Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 09:35
Static task
static1
Behavioral task
behavioral1
Sample
1ac9cb510b75d1afcbca066a6f74b7c5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ac9cb510b75d1afcbca066a6f74b7c5_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1ac9cb510b75d1afcbca066a6f74b7c5_JaffaCakes118.html
-
Size
9KB
-
MD5
1ac9cb510b75d1afcbca066a6f74b7c5
-
SHA1
0c663b37aac9299f7b48a86a20f90e32a08ae3e4
-
SHA256
1c5fd1432ea167f3ffc0a37a38cd906ac325555f45d1c9c8f9656ba2383f2eee
-
SHA512
65530eb3071798860198fc24f1419897a0cf2f24a86d0518ef968bb939c79bf66f79e25eab32f1cd83d38685b79967cd0d3754c069d9e09f3be24f294a293498
-
SSDEEP
96:uzVs+ux7C/LLY1k9o84d12ef7CSTUSGT/kzHZCDpr8CJrK+oCq1/XlVHcEZ7ru7f:csz7C/AYS/zzHoVFSv1fPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608f0c0d9acbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425988382" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37EC1571-378D-11EF-8144-CE80800B5EC6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000d853fcf6e95cd1d0d106f94230365cf2beccb4c12c84139d5c3e6852945a6a9000000000e80000000020000200000009081179063a6290b305b54923267c128f778ed49dca6e468e977be46dc1c0e559000000024fc9c1173ca76b3c7746eb8e5c6f48c7ef805608fa1ee0fd7f767e513b108e937c895567dc19b24f3e531dacd753e2c0f1a1dd7fee546208159d80102f4de8ef3a8fa08883061e1f95d6b15255252d87c9e1613fb9898975d91c177dbcbaff2c6f9674a74a559fa8e16a807f9e0326478d2babac424969d76ab738b4a3ac1949ffb13a84610169facab32bfc4ebf0cf4000000075fdd1119cea0c452fdf23e40a9c79e87a07ad8273d04df3055e25f83c7fefd1d8f6fe92f81919fe0cb93d6eb09b66af1f15dca1bc24f1c00a713fe1dc5e30de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d5d63da0b48f6db06acd96435b2d83b235d6ac8aa99ca42cbf62f40a92587b9b000000000e8000000002000020000000bc691605b85995c3327a8be7ff5880446d1b31ed993ad32456530aac05118d2520000000a08473e4038c795dd1b6ff6921abb9288375e173eee42bf59eeca44b196217664000000020ca726677c45bb3685d8d9ed5275f5bef96ceb5b26e7213eaf41581d2b5795283ac5eb01d8f1f03818da1a9e8904243c748c2f9789c0d9ec745a183a7bc2cd1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1476 iexplore.exe 1476 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2632 1476 iexplore.exe 28 PID 1476 wrote to memory of 2632 1476 iexplore.exe 28 PID 1476 wrote to memory of 2632 1476 iexplore.exe 28 PID 1476 wrote to memory of 2632 1476 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ac9cb510b75d1afcbca066a6f74b7c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503ced153c1f573df6ed7a388984856e7
SHA18914169e49ed1506b19c2571de9c5ba4094d894f
SHA256235685dca567ba3333393a4cfd56a9d96026648d1080efd254167e9a1dff4b7b
SHA51249d51ed7943edc6f99bba7af3fc0da4c9f13e3fa2ada0d7adf2434d73cc755789a82cfbaeaafea5be6755cff96336e3cd4d1ebaa0eafe719d0befc5f728bebca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae780fdbadd8b817bb3320c3c5a5bcd2
