Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
22a9d08047e88a6c9522d266373dff32_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
22a9d08047e88a6c9522d266373dff32_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
22a9d08047e88a6c9522d266373dff32_JaffaCakes118.html
-
Size
7KB
-
MD5
22a9d08047e88a6c9522d266373dff32
-
SHA1
4efb7ec8ac453203e6146508e2461efede56888f
-
SHA256
805dcf2f94ee4e6af56aafbc116ac9888c2f3931f351ef3089db65bcb3c9d387
-
SHA512
9427c40396280669d3ff1fbef97616a98d51cbe936893815b11ceffa9f802c796aacd353060c7578626e0f519716f1be8a68bb52d485789680c971c9f15db458
-
SSDEEP
192:SIWeTrs0+m+y6sflcu59CJroAw8fueDqY6Qi45a7t:SIWeX0CflRew8fueDUjuCt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426178125" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f358d453cdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFBFDA41-3946-11EF-8004-DAAF2542C58D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003bf6e0f369fe6f319a2982873b8f13e002a7e8f15d42f7f58b13d6dabaf1c098000000000e80000000020000200000006d060c7704a63ef3c4e91735f5a13a5b3001f7dd6b00d3cd427bcb54faa3e7c9200000007f773f0935484052cd02318122de455ad142531760ae93c941d874c2f11d3c41400000004063e36c99489806a3a634dbe5793baaf358c6fb2d9b3cf24014ed660c42ad7adcb30ddfeaf12ad37123b97aedf49f454048fb4aec58d8a51e34778730ea6c6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000045cfab332e16d44599aeacaa8d9a7bea6e2a9f84c7190260e1f14d8f03caaa35000000000e80000000020000200000006993616804a39fb18bf295c23fab375126555ac980b844aa0ad1a93d7c3afaa6900000000e6bc73c3af188ddec8e3c0f846e83bfc3d04162ebcd55da618b1774531244f92bdc55c9189ef4f072a078e2077c0f77558d70cc0b964c1128554efbbfc000ad1a22bb0ed01d67271f32701256ecad82068e79eb7d4bbc5e144489e35fe62d7bd003318fbbb1f04258fe5b5348f7cf86daa2d3d126b192943d88b47acbdd975d47fe0a3c2367f5dd0eba874ca629afd540000000c168ddcb6ed6d94fae97791ec054d6f064373576744f635f811df147b51b52b891a249468312378db5fa8dc02b3cc3d43ae93e64cf612ca8b7a4465a6662ce74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1148 iexplore.exe 1148 iexplore.exe 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2260 1148 iexplore.exe 28 PID 1148 wrote to memory of 2260 1148 iexplore.exe 28 PID 1148 wrote to memory of 2260 1148 iexplore.exe 28 PID 1148 wrote to memory of 2260 1148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22a9d08047e88a6c9522d266373dff32_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534befe67044a9f43c2f5953709ef8b54
SHA19e2d67b085278e30cae1bdfc1ff382625a1ad5dc
SHA2569edd48523d9581f64e00b714be0920674b7cb0a2894e84803d3f0e3824eee49f
SHA51241055f6f331d6cfde0e908a0b2bf0c6899c9943899f60878851f202e687d97199d9f5de3f6ce61d8e7ffa06397ff00ab4714ddd53b4b685039e43a2296130842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5574a84dfc473ceb3561e1e30c7ba46a9
SHA1d15ba4513235cb0a92ab5b414291dec12cde75f1
SHA25691201100248388a2fc1ec67346b930c032239ecb52df8bb7019839422fec45eb
SHA51279b32049d85fb06983373e315c64b30d8c214329d8d715917398c889d1f301d575e7395278292b75a5c1cdbe3ede70a70c96e49be58c710349ff3153c2657edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0cd045fba4e02da0f2c6482f1f5e94c
SHA142cfd92fb61b076371915a3bc37281685dcb0fea
SHA256ebb3c9cf1dc3cc0afd75b997963259004334bbbd6aa4c9a11de560267d494436
SHA512c9b355675a493f8e7918c9e4170ea07895e1bc5a74170f4a12bbbc9f34d4c70c77143bab34da635ab17a2b844fdfd1d5aa05e847e91fe4ba87201f9641289ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5793825e5706f174f7701a0967de08b5f
SHA14323bd2748c303d60f14d65de1b40f34e95dfe77
SHA25618a58dcd7aff54a11603905cd145a18d0d09057140f8078ac555ceddfb787abb
SHA512accb646149cc97715e03f2d1787f927e4aee1eceb18dbc9e1985dbc99caf246dd536e56428caf65dd87c0e8f2175a2614feb12c829988884c2e697809432bd28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5becf7ab56ec514ca506c730e26b17fa7
SHA1995f51c4807c2c9c5f76a705e2929045f3e154fc
SHA256e7150308e2f1e8972cd5d538305d53fde3bb509019f5d118e8f11bbd1ffc8588
SHA51282c698ff99e6ccb2cc5606fdcf3ca3cbc58cb0c3e3333ba2f657861264271d2ca10bf3fadaa9d2dbc58336f429452e8ca772d00577f599be99a6f61227b15c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b263f58795d5ad7dad7b7c6628f7d992
