Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
b89bd4ec21f395ab026a637b9ceb15e9_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b89bd4ec21f395ab026a637b9ceb15e9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b89bd4ec21f395ab026a637b9ceb15e9_JaffaCakes118.html
-
Size
11KB
-
MD5
b89bd4ec21f395ab026a637b9ceb15e9
-
SHA1
2af7736fa4a14d57d3c7e9e3f09a90dc1bc09067
-
SHA256
142021193be9e979a9dde80fa9c886c6b015ac8f6329abf42b60553ff1d10d7a
-
SHA512
00537acbf6c9b7401e1981cd89bf38fa96db4d0f5e2c5f2c5b08d73483e643abfc227df310aab6ea57efaafcec75b72892894359173d3a29132ffa4a2297f274
-
SSDEEP
192:mdI3N5OOtgkkOalKn0TLS2ksmDH6KmAILTYWwOHCjYnaYk:UIrgN2062ks06KnGTXwkvk
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073bdb1f9fac9994f898453b5805fd936000000000200000000001066000000010000200000002743b54aecc104cd835a0d81f53df5cb04eb28ec4d3cdc86a76d0091719fbeff000000000e800000000200002000000064baa3e24bdca6544814326f9ec26bdba2ded0d3cae05395bf3e1c8e02a71af490000000bbe8c8f71e14ec197a60af71fb256e31dc516b016a2ac2ee108803e625e7bd07fe9ac5ca206356f98c0360fc4b1a46ddf4e509c3bb1351104b7560faabab23aee095c86df8048ef7502d9a8231a5a043b5134c7a16f0f5a3f46f91f0a2b2318615947cef147c4510a21c326e8b4b038423448684f3e9321ae466437d97dfe33a2f16dd661e07407d2f80079b2a42a0ab40000000f1947afd42e93c05f30308738c644a287c36909ced51528936fc775d5aa669f2199a4374ea797c60baba33df8ecf855b2284b514c9c7046dd59fe2fdcc9b0323 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073bdb1f9fac9994f898453b5805fd93600000000020000000000106600000001000020000000c17fb9ce0589c9063cf4bd72e66c8063db64f983018c53a49129357571a72e7b000000000e8000000002000020000000ceca26eb001d467e09a3b6f000bc01f7f9db222141cc6e9e2e95cee31767dbc520000000ee12ef8c572c505c37c2f9fa657c90086bbc8ed06d3eeab1cb3052747892f441400000002ae6d31fee1929c02ac63a3ca80311e2efc8c3baa2b1997e30d18b8d1910c83b6ae96c57fffe3d821e98db1ab86b32ea1a701621161208699399624a258d5a12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e28fb9b1c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424789064" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D77A0EB1-2CA4-11EF-A5A7-5A32F786089A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3048 2924 iexplore.exe 28 PID 2924 wrote to memory of 3048 2924 iexplore.exe 28 PID 2924 wrote to memory of 3048 2924 iexplore.exe 28 PID 2924 wrote to memory of 3048 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b89bd4ec21f395ab026a637b9ceb15e9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f5e3f1779186f082484904ab4cf7d41
SHA1b650da61855cde83f627991bc787b9d400ca691a
SHA25696e3c8b1d3d35b16372925e32c1fceff2d44fed118d070a8f829d902fef9b3cd
SHA512a1a3f1ec33aa10bfb6ea4eec61829532688850342de31779d83054b60981419cbd183efe91e9a27d018a9771d7c00289c9cf151f3c349131e310b68cc5a4c62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518c3539b5016efc99858fd0a4534cc23
