Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
22ac335c50f6f03d2c3ae3efd96c6596_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
22ac335c50f6f03d2c3ae3efd96c6596_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
22ac335c50f6f03d2c3ae3efd96c6596_JaffaCakes118.html
-
Size
7KB
-
MD5
22ac335c50f6f03d2c3ae3efd96c6596
-
SHA1
2fb18590f436d85e7105f324461a85e97658469b
-
SHA256
f51b640d6e4350b25f98bca3e62d1adfa6df81ee6d290bd3c4ff058a05400302
-
SHA512
4dbe99386be4425827726071f64040b571a13244d261a62218bfe9ab8198ce3bcf02fcaf89ae4ab7a0a99c1f7c7490adf52db1bf83ae1321e71ee573ca9a9f2b
-
SSDEEP
192:Rsj+mT8bZuDlVky7G7nAj6AKP+HrnHQQtPuybu:WjnTOk3OAj6pP+Hrnbtmybu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000007b447bd0916f62be4a9b0e1a11b9c6b683ba6e733e3aa0729dd5852d034bf63000000000e8000000002000020000000da34c35342d1fbe0de43ea1f2018c7b96f0371adb436f06af4988086396f80fd90000000760e1e6d9e8e8f2e25ce2db6646fa17ebb6543e1542b3d6223b1af147e0710dd34c8e3acb7416611bc9b9224e78fcc0677b90660dd5f5eeb14b5c2eddeacc866ef67e822cc4e589a8b863831a0c7959240db46b2b00ec0ccd65f6e8d4ad17c96dee6484e8f0d4d820811309b2a267dd9175acd8b62ccf9b8334308c38fc9fa608d46a1528c9ee97eba0e63c59b77e5ed4000000074a91d6da763282ded67eba78495dd6f5e448f7b7ce88e78fe8c94df9dfaf9e9b28c9df219933952725f8d95588c1a74a840a5415ae14b0abb8a6cca961c332a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426178365" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bd0d6454cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000a7b46863776f18d5c535592432e65edc41ec213adc4cdcaa3224256f11e248a8000000000e8000000002000020000000bbfe45512f084434bb9f0d80e3b321aa349badb0df61767a4ef2084570f13f8120000000e44f760b2313ae313247c8ad9e493bd49514fd2f4cf2cacbe2a5dbc305c79c05400000007ddd3418c05e56315ef1d4eebac04cda029c68b3c75e1514b54aa7462c9c14c895b0e1d0b7b93a01ab0c70212ea406efd36f8ae9e450539c52a10babb3bcadf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F62B231-3947-11EF-AFF9-DA79F2D4D836} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2056 2020 iexplore.exe 28 PID 2020 wrote to memory of 2056 2020 iexplore.exe 28 PID 2020 wrote to memory of 2056 2020 iexplore.exe 28 PID 2020 wrote to memory of 2056 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22ac335c50f6f03d2c3ae3efd96c6596_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5187415ccfc7fc2c00fcc9bc19947061c
SHA1062973df04a03b3bf9699b7bb2e06a9f6ed1730a
SHA2566f8db63d17903b5122650323ad415a6ca17e92cfe42ac00df39483d113482ed9
SHA5125b735f247955cd70e01c8a2583525bb8d4acabdeffaac9c832ffefe798edacf76c7a90847f346c0b511cfd0960dc41d029f18f546d9a8d4071685e99984b05bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8e6810feb21a198bb10a8945b2ddf31
SHA19d61ea90dbeba0ccc95f0ff68bbdd1a9d1084472
SHA256e88cd67a848d2ec1a7628339060e9bb861284e1bd25c36e2f28165d66a34cc2f
SHA5125d46001a79f8f54911c9f4272ba8af0e599bbb9d6e22ee136465908bd35bba3da744485a8a928781463ee0417f79e55e5c2b907a72c3e1b6e27493baf5d3df12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a2fe6bfeb24036338176b53356cfbbe
SHA1595c33c35969b1c63df90bf517b89ba21e6c2def
SHA2569284f4b846e3179f5112482d4da32e2fb96756e8551df867e9061127dd0f3535
SHA512fd18a67813b6720b639670c6648ef2d67a441bfff70d12b9e41b4650135d6bb285203f6271bf17fbb9f05e5159c0959d96b6baccd4f5fe84fe97b97c9042e4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55209e932111e2036dfd55aa22eca5de3
SHA153f0ddac5ba343e8e9d0dfdb331902dd1994e6ff
SHA256861838c254f012582f84f2c12979b54c76f3c9f8beaa87f0ad747421a73b0e45
SHA5125a62eded0d2eb22a45ae6f7b1b2ef9fab158c8a1d96b81b6f56fa58efa7e0dcb43dd83f2c9cf2d0a8eae2599663c6140345ec0f6baa8c6d46ae76bc4fc97b836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcbc03b3013d32a6a592ca14f226cf7f
SHA132aa30aca13318ba96d2b1264516c37ed54382b8
SHA2567fa2b42e06bd9f1228f2cb5d5824c8683f0f88540d884da450363e6a32590620
SHA5120e2a1c64e5e25b9adc2a61a93c429a2a5ddc4dba87495d7384b8f4cac29c83203bfc00fb3e32e56031acf8c6d0df254ffebda2abf65213539e9f4f053993b66f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57da8ab82ab4321a9c906d2df6a5d60ca
SHA131e608689afa41bb19f38cd06520e0c0e545dd6a
SHA2568ad5f1bc03063def710f19031968e791bee2dd0638289851ae92b0ae62320af5
