Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
02cdb16f62c35e68fea5600b92b5808c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02cdb16f62c35e68fea5600b92b5808c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
02cdb16f62c35e68fea5600b92b5808c_JaffaCakes118.html
-
Size
353B
-
MD5
02cdb16f62c35e68fea5600b92b5808c
-
SHA1
2af0c0e2e484dadd15a57ce359c952cf2d946691
-
SHA256
39cfb222b5834a175c9187f2ffa943c02123dbd1ea61cdda3ed8b1dff7977f07
-
SHA512
74aa87dcc16918b4e55a146e21a3dd24aa4f25edacd916f000176cb0c28a44737cbaa0466cb1fc5b3bac5f3ae88d02a24980dea33e469ed53064404db74a38cc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e7f9cd7a98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420367452" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000086a7f0057b9a23604c20b643f747267ed9a5e9ed619641632effb0c0b2d7f1b000000000e8000000002000020000000e2a5e6fd17ef249ab01b8104eec551d638669238826b548964e8b0f7bc53c3a690000000babbe3b686e2f6d2f07ca018a620ce571690972833c92a6d386194ba95007499d2f532f35b79279d8a733b4417a6b5d62225aa919727c8bb1192949c6a90e2e1ef2a41a4eb77932e84bce5477aaad36710fe0cc4ee29145fcc30752e96c16900ea8daebf22ee69992f5b8ae96b7b12c896cda5b575088590e9f7f05b5aff7957c84bd2713254f6b99e3e356a38ca4c464000000003e21a7615028fc6ba0a685c2222882cff1655ed1fa2d2666f82367dc628bcecca55bc663ee72c966765d7397734a2481d5e815349816774b93d54b0c4e5c40f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F959D0B1-046D-11EF-9340-6EAD7206CC74} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000085fdcf257fa203ca52768d9573cfdf1faceea803bcba4e4861af22400c5bf78c000000000e8000000002000020000000d56c932075183274aad1ce333c2a0acc5d71c114169ff2ca488661ac83be3bba200000006e185be5f8bd0892c43575700efd131b591af2e9ec611cd4ae89fccd6dcbc32a40000000cdec352d6a9907557817248e395d96aa1ae056f57110a77b2765bebeafe2da50dca0c0921f7b3a84636f19182f52ddc96571f6343f62d033ccc766bedc7f7083 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2880 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2880 iexplore.exe 2880 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2300 2880 iexplore.exe 28 PID 2880 wrote to memory of 2300 2880 iexplore.exe 28 PID 2880 wrote to memory of 2300 2880 iexplore.exe 28 PID 2880 wrote to memory of 2300 2880 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02cdb16f62c35e68fea5600b92b5808c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e16b9c58606fbed89e44b3c91ab3136
SHA158fc6df4f3e571d44a355f4a90a89ca2bfc72613
SHA2568b3838fbf997fa49736b27de8245bda19c1a2f68b4664b9a9a0b5bc5c20b5a04
SHA5120a659bc099ff23667feae2cf45eb46d70246a2c86cc6e557acadd261422ce79b2de4b9124fa00c9c9d3d61c01d8214f078c910f3e76ddfede335d5f563886fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52224b23d8866b9d930ff7b5dc517ad5c
SHA13846da592720e13720db124232af85b0fdc2ba02
SHA2568ca19d2d30cc34d21b1b91a3bdeec72be0b7d775f40dfd50241f6385cfb6af4b
SHA512f614fa6a5638a40535fcc1b89ac47774a1ddcd993a23377d57bb4c0d2d94c21a3e95b9bf8316b112cfee3885e7f9c8da76fbfbec9ac93cd2a8c4138476c178b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0aa835d7ba67f662b28ae946bb2ea8a
SHA1a781d52519f9f8c9598d4c37922697e9d6653758
SHA2568070f8c818d4c8e53503c9a5ffe42a4379bc983cbf4247d4df965fd3e90aca9b
SHA512630fb46cb0522b4ed13de217894b3af1c489d77270f10aaf8d664ce385241cdc2c1bc96247ababcb546b208ac5d4aa63ef9e71aa9a2a9dd3dd81bbf85d9cc176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58632b5e8a88f3b2dd6a1ee8f98c149ed
SHA13a2dddd0b2266edbbcf445a786690753b03e4fb5
SHA2562f2ad04e10a645887f409b3d58089fe5bbaf4bdb9bd1f46839e2221667ab28e9
SHA512eb8a4d012b8be1d1ca195f44beb25dc9d133c6c321f2ffcf3655ec64300b3168b9c3f37ede95d1a3c5be992db8faa30f9989902e1d3aba7bf27fc1b91f4f729a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d25be6116d0071f71ee40bf3cb7851b
SHA1817372b57b7c85638d988e74699bce0ff3be6517
SHA25674bef5efccc37862b4de2bd9dc5d364d01d99614277dd6a155a02200bf410423
SHA512f799f4a404b58bd0678afa59d5d4929c247e9d3390ff36537a367fe374c84800dbbc38e29fb5a412d237366b4bc849baedbc3d5ec661e9d1c61d65156bda862e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5e5526c26f2e875611259f7a6327e1f
SHA16149104c4dcc7f755896e4028822debbad2c72c4
SHA256f0fcd94faa6f28272051e06ddb2b9d61b4a7f5d7a3021fb17b75195e25f6ee08
