Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 09:00
Static task
static1
Behavioral task
behavioral1
Sample
ed0cf388528161039ad567004a3877ce_JaffaCakes118.html
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
ed0cf388528161039ad567004a3877ce_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ed0cf388528161039ad567004a3877ce_JaffaCakes118.html
-
Size
3KB
-
MD5
ed0cf388528161039ad567004a3877ce
-
SHA1
5d463323425d16dac09b40d8d6bb99b4b8880e39
-
SHA256
ca9254f4a4553c19e608a046ff2d1552e4f7333b2e2c5797d68ccc76e8ec76a9
-
SHA512
10995f518c82f2d0b80d3d1a3d48b1f691442f03419ed9b014b3ec6517c7cd9473dcfc73649f454b37bcb7ab44685791988635ae0c350c21271b6a1049b19d2a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000008b282e5255f1c091f49821508142231fd6d1f288a5a9087f70eda9c96afd346d000000000e80000000020000200000008f7fb9b86660e3857504d5bd833f0bbb43fa478f8b42c37c47fafc5046fd8ed690000000e4b61acd6c78ccbfef35430d54e7e4ac7e18099bc8723ff3b973008bb026f25f9044eae6cb073b4cde819fd1151fabe849f45d7d6e06be6cd9e2db8e683570c187e208ee8abc92b89839253995a49e0d572ee7473c34f69dcc5539d59cf9b56f64698a5e1b43031a5e319f0468cd79e9a676ad6b27d6a4dbd25836fc0077ec78decde40dda0d3fdc1040c3abebbb61ee4000000092a8e63bf7000e19994a1beaa28f16ee2adf6303111dbbc2ad9b4bc6da1d189b19a50d20b08515d42b0bd16bf88894b76cb673a35f33eeb32de439adee1146e0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418987877" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4BBEF01-F7E1-11EE-A619-5EEEAFBF1CDE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b20000000002000000000010660000000100002000000038e3e6f06fa461301e410c9038738abe90bc9180aacddb42ae54071f2aca4b39000000000e8000000002000020000000eb8cd5ea05ace79e6ac690aec252bd17e87dcdf8e0c847a35c3a85f1d6639001200000005da245bfd0fc824db8a82c2a83f8a7521bad614774fb4874eecc0d88de8e42be40000000b127f37c7ce7b8362bcce625fc6557faee8aae849855ed4279b679274d2e0122aef08477adfaca1c3b8bd8cbdee63c1ef4654ce53db4ac43ef32fd72297afcce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109ef5b9ee8bda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28 PID 2180 wrote to memory of 3060 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ed0cf388528161039ad567004a3877ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5285982b424c7be4303b931411634ab65
SHA12a139114c2755fc6f5ae3a85e8816b69297a7ec1
SHA2568c4757564a4b7f295bd4cf68a564af998c1e5ce2fbecb6dca838bcb4a2344c7d
SHA5124460756555ce5a61cd6e63634a5fbaf13a8064ef8698b3da6858457519798abe4fc9fa3fa4a08d11bd54f46d1b1ac644cf131add3b1597a340f109bb15ea0fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b92827bcd6bac56d4114715ada7de3fd
SHA121eb673598ea406f221687f33b615a5bec6a632b
SHA2563285e4767cbe053d1f502c1159ae5aa18ae65aba6b188da920e7ba2c0da0d214
SHA51271d9915367a5bb063cabb7c759add4ea38de2c0f72f577cac31adb579f8aaf766718aebee5e470bd58a488377aa4e79115a7744410ce57917e1a9f1c9e0538cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519ce5d9f62ed440c4059775a5f963cae
SHA176febadfd2f90d7f14812d32434cc402b9b35d55
SHA2563261a2c678646bb42e875c98c1b82acd5df52931f41b29abecd3ad30a1b9d36f
SHA5125cbd2d80cc72e3374387bd0d147f9452ab094d3201c194bb32b89cd63c4c71e482c1b9a9080880c9f028179fa0b4bcecc3be4880bbb852d8d11b7d17542c36b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b8bfacc697357218859d959b270387a
SHA1e69cbb1ab2e16b5aaabee44fead80bfca1f06f87
SHA256bc20eb8fcf15efbd5e7ec7c74de6abc61fda4e6fffd8b2820dde28524e4420d3
SHA512f65ee7211a441231500cf877056db755cf0fb944d48d522961aa243374c62042050d2793b045d3e1903d24897094367502678148f0665ddc7f58dd8477d38156
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523074527d1941bcd8b92fa557f058f22
SHA1b3e28df32133d4c1a1ee26daebe833fc692139a2
SHA2566f16bc120881fe37b9a1eb766c5911388bab172e45cf19b18345e1610a6b3645
SHA51213c25ea5528a314a383e50f11661c2b8b659e8d4e2bd77bcc48905bf6cecdd619bbcac72f6f1dd10cf5199281a7fa2e8d97d4ae9e46e6f39a108ac7057c6d0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c317c725d9a93fdb640abcf7a8a091d9
SHA17aeff640be17c64ffc8a66486b3e36a5bce941a3
SHA256da00b44c3720779a74ecab435700a1ff026c6f47c2fca47546b8d1bfad0762d4
SHA51265c3cc8294f64ed361678a0fb825d57bc51db0e4fe373f6482d0ebf9e32709183641b61cb3d891c030a353fbd47b23ba5e6ce6c747fefcd76def1b22722971ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50af14dfc4c99635f8fa4feeee05728e8
SHA186fac1ada1cf1df883d53081a8980e90d73fb7a5