SHA1b127a5105a6e4a808f81f0627c09eeb9afcbc84c
SHA256fa2ace0f63a8d1d94043b0bcd92be366e8dba8d25f206153d16828767875f8e2
SHA512bdb4d5dcc0373e918f3e0a39e01884f38d893a06906143ba9b3f4e3803ff8cc6ed5893efd21ff274cbb87af8f1101b750d5c91a8ab2f4e3c0ba5a2f305ab9f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cd0442291ff4a32ddea37e9b943c3aa
SHA1c78b1fb4be291b698c7d3b6577fe2bd626f26fa0
SHA256514d40f43fee85838b54d6e2d297ca0fbfa10c56887579e41580f666fffe10d8
SHA5122c9a93319ab75648d9cb817835c39be0cb34b9cf808b0edad0ca039bb82e0abed14c532244f6380de3dbe82e8753947d21bd69097f0d2d12ed62f9d08ed701fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571b7533c1bbda7345b8dc7ed4f881fdd
SHA149b413d24ab3855ce10f5a475de497bd4fd26d50
SHA256e89b2cce4eca2cb957a081d0942eca8db2ee35bce199af06f3bb9237e870ff8e
SHA5124334f896746985ac0013f4af54adf1b7b430570805c706c1a4b7335f3eb7d197bd0fbe2b0d2073d042d21cb39acdee859b40319ceb862b6ae90b32ea4df5bde2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524d60e7b93f8cb49a9ec072418bf50c9
SHA1c2a4c4fb401ae6ce2433bd2be7d720323a84be02
SHA2563af9df8235f1e0b6beb37e85184267aa4efca4ca2a47b879b1438015f89f7986
SHA51287abc5867366120d2de3b3d9a65cd397031cbdb23a17bb38fc9b832a2d284448bbaa1e9a56836d7e6df99c7721984c6861899f383486ab63af81472a6f31caee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546e5ba689aac805958e9ef43e3edc760
SHA12550ee9f632129c6fd2bb224cf4cf372448e0782
SHA2560dc8b4c4fd07fc5ebd0e6e05fdb0d90a9ae03d76f0f7aaec937839a4406d5997
SHA5129c89679b3a3036209a80186d55a40e37d5c39abaa75395396afd931f5fddcc6dc919d14d36f6d089165d5470906f1702f00a203bab4631f1ebd676797b384b46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aded3890623a638921d1305c2660454
SHA193577a052e4be0d76a9c3783c524d97b8672c9b3
SHA256feb2365ef3c15af5a24f161f5007c892e40318b551e177a76a05bb60c36179bb
SHA512c0afa4e8da8e265b4a926d201558317634b7956a815aad01fd4ce77f8dc813907e5e0f1015beace0e33e3d567120c7ad9780c51c1f06e62aa64909e4c91a6783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bfaacb7d233e4f342f0572b0753f9ca
SHA1c1da717d99cfde1101ff9c1e5744e66f312fc0bd
SHA2569a917551a5553b4e83429208ff59f9f9f75c9f00e3205c5ff0e21071f9aca431
SHA512bdad548e09f20cfdf9819458e5e41d5ba3b841f816abcd7976c70e2c071f2592779c5bcfd52142ef624d50db76eeff11edfef693e2e9a6e518b5bb2f7ad50558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f425babec849fb93bffe1fdb04aade0b
SHA15fe334fb0a01717e113153e4b4fd0422d1bea846
SHA256e7fb3cce1a70b4279c951b8ec9f178115ebc6506e7c16805ee36cbcbcd85b1a7
SHA512d9704070625dc074e5df233d33b13e91529c2263e80e1e7bc4f18f197b9ba8b279f475e5a016a8b371e0fb4d72df5c59c9fd5e3d9f86b68b3f5577229339bfd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ccd926dc2c6a94a2bb771c4923c612f
SHA1ac768961b7cdfba71af442054fa0bd4b3d67af21
SHA25629541fee026490fd805411c091b1fc7be080c4764a01ac5c23a9e4070b028f8c
