d42284646ba5afa5a17afa98acbf0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ae0d42284646ba5afa5a17afa98acbf0_JaffaCakes118.html
-
Size
109KB
-
MD5
ae0d42284646ba5afa5a17afa98acbf0
-
SHA1
c509abdffe560eaa459969fec3aee65b6e6b1558
-
SHA256
a56c0dca1049c6d8fb5cc079e20675474de09f62edb66bfcea2fc17ae69b0b89
-
SHA512
0da9f914b9fea851f0275014ba3316fdddcd8239b57bd7ad088bf324a60d2c67eefeb0ff91b7b7e6177a6e3bfe5f00d3f85073e57eec9e2d8dc7d113ac6e1477
-
SSDEEP
3072:c0StzzlW7nQaH48jsqbRIdWjJLYxH5Ae18ze56QLlo8udjqBEVMvBISDERchAP0V:iU48jsqbRI8yBISDEShAP0XF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906b3e4111bfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AC15771-2B04-11EF-85B9-4A8427BA3DB8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ae422f43e29e7479a643e02abae30a800000000020000000000106600000001000020000000d5a958312e5253e90d81762f3d86da5018ffe3a5d2b10eaa6826e91a87213f27000000000e80000000020000200000002099b75e9c6615c12e2eda85eed7964d030ce968fabba16d674d90586390ae8b2000000073d065b7205855737830bcb5a392de846803f26e9742da2be535c18b3cf45f2840000000af38d58ef353f3e089e7b5fe42f804e1fc4958f7fb132c588e689b29c67523f31ebfdcc3eef1d8a16414ce27edcb88ecbe4fd7a303b256adf9e9ff5864dca329 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ae422f43e29e7479a643e02abae30a8000000000200000000001066000000010000200000009c40a43a1fb78c12c342e2595ede3da520a1fac2fdfd457ddc4a190158d3802a000000000e800000000200002000000036cdb20b8cc1f8e39747e1bf8f8bb94bd2797d415ec7fcfd9487f471ba0551c0900000000e05dcaee7d431b777d974ded37bf91f60e06878dbccc62470a0b59683b929d556ab0c321a976264355c0639684c21b3fd636ff0eb59d5e8f833231bb492e8e4ffd1baf7beb66fd98529dbb2cebfc13271713617809a016e050865ac8dc1701d6f4d9d0f15bddf08b13cf3089c9e387efe2da7f9eeec6094e4fbb5495d5df76a72a876f3097e4f88d9ae25a489a0cd944000000077316cfda0265cb77cedadedeef93bdfe0ddc79cdefc2dda02f1dc85f86df0b87cb6ff54f38957732f9e01c2f0be0de288bfd165f05e71a29ca637d3ed695788 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424610212" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2988 2368 iexplore.exe 28 PID 2368 wrote to memory of 2988 2368 iexplore.exe 28 PID 2368 wrote to memory of 2988 2368 iexplore.exe 28 PID 2368 wrote to memory of 2988 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae0d42284646ba5afa5a17afa98acbf0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0bf421d22e5f3bd28952e8500e1b29e
SHA128afef48098d95e08b970726dd3f807da4748f75
SHA256910c28d0246e0999688391a328383811319881596f90369757dbe834e2576668
SHA5126192ac18c02ef5d95faadf5a4c2ac53981806fcfa9c2c44efe8d1dc632688004c80eeb4a70e7e50501d628f43dc518d688803f2bfe38ca76694d924915e4fbf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c39dab5a684fd2cc55344f3e06c5f648
SHA16823b204986020e2681853e67d21247642739644
SHA256304926424af985f4f1cb1415f7c4dc03d3bfa836b3fa2dc829dc4702690ee50c
SHA512be30c309e06fdd2dd10a52db9ac3f308dc5df2878370a34617fde4745ce872e0683032c85363f6797a6588ea6f05dd19f7a6dd888e4158c1da46821cdf898943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6de29f5786cac6e5fa903cbc530e938
SHA17a874a8767e3176d0f67524694b1a425074ef7b1
SHA256667eb75056272f12fb772a7c81a737b877b5eb8a7d6ff8bb2e6e14fcb82299e3
SHA512e1c35ebc3e5fb2b2839f0e47ded418a3a10180503206a492aaece08676e05aae012e903ef456cadfc8cdb816c5fe9b0c8375a3c3da3097ec5ea52f014c0f38fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5348bc258478c0dc2bafae78e3a18375d
SHA19b1225ba3a3af72112965785b8ab232bf9c7083f
SHA256daaad4390a6166ecac8a7854bfd1af7f7d7b58ead1f7a76a3ed4cc072240ce3b
SHA5127a68d2e8283e6101588779025da5acc0891e9230959af1d9dde78825c4dff4bd4358dc16a07c21ba9b0b1e603609876d32318a8f10e904b80d027bdb7dee9e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552d2647dc483d65329899ead625486d2
SHA135d70a40af08a9e21406e83dbc66522200ffd3e4
SHA256c9d5dc655a2e7eecabac9e838168f1e8de8bc9709b36fe88ea52bcecfb6c49f6
SHA51211b9c7e01210a3ccdd29bb019bd702b7b7af04c24cea2f9e2ee1cfe4d16210401131047393bc8cffd8c81cf2c30a35fc172eea0448a66d822647aa194dcdbc55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570620d71ad6aab118e5b5520c0a04c76
SHA1f16a83e82d4c1c5904051985a9c25bb0a9b2f9c3
SHA25622ca139b470cc438da0c4f782774db95fcf4eeb1ff30a0f2399479f89f21e8d8
