Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 14:03
Static task
static1
Behavioral task
behavioral1
Sample
fa752014138291bb0a91e831f73b8d48_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fa752014138291bb0a91e831f73b8d48_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
fa752014138291bb0a91e831f73b8d48_JaffaCakes118.html
-
Size
504B
-
MD5
fa752014138291bb0a91e831f73b8d48
-
SHA1
faa9be9dda0ecb86df1009cf39dd4e10320a17f4
-
SHA256
d06bcf3a5b119bbd8af3586703c046e6c306c2589a7e69feb75b83f9b6deb008
-
SHA512
635d0d8bc44926369e64a33a2e98957ec590fbfeb1fda5d1ac66ccd315106429864d179607a8d56319f5af26ba7d44dc6ce01fb9be8c8a709374efc2d593dad7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419697269" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008d89b9a5437e7b11f09e3e5719a80d2b5b9b2a5f261eed0cd56273f096bcaaef000000000e8000000002000020000000524e8f5e90231be02bc384d61370cc54da94f10b115dbb7c735196bc665a383b20000000954e74be0282041909461fcf0d3ee5b8070d3af8a9086097a8b21713a6c08e7a40000000d4ff6c283c2bc64c577d3cdf965fc78c5140ca1701e3497aef0e708863bfe7a2cb84c179010b35b38c4d93f7b6781dbbd4c6c651d897f5c383477a6217801a56 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d0ef2241fe527471095180e762eeaa6a611af6035b0278caebe4365d752bfbfe000000000e8000000002000020000000dee2a5a663f13197b7e6deea5ad057a78f8d08993ecd61668a99194b4c4443f390000000eeb689447e91f4097efdd46e587c4783887b97f1b1c6e9879219adccd69bd4f5e9ee707d3a115840eaf6cbe56794e9edde9764285de5341e19c7d89c1776b9aec092fbf00b60401d66418ed00e0e11f79f2f071cf136ec80a1ac2cc70434cd3eb7954b59d5dc8576a84b12d433fe2935fd9107d96c1bcf27704dd8d0c7f2645449e4d0ea0d5fa89530abb2a92a7b8341400000000275f06ee59ae19f04b1480c395d0c0dbe527b019943d0fe094dd8038b6a27a3ccc14066c5e31ee51c3d433206814e21ca191c4190ffb8b0e4abda6d59cfd5b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{949925E1-FE55-11EE-AD12-DE87C8C490F0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f410696292da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2908 1728 iexplore.exe 29 PID 1728 wrote to memory of 2908 1728 iexplore.exe 29 PID 1728 wrote to memory of 2908 1728 iexplore.exe 29 PID 1728 wrote to memory of 2908 1728 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa752014138291bb0a91e831f73b8d48_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d938beb7ce1bcd05292d1fe3c041a566
SHA1d28cc1c4ed206078014f247d4238111c1a204072
SHA25623afa00f33452280adf71c581cf0f0dd12cc08847020e4d4905a52ed336a78b1
SHA5126d256e78ec9fc68ac470f66ca5dc817185cd3c0be9626e28e92082808f672e1a9360ffed169b3dd71429155e9d9ee599b4ee0949755bdb4ea5ca4d9be4d48958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507925d0c7f6eb2cff5766d89938077df
SHA14352f1db63a5785f335c8f07f047d39a80e1efb3
SHA25616b4b19a99116f48229cf78dd8e6ddaeec8d136cd3afb56dde29c4aeefeca3a0
SHA512c3cc2765d8f17f0432a2f1c54b85dc6086d1aa2f8f87583909f89d5b5e111a989e67ee1b5c645de68bdd8b12877006df791a57718bc40ee2e344a627f49028f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bffdf9e211246c5f864cf0ae0b033a13
SHA1ef54039cdca8ec93cd34067df10008da55f32fca
SHA2564cfa0c2a5ba7f40cb2e3c489ca84993fa9438f2629d13097295ab65b6194e636
SHA5121a936bc4274f21ec31e5ddf74104cfb2c4fae398c7566936863e48ffadf8d11747b922cd8ff1167a23bab19122ace41061666885a9a7e87d955d69a16ccd6385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561c186b54233665bce80591dbf0f7cb8
SHA1972c4a4c4a6e67f66c2b80753baa6b54ebc22804
SHA2564496290df42d0aac88dfda841b3bf67a2bf36c993aa636ac6e24f70d7440414d
SHA5127363062a46c07754aa55e32baf5943ba7474ca317e45e9a9e59407db49b83c5d35505581c7782566749d6df935e56981ac0a0d3568327f70d5bcfb1a39930d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ed4d9944e6eedd5beb21f4bcbb227b6
SHA1cbcd9042b9077a9e5864256a273a50b9c48eba45
SHA256ee806e32b9f3b48a93f99db958eb55427dea6a66fd2746e6c34faa054dffbafa
SHA5121f8ebe5b5d57541cead1fae2a2e0f8ac9aee0af1a41028013a0d40df917b0a90260ab56cb7959c3108ca88a4cc70d892715f5c0f6d91dc8b32bf969028e5f91a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9002eb074c56e6acb291b75186cea3b
SHA1f191fddc601eac561efb8a939697a2fae72c9f58
SHA2560f923c5ea0ce6cd37c6578354a237559c8b3f14354bef9df53d544a1e2465e9c
