Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
09389dd2738dcb595ebc7abcfcd6b946_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
09389dd2738dcb595ebc7abcfcd6b946_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
09389dd2738dcb595ebc7abcfcd6b946_JaffaCakes118.html
-
Size
9KB
-
MD5
09389dd2738dcb595ebc7abcfcd6b946
-
SHA1
01f79dfee1af04973ea234ca25e29525931f88b6
-
SHA256
5a2d04c5aace71b6a6657359faae638575856553e264591fc820ecee216a717a
-
SHA512
18dfd9466c887a7cfdcbbbb6602469de38a24eab8fde64db09ee2c4dbe1d92b098520b03c0d09616c27a0fb53712c4cf4a75c9bd9c3d1c41753c2e9675dae923
-
SSDEEP
96:uzVs+ux7VDyGLLY1k9o84d12ef7CSTU6GT/kPsKpUlVHcEZ7ru7f:csz79yGAYS/LLUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0eabd0848c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33B770F1-323B-11EF-873B-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425403400" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bd5c98b772385439b5f549546d985db000000000200000000001066000000010000200000003d2eca3346e101ed0ab169705dd75210beb08ced71f74d0515f2c82886811ac4000000000e800000000200002000000064c3cb95bdc3d4e7a9166e7aca613ecc31f99f82623f7f08e1bcf6c7a1cfe71d20000000846e131d433f458c407482a0c1b9eb1aa1332276c9b42d7fa8e037bb23406749400000001e6ab83d50fcba4d7709b4961e387af50d79bfe4d303840c31c210968935bacb580941bc3432fb3935718958f11319b994afb10372aab11c73595601a65cd7e1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bd5c98b772385439b5f549546d985db000000000200000000001066000000010000200000005e4fb4ded76f31c93f44462f63a94e8d05adb0846376b3a8d04e7329c8e27097000000000e8000000002000020000000382cc23e0ff72317d32fdbbe639602f09b6653519374618b2b5747ba95a4732190000000fe4982de5986b1f3c197ae16a2d0cd63d7059a812965568ee2943bd33bd058989c49a8af8401178e5500b0b3cf364218e84a264dbe5fa2d6fbb2bf1aebe71d3b673689e68d13b2d555d34cbecb1e924135f2245de203e2e495b7e76f6a62d4fca26ed291895ce08475eafe638e49391e912aae82e3d9d85bbfad7cb316b5c0a3bc91106d7614e02255dd1e63286a54ac40000000f81ba4c4bb471a2c6b75bb810dda82686ab1b08702afe4363ca3e96888b96f64ede8ad320c91820a84f3d89d4d6cde763df1fc1362642eb25d161d3e130905ce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1684 iexplore.exe 1684 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2392 1684 iexplore.exe 28 PID 1684 wrote to memory of 2392 1684 iexplore.exe 28 PID 1684 wrote to memory of 2392 1684 iexplore.exe 28 PID 1684 wrote to memory of 2392 1684 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09389dd2738dcb595ebc7abcfcd6b946_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57150e6fd60e1aabea6bccce16d7b15f7
SHA1c7df54f10ad99f167075442dd40fe3b915bc1025
SHA256442850e45ec567173d184dbb0f9eec22ddc4d8c897a80e090b8b4926323a86fd
SHA51201fe443ac0136e93e4fca810fe7192bc6366a59ba1b9cbef74761da3c9a738de4db840b2691989a70ddfeb58a5e34798b4c6c145b5b8317e9ab339aae3c4a9a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a051c9039b98f9bf4e4e3061bd847ea0
SHA1b6272e80bd8f5294a7039b06810766176a99dc80
SHA256592d900535b5e1e85031d2f41769f3ea0fbf88e767846359b59c98e2c3a327ab
SHA512543e890ab983be9ea1def0dab968444c2f8585e871a85b7503d594cf2e42fc089231f48cc1f2bdf32606ba4b6a34cb26f3a7d1ab8af18523ade4557ddb2c1f09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a940479673b15d3b1df53d5becf08e70
SHA1a32550f73e4e47555b2cba4c1b23ca8efcd55e81
SHA256329542b0437014058b7b1f2172114522bcb50397d6ee3f45c8679d13272266e7
SHA512e6285205bb09b5c6738e4a8b2c2ca36124d10e6b72bf657e35504b337160299e1260f5f12b1d60f4910ec23c5f761f112ce19678acca5a14e28eb49f48e107db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537f69f2f06458e9a99eca267be242bf8
SHA198ca066deec11558cd44dc2d75a0e32393fcf3a0
SHA2562c02bf258d607c4fd17a163dc59361ca2a6d1057c9f2ee19e7391dbdfeb772e4
SHA5122bac967d8fc0b9df555105304252a0651a52759f92c788eb65d77aa8b6b7138fc5e80f631a58230c4d751d0a817ba7fd78c91bd221538923000a11d007670cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5037610c5fd5508abf8d055d9e0d37d19
SHA12c1d70d91ea9428b823fc3b227e43295c8b1dfd9
SHA256fbea4d7f95e1dcf8caa58666c48e4425ec39e44b8bd42a851f158530e3c1f3e1
SHA512976657fc7215aff4085797fc0689b8848da62122d983c3585a667724f4600724038a5dbf3dabce72bcf01db4c79ca720ff8439a9639b4c1af4a0d39e5d58c0ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57905dd75ef0f32722dc817cc0a502fde
SHA1e72807687c5c7b542ed2fc412784981f19fe3b4e
