Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
0c712a39ba7f5ddf465f1f918d2cecd0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c712a39ba7f5ddf465f1f918d2cecd0_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0c712a39ba7f5ddf465f1f918d2cecd0_JaffaCakes118.html
-
Size
33KB
-
MD5
0c712a39ba7f5ddf465f1f918d2cecd0
-
SHA1
c41aa5f0c72940ca66edbf289b6e7b39e600c180
-
SHA256
d6e4494ea1e85c0fc13d8b0d88fccaad141768823f265f5c487809ef3c237dcf
-
SHA512
c6cee792d2cea013329feeeeef1290c550c3bb16c75fc7b19ff2205874eb0420bcda1f767d40ca4047b910fb5b1326dd6fd8b45597361191ad0d895d3bcf2d55
-
SSDEEP
384:tL7HZNheqjnkQxPZ9sQzGJtc+D30IlOTHEORqthc47P6M2avTwpmKfRwEHbyBg0v:r7GjS942C
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0E046E1-32A7-11EF-8303-EAAAC4CFEF2E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd3abf83e4c367419536dc98eef37a4100000000020000000000106600000001000020000000228b1a0914fcec6c2262b2b0f7089678e8960943b1be0634fe91115a9209d019000000000e80000000020000200000008b2ab89f06f7891ec337dad5b878668164327ae60dc56024ab549fa3ac80e7f790000000267831329c684bcb6fc17e3e46d7d68b24b176c3c539cb86d4278fb5576edb5dd47abd788624fda2cf3cfc247670fd699bcf3a96eeb5605fcc5c5dd7037a83d13386d3a3afdf49d9785759eb0140cadc293dc1d2cfe1f0e910f7371e31190f86dfc8f5c323a1999890325b376664b7d29901ff240633c222f602da06e3696327af9d515184798891df0e225706d815eb4000000075766c7a2a820437779b369295591c51f298db78fd37ff0a7182d3fc4fce6b6e0ec5c3189345763153dacef1d566b33a9f152b0c32838949a2782643d3f9b24c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425450103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd3abf83e4c367419536dc98eef37a41000000000200000000001066000000010000200000006aa9c230f57a1aedff44a5e3ae45a3bb167995447596553f27acc9a5baa348a1000000000e8000000002000020000000528974db1af7fdf0d76117efcbf155b0d1dc74512616b64f92dd93229e021a61200000005afb760e2c7b18546fea7dd4a165c32e5fa6a74be8bf6ee378558e32a4c5f79640000000e83d123af658ebb749c4265ae6cb0fe0fa7dfacc96eb4ea5bf3593b781d20330df5a9b022c799002dd1f0a3dd08ca8e56fff0a01a9c856136bddad430491fb4e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f191c5b4c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1344 2224 iexplore.exe 28 PID 2224 wrote to memory of 1344 2224 iexplore.exe 28 PID 2224 wrote to memory of 1344 2224 iexplore.exe 28 PID 2224 wrote to memory of 1344 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c712a39ba7f5ddf465f1f918d2cecd0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51268cccf1dc600eabc7cf3929b6d9550
SHA1e2dbd8da84fcbdf443bf84fedb273deeee04434d
SHA256c1f9b476124d98bb228720d62053f3950bb0433fdd18a67917b1dc6b3eb02c2f
SHA512a053bde5abfe71d56668a6ba6ae8b6200d1e1229595d67e11a6f99236245d1c4091c1f391b973b8d3f6e7ac2e201dfb427a7537bcea53d338a7290033560544b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c24b66043b3021961209a2b126d17fb5
SHA171683b58158be7674fd709c75dc0d40381b53aa1
SHA25651b12598e5031b3a653897caea228fa05025b76b36b083de66a075760c2fbd2e
SHA5125cb3767b82d4865b2fb9eb4d023caaffa1508b0878e0b77e89db5700ffb849006dda0f9b700c9f2d7328d59e1fa05c30b73bd17aef4d75408d2137f73564ebbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a470794b0e80250cf16b3b83619faae
SHA1c3b21e253e3f53f4f8092e72b324c518f0ce2776
SHA2563751b21330855812211e3f31debe31933f664776826e2fce08bac1b58a843038
SHA5123d96a0da50c50aac39681d66c576ee23e76aec0848b88a55b3a26dd3ab9058dc6e848ee3a9e0c76530f27ef1212fe691074af66242f0232dea0216c9f7d37f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b17ac0fbf4abc2c834d1434d662bcd6
SHA195525b19e6a07b7a561b6564214e47e6f62add69
SHA256f7b4d562420904a1a72893fbc250d8f59d48b1600724baefed8a9405e5d7de7d
SHA512fe2f7cb888e3936857f0f17e14ed7a49afc9deaa4a72047ffacbb45bb4819a3326a7029f8bb960d7c703afb259269608356c20dd286dc16902b856547ef72b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5626cdff8c8eaffa02523e2b4bb81779e
SHA1a372f7c7a2a3f8e2b4c1e003a9cc6f0ec3218326
SHA256f82d127a240a036f0035922769ed55a52a49fcb21ebb09595e16f6964329d6fd
SHA5128584436e2b05b8c0aece9a78079145dfe58f4c03d9858462ec0747afb4159508c4f33e243f5a6248b32afff69f96ff256e0e943a46e42d6cb9a8208b7014c6c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513ca73c97a1c203a6dda58d668db1caf
SHA1e9c03c0d5cbb0d6ca6e2408a694c5d40c0f47ecb
