Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
11bc5011211e16970a52dd64e42f6147_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11bc5011211e16970a52dd64e42f6147_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
11bc5011211e16970a52dd64e42f6147_JaffaCakes118.html
-
Size
2KB
-
MD5
11bc5011211e16970a52dd64e42f6147
-
SHA1
09d14e4afaae76de7d4f3e4db94639c29b51539a
-
SHA256
d7c9383478b46350cd0dec4106dc941ea342c63790f9e8dd81b6a4b4263b928e
-
SHA512
a018461129072f20e82f9882eb7432a9dc7ec2741ab5cd641b98b789df073e719c1dbfc7d5308ce34733639d69ddfd16f780d65bb396c29edf1e6c781b7a9a5c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{376AD9D1-ED53-11EE-BF93-66356D7B1278} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a068ad0e6081da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007ab382ec6bbcd5e125250b83e1b3abe8a5692590c57150666974f6bfa9df3d90000000000e8000000002000020000000c2a144c3c9997915b616d7bdc1b9b5cf4cb2bd625bcabc0c4e6ce489fd39d1c520000000a5f8d11805ed65a11144479aad4c7ed56e6699d32560148b23b000c27b3060484000000041dcbe7a5c0d160b265c5efcc204cf5dfa400c66c4fd592cddffc95c97c2afe1fefac923d4f2878d26ebba8be55876316be904dda95539a738e1a471c9b73e19 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000068adabaf29cffcde3d5de10fee934b689c71c973e8d32b4ae9c45a0d7634936f000000000e80000000020000200000006023ba9a408039675e51637f2f9a2b20b6987f20478c1d90fbd65c23ffbb45b99000000021af18bc5ef7d8b34b8b52cee0dcc4eb9e8d610d43ef0c9c130a0cd97a976003c64d3c590f2c6182764bdc2816aecfaf8dcf38cabb1416093f00b4bc34be09f3164ac686d86c1aec05470c74aca1074bfcbcbf877d52c5783499ad4923bd3f30822127bbf03a0b71fcc02b5f52cb12b2f3977ca9cf58d4e2c61dfb00e7d02f9fb67d357ebd46903328a8aa91df02e98140000000d6c801c95aee9a96b4f6d74ab25036a60af7a433dde15ca04cddd1819c628eb8f75dd15b85fc0cadba43b11f44598b1bb01597a8b07182a6cf16ab9f00a7575d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417827086" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 iexplore.exe 2040 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2036 2040 iexplore.exe 28 PID 2040 wrote to memory of 2036 2040 iexplore.exe 28 PID 2040 wrote to memory of 2036 2040 iexplore.exe 28 PID 2040 wrote to memory of 2036 2040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11bc5011211e16970a52dd64e42f6147_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6b7a37a18fc411a8107efe43b1a3425
SHA13fe89da0a38c973a1e99018cd2fbf5cd11a49260
SHA2569a5ef6b2535f86c09e8a2ecd5454d74f701ed18af0c8416a0d443e87c88bded3
SHA5121d97104b5097d0300c77a2fc0772e1839c1153e84ae83a0c6b22cb19633d560ecf6fa2ebaf80e2526c5a17124868564c44552b5c8e31f19523e53414bd44f19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533a53764d1bfa87119182d40d9070030
SHA1a878ab9235b8e87b13fcd2daa165302493629fac
SHA256fee2e6556519345cef893f6334b66e81da6e0c56f40288dc0928e20a7dd61908
