Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 19:29
Static task
static1
Behavioral task
behavioral1
Sample
b4d1403d20e8b750b1bcd9f7e10ddf41_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b4d1403d20e8b750b1bcd9f7e10ddf41_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b4d1403d20e8b750b1bcd9f7e10ddf41_JaffaCakes118.html
-
Size
72KB
-
MD5
b4d1403d20e8b750b1bcd9f7e10ddf41
-
SHA1
294cd8dbe0355d23ce9db238e8664e5a15f330e1
-
SHA256
0107130b10b18a1d7928e6a7fff7c9f8c34ea49622e20dddf977c07ed752cc43
-
SHA512
3ae11b649fe275fd2379ce59de82d7f4aae95d996094c2fde9a5b8ab242cdfd7b6f5ea321f24f220f02ed7f6b866e063822cc0f685d59d6793a0db84de3a3cb3
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sB6TH7mGoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:J3Y8TzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2D4A631-2C16-11EF-A296-4A24C526E2E4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017977dd6d6ae324ca5c70a153caafbfc00000000020000000000106600000001000020000000376cb5e886fe6d851c1b5d331f1b5be31bccda9b33dec731920cabc7db453315000000000e800000000200002000000053fe3565d140f69daaef7b884116ec990523ad59d1b1ea490c128665fa28473f90000000bce5253d93770dd6da6485095179344527002d0775defef539a41df81dbbd24bbf2b6eff54704926b1f059b1ca745ea95612ddbdd545610b8b9bef9d6c419ccdff626f51945ebf33da274617ee5e2c9c009ed3e9236b4085a05dad6cd74c9f1e7e87545508d76375bbb324a1a622e88c322b10bffcf497b896aeddadfd6ce60173d1cca907049c90502d4728a2596276400000002646a928a63d60e7875e51993ae2c443d77a378a5296c08a7460b39ef9b8267d0805c109b0f23011a845014d6bb7cb61bd9308a59c16ed317ee7bf0e45bf9595 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017977dd6d6ae324ca5c70a153caafbfc0000000002000000000010660000000100002000000039433b963f1c359a37bc6d431e0563072b4f0fe3292cac2625dc43a62ee16cf9000000000e8000000002000020000000200177b621793f497b9c6626bd1a9a5f6a3f28600ba1bda492b5b784432ae3d4200000004c152dc0f7054a731b4537c8381999013dd9056fbdc214b67d10c1ee78b1086540000000c63550c7a5da47204ad258501139da3a3df548c39c2d1b9134daf07eb7c92bf0c1d356edb0a2561baaf6a4ab58a23cc90cfc5b7e0dfd5252816474446038dfc3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424728015" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9060868723c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 3068 2904 iexplore.exe 28 PID 2904 wrote to memory of 3068 2904 iexplore.exe 28 PID 2904 wrote to memory of 3068 2904 iexplore.exe 28 PID 2904 wrote to memory of 3068 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4d1403d20e8b750b1bcd9f7e10ddf41_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e7b75b1e14d5dcf932f6a1b4a31e72b
SHA17db256de83ecafff3147984d5c214b7192c310eb
SHA2569bdc9c79e20bf972554af110f36fd7e0ed73fc44da0f7acdfccd1c4fd125133f
SHA512b158abdcd2ecd26e78bfbfdcc787a5fd4f540916f4fd3e685b236b8dedb82661a5c59fc3054095685d6a0056a571831f90f3fdc530c6977d3c70f1e3b7a4c9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f25fc68bd0fb5919cb33347d4596ffc
SHA1bef1c53c15174469822f28a7e7e04e9b9eb9e46e
SHA25684ae78fcf85097c1e81e8b382350e8d62f74d59317438dfd37bc8a93b7490f8f
SHA512b146d9df28a33faec2d7f38b2c58aa6640847a424ac78fb9991584d14dcda886fa2ece79a93b78d9243be88cfdd9a9cd9ff7cf7b930e52ee10a5ac20b419e5ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f98f50ad35a0f8806108e6f8c3f3a8f
SHA1852d40a9a1bcd35139057554e2a49531e408fa0a
SHA25681f36aaeb06b40b30854016c7c77f6e8e2f6e34f7f76feb7a46d226a7b29f7fa
SHA51297a630e74a83b04f7f10c0f20431aa9d7c9011dec9020ca585d7a37958fa9573eecaabec86637c14d1c9f54af81ff7af1fa1569681dede3367fa530f6afcfd92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d025186f1a737a037fb1685af08ba308
SHA1347b7966b165cc8254b58ab783a8abb532d74dbe
SHA256cdb382edc6c06088061af7d4ae536029ea2311e747cce0a322c61917e882366e
SHA5123e5969fa91087f1258007acfe5c44a3cb0dd705e6d998c56419e28b037816aea18c37a3500d6470c56ad135e68cb2a3d2b40dadd3f522797ce6b78f5df6e2367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5207472858de2e9b4fc25946cf8642660
SHA18c6e6755f1dfb504a8163ebb3d680159cdac486d
SHA25609edc66baf793d31d96942a44e8513a33413fc937cf0d497084a9028f5ace40c
SHA512234b517129e412b55ab82cdad5b8d21fca010632e930e8027ab3d6db1d44d3a84ac48c6693ae02c1098f9ceb033322ff67c526c01ffd2ced23af3c86786343dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f8837e88f36bcdda91fb2a7bfbe0ba1
SHA1a45146f8ec918f97e6c77adc5206bf9b852bfa3e
