Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/06/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
102bfb5b9b7c1dafb48b641e39ee71bd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
102bfb5b9b7c1dafb48b641e39ee71bd_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
102bfb5b9b7c1dafb48b641e39ee71bd_JaffaCakes118.html
-
Size
9KB
-
MD5
102bfb5b9b7c1dafb48b641e39ee71bd
-
SHA1
50c3537eb7a6e4bc2560366e4e2bb92dc6740c5c
-
SHA256
d1eeb8f267b3045210162c32b11c18f6b1a53adfcd3d5ed76ea8dc6e97976f74
-
SHA512
dd8054eaf79f1c6b52367e048f417b1c029465c606a2323037237c1a4321171eb17616b3a337e98bfc572e28c3fc215d0c82002028ace57431210c1b16cd767d
-
SSDEEP
96:uzVs+ux7axLLY1k9o84d12ef7CSTUIGT/kgFppUlVHcEZ7ru7f:csz7axAYS/9eUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425525323" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f506a29c644c2342b7d0922e23f9f3b000000000020000000000106600000001000020000000f68662edf702dff3a7a0d8418429b37be689991868d8e7d331f06f8979400b70000000000e8000000002000020000000f49d79dbe7fb9754eaa9c8b524a11a095897ea82797f788366792ab1245e5af690000000d45b7f43ed2180375bb3e54d44c31ac4e8970c927466d1e1397134f620411877f1a7c3fa7a4e2e9fd0707e654a44af3139c63c4167bac6d788dd1efb4a65131f7f35b5647324c5958399a455db9635d9b5ea2a7cff44abd1011a6fb5b027326487cda5e388f1d6754bec885caa5bce05d7fd1ef345c23dd76bcff09449c3da19925e793de1c08d4dc9fbdc44fed92f86400000008cadf89f1db38622cbd1c10d8a4999ec59ddc7fd5680b8ef87ddac516d72b10ededa91cb2aae1ad7e8f5afd04ace5190067fa8075e716df60f42f0febb9beaa0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02c93e863c7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{137F83F1-3357-11EF-83C2-E25BC60B6402} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f506a29c644c2342b7d0922e23f9f3b0000000000200000000001066000000010000200000005d19da3df6c3fccf08cc9845fa2ee45a30d2683ef064267028ac264e7a480898000000000e800000000200002000000076b3596f4a88d95c100ff3707469ed92792c4c7a99f0582336c508c29df4968920000000c8bd61ca7d8685f34f07389f580f4824e760a9b215969f2674650d5813f8526a40000000deecdeba9bac489e57473ce4b5d2e02e536fed58bf448d8c7bf09249f676963aae66c5b8fb708227e60cdf863b2009af12ea631f6aa74bbef8ac1f750b722380 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\102bfb5b9b7c1dafb48b641e39ee71bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594d2d064062632f23833fe5b755b4a78
SHA16e2e2e4c33e3fc9fbb8474adff90a6ac2984e46e
SHA2568c6ef2820f792ff11243002778d2eaecc752af01357e9c618c5a97a8c28567b4
SHA51238e74f0d9b5589e09b000a2925bc028fae1a29e8d6135ab8194f7bede3a47ec5c70f6a4e0052a1cef52f5f2eeb99b811a563b8acc19047af9d97426ff94e5137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5660a28e6dd909b886d5fa0aef01a6745
SHA15d09039c7ee6debf088c8430539b89035ec16c06
SHA256d62538ae12f996a7b55bddcbc18745e4dee0ef97bd13e6bc11c4a53b994485cc
SHA51254e008a93c629bee797235e86fa38f12a61d15ccbd3fb39dbbcec733b7d681b3ce722be6942d26a2c1bacf502c59dd33cbb0185172f1782684f82d2673fa5a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb605b7e759e8ed00363699e9faf1cf9
SHA15dc5f34529730ef36cd9e848bf0f7379cc3e6b87
SHA256af524aa06c90ec5a12ec82252a745b29f47dd3410496328c4a2f6c7ac22350db
SHA51223095f58678cf564a99bb8612cdf31b916b809bc71c54750287ae3821b2a0e4adf432a874a59b6d1c81c1281d0c3a9cdad2be67c55945b8da13e7c03f8610317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a601f6e7838e38e6813496e3bd7d75e6
SHA1048f2c16317b2e8bc0c237f07aacda606b81f084
SHA2565e527d1bc9bb934675b9357d03ac1fdcccb4e1ff31a01d77fa99e4906207e950
SHA51248ee20c8925443c0b5cf872ca80931a44aba696e0b88352055f5398442913a7d795c61e2757b63b1558f1d17ae4c13e9eb930e36dbba1ccbe99566a36768fd3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56755c02f8f1887a257856beb50ed8ece
SHA19f5426762b59d264e0d66ab2a2a3ec9c3d258d26
SHA256d6bfa4bad7d366a52b3634aab3becd7c4077b78d875057d3a90bfdaee1697eb1
SHA5125bb87cd4891ca34cbc8e9b01a09e552c270d57bc428e4698ade6e89d910d735e2fefab8ca8a98d45603becbaf3ab139d43e9206dd0e09ddf6c745e5903dfdf89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550342fdf29bc79138405d8fde5c44c50
