Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
1719c4a896fccee179f360ce6fc58740_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1719c4a896fccee179f360ce6fc58740_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1719c4a896fccee179f360ce6fc58740_JaffaCakes118.html
-
Size
2KB
-
MD5
1719c4a896fccee179f360ce6fc58740
-
SHA1
d1a3578e7d54692eb67d00271b287bfac8814ede
-
SHA256
caa0679687b31bb44bcb587e5f48cc8787ae25c51040a8c86f6574c83df4fe1c
-
SHA512
7c924f0b2d80b6de9c69924b2e64b25a22d6c441ea2d7e2141781fcfc6bee0dea6a6c8230fb6df312f66092bbebba987eae6d8ebb2b31a988d9ca3333da1963a
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417844409" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b496628881da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DEC1DF1-ED7B-11EE-A5A1-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004f6171aa1a23f2be3a267696df6b2128ca7886b60339bc0ad333f4b413c3ffc2000000000e8000000002000020000000f8ad4b4bd4eb7b4fcd0bfdde107d6a4e5bfc2db4952516cb04e36af65485657e200000007e7ad4e8cf462dd0c0b11bc00cdcdd7cea1ccb9e330df2dace7fe16d81ead6d740000000c8c7dc1e07e8b1e71d7c193f6a788bfbaabe123650214054d0bc903ed14ccc0fc8be2b036c0043f83edd3474bbe1828b613a65c4ffe00fee5921bb84c2612db1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000462f5002ca4cc17252fce45a960f17cb6f505fa1455c5e670548fc2ce59c3e53000000000e800000000200002000000076e8e84d8a7fb5b7caa4c5f9a9954d99a5cfdb3f119d03751d52cc8eacc0d9309000000047830c77c0cac6cce87889860a4a75926d65efc88f535a5b9507d0e76beb4f26c8ca3a44f972db5ee8ad8c0dc0e45273040810bc71bb8256188546330ed8fca5107768a2f3cd127b66e5b379b8e795390094da42b14fcc3358643a79425f557d3eba7fe3206035dab22ad88ee9259d46f8abc27d1cb66b57a9061090a6bce279769e6dbfb1ec46de1bd1ee4da264897440000000e03c02637ee6c32385c7e06a9e98d03e5c248f463c8ab5f5638cf81a866631b81b25ca0a0ca89a9ffc4431dbd13cc1509c9b3064d7290be146f327abfcaac18a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28 PID 2008 wrote to memory of 2204 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1719c4a896fccee179f360ce6fc58740_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ff50535e4418428e8d068ae66c1bf46
SHA1d805636f20af078f9cf5cc5ae39094f0d7779047
SHA256d3f54c414ed8fedae8998323f4c911bb237c5b60a65e00d0fe64912da8b60968
SHA51219501f04dab480fc2f8ff5c9d164ba158fa1d9d0d4464f55ec9526376ce8064899a7b8a2f3ac67f84ffb4828d204475652b71bcbd20bdfdf11bf56d02c556c07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a0084ef601b7350ad95aabb5773d12
SHA174e9f7b5451ad948fb00b8c558b385480333535b
SHA25689113d9b70b33ef4363f1bb6432400c31ec44d781bd3b6c19a3ff795250d7337
SHA512d7c9e15668829ac9be713dd1b195808295892cc37b11e275f295463a2a336bc9013e4d7c846b7aaa04f69327f3fdad340855d752fe2fc7013074341f84401b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5997e802f4da0bcaf650f5bc25ad1c22f
SHA1b3f672dc893ecdd868a87eb4418d8f2769040c0a
SHA256539268b2209be5b9e65ecefeb214170e2b95cf9ff29d47ae36222d6e765ea8f2
SHA51273c697c38f8600dfae7cbe4f296e46ebea70c97c4e4e6af130edb8e90cb3f138b7ac800c631942e90888a61a8d0f419455818606d8ff50ba27aee349c21e1391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2fdd2a5c90d6fe118919f9588a57a10
SHA1f64c03e6d89122a20f5e00fdb6d7b6f77d85b7bd
SHA256f798b037f78955369742178aae6d0721dc8afdba3f56fc6a467711ef30308ff8
SHA51264d98e5544efafa77929b6971a7fd3267fc13c0ab5b957c85c8045c1050bf836d5b0f1405f283308075ab5adff8f7d7a83d2001d02775d9dce9dd4890941944d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4b8743a99bc3cda9b70de3cb5e0b567
SHA119bfdb06779df920d58d5f36e01d0c7f86e51dde
SHA256af50829e87f14e779347853f02fecf7fcc2c39949adef0feb3c7bf0afd981e4f
SHA5125d6ffa3dc6ea8b77ff3eafda5d54e5d353ccf51c3f244600ac4379dd9b5a1bb918b2a5252d07d9d0c64f90418105596dd73595fce77814571f08919f18d7aaf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a01b6cc3ae1dd972e1128937833ed0f
SHA17c9272dc981482dd3747eeb11984f5376913e97b
SHA25638c05a873834ed79c27e738fdc6b534eb3d5a66b2fe5b6da8c6dbd9746d0b863
SHA5122f97fb1e282cddb9b35cf169722f7fdd915ccfd8ccbaecee275305baecb00741393308b166a6a46ff99f60d5a2d4be41923122e3989d87806145a800f40b09de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e649b057c3db39eeef1ee3760cb72da9
SHA1a0570d37080fed9699c1d7b6bc126c62377893ce
SHA256ffb83f8be5cdc16b623df7e83ea731d54b42ccecabb388f092a184864e777818