SHA1c5ad40163da3a17f5eaf8154bc5f66fe976c2b43
SHA25686dbb238b339fcd87b1b331d99a97d59c9f59cc2ef55fe7957542810f3a9396d
SHA512eaa99f90a7c617fda3e76a327a112eae29aa8e9dad77a3ce1dec5618ca222420b14727ec109a017d526191370b9b96ed31d77efbb6d44a7ff6541199387e8c41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1d1c9810b789e97b35e5a5793adee2e
SHA1f6726b3f5b7fa0471448c1692cdd5f94bbd00ff7
SHA256ee23f4b0c35049ef887844f666717257402559d16e46b1e14c7507db90cc260a
SHA512d857979ed40553bc5f674155760f17b7d0774d68330f79cfdecbb7e4e8168215705e5a0bb15170d9c8ab85a23a6e7710834d979c7fb7199de48803e15ad0472f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1d82f136c033ac2aed2f549d0528ab5
SHA1c0c960ae080897e323ddaabad4e0e528df6f7d03
SHA256c775b5db67b4beba2792bcdb053051f0271141080cd7c057811c13e84aa92149
SHA512784d21e06db0ad431f6b8e93d3f7ec5da5d4d4ad95c73c3c3ddbca3368295964f1b489ac6f870850311b9728ae416018b2b19bfbf1663e694fa827cc6e5c736f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dee579d8e4d61c4fd449b87220ab2dff
SHA1396b4f3910358035bbd6ff7803190eee0ca603ef
SHA2561a8701bd7aa9ed6909db1db6c9685623d239f206cc96621aa3dfd0c15ff0a8ae
SHA512c4e200fbca2997fb94567f2615964a1217982a4c69d01f61f2ffd67b478cd9729665fd6a64beb2b890583feb6e7a9161cf02611e7f2d1f6de9f2dcfe34a5bc49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57723786c9ce4908d08af7a5f5e69d5cd
SHA14dfaa8652e9d17b1241580bf423ff7cda813b05f
SHA25698c2c08b0deb11e1235b915831cda962bb6fdbf27887a8e562f5b1fa82c8fc33
SHA512d4c7a8d38ab414750ab6912a0c09ebb776790af5f1374a134d33622993bf283ac424a4a3a5bde945503d626c8fa9e975aeb558f44430302d856fd385c948a649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983f41526c9e0504897c697dbabc24cb
SHA12866c31c5df8ef3c936955b04bdb288fd7f8e4dd
SHA2561f01dfd5f45920c369cb6d90a46aebfa3104c9b1919359d64041690d3c3acf9c
SHA512ccfb59c761c81772eb5c59290a2a7cc53db8cbe0a9c622054c99636922531948fb034b6e790407dedb3f856eaef81dfd5ba81d784835cdf5f99b0a205f582bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f71a772a243052f323e1be450613b343
SHA1f6cd42d34679281f8c424eb3b1ad84753dbb6869
SHA2562e85f6c034ef004de980879d8565775ea8c28e1338aa3a44a884984577bc91a9
SHA5122d6b1131c26aefb5832c4bc2fdcc0cd2d6158f2e3740064940f25468ce27b61947310506cd7066d66287c7f2fa59b0d20803a4ac6f5b33a3d9eafff84862c690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58126c63c681db741733dfd23c90e7eb1
SHA1807798b1d1c6bb352f47a97ec6c00706c9b725b1
SHA25635da42b5ea19059b1f5cef438551f64c3a28521b56c19c5660059f9d14a46ce4
SHA51264f7119222bcd00b1a92f1cfb8a4683a10efd737eac56b6725acd7b2f1e6bb31ea4ed6b447150598a567b2b3b18b8868ccf075bfd87453ffb45d986fa3fd59cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa182a684008a4842e582b026740baa7
SHA10416164c5c89bd2a98c61dec86891248e057d85d
SHA256e5f7c40e1e144a19edb168ce2b02854040877e32f327cbc38d3fb6bc4c50eae5