SHA2566034eb25ae1ead3ef1f2913a529a74c8175d1f89420f1bbd889cdcfd4ed046af
SHA512f8a54302f2098bd894d770b4f88c0c9079a3fde53822babef36f8b51f895ecce06b1c41f6d5d8d6ead08bfb6a3b73ab4745286b013c548fbfcb5291e6cd00a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba162deafb41693a26dd8cab01514ec2
SHA115e43a2edadd4c44069edbd6f27f78c6e0bddf8f
SHA256eec958cb7971479c8dd5aed12f7e27f45b7b094e4e8627288b2499f05115f220
SHA512ac6753458027e86adfa6e5af5ab7b0d48328a4baf57512c8b28876b99cd96f5811cac5ec4dca4ea98bbe199de0b305db9fbfa9b8fd2d680def55cbb420394bf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a383abb48e7530e5b9dcbffb9946708
SHA11f783e1bd8d6fbecd05b2a8f12ed4ec91d0dd5be
SHA2569c657b9bdbe95fae05754793dc54c50453e020211b2dd62096fc8401b42ae02a
SHA512c7a226ecbd131c19768a0994fb9e684248efa83f24aff43e1c5071411320900eac5f91e5dd1a6e2166af56c74e71fdd1e85c100977509959dad184fb1fede4df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d026bd68c49504b7eb6d499b9259ffc
SHA1e55958abe0e06ca64d21e30f82653e14c16a5355
SHA256e56cdf0216e1c3748604619bf3efb08ca278a5c91474af8356c30fb5ed3584a3
SHA512b04bebf2a332fc04822a6e64d1ff53a4eeb030868141b15615e1647311fe8650bbab67120af76c27adbdfea6d2677c985d87ad31d681e23ac43aa7b7040c88fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529ce6c0ebe99792096aca2763ab9966c
SHA1ebf1cac44df6e9e7d5e774d4a52581b4c2b0658f
SHA256168517d7607f86aa397e0892aa21f66dcf8e248a7d80fffe4998251bd09eff06
SHA51266c074e71cea130073795eb632617cf1ec3624288d592b2a63efe57c43a9f7426600388942e123f098d81a2261ffad024e3341f2c9398226b1ce3fdf06ae5394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb38533ff401cc390e0841a214ee3a69
SHA16ec2898451e83d9651887a0bf679ff336ae2e74e
SHA25687d7a26b5ebdd36596414c9798868b54eeb72feafbc3d69a3d3e3f4d40b0e58a
SHA51270e38103d759ddf5158e00d14cc12d16818071435fd21a56b8da9deb07fb57d2d5a70cf3438918120f5c6804a5860f4c3d30573c08c830531eb457a26d9a20cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c55f39824aa8529d615821b079f36cb
SHA1b8c8d1f9e2b20538ed4d67a3b95d39a19c92e112
SHA256ffea60b70a819096bcb2c2b54f9765b7b5faef85ceb694e9a8c80ffb782d78f4
SHA512cc9a2326d20c3e9e0a5003d1ca4a737dc2bf0e0a265afa014e94e77f1ed9d51b1c6f3b9750001a29b00e7101c67e38931c53083be522f5f66e21c163fdf907c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59131205d0e6be61e6e5466f267c6960b
SHA1e2bd990298a00c8155183116a4998d2282671172
SHA2561fc675fd7413569692805087d6d998f39132c9b782264b77e4b6d5878c2bbba4
SHA512aa576e637b8ba517521938e5537113aee2a212ddeb47869ba454a7651c7dae218bc109ab118ff1504f171e9c2e98ea55d1ff4cf0fbaa8a8029e118501c75d0fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535695a3ccaebbaedf525febdc02da954
SHA1d3e41f41fc26671133881e6c7c612edf8594485c
SHA256993610499a356d74bd5e2609df21b1c8461e083205a30cd2b84aac87996531da
SHA5125baa8693d0710aa3745a7b22df80df9b1ddcb78cc31b8f8452a9b7da015b242bf4f576d85ed12c05cd060b6d43afd55dd6c672bc7a15401df98c1cd5c1f2c6e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e82d04aea006737ccdbabb7f6a3db55
SHA178d4d317886db2b7d55329b39d4342447025883a
SHA256e51a9231663111d93a28288409c8cbf9f805608081601b5948b05827dd129aaf
SHA512eb53515712e984e652a510094308a4a6491be3a484cb4bce2f2c00c148478cbdcd602620045f535b8979f95b70298a8b9addd19eb9f5a9262c569c476557a68c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560845717d847c7b03591ed210de11e01
SHA1e0d693f76ce1fb0b068414818780efbd730d24e4
SHA256fa540b9202f4dbc7450ae2e2a4cc05ed753bd7f9dd3d35610f49a14edf2429df
SHA512112e3ea6c51d29a460c955ac7bdb1938569eb4340d81752df78c9da6d60d81b81f319804b9bfc977939eefaffe4934b87c95f2745a8fb6641d59794c00ce56cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57895491d69133b5a35edbc46acc80886
SHA1ee936f37034b3883cdfa9efee527b18b96b727db
SHA256b71c5d603960707b07e8a3b892d7d245b8c82823c8c6bfe6b0f3ebbedeba4104
SHA51293a121700cea08cbc9a6a386be4e82f8d1b38788be22cf73a1c0a1a766d1a51cd4d6bbe1620441747eba800335629229124969563b184bf35036eb6204c652ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e4c4e94d78bf1cb553e5b6157852086
SHA155080f390dcc7f2dc11e2ae52cec07b9eb59cbed
SHA256fc1519b1e8653b12e6a7964a68e146f078c0cc1a18ba269be96cbaca9119878f
SHA51236bd6c17fdcca35fe19d2fe7362759d01b672d0799d0da439dc5fa7445cb1e760307802963ce5845b29459b9cd5deea8844d1a0ca802629de1134713b21b090d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b