Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 05:30
Static task
static1
Behavioral task
behavioral1
Sample
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
-
Size
1KB
-
MD5
dc70b9e03d22d473d947354499fe4f64
-
SHA1
24b0fe13ccb3dd4439912f2dbd5a3e64f17c0c6c
-
SHA256
76004c42fc5e907d9263a3d33270e4d3e78671439f21ac3e6e85b2dbab5cbfe0
-
SHA512
c2638c8ca8106d8f0ecfc97e81ee44a126161d0147189d4b9afc63084b14780f8501ce1ed6d59f0a5d9bc611e47c3b4b752c75932f5d334cd764b94f339cc771
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418543323" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000dc88fb37079fc780e291ca7c04f97ed46c833d0ac2e38283cf609456e7b09e07000000000e80000000020000200000008711a7c3dacf06391da0fa90ed73c7e9aced18efb32b11fdafd40b8d0816c77620000000e86915adb88dda2487bddd31667ec44a2ef40bf3b04c4fd67b657f76e09f0a4340000000d544c73737fd865136cf49c72d5642e31fe9241a81b21ee66d69ac92caf0f13cc45e6215fce3e7e12014c179d2bfee5090a4dfe0146abfb479538fd18821865a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D73260D1-F3D6-11EE-A30C-E60682B688C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e4c6d0276bbddcb16194a0bb6401d50ea56fdb94f3af816497dd85c079e35a7f000000000e8000000002000020000000fe29893ef65e27dc2fe9cef269a4cee182cc5b51a6bcafd2368ac76f5dfd5d2090000000315cc6cbf099cd802da9a0fa4b706232a849e0dfb040cf62c4e2992c104d8e951fafdf61120e55735ecaa0629e32c8fe5a3c08739cc7feb7c3423bd49c55ea7e1e13d963431544b005ef2968fdcbc83e97b372ff6625113f275a60e48c4b470a171640e528a6ef60ca1e40cb4b37ee39b8da7ef6766f87e5674f39fc121a792e551811a2e77a4e39bdc43b11ee3909264000000056e40d3693858dd6b07c169c47e2f49483a9d1c8dda2bd4dac4c871e8bfdeb1315e3c45735ea5998fb0858b1494aeb6d06d1931d3987e7300a843bea52d89511 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707f94ace387da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2536 2168 iexplore.exe 28 PID 2168 wrote to memory of 2536 2168 iexplore.exe 28 PID 2168 wrote to memory of 2536 2168 iexplore.exe 28 PID 2168 wrote to memory of 2536 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53393d4f8a85f917b15f25864cd674665
SHA198ee2bedba3ab1fea4e5bc260615a22380f977db
SHA2563dd259b5b8ab3c6df02c9adc96336504f70c48067754a2d932e96b7e8306c122
SHA51252b2f2179ab46fa8aaa78e04e33d722bd720f0deaf4f692ca3c4d06e23b3eef810e1d71c63336b13205f0c860579974ed26b1177c0eb54033f648be34cfb2660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58afd121510732913628f6fd6abd3d1af
SHA194f918d9af07e2cd02e13b20f3d0aa12df8735ce
SHA256ff554e118081a6ac8ff1ed311d32f6235bbf1bdb4d652a629726b1a3f6010f25
SHA512ba3a8d9d63ef06c0d18e376c12a95d13375be34158d31dfb8b85443a856f0104060f8aab2ae26482f82e196538f0a1efb2f116349044d50c7fae40d891bdcc53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57af896713991d38c1dea0928d44fa944
SHA150f27764e5dcc39919f2209379280319f1dd9487
SHA25669af26b25f31bb3e5b30452806fce0cf62e300301ec42e38ed827dc20a70cafb
SHA512b6d85a8ec971d12d6cfbab6f55ee15804443765752c8b93777690c20118567593f6abb4cf2fdcf06539aefd0d2b86aa94167d04c0358883d9b482f9ca3714d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ffe01ba9db88648c7ea18ea9dd87c3
SHA1381b91a2ff27e2ae921467b0484d77eae64903ca
SHA256fc088cd10cd7c32eefdc8b4743af17aee13cb660f246dadb044a7afd6f2e72a1
SHA512a6f44db97d1b046a6e924c7daef5fbf2022d7383dea977ea7546516deb1bc2e2a8a244b2e802cded3b4b03f911f8b1d518f598b26bec91a9dbb1d74e82264b86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb89d9e3b79c37c1c231ee5cfca8f0fd
SHA160abff46bfa26c4c96cce63118dc721e415fc7af
SHA2560302c9366b5f791e1ea7b0a0c17e19140bf2785c301d2b426c32122aca752c52
SHA512fc7e4afced6451a9b5de19f8603ef4868c2ee2f81b3b5a655fe078c98a2e10bef426766e8068872f67d54745b84def0fe54b2debe98cde2b32e82bab79e42946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a2fe2cc837efa8df819e21a374c73e6
SHA1e57f2187d9acc1b1f880f047b265528e55e899f2
SHA25641d478ff52ec6feab74791a0ab3ffd9b86afcc105585eb9eef118f751d83ac5f
SHA512fea576b76eb897acdc128ec5992d85e97fedb8d5b9fc58fb08ab2b79f17a827270552c4d36025c8437fbd43c406d97c958667476b0d8eb6e8aa1157a4695daca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e37b4febb16695798ead570061767b2a