SHA51216853545d87588884dfa350f480ca6b16cc5a5496cf463ecfbcada71b4d9a415d4d6f45a2622c48389b95b19510dc5c228ae95cb44d7216b45c42ae162f15c38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b62c7f4fa32b0633565816284c92082
SHA1447563d175acf9c3ca3e794031b47b2d194730e5
SHA256203fbd99f3623d06ac13fff717892f8ed0300dd23605f6d54f07aa5d89b1059b
SHA5123d617d759ce711f8b4e288e78825e890c7a048c22f1e10ae969258997ccd20e76c6aaa3d4c0df813fe1db5f270f74212a9d4910f27a14761a832b2eebdb39bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e89ddabc15cb58b8ce74ca627547f82
SHA15d9871e1825ca903df3356f0483db3c321cd6ba6
SHA256814e2171c2d3df39ce7e686c368d18a3e20fbdd633ea88a46429256a6ec9e975
SHA5126cbc34453f484f6b1d628b05c8ea36ef978bf33a155c2351890b49252f20976e0f605bc9cfe5a4a71d1d3c92d1841b0b9c41d0b12f7486b72a98edcaaf1b9d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5318db2251baff893509380e732b8fceb
SHA10ce026d03e6b47a69be8b34e2ad47254b6f0befd
SHA2561f446dbecac6b0152aa4a6ff13f8ce8a00ce9dbaf4885058181a3a0691b275db
SHA512943bcd580a7a4aa05c3c2cc680c78c3d4782bca946d7045ef7bb6d163aa45ea6a560e59ad979afef3ea5588e8cbee29cdc791b86c91f1a285d200a6af6754048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571fb66756b3b2899ba1cadffd9fc2b2a
SHA1d91800453dfa2c6de30734bea18283b5f2a50552
SHA256ce1ebf65fb475f43dfb38650a953b0e56ec8ffbbc79af30abcb540f82a7dec23
SHA512f10d3f220dc4c353bf5abd8685ba32c11026f6995d6c658a7fce13faaef4406c229a52b37fcf0cac6fbd68b5f74dfa092960d6fb27e46a4404ef248261eda3ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ee1133eb2bb32f99a7bf3a814479763
SHA1d230e3d6abc63e852384aef13526ce2a2a20b0dd
SHA256bb6168683375df4dfc49e3547fa1164c6589799dc54fd3e1828e7ee5d70e83e5
SHA512acbfa8972d442abfedda8fde4af31a416fc1969682992c052399d2bf7c4f6f8b6ae8b20a687266babe2499f3fdf2dc914ab74c803fafaf2e11d3029b253dd8a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576e5e4ad0d1bf536364bc2097fbc5399
SHA18317a71ab5bb60c7b3bcdfbdf0e7e69750c8ddea
SHA256f7bd9fc6f767976b929ae1b3c7f9c2defadd48d444e37f705126119648bb05cf
SHA5121f1f5cad9c9d20784df7847b8079ccb99338ef9f28089d6bca3ef1b7a7ed3167f7db06818827ad4736b3a448fb332d7ffb5f3efe76a08e49c30803d7032ceb48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b5eeed761c2226bd9d1b5cc5686a05d
SHA18652a58ee94e149b8d0c273827aa04b6b8b90abe
SHA2564bc31bc6a93ae2e16b661e74ff76bcb8a70546517c3bbb3c6e1c4f869d622675
SHA5127bffb009a65732cfe3699e659324d2c43fc191f558dacf703626176e3040819a2070a3083c8447bb1fd880b7b48ea20d034696aa626b5844895ec8fe5800504a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a944dc331aa83cd61183ded08e64c427
SHA1e14ceeecfcda04e4972b5b420adf8afcdb7076b5
SHA2560723c73a8c3947f90ad33f4005c7db85bfc92fc77a4a60bf0b5f16d74f69c6c6
SHA512aa085500d6539a1a9835745321e2482e1b3561ea10079a355e08977b617dc01f7e3dd758b567fb57f36629e8b962a1a6f1e5e370f942911aaeba25d2ef303ca6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b