SHA1121e0aa6fbd5e068c45f7f7c6e48edcdad5364aa
SHA25621b70abf52334e11f0332387d39faba4b2eac0fa2ba6fe2625b6ed555325c7cb
SHA512b5f35bb15edb4e54e009b3fe957ba340ee68015d4bb5bc9c263e5bd057b6dba66b147103766ca3375fb4b114a8fa2db0a36841af6a1ff80618604552ef447436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5b4d5e70d09fdf10d962a7ba8526ad8
SHA1d726cdc4c1fdc3d3fa799709a8e4855b6879ae89
SHA2566bfbcaf40e94b56710cd27951491e7cc89ccde0ec6fe5fd3e05534496d01520b
SHA51260236f4628b68575dcfcfe149168e2673f74589e633c94b01154303e4734861a3237f104eca441982fa876f659368982452882ca39c819a34f2786a1477399be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a83cabe804374daf8a9a99a701bc14d
SHA1f1b1d0eb11081ce50f7cffccfc401fe755d791a8
SHA2564801c9996bf145cf636ec39fc405656361726e0b34bdfeb724d1a8fe3527f7b9
SHA512bc33a7dcfab1e6da76d16c45cb6bb6011042e07bc682fb4146703b95077ceab6734a33beebd08272ff48841de97b75867d813928b95b2d38158305a2ec67899e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510a4b576a412f8793e576e6b454da95b
SHA183a69f84a2eaa892045a50b7c7f48e762affec5c
SHA2569f58aaf2e08b37bd3c9e4fbc685c4f450cfb40b61f8670cc11549ab8f145242a
SHA512388ddb3ca691f3e9848a227fbe1e53a336c032b8cc6799baefd925e0f189d3b9809c92f4cfbd56d8bba66bb26b01f6b7477dc47d85a7ab86b14a2f7148b3207d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48f1e92ba7fd5682fbeac8e3e2b39d1
SHA144550edbb8994270224f9902a27ca214f2635d1f
SHA256fd24b7187e017a46644383c818b87c26f294e31a0c6a3035eb7372d78d4b60fa
SHA512b9a4da43309cc804365799eb33ead70dbfc96ab8f51607b5232aa85d4bd137f28882c94cabd394ac7b5f4892c500dccf8e2f3f6a2f736213b87f58116153e9d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aefaeb433b566e259a9c203d51944263
SHA1a5ef4bef231321b5e2ab27e65b3048356d68af69
SHA2569a8198491ee64c10c1374cf1c28cd36c79f7d52c3a7841f7f103710326ec0e7e
SHA51202e4ef28f2fe7579d1327a141c9b6907e6ac3f5edb8dc6868601984ce287c241f9f4a19020598f4e123eb34802aa6f821bb97b104689ce5a13aa7faad4d3e8ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d998d89b2dbffa119289fae4a024ff26
SHA11cd5e14f6c58a3751b71138262d646d517af5114
SHA2567419467eb931e41d3f2a6cae810250d57b7503f4a76f31c135dbedbfbdaa9566
SHA512c1feb7a5fcb883c32a0895900e4572cc6cd22eb7b98924c31c44e9c1036dc79d35301924d4bc3f638950b8434e8a40dddd1a4ca50ffbf9f1379eb8155fbee10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd325566a64c53a69d8bb3c85d9d2ef9
SHA1adcf4ce935c2cfde9ec7b9576fc76427b5cda4ae
SHA256a4b2884974b140c0d9f166a8a70a606781555163135e8e7a79d7f754a85a2b00
SHA5121259d151869bd0dc639e6be13880813d6598ca0b3d7d77eccfe411e82bb29bb5eec4ec66bbce278f51f1887d97a7645f050ff2c2cc75218838d5b630bc392406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514b2e60f7ef3416791b3b01d50706ab6
SHA1fd43ef779372f8ba1e1e60bf184bee340dbccb6f
SHA256f921185a62c2dcecc8638759ce2c12b03b1c072d12b24668327d8eae9805232f
SHA512a707b98b7bb9d2cbc42e26ceaa1ac2834907616daf38f79e856225f6cc9e9333226fa36bd0a745069727422a43f7825d203ff556e1c64a7410e14b7140713664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b495b674fb155707db537ec9c6b564d0
SHA157bda68d2cc10771c35e62f52c96ca50d120e5c7
SHA2566d733d747fd13952d31d8b285bb9d42b60a60fe60fc82366bf1d12ac190ff95a
SHA512cdf2937df96ddcc222ad756fc1e6d27df5d73034da9b7e8acbe9888c67bb29695e0c088dfcdb360688a956d7d0736b9a90d09dfdf3eae903d68d9892b6ec88a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff725e7241b3bafcb4619fcb0cc75daf
SHA1dc72e2b5d687d6140cc5977ef9e432ec1c0d34e6
SHA256edf86554e8ecb8f8e6d56ce78388664dc062128ff3f8a057c9b0c1565068f77f
SHA512053259ff62b91fc9e4b46e56af9eb4f091ca9fe2599414da134fc00e664e4e119fd1281bf61153aa9f1b35744768411925367fb5e7c9edd81607bca4cc0095bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e12c6f81c725b092d99bfd29da7ce00f
SHA17c8ef977ab72ba0c34eaf446810022b2702ff560
SHA256c75176f2420ef7865c42df18678813105465bf64e12bb3ad9c37ca0b64b6ac29
SHA51275425eb27456ae06df2d5d4756c68147336eca028694808710577ce3d9b6bb144a5df5843b4344a6fc5d945e4132064ca917c88677bd05d3f9375c27b5c6cea5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b