SHA512f78296923e4972d7fa601c617a762312d009b45f704c9e239fc07d810202034b3398da08144afc8c6e45073466c1d0410a2b5ec01d4943c53137f4eb9873e297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c0a4c456328e109e82211dae6c75e80
SHA1ed05e04a497f6714dd2869adc741b979383ae557
SHA2568b9c4d2dd08352b8405761f32d888daca38c6341653ef76d669a5921ab04465e
SHA51226a48d467bb2504c45715c83483e7021a4e61d70e7ba6924c5e2edb210703d03e4ed90ad3117351c8f9f915d40c76dac36ad278749cb0e9b23fe1cd669c2173d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7808db9a4466c5e17ed6f77e8c3c517
SHA11565b2b4940df9b12f13e904c11a3a94292694d2
SHA2569c39c04065eca18cfe7672a84709967a5e705251c8cee6cb320ce18fee9f0dda
SHA51211ce9ed9374e7c2f6e7f4cada4480d3f4e9569baefcf359dc07e1c9747f5a828d0f1d9395fb7e9fa5d887a888db316eb49c9077c9a26ec3b7c0c3097210ae3c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598178cc499cba3da8f6fba38fb238f71
SHA1742698d8c18741a66e3602f834296d2f77ebd7c3
SHA2567a5c56aa150930069fc34931a36696a34752c4c1b6eee4d6a3fcf6bb6ca50a0f
SHA512a1bcc846ce1613f1056c359091b0f6cedc32ab6c3d74614d3c3a26754bf733c32088e0a32a6f9cb85fac89ac23c7a4d2f187bd1af0e3b289b6f77ecf9b34eaf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591df250b82c85e4afe847e93aaf923c0
SHA1695d19042f8b7899ddd230847f219e871ed4f76e
SHA256d49e8f7a9fabde8bbe2e220fcc30e9f0d88aab0da25ff889fae714892c533949
SHA51215c0235f0f331275d7831f239fc0c8ae7f14fa38ebe9a6a3d71a4ae6fc4553f3b225970778a28812f0c18a654219dfd1e5b3e93ce473c6d57dbe2fa12c138fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ff9230043b2f8c374cdef865e3343d7
SHA16a4cd0e5fdbc841de3914d7257cb0bee2ce44afc
SHA2566cf8a44c80f5fa079480010afa3178f767540e7dbd2ae9dabdb30ffc9783e0d4
SHA5127bad1f1421117bd2ba128bfd6de998410a44a0d2145a3239087322026c1621388ee9c45e0f0a47154d9489d8baaec4d29c61d73cb8b76cb41776dd439cda901f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5773bcde84cf00f8dbd348c9b87030972
SHA12ab6139ab4bcd52ceaed373c81e0a235027b370a
SHA256b54e945a25ef4aa7ea7a8ed0cd31f5c29567d00945d70b2bfcfc2bf6fb4f4a07
SHA512beae1977af60ffb45920d4c5927eecb6ca4a01e824579e0bbfc752accb55032152ed031868206737431b10bc928e24f35c47827f7ff9d8381676be5a776f641e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544ea1cf48bcce63af32585bf8cd2b65b
SHA153df7e3df7580393b1765496b77cf45cd630cfe3
SHA2565a2dca7300e2779e81de333624c2cb0e3dd05bb1bad54632ab9c2a4d0fbd5ac5
SHA5122bd806fe868e928053849034fe8aab1bc0acfcd97489d3d94c8c4627b44ca82fb16f680243cb8a1acb201832793d5a227e60a67a5c1467b4022b4b8ab796bd15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8cd9534eef81fdfa8fa2dc2facc65e1
SHA11e12b54e21ed3b5366d7494a548ec3b0714ca37f
SHA2566fc7adce9f43a08d2b0bffc5a77ccc5e8f2f16467156e2558d631d157da266f7
SHA51219339eb7600cfc402292c099d37fc47351ebb868a948531593ecaee9551ab6a7227af485126528070fdda7b9b176ba7ed833846c3f8eaa22a913dde6976c3774
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b