SHA5126877070b67111f773552ce4c3e2596efd8571b6af04af3316cf482c9c9b1ed5e193b51594f9d8df083c48e5fa514144237c76bc0613276fe571d7e91087ca760
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac9c71759af800f1a9e0e0666f1b739f
SHA1c67a1a070e0227ecbfe6cbba0dd11583b248b205
SHA256fd8c0bf74e71faec09f133cfe025ab514b326aa4d997754f9c422ebd4606f48e
SHA512a4a9c66e7c1c832a5a640c7dfa4fff7555900719dcbbde6d464a86cb3853e103e8f862011f94bf6db4bc6112c4f7eb846d3c538a58390de69bae070b07ed7d4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4ffc82601106d68d3e517b5ac4419c1
SHA13f1d771897528229a06635f9b0472f70f1ca897b
SHA25690ff8316795a920c4e8f27ece43310da82ce8a4c4bf896e83031ca9ca351a19f
SHA512e5eb74a538e42a84811a9b47e1563b7e4e5a267fea27eef0a4f5f7e8efe817ea2e9d473f03bc745f21bbda7765b18bbda55441cbb9224afc81de849f5c5efd09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5117d02ccd23cb0dd885854d5b951121e
SHA1fea32695046487362b2b56c5ee927789eb5d72bd
SHA25675d7df2b8de839c6e88133ee8dc3de34a4c15c60568e6e3b2c66135c678cebc6
SHA5125b4686680294ffc52ecf87ed39076a5afc2804db1b84c2ddb79da7f1c8fb1a0cd4d929a59d7a7f8031d59308a51e86bc4415493e2a509237ad17b826100e711b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a37a968d241faa196d4cc471f6b01817
SHA1baa5b8d6657e1dcad664a4bf7f3c4a70d543946c
SHA2566e3dd8e4c5fc4842014f7ea94acaf2f543d139eeb74981c3461879650e4d066f
SHA5124b78af1a361ff493e5c4d539d6d2102b892fc4ae5140cb3bcfa711499b8b9dd47268398c21c7ca56471bc7b0b63625918b1912a659b40c6a7ba5bc79e09fd257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517f7440a17548addaa11982a9da99bde
SHA1eafe2f4901fd9415d0b8daf0f082295e7e4e3dfe
SHA2560978ccdb566b380d5a070f49e288f37234e206f3e4eb5da8c25ef1e8bf516ef5
SHA512167b84f474f0bf1366969b6e7897c44648c45cbb09c442cea66f847c64d068162330e534435e61f1d5a4c84c39f20b1861eae8fa226e78b864460f47c94eac11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535be20dfa5941e019522930709762cd6
SHA1319ffca5bdf970ef8fe550db8e72032dc969c472
SHA2564c0c18bc85a8e84db5022b84d6fe3a63aa07f7ebacc083b59c26719d350171c4
SHA51202b347b7d3318a1e3e8be9328661496aad58b1436c6284f75342281035e51420ea34b873b4910a8673e9a9052e8ce71cf971dff106688f6eefe2a9ecc658a64d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf04f569d9fce5ce8f830c0f7df8abc4
SHA17325b557c8e1d35b7ee785882d77319d84649511
SHA2566c2da3ba8d2cd7ebe2c36e9dafe82d29ff8a7f81536d0c87fe22e1fd8b52b036
SHA512ae9c445cd575c0a968c5402e395b5a2524267b0bab0ab6e36cb2452384cf5c0948aa086141138a55ac4d49f22356138ca2e7eef63a560611b412a5e2e51d4d3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546206e1086b23cd13e8ae812c2bc5962
SHA1bff591747c46a78398e5b9c87b936ac8b3bf8ba8
SHA2567fc39d2885f772300963dc25c01a3d28c7f42c0ba9723eb72f8bf298a403e3f5
SHA512dd64bd0df19275d9ef0b8a18ad3ec3ae9814ff37deafe3885af088a7a910c448e37a2170a465f2c7bba3979a03852f0fd368fbfbd1f9c12a11a318ef0fb14728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597b360fd9d6c8a2f8fde4083a89aadc5
SHA1ace5227ac7dc767c79e8c48c341bd936ba5cd2eb
SHA256a3d98a0c907decacc7d6147f68ceba2d63f4ebe87c16be42e60b6e52450aa4ff
SHA512432b68d05b045e2cc0e8f3683f7ad963691c7547ad006f284b4139c43b28e956593ea1b9a74b12bcbeb6429e0586e48a8ef1b3dda22ad142f5ab7ba56c3b1d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fddddff468852b4a434c2079025ce1ee
SHA115404bfcedbef5909f69d40f0100c71a08990bec
SHA256dedb3fdd441ed03ac4cb249d887605af65c6f33cd00276befca6c41700482294
SHA5122a81545f7c1b6cbddcc6ff8c1d1cbab865662b4022225d959d9a41428b7793b3154e25a70ccebaf37e8f0048c590f3dc8692d26e7f23800d5642a2eb3ceb79f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d987c017db2943f2e4b1ba92580b920
SHA166a46c6d570fefe7746a7ec1a8daf676c50a4c71
SHA256fef4dc112aa55c196979d16c9789ef848bd1c38119b09c6370a09dea6ef10f1d
SHA512abdeb5888b6588a4f419e9bcfc55a343b7a07c67ca02ab18c840b192699a7909a200cfd69e33cf6a38b77865c16480b62392b41dd4d403f996a966a40d1f5d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea92640d8df7922a210da0559b31f187
SHA18ceacf5a5c644420db488eebdd85ce0341ac1e2c
SHA256bcf98598bb1028960fbd6da1845a520bc8c47623f6c302f54bc17d42c8b7d0e1
SHA5121b3bd3067e6d515d124b061333b3de4d09deebe631ce68e2a0b17cd2e3c0a0bc5a94120ea0764290b8c20c686f49cb978ea47728819a7cf716f0daadc5367ab2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a