SHA5129004be3daaa688948c67494b3669f76ca30cd9556e7bd06e96ed1ffc87972f28f03004fe9cdeafb5b5ea9c8d90d5f70b526485b66eb2dbeaaf13e44bdfc4339b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aede46736ea96cff28f39c1942cc34d9
SHA1d330e8838c9d6ac7e9d41b09b5b294e1eddcb2a2
SHA25695e048adf47b439dc67e7298cbc5549735398155e34af07edffb15e88826e1fe
SHA5127dd8b7c62a759f1ec3d8d0eef2ee590a62ce363c68d352fa73f0b265bfbcd3caefb06fa6f3eafadbed937b807124af29531280d6c29f624abb13481f2bd56a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5617b39c565103a5a8a75f64c92accd87
SHA1e471a153a32c561169c02a956a92a9b835579920
SHA256973fb9d0413c5903fe71eb67ce3bf491924f41673110584deea522cd5b020afe
SHA512368d02f388c444ac9e3ac41fa6588b06f5e19c4a80c321d69181b6b0d6ad989b946825fce96efd4a1e73bb532ab9cffb2cdef5940d96f130d8b43789f8eaed4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503c6000a31d1cd61181bef24466fd922
SHA13e4699dd39a73e8ff52680af6bceb24d4718c355
SHA256c4ce1929f860090fbde0f5c4cd910f5376dfb674bc18937017422d6a9497c112
SHA51268ce66c2de559b759110cc265806004906011ef007ecbb3b95b830054d07cda34a28ca1dbb2ecd68f5d70cfaee9a07022eba84ba49de7a578c863f44c5aa9ab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54871f0ac5cb0563ee7681eec33577de5
SHA1d0355cc64eb5fbef8599c303eea48600bd9c272c
SHA2566f34d16d25d6bebe6f25ecbf199dcd3a162c8108c39f4e9ccf0866f784d838df
SHA51265f3111d590614bc52a52ca9e1ffbce796276ac5c353f072c1e9d5eedb723ff783beeb9670842266b1041a39f678f8c341f38e11c43ee71e8fa96e200a85ea30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ac3a8d733696686bdff83011f8985c5
SHA1732992c6b337216b7d3a2485cd63008d293434a1
SHA256988a23bcb5f60272e91b49bf433ee7b0a70ab2cb87bc994e2ed0c5d2e704be42
SHA512182c79e31ebe9d3c53370f99d0545faa5b5158bc2415063859cf5f42b15aa254b8cbd06baf6f48471826dd92e360db90b2173b36cdb86caf7ca70894cc54dbd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51508c3904d8fcf9bb3e74e6a14541b28
SHA1045b7ed5de162a79ab71759e8cb5196bbc8118b9
SHA256a4e13f0ca854f08b137a5d6f79e570945dd9c1df5283fa5f181502a72ba95975
SHA512eafb9ca7e270fd0da607c8b6386066c01a6f28c8fc5c70ce09ab2775525b20fc216dbd0039846bf0cadbc96d6a703e18b61cb30b6ca8344dd5139b05500669c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556a71566038d6ab1f2095c63850cc862
SHA15d6f95b334cfef216aad8573957b4b5dde3bc1b1
SHA256b85d7c03186d086c4d557beb31f60477beb82286598ba74e518357455d8a78fc
SHA512487f76809010db29f1483dd69ee4c2d5ae9b7779bf47ac367a00f10796fa71e33d46f86a5f096d1c2d4beffa40ece3e758ab70574dca4252703902530059c4b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4b37c20a19bf2a309936e6ffbd0967f
SHA1e2a640f2713ef27673606bb15a1f9d1577559c75
SHA256cf0bec64609842f3708e62cbbba0b14d4d30ccf1342a8a8a713f5548b45e6b5d
SHA512db91efce0f6f580b8ba574316c0d7597f125e9e93cedf4e746e1a7c2fe4bacd8cc015eef60d3d55bd6b06083d73491375de2bf478dd6bcab25620dff35de1b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eb7a46685385764e03084f8f57d5a3b
SHA1ca4d944c21823efde3c7152aca8863eecc991e63
SHA256482d79841fb662d3a31f86f2a557c48081879f1a6e72be93156bdbf48497e1b1