SHA256010c605b7446ed953ddb6c8bbde623c5bafe51128cdbe286de6774a3b528752b
SHA512a2d52c4db49e2eeb1b1cbaba559691ce82c6adc5ecb50d776a996ac0f651fd981a6e2ee4f1a8935fb82ca1fb3d78c8ec531aaa03604743c319209e1bbd688c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5530a96549f74a903b78f5a5c9c1dd8a3
SHA18d515718b3e543cf0f776b2e70688e148e46cce9
SHA256547d1b1146a5c337c5ffa59546357af87c01456a9599843a6c5129cf5865ee48
SHA5124c922d9452e1fa482935f11bfc6da4f890e432f619ae7ca6eb48e4061c69dc438b99d758573b7f921cb55c7b856e8f30fa847c0c8bd3a531c252c3829c09003e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4f2c1f5c4c980817d056b36337fe684
SHA16c28790926e116cfefb85fcb2300c142fd421c9f
SHA256a52a3714e5f07a46da0298251c16cb6b61ed6fb345b2685009321db7ca0c3be0
SHA5122599b6c0f5c3d0a8f9148a779fc3830b44710bcd7a2ab228981d86a504a6e2c42aee33db8fb0e4c5aa05bb620cf4860d28a07e3778d1846b5980a282252296e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d75193516937cbdf71979b315324e66
SHA12591f7a65c38d0461741eeb39d2cf3503573f286
SHA256a0075651472934d679552211ffbe84792363f4135ca1b16f88d1f530a027fb85
SHA5129baa037bdb15731d245530ddc7f759d5e56fd1a166697f8f900085a420b8cf7445e40e718272a6c0baabf3bdbb6a448f1699838db68414d0f8f514821d8d6236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e87a41d6d29b0378ae3a45e5312babd7
SHA13edf05343c33ec344755c048dc143bc701520954
SHA256a8448c0524fbd8223dd4d641ddea6f6b0996ab5791c426c0b87f474f404a2f2e
SHA5126b60599aea55be7e5482d343faa42fcf35dcfc2200fc8f1771b51f8aeb32033f311bc4882ef464d39819f97b5b1cd6ee0fbb1496c8a39bf99ecff8e41cf795e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59504831442a5409e16ffb07bc46947c3
SHA1efb2988c1a71abc46026baff7eae4f99f88fcd8c
SHA256d0ac8be759ebccbfafae0a9182ff408f828bd6aeb712c5ffffca4d82dcdc5bf9
SHA5121c505dd58f26ffb486f4bdb77b2119db62c7c9f100d33ec6039e363dc080fda9f484c376f39ee499c0fc9c76a68bdc66131645619e5a41b2278baa4384489336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505c74ece47c4a8d8e75c62edc67fdde2
SHA13fd849a97729998ce07d14581cc278f086b4d4b0
SHA256f85c15b8a5f7cd1940684fe9cb7bbf56844a50b5a8476cd386e57a0468139dfe
SHA512328568bf16643d9ed23d138af41b0953041881f3a3d80e2e8767aa7fb991afa341d5d500f9d34d48cdda290b8bb0f93651fe6aa9b17c6a639414239d07996843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d62e7aa8322b70be60fca6afda4fdb6
SHA10bd44772d674cb5aca794ff9844381667176fc3b
SHA256f6d5721885eb4181f138e21de186b7847ce3d530f02edad473c737a0c3d9e541
SHA512d453a1e95a428cfa685511dfb9ccfb352adfc92dcc84a048b39c84f488c548225e0ea2875ce150dd307e5bf67c817cec474b96e6343c1ac84983093e4a30b9d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572ecdd67e2d094f78b538b7cad4835ce
SHA141f867d1171fb6ed050a2bc1d3852405687040cd
SHA256b2e28f183dc11e890ae82beff5d80fbcd2ecf7c9b10e5b30168a495398cd6e3c
SHA5128cad41bf454d3b8d1883fce57a546748cfde78d10233dd5070e2677c48c8755eec9e4bf2419b9e775db3bf001c40433245eeb737be5f3e05b91eff3797e83576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557064d1e9e20a2d41c1327156e714361
SHA18140035c9113909b7743514584ac9efc74129cc0
SHA2563093e46cdfa7d3da5ed4861cfc3a427806e4cf05413da6b2de9aeb2ca78a12a5
SHA5129efce36be420a7c760d2a70431293100ab05d0f04bdd5dca7a83ce0a795f21baea2ae9c415ce36a2d644cac82b6203524b2419c273ebd92a4e3a8fa749289062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54928b4c3b7d7c6b40481d0191cbef2f3
SHA15e641ce6ab49e84ed000b4b4bea57bb44c957893
SHA25666f413eb4857fe04aaf3713a4fc33dfe6e2a0a95ed1b0ff083774f8868648d7f
SHA5120cf0b8fbe328ab41fbd6a976cc2eb9d7c7dde1e02aa32b1f70fa990a896458ef94bc1f80f220df4630d5b9bd29a8c30ed655966becd52407ab6331b69a578435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a4d1279d3a12e91e02be68aed92ccbc
SHA12b34aa3754607a24f489c5f76b2ed318834146c9
SHA256778489f9588f01bd883dfc0d4ccc568f1cfdd07e99d902cfa06b19cb8e09a367
SHA512cf14fb9b1541c8916db573b0451ce52be661114f3a1190317befc0d0d3ca45857f6bf60a2496ad9c04c1c3113a2cd04fd46d17f0feb9203ac935e7ebc5c5783b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569de12fd4e7222261ea4a6ca3b50cc63
SHA1614633e46ecb257c44d5f29b2098e8fdd1c4207e
SHA25643261fae01e097adc30acbe209385e59bc8665823245dbea9eb70b146b29e166
SHA512a6a59e5ac437742b730ac11f193305e1801ee102e23e6f6d12c4a53079b24eb53951d75837bdb5f4841cb4772cfc9e3a68d8dc26eb19cfec391eb9e61a5e1ef3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b