SHA512a3ebc2bf9d18e3fc1d635044187fd5627923e2bab11af85189ac9a2e893f37e3f012bc8f2f215dde270dc1a488d0d25a84eb5a40903d41940ca46d7b8baff18b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d8fed83162b1c55c36e3d2961db4aec
SHA1f76e953053179ff602ef00c437e60d30a2786d82
SHA25696ed11151a6c44261cabf3654a519a6d5d92cf8ae5903414bb085597a37b470f
SHA51292a287bb9ebde14835e54aec0140ba98d7310d6657007d2c04a2fb9f90cf970dc8c434517b650d67e440f76a34fe7f3a0407c1d9ec933fa969012f91452c20b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cd10e09cfd85fcbb2f16dccebfc8d8a
SHA1de45b57de41892fef2d832865134ef388c3340bf
SHA2561ed49bf30e5c3236fcf8d10216f1d0fa54b10e1ce7aa96ec92fa52e3d4e6dbc1
SHA5121ee7ec71bf61fe6d8e13429171df3e28d5070800d5766f3c3c0a8b1b726da54b36ff3a177ff162c66b2028877ac6c4fc136827851fb9338f5381f715503431ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521033748b94d689cc6413d03516197cc
SHA1c2e89a70eb4be8a0fd7773046230181e8db935bd
SHA25637540fa88bda3664f75ad34d085f243be812a168fbae63f6f1303b74bee6ff79
SHA51212f8a8c0d00919e8d213f8db00a02d2032a8f106a32e4f7355e425bd09827e2f6b2e04e8258bbe81472f85bce68571db4663f24acd4a01dab4208ea322d6b916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f54fe8fe17c31e62b9138cfed7b71320
SHA1a0c3ba7e3b6d277c012977e574abf2a97d3ced78
SHA256e54adb4a5ec814937b05182ed2e73709984387e887df916e8f93b0b79dd15c23
SHA5128a9fdd238b5d1438d26d253f064977346de3cd55279b8e452a4110fd065772a89e0683e19990129a5122142a5fa3c235db522a4945769ea7db7ae786a0d55ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fc6e41c078fd728533833137aea0b81
SHA174c5ad0622a908c8b071285f8d2343bb1223e998
SHA256050a893d1e02147a432d57f65724099556a30749f0fece6a80592f85fafe0a9f
SHA512a804459966cc79173075d8cb3bb819a2c03512e02fd090a56ea49bcdaff9c5c377e79f0466a4df86ed916d14986ed145eeef842dd3b0b279acd629cf63ed255e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fe29cc19f8be1d9cda49c19308d0d43
SHA1c33bc308f8b6516d0223ebf1fd4fc1d7046ce78b
SHA256e11caff2501edeeefb535b11639c08c5bcb2d88d20def4441a97535d887f244e
SHA512f8397dc2b8accec8b89dc8aa5766920a3514c76f2f8f2cef18739e29837deb8872bd598618aa71c9740aaa02d7cccc47fab667c66f29930b440b8a8b9a255df6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c3fca2f07cccc99da2cf3c38e90b172
SHA126fab3772561c091c75183ec0d7b7e5c0ede8d07
SHA256243cf0a97dd6528c6ac0163b4e49b8620feecbd1034643a01181370144b55c83
SHA512bcac2d84b60cd12baa6c038fefc28ac7b71a57d214380bd82ca65b4d85f9791c94576c6646d4101f144c2c309e764545021f30ec18deb98bff939642e41e298f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a22c665973ea9fd8a5d9f420eea920e4
SHA18251bb8ec30df2ccf63080f2ba5cac134a27e535
SHA2563b0f98c36509443b7a8ef362f9b0340723696e2b5c76e725e08e1a7d4b93af69
SHA512a0cd4c4f0daf9bf4fdd2533c6633d10e01edb10f2e22709b86d1480c126c54c4cfabac7b4dcc1e64a4a30cf2c9c7b97e9978f8cb1e5b5c559ac81dca23801105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507f37c074660ebc1499558a218688bbf
SHA14f5c5e20a8da1fe34e86a90b486809e9fd0f9713
SHA256c5db784c9f2ebbc8bb114983e0e0304c85db394c5b181289e325a175ecbf1dc0
SHA512016b71cf3218f9415859207820e764b86d46093d5f4554d89b6a54f6abdef68206855350c82342d36384fcf996f3475cf95259453352cac989f42bc578e50639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578dc27ed94c57dc6c284b5fcac128f95
SHA15792a90e94314d993399f27e4bf31d95599569bd
SHA2562f4735fcb503357d9e4201939db1a19570d8c529bec48d83b16c54e7f7cda20a
SHA51271baac02730b3a342126cf03913f63974676c732db1e7149eb4e69416d6fdc5ec7fbe1cd7e8d214771755a44dcd1004193d2517ee0d29ffc26a27e37ce1826a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58346994d4ec9aeebb80f80fece2e0e1b
SHA1595fec2d045fa8911474e20eb5b0d8fef5638774
SHA25629f49815e417296a410f2af0135117b640ad56d1c5ab60dc62e3a10754e58910
SHA5127b7ed1a8195db77c1605d2c9ccb761c6a10a47beba36497b6f71d4e454dd14dcba9d04adaf76f0abd63588a6a7f5c20fdd1f1a72ed2be88ab99b8c82197aa130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fc7818bb63fef472b52426dfcdac898
SHA1c0491fc32c75b12a25558524e07ef8cdb7aafc97
SHA2568e54f0ade64ad198389aa4f9b946097fa4431e42662e3c6d1895dadb57bf3f7f
SHA51287c9a989a43399c95504b9ca73deaf7ac8f2c924108dee3e7da83bda5af398c15141da00726382a060d324712f42e333d149e6b3c5a57368739bb3bcef766003
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a