SHA512ba7df17cbf1ec2d295a5ed03145c00a4e51622f00cc5ceb63cec127e8a0a6d18d6ffdb7f617289c0a2f11842ae3d946b7c67f54f420b5830d88268564310e106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fecd51e288e680e843a922c41c30a86
SHA1c8a5026123f60bf68b2b65531e128a2a24462728
SHA256270b470762b15fc61e3e12dfd858019d5e4cd3ed6681453b7d831aa1a0ce2f2c
SHA512f346c4848e39ace6bf111d4ca2c0e22663427420e1815ce0ba1654c896eb6dc651602cb53ed87beb4038b32a8e303d61800b98f14805f752d951d5d19b2015dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0dc27555214c6c34abbab28100780ef
SHA131203b7473b14a5d13f9a04a2f978c2087c8f6de
SHA2565f23616bde18bca9d2ce62dff5e350ebe8bfa345f178bab0a6d32b09c042189f
SHA512d2bf750616287b8e1b68de219dd5e43b5a3476df8de6a0b7706131f22408d715c589636c6d5e421de52532e5b09d00355b3232321e90524e029d1a5ad3cea40f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7dd190444d28a384927b23828ea227e
SHA198b2c82c5958f58b1a855831939ae0929be14bdb
SHA2567a24c3e4a90075ea350b571ac8205273d10311bf718c9b880d976930ab51173e
SHA512f6f99be31b5e8c2943d6186c6b2de3218de4c02a143b0afef15727635cbf1f08c68ba89ae11c477d6fdda6f88da949e90b1f9f4b2e7a2f82c13c790bd123887e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53055e67615403ec9a5db0c1a3ddc21e0
SHA187c37e63465bd5612a9ec5e186630f2fe24cbbe3
SHA25664b87bae67a926224819164764a1657c632a6762340153a150dc994900152333
SHA512324d90e7bd2900534765676fcb7a081866ab36e7d6f449432190bc49e910087e8021062470d530a91557c963058ddb8acfce4333b1a459f7d42021c781aee322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8109b34fb05a787fc0217f1a9e58cbe
SHA125fda09893537cd56078e47029d24d62fc272ff9
SHA2567dabc8c4e4ec2bdffdbb4bc1dfe7a3f496797c9f4aca6e1d21cf00ad20b48fc5
SHA512ebec6ddc130106703c8b009f4817ca5ae2db73a7263aa9627f7f694834efed703fc6e920ff0cb4d60006e1a4e47f7339f8525959e5f02c697b7a91dfe3ddfeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f1557449e97792352df98edfe15b543
SHA144f0893f7b958909da056bc0c8f0ff833d51ccbf
SHA256ecb1c31a80e390d8cc6e0c6fe679b31f25263a317e6c39a02d2b2afcd1df6a7c
SHA512b28a51314e2d5757e4d95919715b0abfacf07a2e6f2950eceb36833f5ef533c8cb089dec950033d1693523436a3d40d981947b1228a032443a2a50739e3d1aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8f047b7b1db4406df52b2cf3bde7d92
SHA18d2184ffe7a48825287b1dc81c57e7462caeee62
SHA256524721d8159365b5f70dd115fad04f388a67d2dd0edbe833d20d4a8b24cdcd33
SHA512c17e1affa757dc5198c80337c8881738fe8f56cb14e90aeb72dbc1e2b5eba240ac19688de329bd7e07a1292ac0a724ef61cf320470ace002da90449064e605f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cd8d077750a845b48073ff55c439ec3
SHA1ba3cad6711858cefd2538a88757fa37d87c5de70
SHA2563732c6d114347226e186895bdf0cb7b8aaa75d8f4789feb27ca8f69e5a714d20
SHA512ecb8f454ccc487eef1959f89dfb8854c9883d17b5d5091af3f94ada61e14acc405cd1c15893edac7e4bd35a7ed3d91d1b97052f7d12de6117e7e4c8bbe242948
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a