SHA256f9a26cf4778abcda11b96a32cebc5545be81d9132bcbb4b575f86ed351e94f76
SHA512da47f0e6c907b287b1b3e30d51356b330c83cf6e910ecc68ec03536cba5731ede93fa12787c714b7bd031fd8f3649336768a5a4d4a05c13e84cfdb628d0b7ff2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51547eff1a3ea90efaab079f9ea9dad19
SHA1c3ccf0c3f9fd64e5d1f50c0c3256b9e526d0a422
SHA2566728d6abca97a3a39f19c2105be65a13c9aa8e86c4e435507348c2208873cf23
SHA512b3adb98b657c0d945b35d4ede09373e95fd88d9db3ac045cc19df9f58679c9d45e058d27f073b9f05c41dce4a8377c61fcb729ceca2fb15dff45ef1434c6cefa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d82948e479ee20e8745376da841139ec
SHA1075221f742ce03b972c5d0b72227ff825503a28b
SHA256e9cbca2dd224baa6c8507be464a2c693b651f47cb1f106fb750a0f44b3a564f4
SHA512736ee5772d15b22e529310b247d3119533bbe0701d0683834be2011e075cbed780a713979e523c202c97c96be44daef5e88cb27d7c6f7a1ea43d9f976525ec53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a67dd69effc95d53e227b5214a9b0f3
SHA19b9e72b920b189c66d820df11ea1375d9253950f
SHA2562a4c31ee4f1790a97687fad48ba66d5900b99ffa25cd9a46869d7769edcb06d3
SHA5129dc86c9fad3eadbea37b2c41165cc2ce38d4f710cf709bb0d22c4c0d2832ca95f06e81e5bd0b1334a23382dcf1b970b6084758bc073f6548eeab6ee80db75a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a610d866603fbc4d3d484e8d238f5845
SHA17953bbbf691a0497502e0a2917a4b3966871b6cf
SHA256f28cdb7ad78c0f3d03d332e8ea72464dea6ea3b86f68aa4e062a43325bdd6878
SHA51240b1f78cc5e75ed66cd1efa33f2e37dad3cbd8787f2465ac0ec07af7e9d7e685986308c0703fe4c6bc9dd126ad2b53d93739b72069c04973a08f4f190531cdab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f68674cbfeccf5f5dea009088fc22b9
SHA1b9eb7d3a38193fcc0cfd324e277aedb67e1fb862
SHA256b5bb8fdfca3592fa53ef4d1d826640d73cf83fc7c18b7e41506b529e8f9c25fb
SHA512199dc80cbaaeeb3a6ac45c0eefd3596d568c62ec35a6bada30e1e48866fae7c5a87941340c301ad6486e09a19459621cefbcdcb71a0e815a2ae3597357797885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511e21de649244b94d9d824e58fe28221
SHA1cc4ef1452ac3c68116815e96fc878edd296e71e4
SHA256986862cbc2554f161997038e9cccff662069d6f1108cd7ef54bf2973cebb7b54
SHA512a1cb76c0069af46cc4d00df0a9562aca002ccce2941c3eb84f8f8ca83a5976c485aafbbc5df0c732cc4513429d9daa421f1c08be3dbb974a713510820a061cd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b71fdd83938df8f66b863b91fdc2a586
SHA17d792265fda12a3e815305817b69eaf852d75cc2
SHA25677cef9c6ae577d02ab3151099e23292ea0c87b13ad0e545a875159b2724561a6
SHA5126fc01f174bfa928b917ba79c81998be9307b8f280a616947d1dd27528ec1d780a650888c2e97732e4f20d7a8fc9ae198504cfa2b7f966f5b26e521b12b55ac2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dcb6ed408b018d549e412602f966f8d
SHA19056c4bd4060ced014e9c4d404e35fa9b362d0ca
SHA256504959a29381e78fa267463a1cc8541e45af9f95ce315382e6d2f7a8de41ce98
SHA5129c90d7076388fb8c6d6ae75f894ab446bc548951ff15e6c2d40806a8b2e49e01ffd8adc0f7bff9f25e81ab7867565b2d96de46492d0539ddae13b263cb4c9c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b6f4bddcd820dc41a79c54033ee458
SHA193ce15ed6d9670ffe5d6b428ec105d8c9c9ad646
SHA2560097e728face245e66d43b7d8f1751b10e66b216d7da38b86484cb4ec55ae17a
SHA512c3345126f870132d3168d4d30fe4ff923928bf36531bee71ffe163caf2b0a4490fa7187df289737f73292d48441d6ff729ce50a194d628238d4a171f40db976a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510840b914e561f32d6ec5cb30427aadd
SHA10394b246277f335e27b782c86f9b607783e9833a
SHA2568dd5f49a8e0e07bc8bf124d7211c64b9948a256fef800d01b3af08283d09c149
SHA51244102d63f0b18d8f8d285d107307c2f5899bd91cbe628fd3ebb9adb163bf47245fb2790c45667c3be8b6f4f5b11c937ba3298dfe32549932f77d5967b8c89098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509935579c4e9d951489df93e6fcb17fe
SHA16e7780a862af4d83a502ab540264fb0ac5a81a9c
SHA256cd79fb004d5176cbcc2e2fef5ac06f785683cb83fd63ed1f9355ebff9ec85386
SHA512c87a2b02aaa03acde8e6019aade99271d1f9ccc0929fc23effa1ee25929dfa3cdd9a67a9957513f3a45b09d7e7607f73e38367afaae5706831aa4c2734e11a0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538837eb5ec7511ebe59cd0c8acb73baf
SHA18f43bd624c01fa1fa90c22614f059122e196a2ea
SHA25630c47e62e78276192ad34f2ae706c012f0843fd24b024c42a1e82b1c33d45b95
SHA512b7a8dbf3b1713ede62d7b1cc5d92c47313a06d3979decb30acea857ac91f96e716a3210be53da70c01a4c7fd8e13e902075487fc71375ec7b18608956a66ff9e
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a