SHA1c6be8676456463c2299da2e71546988bb0e44429
SHA256d7dd5cf64574ad62607d2280e435481c0dc8bb3e68a659963871bd3f9d1f9945
SHA5128804e1d86a53e42a941f13de8cb3d7c8917d55474aeb13c167a436b05ad4851dc1086a46034b11cb24c5705d6f72238bfd83d3e189f72cbb5b5d6bcfbef4a166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a951256f71b9c7ca492da88fc343245
SHA18d71abf24a7436b69f430eb670fb32169baaa1da
SHA256fa5832747555b9279d462cf2d03742c47f51c43ca8a8edf2e68e3dea59b92dbf
SHA512c24cff34dbf5a18ba178da82130e3407af823aba17ac14605f6d4907bd7a108da86bdcb780a1a278a78943aa307202be0cddce68f5170bb84a1182bad7abdc9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5889e3559c75f1eb1400d5ec3ef9a7e78
SHA10a687c03c240fe4f3d635761bd0674e74a63a9d3
SHA256162d28cb60c0a7f12746daee0c3f023f3111b8a48c4f7d0efeb01fcb001c91a7
SHA512fe4f3eca57290c1e9812c9950f3ec7562641de67eb7c455d8b71032df727f1c9f4352b877221fb756920877ffe457b5a4074958d6a2b313ad4fbfcd9526b3393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d54a1e41d0757ffd61c6bced0178464d
SHA13bba151ed6cb2c81a2588d5114ef76da79aa2e79
SHA256d858f14e755708e55e420e2c13df24181006c50d4c9677eefbad8342323fc4d0
SHA51265e170c3d95ecc25c416eed13d498c5dc7eaad9b44a8de944b3fbd23a1023d9adf478abbf185c1b49c7cbfc91cd3e3180ffb4cb15b2137da6f27e13030766494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbccfec571ba66c90688176d16e8ad32
SHA158b1c57786db871619beb50c950f68f4827a713c
SHA2565d734332834eee9a47d26dd77982670180d10e243238fa712a763daeffa6948e
SHA512eb5e5f5ac793d38ae440fa1a9d0774301a3cd8a72432f9a9c3d12df3af617192a98f13031be1ce91061216d1ea26280de29115c3140b63742420ec3e1afad19a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e2751f13e03a131b961c60a40cdeec6
SHA16dcb55da9c7356bbaa57f7bd32e72ecdf5ec4f94
SHA256f7c6adc15ce07de4d72acf39eec6cb540a66c48c484b81f3db6a24233ab70a05
SHA5126d146f2badc919a6a5a730a41ac10e9bbccabc789873caabd79d88c470710776d7a66dd8b8e8915e7ca4165ff47f693ec8ae4147d2a5db535c8d77284e709ab6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5293886aa45c77e12693937c328bfdbbd
SHA1a13d8b8f468eccfbc6bc368720590423b7b37d28
SHA256c2b8ca3f1f46e289cc940fe186b00813ae4baa90a7bb8f26b37e3b104c19ffab
SHA51240d7b9ef79594a7b3ad8f4cffd782c54113ead2e6cc3b02c23f8c7b5dc584558e1fdca7e661f17b02a27bdacc5c2c40d2dd7a64e5c5400659c6a617f660a0bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58100bcf72c3a3179255b520d4da6ce37
SHA120a6a8a5c89808b35f492f0f5ff625f7744256fe
SHA2568f1dc1176eb84dbace6a62f27b79e5d1d7dd36a598af183b99d5ed240320ccbe
SHA5122b5df7c5d331779d88f29b90bd9f44390b7d9b0dc94946c9ea7c5d90665aeb481c7eb56fbb11086cf2b8de5f3582b463a198064eb1ee13b457a1a116ca812e5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b0cfb0eed0bad178451a7a25068d24c
SHA1b12e023576f7152ee8ae99c654cab4d8510e2645
SHA256dbe2cfda0fb5c14c5075d3478c8909218122280c74baaf948904f008136c0486
SHA5121e8600f3a6e2d3ffb7c38d7460e6b7d1fc80f13fc28b89b659dae37ad581f1e5693b489ac3bc5b4e3889296456a78aeded6cd016a73795a9240a6707b24d0ccd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521d14a6659d810b81382e88f3578eacf
SHA1b468f653800e54120acf1b00b32a10519e32b122
SHA25603fda6131a286a3b83f5cd905fba69a2231b8f0f1b2a785f07016c43f4e2cbd2
SHA512499a33ef80793173a7f5a396622637bd7d6b020662f5c679d9c9dfbb40bb2bfd66bd86513fd5c92fe97b3d977224bc7fa07aabdfc035a828c2bdc7baaca83261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552933ea8861586062a569ce62ca2558a
SHA107edbac0c042ce6824a82472359d7daa91cb1296
SHA256f6c476affc2c9da822cf11e881be3933b1a1ccc8a53341b88400c1e48e6f6415
SHA5123585dc9fb5b313de5274afccc541633ea635ba05cf4d98c9372a074ac8e8b285272322aec7fe9c270398309b8a3833d96b8197c545817aa347e1a93fa6870672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efdad04d3b5198f92e4de97b595cd634
SHA1b78b810bb186e295f81f97297245ff53ab53390b
SHA256805d19016d2c1cf997fd5ce753d5945c7ef842168f25b65043b12de320903911
SHA512a5f8511a5bc09f3315b527461a653d213dbf807a61dbd4d990e3e9fb029bf492a620deaf4e409976868fe0efe02d8c4dd25cb615338fb27260577c3ce7d62576
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a