SHA512085e265c3100b212e444a3b946187f0ddc7d75c37e9b762011adef500a51e58c0e5ed8638c6672100d8b3cdc98e44ba559b1287049a6402896efdfbaa1916d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a519a43226b807e248b759401c8a5c58
SHA1f0a6bec1cff331b64f304e83ac8bc7b421621214
SHA2564609f487bc8e6a0245ddb30bacf759281ca1158806524370d526e374b47f760a
SHA512ed95a03d9d42dc27b123c612f0378a42660b2d45ba9da75dc574bacd2c8ee65200896090079b83cc2df6b9bd43f9f4b6d02be3884df100dda469981e2748aa90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d71dcbb6e893cb86404bad7263e10d
SHA191ed675f69a4cf33326a228d89facf1ca9047b46
SHA256fad144dd28f6b279cea3fb0e893c738cd48bf2674c4badb722d663f9f2feacf8
SHA512ca17f17b673c1b3e8830a3273a5cd32789f1afaca8a0a6507907ead6f08f9a639367a822e578d8544fe4153a5a2659f12874552cfa93f4fc402b6fe67063a43f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5386fa7853c8a47506b959e778b6038fc
SHA197f035982a9810bb642cf2764ee8a59e617d3643
SHA256ad07b19de306030c91c63501aa8b6bce00fa010bdd0c425b94fddd07ef49ebcf
SHA51226935d959cf720c04bc874ce80b907d05263cc4a653ecba15e2f2c4c03f8a6ff1eb2f9f3773bbaa76620d213a711c0b3ac8a2a3b5e3f8b1924a37cf7d2da6dd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e960d0c996c0fae56094211a426649f9
SHA1310eefefe4e415d5d1b16036cdb5ed5feb2854ea
SHA2562794b50f810a4ec42fa1219d7c0488ab3ea183c4619995308f1165fc35c56a1c
SHA5123525c6e9f4add4a640a99d0eec829a4d9d55a4ca9e60c467e2329154d2e08c7ccce33bcde7674c5d49fb30a5e4b9a2f8291c8ecfc4b95b1ab1a2cedb1b6326f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c68b51c3c240199be9d292b1d087b318
SHA130cd9e463d233aac4063cd99cea7596ca8467cb8
SHA25668b4130ff802373db71dc37c78b2475136a8cfbc0c2461214c85e29ceead3173
SHA51291e1f95f531a8e07993449d43da3c1a0ccd019b0f6a92d5bfacfb42061227ee01e40527edfc375da3a5211d0fff9c79ee2e92e1edd8085a1e71db935b46fe548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532dda6bc680114d96e7829c5e69ddcc3
SHA185f9056c7cfc8ce80f0e0d96917168c0deec45ad
SHA256faaaada2c0b47230bd8e1d58af05f71af4656944af9258c8dd23641b966b7bc3
SHA512ef0e5b9513ddd0d053168bdfaef1ebc39b3e890541620df789a085ab0ddca3b064d67c374ee36e32df3d346f5faaa552816c142fadc315ff947eb0c233279b7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55aa069a1151f029189e3b03791146d0e
SHA1c5f0a4721c714bc1e2ab40a7ddd659f7b1e40e4f
SHA25646fd380b2487d22033005a9d0a3c1b79a79d5201bb17df81dcb3ef2580728316
SHA5126f2356425fdbc2f8fec1dba6f53b7838545f0980a6d9297ed16592ae875993dc817481b4462356b2c59b5f0963c62834c16f5c77653e9d1cdc695ad2ca6ff1e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586750c475617f218392f4b7c09c000ef
SHA171b06f4528125c93edf5ef0e3ac04798be19c549
SHA2568db6645d747cbaeeaa098ef5017f9ff4a76230715abbdd5417c854bf2dda16d6
SHA51233f68e913c4ce1048174a1771f00bd6ecb07f49a2c95440ffb6859c410fc099c894e6c44987c2323058257fd9f6b6a2480ae3b524e44b03ca127351f9ca8d2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acfee108b07bdfe5574b1a04c5a5e10e
SHA17abd06b8d64941e8b576272005a8cbf478bd05c6
SHA2560d35fcdc59a5270b95c513dce0b939dea88aea67397ff214fdadbc76f6c15c9c
SHA512eb0a2e40eed10797bcd6c57652b3b848e9f4cf87af1bb95df1e720fdae96dd187dcbf5c2cca0a59a4b9bc526ee3fa46ea46fc703e8e7cf290538ea54f43a2770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5210c655334fe5252b1c6614b477d5a45
SHA1cb9f50e4f0969702300f0c8e0b765077d17fa0ec
SHA256cf4feb42122705d55e3974783726c503df38a6f07e5c7aa16991c8d225b2bb1f
SHA512f0b4f911311bc8b859b7d62527df73d5d256dc26b6447a4c62803967ea0b388ef6da31737b61beb95f72c1d834eb004d55579ebd1f37de4a01382fbbbb279ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5941c378326f0d51869b48d8614622590
SHA18c3a109fe14c2d9bbb8cd79a93de048708d97b72
SHA2560b4f47a909240aa5aea2e068dd9ddd5637993f0ed5e274c91f70866e9484d5c3
SHA51209e621396b0555f294270f656c470eca12776a94b6389c41ec7e07af83d54cd21364aad435a81465a8396ee21c1631fac5a19d27fda2346ea581aa2ef9dd5bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55185de5114427fa537138d2352c22fe3
SHA19cd1df0711f1e4239adc3f8391134e4cf43968fe
SHA256ec2d672f30d1b46a26b9689600d22f33e6547069b51a6e9dd078985c3e4307f2
SHA512c960ca56b4122356f5eb15ed5a0a9a1cf3de54333c7a236b59a1d83fd98a8badbcf33cc14798ddc5cf33efa8a86ac574283f335fa8010081d64d84b1f882ec42
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b