Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 00:08
Static task
static1
Behavioral task
behavioral1
Sample
089051cf668a3da826748f4e2433c5ea_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
089051cf668a3da826748f4e2433c5ea_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
089051cf668a3da826748f4e2433c5ea_JaffaCakes118.html
-
Size
1KB
-
MD5
089051cf668a3da826748f4e2433c5ea
-
SHA1
889f951f431cd97f53ce602e1dea4f68d659ff46
-
SHA256
8291bcbad4caeb76d3c44a8239bf92135c31565d659e10dfb3072cce76330759
-
SHA512
d51c9b18eed5ecf71cbfe7984c4b99091e07b35ec3542b732adcb8f772bb944c81490cd1f659f429f61773943a35caf7685ae933f76b107f72e82fa4f7484761
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000c279cfa683cbfffe65295220e256de948fecbcdf9c67eb097bdecae0513fcbf000000000e800000000200002000000038b556876278178cc7cc67d480e93f8b409fb22e5cc0001bcb9461bd96541a3d20000000ac7157ccb893a201b7e951d4383a178b325e753d9c5071ae98adca08d4bd5b2a400000007b92c8291cdc0a1f8c6abcf11798848e6cad1c27992c9bd035310fc342baf248f0504b09c1473e502cfe356bc58f8c05f98ddd3edaf2bc4ca3c1106afa941349 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f011cc96929ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420597595" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0AB7001-0685-11EF-A293-4AADDC6219DF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000079a7a10561c58112b7c6dd38d3e689717c2cc61756e197327d90179c6cd71d1f000000000e80000000020000200000007c388e5a581f6a9954c9c3f34d6d77bfd6b7ba7e3f066085e6cfd3c83655afdf90000000250ed2175549b29bbbf1dcfb89c5b967eeb504463794377f064401b33e57ecdbbf61a20bde338e5270466542d5953344e8c6a11d36c914fd972a83223e89aaf48865f6fb5c416393f5b025c56db80d66ac9080b5dacdbc0bed51948c6df555fa86826ea8c19081aaacae0fa87521e530cbd6dc1fd1aa4f9acf3a64ad7a96a245e94834349c50151efe01dca3e742b6004000000061d53c2d9ee87888a91b416e108d1b311a16af9fd3cd9a11728898215e9682f944a72b61d8cfbcdb7930df5089636b389c90311997b8e09e6482f700a143004a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2072 2172 iexplore.exe 28 PID 2172 wrote to memory of 2072 2172 iexplore.exe 28 PID 2172 wrote to memory of 2072 2172 iexplore.exe 28 PID 2172 wrote to memory of 2072 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\089051cf668a3da826748f4e2433c5ea_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5273346db015da1833497b2aedd51cd27
SHA13d7fb8db154685e9d19877e10c3490982bda1ca4
SHA2563521419ff1cc545b982909a2cf40aae46e73f79dd440c6487706c0467096b7ba
SHA512168bbca39501c966d0d8f77dcad4ca031a15ad2034c61425c68c6e88376c7794699124ca4abe42d382b75141948a1bd75543ef6210f18485dc4d11ed34f59f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526e29696a61d2f721b34520a58b2f3d6
SHA1e92926cc44032fac5c6ca9b8f341b1c163ed1ea5
SHA2560fd36b24142c15061c9ba70b4f26cfceed7dd3da7057fc3f9409b5d4fe753cfd
SHA51210f9b739542aac614f6bda2653759d24b380d5d5719487bb54e2076c52025c2cc7a1438f1e3c64bbf34e479c1fbdf4cbc878ddfb13e33e792745345b0227e5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5171f66a71d18b2660cd0a138ac7fe916
SHA1f99a47ec1ea7bbe279e3b704d19c808ad0d3bfff
SHA256d06e4a7ec97c16cd8b1b16cb05df8d29571e898650ed61775e8733577665a3dc
SHA512874507823cb2ab66def409474155f4880cce178926b1467119a7c419f392d73ebab52770253e50d58365fdcf7928119b7a3d46eb2a3c80a68fd96ecbf2458474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2589dd5a9a2c43d7c756a89a637c455
SHA1566730db0b02809c2a2cfb697f8179688213d1fb
SHA256d1b08a33fcf1fae75eaca1ca17ffa5010dbd2fd2cd4a98fb9b953cd0caf88585
SHA5127626af34e6b64662ba0db152fac5b1425aa3c62b5ef9ff1756f37fb1627de54f7ddd44bdb827a479581c3aa3185f3c7faf6e47687fd407299202d7be069674e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f61b3aeff16ea18d8273e9c0a18babf7
SHA111fbdc4bd1b21507c91800f24cd4b964ed437582
SHA256e3af4f2f4eda25da646da29a7dda1402e99e10ad117f59ad0198edcb33913c32
SHA512a24d086d9973c81514f2ba1e5b320065c3969b3bcc98620d87c1deff0e01f846a84caa19fcd6a3da373bfcdc15928d6a95a443ec530c9b6cbf4d8eb5052288a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6b99fab7e535fc8b16d28b915a66ed1
SHA1a69fe01a3f3ee4238ae5bec2fa2203d27d24cb0a
SHA256a722d22ff23797943909b837e9e8f55942fe3608f59780f2e7e6da39d67ffa26