SHA51275b7fa8af7389d9f4019858d48e6d769bd5f80c309cd93709f5f29c9bb3ad9fe6102fb0d6ed48e47b637313027938d20230de8f1bec8e3afdd533bec46bac639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea20741a25a6bc59926efb7031543c42
SHA156fb53120a267e74d71c8af61717b3169683cf52
SHA25603f3b760d7b52964b72e3b624527d9fd3ffcb941fb9a1924e8dde5539c087001
SHA512416f151f056d98b16d64a4b612bf41b85694794f56ceace76757bcc7c1ff698be50f80b1b0489eecf954336b570ec240d351ef84bac2d8359aaaa3e6c1e7d658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c75333e1e27defc2617f64920429c5b
SHA17f72171d292850a6ee779e59f1d88c4e84140ffa
SHA256f9c996681663a7cb115f5c0876efe3959efd658c6406bdf0297cb64ad2f993b3
SHA51233a6a6aa9b37e43c997267cb8c734b5ef0d1f21a32da601917fe8f442683cefd9e694cab1673108b9475f78b5c4476c220e14e50aa543007a08bf948bfad44c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e4920249f8b48a463f0111e0a5758b8
SHA176fe9a86f790b8e292bba5b1b7ddf11ec0e32515
SHA256f0fb68a8ee8d45876213ec114a2135f6d31699ed6eb1523cb6ec76c7ae30c9dd
SHA512c8806b351693977dc3ceb56a9b252332bcc2964a4859c4a31c66644dbcf2b9e22d339f3d0b6162b48d85c2c115e249a315ce1667c6d26e34d0cfaf0267b8e8d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d475ccfe44cfd0e8581bdf5be089f1de
SHA178fc273d84d902f7e5addf1e6751584791060e5b
SHA256bce42ae2745e5de1600afc9797fec2544ef152aa18337a976346df42cfe23767
SHA512d724b386c4bf6c00bf98c6d0e3131087889bc19d0fcdcedf9ac1586e7742f54da3d89b986c66760c980ebca27570be4a8dd9a34b9e87c1a89722fd517a95c057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c3640de5b1bcb441a655ffd59efa592
SHA15237b7e09ae4d2f64dcd04f09a9e9489299651fa
SHA256e8c4b133b9ae54b4f93130de26c073c6b6931ab0425b6af546ac6fc7ef1d4602
SHA5121780e4243ad08f149bc73e19cc41c65ecbac62f13305e5ff49da0708d3aff46f94b4ff5a1919d8930d41dae2c2df16325e51b0cbdfad2097e238fc22a60559af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e846b2504dde37abbb54213f7afb36e
SHA1462239e26c5413ff82965256f5bbd1eaa612dd9c
SHA2561ef9a5dd75aa10b847126fab09e34682869aa64d6e158310ecf27ad455331e86
SHA5121bb72ccccbc8ad6900c3eec3bb676b7793dc6fd3491fbde677b5cfeb0b93c4efe176cc63b488cdf173ec333a0b05d7439586693be88131616e63488ad41a07b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f1feb0290b08942923e45989d760815
SHA1ea83163748e7fa74ecf4104982ed7f5eb951aedc
SHA256553217b3ebf12864c69f35c02aa564a509d148b02e792aca469140c0cf63d506
SHA51220ad686af3f1dcbb52dcc951177c3344d25ff998564030410a583aaa47c6c78ead91bd6938a20b40fcae09f5013883ac07af2f25d182e1151ffdf8d0ea0abdfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be2d1df9bbe4704d08becb5801b424ac
SHA1b10887489f1c240070bab12fdab7ad269643afbb
SHA2565a32fe6bc69558a83dded091ca503e74f4012acdb2d9ff990a4e0c9a12caaca1
SHA512f1f151c77cb8fb7ed2c80f9fa0fa32d6aa67ba020c83e2cec9e20bc8f6360e5ef3ca70c623ebbf7632c6da38d0b09ef6379db8917bf6c994b91c754c1170dff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5624482b52b0e5cbdb7c1826f6510d320
SHA1b630be81ca6a3357a99d561115132e4c5068c110
SHA2569985e26b2146cc4ed34b0aaade0025d35a58738b80d1cd94b74c61b08e1bcced
SHA512096ac2ca1e33e1e2148cbc4a762b512021c832ab679ed6200f9fbc04fa6a31d29287a9dcae055efb057078663c05127f627465c5d4929d2f7c14f58524f3f43c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acbf87b6fa2a251981799a1131adc946
SHA1e3fe610f1a1594b9f7d9e32de48d2657110fefc9
SHA2565fc795f12faddd92e6a46a31002248eca9e743ad8312cc7a3e110a4cf480ec5e
SHA512c1d8f193bf0495ef7ead6eb7202319e8fa474768b4b18225fba51b5bb100acbd06c4e8aa92eb615865121b6f08939e451cdf2ffc2b365a1976ed32403d976585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51657954ca92ff56612ebe4fe75cab263
SHA1ca13cd503d2ef17546bd698f40c869b4ace1649e
SHA25645efb42b99357f111e4515be8e0783f6ab96b49fbb7ab0cd317a4b64cba91eeb
SHA512212c4b230a33bd18be520fd637fa3743e01a3a84c9676eabbcf490b8696583bfc4d0efb213d7f4a130a9aa1999b0c32ecfc98a579e9c4c30a23eb2cf5acabc2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eebec0f19adcb622f022b9a91023d655
SHA1894752aac81ad333b01ec9954866c2627818bd86
SHA2569145620f7ca193b45fc90a116adb9beecd829067c0a75522637b81318f43ec0d
SHA5127472e98e5667972467d5a5da79429d66168edaf5695e715eb5d8d72155bdac0d3594cdb498ec4c6530d71044cf05329bc8f7ba2de6f709f08190c7233b47fad4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b