SHA5129d7fde5aaeb7fe4653bde26a92fa37411f65a25ff2110748fd2c0106c18503d13a63f5896286279e743a327ed8285bdbc10062d4529fd0b9f5336787d3c727c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cfd80b74f4d7d0cae7740f9bc07fe59
SHA147ed0bcb427cf5fdca2a4c60e9b56ea494e79112
SHA256d42b01e2ec0883b731f296abf310da6a79bd9aac679b61968a7419ac755a1009
SHA512e8824b1b63a21b74dbd8b73e216ae0ee63b17e883b18ebba084f3992f184179f263e5589ded0036d7eb993eaeae91c756163895f35d24b55c94d47f394065197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51510cf0919c0695112b8243a2574e217
SHA109e10f45d693ed7c4d99fd7f3159569c9bda6110
SHA256ad710d0d33e42528e39bf469144ac3e333714c4d52525462079ac8c4dbbe0cb8
SHA512b1e7e8ae49636a1e120fe7e30b2224977776e5f25f88b29986ff3131cff6f391a602aa132608b568dbf602eef88523899d464ce1d871bd05fedee11cb6b9d034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ff51b0578784fb3b8244205bfca6eee
SHA172d7a50cc756bc6f306e7d3311ec3efa7ce82dd7
SHA256238a246e3a7b001c3e0418f79e95c061dee012d4dda80719490f580927a08438
SHA5125489358e537a71df760391237bd2b524b5b7e159b588ac3f17a8bae089e99ede3c6461a728c80d10b634bf7a53c76f478e47477e27824c96b66e539f97f8fdcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537364af43cb6a123b05b61384b10e449
SHA10d4a8c5fca7553098318e2b15b91381e6af415aa
SHA256051516a4dc15203f35549053005af03d4a9b10dd4c9ac117ebbe522ae387f386
SHA5120ed15938758e6d305296541723485ff658901091e62ba7124b1746fa70a758888fc278f02c36755da87bf2bd14434882b9c5d6ef50cdeaa554f8f17eda8f6cec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd53175c5aa32fb0e0c79fbc9e72707a
SHA12e118987159f2b4b7e6015ebe1a93eb98b5b362b
SHA256f552c761ac72ad031ca26ec2dcb968b280d6e72cd55677d666c76c407c20c2bf
SHA5121868bc4b043b26444265c221457a1d84b3780832d21b1503b2830741c1a62fa4f6c3285ba2e421e1635f8eabf21a005ac63300e1cac7f1536bc0031ca3492920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6b3d146002dddf48d8fbd94130939a9
SHA1565c4db93faedfe31252004fc67991ce954bdcd1
SHA256877f09e378b6cada8a896d5af2930277c53acd911511c8bbf02afc8e850713d4
SHA5129dac78c740068d8187d7e6b8df032ced43305b7f146a58992bf549ecf0b3b1881fe8224f691214c46acbda2dbb888cfd40d8fcf80b8f3ddf3fdb7aa565d21420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536f02dbbaa621bb9fdcff14f9b555ac3
SHA19b9a712d34463da071420b1eb1822cc1630ca281
SHA2563cf272671d69191eed63b346de3dd79d0d02637e08ffdef25cceb4a992e2d968
SHA512bac8c3fd8d2401bbce26f9da1032982fcd3aeefab6b3b1249bab3f60cb19eca0a482ea65befa1120d1a446d64a8532694dc9e9e792f7d1c173169c465ae8d67d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e064573a40af3897a61db3ce4cce321
SHA1226001cfcd29af53a3d9b943d7bda01c415f6fd1
SHA2565e72fe3d23cf2a97b5944df4947894594ade97ff97280455498bd9f9dcfb4d6a
SHA5120352e0fdc574136abe6974b2564a1183431699ceac3a239ba49aa76fe94a20bac341c5c858131dae00491e3c13fef673877230b374553db3f2d12e77c2e814ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d896e409b5718d3052f3419bdda20bd4
SHA17aecad322dd77ffaf2fce180f7dbafcfdf2347ca
SHA25631da223e8f5e7593ce6a64359477b2c6691184ef6e970ca7a9b06368c41d428e
SHA512363ea73f1aaa8a65aba2994739370b50501512ef7f1fcf1fc3e00ccbc142ded04af25ef3182bcb0dfa6ed68304c76562c049c993e75d65718f0d037d3a7e6893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5265728f31bfe059ecb0152a168d9f305
SHA1aab0a5125350c17eb0a79685308bda03ea8ff5e4
SHA25620a0d1491d2fc16bfd8d0d6ce5e516029dfd4cb591b7a15442aea58dd81d7daa
SHA512bb1112003c042c7da1fd05c9660587d99d2754c72e6f8bb623ee870044fcf35bd64855319be68f6ea75b41343836076f2fe0adcf69f83f849a2ea3e94449c216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52230201f1da286afcff587b5e2481878
SHA18a9e911af034f3611c744dc35baef35439ac00ec
SHA2563b70969bde929182c35767ca7b38011357d8ec396615aef8445dbac4d4cf11a1
SHA5122a8e2c533c04289971c707a2b174fa190705681ccc80441c6a47dac64bb6a55820ae742ab660445e6461d39ec0c8eccbf15f1b84c39ee62068c1e4e3ec3a2b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fde1860f1c11b0347d77014db7016419
SHA1c27447014920d1e8fdb535991bf02e0b5e3932b2
SHA256b6023464339c7b8221f6a2f2902ac1a243c6bd9f509c14b457f0fcfae3c8c3b9
SHA512c9191a7ac399155509271ad96ff0bdc2d2b3cef7fa75ae39f61081907e08f620c55110a3c27dc36b0d5448a2eed0ddf38fb1d953a91c6892de2b618c2315a3a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a