SHA5121efddb7ca094d0e6dcc72aba6606497cf3dea36abc266987a4aab916154e160006352e6b5839d799ee7cfdc9b01b99ec3dca4593f58ac956300c42ee38c0beb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc961e1b01689654982c7ccbd3ae879b
SHA1b500ef115f97a1579b815471b7dda26c7a77aa30
SHA256ef7a76055dc597b20d2582a8a8c2690c0df59bdeb1bca44a359bd6788632948b
SHA5121884bf5ec0911c4a536a321c3790049964873a0f2530b6fb7a04f96c87cf309b32f6f5f71aa4c6514a3ab675f9d8428c6063d2d94c8d034dee1aec863d2d1ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb62718f8b1a106d9709988f3cbc5dc8
SHA18ea926551b938baca3367d5f789126e34da91805
SHA256085214b70434136c251f14672df89a5931bf263e9cdef16daba49d51be895d49
SHA51204ae99e2c4a46c830fd6eb0af22e96c8e70c82159a1a0c15da497203358ec76b16146a47d4d63efe4caf0feeec003eaf447fe0e8bc588dc32a4f100c1891d077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5eddfe579b53e9a88b27f2322d9f9e2
SHA18688edc37cfbb1b37cef8994485829c1006c6873
SHA2566cdf43678a63c1a5f9a306235f036e4f363e9cc17e1d720fec51c69d9a435004
SHA5121486aef955c0f9c9c1985caca897c119574cd7de12ad34ee63c0df2780f0e36d8c110010380106de6f47f8a225384a4eb3b898345e9011b9e7074c98f59f3a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c4879d005f60d1da3b00aa87fb9c55b
SHA1ac354374f3d6473713bb0b8018915868bd7522bd
SHA2568aa4b7ff775863b7b597d09703e7e04ef1a71474ba3825025e306ed41a874733
SHA512912b41dc977a19943c59b43ddca6d65190a82a1051860f0b3416f91fd52c6210ab3b97d59fd9223384c40c49e33bcb14045c675a37d6b1d0801c9050199ea9b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b414c166d0ef69fe96eb1e58d4fbef58
SHA14170713f9a6db62ef30c55380ec1a3a72e3e34ba
SHA256130bd7bacc7b768a6c277ff3e76a8d88e672bfd8cd179c182dc70ce63a6774a6
SHA51251c98aa0cedc0370839f6f4c64f5762721d892bf20c8658ab6c9c0336b73ef787bf475457d9e6f64d7596c4c5d38cf35be144d9e029ebbd11158888b6b93e0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d502e2f771ae2f1904b2ae27889a88f9
SHA1cc711f74aa760e4ce1ddc73cb1930500756c693d
SHA256ea29b64709cd4ed26d7774b6582913414e4546eba86299f081a009bbd8363ef3
SHA5122e7a4940f34f3f7be7b11cac8b25776355d18470155ebfe9b091e78dbaa5f3b5c92c4a4d93949190e247f8fae6dcd4d383e96fc1bb8b1735dc4fa9a75f14c84a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d81688ad5dfc02da444927a194518a4
SHA1573107b58f9789c72fb9647b4f7250456988eac6
SHA2562ebd3fdbab089e8fc50373a0d940eb58573e878dbbfa343c6936bd025cf64b9a
SHA5125783d4b4498d973a5235708bf2ec2f02545145bf833ece785235df2a242ac4abe4e946fef135880b1dd1703297bd31731be7c1bf94ec81df04857a83b6116073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cca48c4242ac661868dec1d45ae8fa2
SHA1d553d9198ec25a562ba6f01ad410f4cf270aed4c
SHA2566af8cb3f48a330cf67f6263d350dc95a1d0beddda003f22c61a9828266917ffe
SHA512f7379c1a1f7a548720ddf82728a33b716a5b984f8f040002c553ef7fed3867509f6d5025cddb14466b4ced5205daa45e316650081f9c748534fe8507e6137967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c0a5e1f977b019cccaaf42bacc7120a
SHA1494f594f9971b60218afb9ea01de9e27ccc9e740
SHA256b2b725b4cf30058c6abd7aa9a8ad044c877d756571b246cc5e2b6e0d58775db0
SHA51237a42c93aad9bf8bc294bf6aec3a491b8fa718c1d7ebf2fc481110923ccd85c0ab3c7273b822765d6a452e2334f2f85371459e8a3bee702b2bdcbbe9f631d50a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a28eb8f12c01d6d6e96ca1ed50c4a8d
SHA1a33f998ee8eefdaf79f19a7a533e6b83ac25da42
SHA2568a4c14e346c62bbaa548d994224762c887e610b2b3f4ac0aff13ed053a1ededc
SHA512eb7771c87dc8afc68ecd0d7cd2f8135e9ced2a45aa295a1c9a6eee3d21cfec3ca4bffa6cd72fb3a57002d24e5e0aee775697ba52523f15c5ca98c68e60df33a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5601a4ebe1842d68f7ffbdae2b90b21fb
SHA1090bfb174981c71f3228b8f31cfef20351cf5aff
SHA256afbe139c9eaa51ed37525c3afdcefd2a90e80aca0eb4a81e6b73dce1e022233a
SHA512ab0e6b252f6a3b966946a278060c990a0bff2a7b93310c169fb5a3de7759e04a7ef3286b96461621d602f88932752f3caac85407e99ea276d037c0060eb047b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5921e4f4aa781b5e65824d432c0fbbb2a
SHA16ad99821be4efa8ca14d4deee031a2b8cd1f59de
SHA256478b96374ba565c1f74cdc4a0de68e3b1e554df951a00b67c8110bd0667ea687
SHA5125d8f626740adf2772627b6345a1723c55b895176020e6dde6fe05416b3397c412abdd39e8b9265189416f77ba4b0da43fab436388562f35f01aa20a82918fe5d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a