SHA187b4d2d15948f9d83e5c1a85b2503a3fac22b2e0
SHA25683743f2651ebd0b329ca3fe4b4b107d00de5d40622a351849a7d97dd62a5f60d
SHA512dba3984fb352428e4f9c04f48ad92baf05b4f727f05d31cfae6a489f7d1ae869f32ff5ff4e6778c9b5c99cd305c0ec1d496d0fdb11607dfacf09f769ec5f836a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51280b70ff9e8ddd01f8abe9035934cc1
SHA1441fee2659c3538f556685c88ff8517b522440dc
SHA25650709e30f943507bd83146a0835acf77b699a15e3a318dbe460d5ffe57b13292
SHA512ff3896400b0bb71357eb71852ef1481ddab79492a57831943aad5528e62f494c4b757e8c3b1bb0c1d3c0e2ec8e3f48f52042a06dce6556c47cfae6fda267eb04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f879ebf3c5ac687d02d583fe8f20aacb
SHA1e9331fe40c99c963ff5a8e885b65838728eab171
SHA256272bac448cbfa0e79e2756eeae05c5a5423bbae1f311248bf657a7df7b8382bf
SHA512442a573055dfd3051006cf4258c8005254f7b3322978a76ad8c69d722aa1b5dbe06d3007388502bd646f2d62fccbbbed036a60921bc0074c7c570086cba7b81c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c11df5ccee01fe99d6fcee6de7811e94
SHA15bb60cac2d231646e31eba1392a980561038812f
SHA2561bfd8253ad4b50b1ed5fdeb57ffffc278c7b2903c3060d8230b255caeba6aa49
SHA5125e799522c4a0eef774418d1c4f0820459c48b0d7ae41d4ae72d488058e19fe90802b0c7ed6c98b4d4fe4490c2779a855a599ad738b13b195583e38aa7c32509f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579e694370072db3e5cea25e7f6b23483
SHA1229bf1d9a0d9dc9fc5f120874642510b1306af0a
SHA2562a37e6767b4c90867457a091f0e5ae42d4819f4386d800c7722086de04ae4029
SHA51277cb16b197b466356ed07f0ceedda7a4fa16cdb7fa3c4e7662254496c4067fba49207a9ae3422ee84513bd4d487afc254678402f64eebfe1a07e7698488430af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3a957cad62c05d69015fad91a70d485
SHA1d2f0d105ec745498cd83c419cbc9a7d61f16eb55
SHA2563b0c3da24aa756bf07f5b2fef52a6aa71be90b4d4836d0a7fdca9fe144b5a4cd
SHA5120c04d394687707c1e6730a30b7d282fd083929f5b14818548825e8f8f3b8eac3acb726ac357e60e21d35e8fe1cbf57a6d39320aa699876dd0ee1c0764e2c80a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f0f8ad0fac08a5dc229f2764119414
SHA1ee0109bf34b833a470f383a7507cf9c26d59b8b2
SHA2566e2cd9a3d1aa890ca13379565d4b6571cedad7ecf4db8bb1f3d48c89e326455f
SHA5120302b28d3fff2f7be57bbfdf7cb39773d47bef437b99f4ab3cbe6e55acf320520901c9f1265c08ca793f11885ccaa618551ef5b3a851a2751a5b7eb57f817007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560a1d9c418d24cd431d34b9003a4b7e9
SHA1ec169f6364ec17306b39137b99693e9bada6d1f6
SHA2562ca7105a2bd5e95bb3ab225b14e01a4f7b03ca18807f05ceea93f00541b8af8d
SHA512015748ff11ecb786e87a64829ff17a8d1b89251bd6db54ed58b854d322fa1d928a93924976dcbc2872e47f7af9788d209818a5b5f0abdef844dcca28a6bec45b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51575659628c890f9fe18f2152d0d37b6
SHA1145c35bdc4d9a77ef784cfdb7138b3eb77cf8fbf
SHA2563e7cf0598705af52a8db509f60aa8ee893b5053c636414d96245d967f3ced816
SHA512d8355187adb9afd2c833b642ccb1804c037a82cda85317c8035eeff6845203b0fbb10ce1f977c0fa8173ee08fb1f8043c2604bcd2c964fd2bb0eafa3cfd7752a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504874104b47f62bd06264fd9e0c08a87
SHA15a4441fb616397a58e3c7d97bbca11ff7b5c2c63
SHA256f29ca2a8a4355100291dbacd0061c39b855eb1d33abadbe5bf2822bb19685313
SHA5129627734a44914935d43b8584d31b53eb0d338341a4299e51926353fe5b7b39ddf7e6007c5e9a0369bcec5570c261a53d77f6ab7aef7b57379ff09250552af0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570acde36bd67dceed251bee850bc0fa7
SHA196b73ed6194c1be0a38064bbe5261075613ca53b
SHA2569c09a8efeb6672076cdf7a16408f9060bebcb653e5c016f0e84e45f397713f4e
SHA5126930ee9f229b51667a260148135e27b541735737d175a0d4daa827ca78790c1de6d270fecd5ac2943b2c1a98884facceaeb326145431aa5fb07c33046d9fa5e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527c39fa3ed34bbf5cdeef979ccd911fd
SHA1871b3e1c0c0f5b98cac7c0fd1ccc3ea3d1a2c03b
SHA256310b5734acba9557e66e78a6eda5a47e4123f791ba55a75e33530a17435409af
SHA5128e59148706a0fcfb7c9747b6eb24b2df68b547739b339267232f77fc0f2ff65c036a7cbe55662ef37645e79aae097a85025f0b6a9da288ca0db8e52afb29091b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b