SHA256b54ebe8999c5931943857bcd28c9d86eb9555ab0f591903ee08ea8a56a239e57
SHA512b89a92c43136f57b79a2e4677da39a2dde286b6b9ec4b414daa97e9f511503b6490f6ee0a13eb1dad974cf8457bf71eeb74f48b9a03d4df48e238f92a8cb7ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52434aa65c49eae8e782cb39453dbd609
SHA1e7709abc9446add561115e4cc40abeb30d0c6c36
SHA256f01115cb25375ae3891b366998d83edcbfaf071164304366cba359a9e909e495
SHA5123a805e584f71fa6a366270c7c536b8dd620ae41db5910ae855232b26f09e18fdeabd8d35a84c07b87740a8b1b59beffd6b27dadc045c667686bb6dd06461139e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5559927ae4436aab42559107b41d85745
SHA1887fe5fb1fa9e6fff183989e485a97b80c686279
SHA2561115429515cb72bd6423be8686eae345761666798e2d419cbb2e6c01c10c864d
SHA512b3dc0b64680ab99f2905d4937ab2fa07f7fc39e80899fac6796f13a62a3c46fbe85961fd5ad236e23f53ee3d07717516212b04f3b8dcef474aa31e82284120cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9a75c5fefa78a2ff56c863f058e4082
SHA1943f42ebdfb9fef77a855cdd8753c0804a2b2cb4
SHA256ac3ce61ffcdb86d57872f1edc29cb0d500a0c093bd15bc949f94e4e68e8af7f6
SHA512b794b79ab34b65c7d5ebd2b4b0e7944c92d07ab3cdb8f3ac1a63cb9280ac63ae65b944731c091ef321622259fd97e409a9518e391b5803ebb1726c7a111aa69f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa5ed78187f9c8c12ed1d3b4c8c8b4d0
SHA1e37aad196f8647149f95f363206819b8ab50f11a
SHA2564c5a802ed1ca58ebce76315bbe541b98daf262f7a4ba9cc98cf5dc8a29d19cf5
SHA512bc6d3968fe9d27aec91c99a98207a2a21631ec9e617e3d466f24ed6f41a33ac3c8ad91ab7228e050344da218bb8ead19b237b2d4791c87b167c3733f5d2d3515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4aca398fa2e446b3fa09a6a6aedfd1e
SHA1bb820a45f5b1d493d0239fcc2f0d3ea1c1334847
SHA2567100007fe4bb5773bb3714641cf356d1d528f09d3f130e9b6c7fb92671e96d72
SHA512f9345fbe3f21bc9e7b882bbd69ecf601b679b96c583eb220a1a0bd0fd6d30c7bab318eab85bb556c46329c0fd2cedc41ba2597c72ce8550e6723e5b3146dfa40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fad411532e577dc2d0d0736164b771f
SHA1ceb9f0441d71d98f79f25c5f6c51cfe02469c97b
SHA25688ce0434bd25a3e85ea5e0b59df12d87068e342b5527b3fed28ce0ae0871bebf
SHA512302db8ac8e2af037062090316332249415b467409400f5f006cef125e49be1d118c26fd074e1294bee084fd146fc0ab7d29629d4fed83408326d773aecb8a451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5862111a9877d2bedcfae57e149131671
SHA14586df33318d62aab3375bfb40cda7a9bbe89f7a
SHA256076e56ab42ea0338b4b8cb8988c3a42afdcafee65bf2337b493d852391751be4
SHA512e3e2b54d7e77c6a0c139730250f08abce4c29c79a1bcd26dfb2a8d5d2d7340e7da2aedcdac1bc9860eac58ccf74b248d354b7765eefda4aab8594a0dc616c4c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffda8b63fc5ead62bb27c5d892cb1a72
SHA19c1fc4780f73b0566f8371bb6f3b12161bdaf562
SHA256eae3b09cf7a0586f126259afb79c88fb53b166f2027a0927979f4dc5a693ec01
SHA51263d372dd4e2699b4734566140c4a1d92a061eceee14d9c2d06c100d32e9fa6d825eae99cbd9b8491bd524f6383ea602cbd53abb349119339b9d6eed38164a108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e49511b0d27dc2592e1652b1cc0532e
SHA1df5c935d9aa63558881998e28e19d731898a6bdd
SHA2565b440c400c405a89fc2f8270581ded18cea01dc2fdd888641202b122a493ccbf
SHA512fb3b537765ba24aa9b7416e4d8fd1c3e555fcea90eb672c9e8480c57ce70be20dd94756da51ecafe11f4eed89555d0e87515797a1deb5ba6e07d7d22accf84df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f0653db55f6897c08c8d448409168ae
SHA11c8318614e39de7e24a3147b7ca46b5d39957593
SHA256aa828508f0e6f44adcf109ba9415070a57055fd75900f457785b6b81e8d285d1
SHA5128a1f92614207cba1536aa003a175f14977eb6bff80f8d547f973cd20771f9fb325d074508a3306b18bd2e6f86481e48cab003f294d75375bc8d03c98c14afdde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c64cf4ea8098ea9ff5571bd9f2b6371e
SHA1ced9d10efe8fa749ed74dbc615e8d1ed611cb9c8
SHA2566ef021f767d489cf3245cdd6cbf948d645a086644c068145f5913c39ba26654a
SHA5121a3463445f3a359f28e05539dd6e2ec416068d7fa8f45df70ed83f05f32926cddf4426f18edba703ac3747a4bb10169c36da9ef8f299ed0265e15c00ef726df5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d43baa487cbb02649b1c369fa1d3fbd
SHA105a65e1b9dc6347e57fe16006d94731abb7b4dbc
SHA256af553bdabcceeceb5c9b25a576bf6db87865475ada7a02873d887980a844294d
SHA512277349185a65e3160dc02903fe698f6d28fa71db8e3f51135ffd53d6b0c18eaefd604e761edb334fc817357f4e99c7bf104b734570065f415e3f4c271a58b899
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b