Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
09de7f384af3013c65de82c7f5730ffe_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
09de7f384af3013c65de82c7f5730ffe_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
09de7f384af3013c65de82c7f5730ffe_JaffaCakes118.html
-
Size
1KB
-
MD5
09de7f384af3013c65de82c7f5730ffe
-
SHA1
b5ea22ce15dab81e2b443e1b94923c61a50b30ac
-
SHA256
3b0473082be523db2d045b8b9012c920e4d3caee5ff63268409f3a6da1df0f77
-
SHA512
11c72bf2df724f0d367eb84419e3c8e650640ad06cc474c50c1a327a0a219d8ea62b12b11784c335360c88d28c373744398ed623c51760289a5bd52fae777dd2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FB636A1-06F7-11EF-9CF3-F62AD7DF13FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70583144049bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000032162455d63b38b4da755f64b04449c10b56abe67c5c16aa006afa13150507d2000000000e800000000200002000000034fa25c4ca24eac2f8f284b58914666206cf24503e23ec18540c8310bc85052190000000b9790def73f777e50a07de94515b22e49bae6d83939fabed53940c7735e8fa187dfb3e08a272876b57ffed5aadb4dc7096e3cf4ebbf87d481c29ea1e56b6656196f969dfca3fc91612fbd5d8e257eb87ac9329135c48b9d0cdfc1ba7a89f057d1f47ddf15b1a221e65feb4b89a58fa85911cb0bbb21792ce26af056395d1b1ad75bf9e97839f0267d84503269b4b41bb400000008f8d6a69522781c4095bfa32902daeccd9d5047a5ee8008e3e41815575c7fd29d9052470749c36729b6bc5c4fde612950d541fc323561b0e8456b48076b6b064 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420646394" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009366e487ffa8f67078ddb0b6efcde805bf5639548a94c70f375c73fdbeb2801a000000000e80000000020000200000002542f5039657ca78c89546bd7d16558636d95c73eed7b218bb2d0ebd75e8044a20000000d39f7fdfc3aa346ea1fcd87c26aeb4711d834f4f3c5128070f9867bb4cec6a93400000000c727d4c405e654a0be9444db48c2ad857cb5753f988ef802abeb0e1f93fd3e445a22d34cbbd391f09ba808a169034a40f0941efa5cf19cb7aaea6459c4beb42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2936 2012 iexplore.exe 28 PID 2012 wrote to memory of 2936 2012 iexplore.exe 28 PID 2012 wrote to memory of 2936 2012 iexplore.exe 28 PID 2012 wrote to memory of 2936 2012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09de7f384af3013c65de82c7f5730ffe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0da90f0c6ec62b1a3550da8498569a6
SHA11fdea30ffbcc846691be6f276587f94ec782e918
SHA256cbb1958b622203f033ff2c32a66723ee8feaa7ccc9807128011b49c8b0eeeb05
SHA5126db1ea871d4ed05e15f15fa4da65cbc4bf6642c605ef981b480c8543852e2f597a4783d3a96bc90929133c8fd0ba513a3c1fad1dcc9b5b06ad030f09ddd6fce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53551cb62725a75f1bf321e1ab193c28e
SHA131b4e7c81fdb39492af9575ccfdf90183e850f25
SHA256253b8e09de91b0075c2205f29c9b45dfa6e17e624d41fbb7dec0132c28924307
SHA512aeb4a89f874196c206640460a48acb7f6f32ac2e536d7c824b0ce96fab61c70870434b2131f80734a53535b1d89d6e52a46cb935acce0f1af3e7fc4cc8f8c5fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a2b6bca96c3e9171e42792a270d4be0
SHA175e90406653ed9b6754268a684453826f307dcf3
SHA256efd62e024a9d0612fec72dea5290422fac8f7eb690d7235415744f1f461a1491
SHA512372b0791dc67da77c9f9b1dc15cddf31484ac74ad6f12420fe62b6e23cb3edfed484c9e6ce65dd1401c31e4b92ece89564b84e4e4f6759d0d5c4f309b0698a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591adf848e5c54d7913d141ae5899014b
SHA1b500b22b34b7afc5fcbe31bfc97b8a0027514418
SHA2561e2e1a8b07afabe76d04ac0d361d6ed5f564ba27f84517f4c0785532d2e07937
SHA51295f745626ed6d9956e58974cd531aa77a9a26242345b5379a48a6ade63d7cd6918f1c10be3bc4fb8378226070168ae656c592cf29b815e3b56d267e05754df05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5081ab70b7a02fa3d39b73ec951477afc
SHA102139886b31d5dc8b0d4d803f321e74e5f208c02
SHA2565a21d2bc9bd37dbc07bf9fefed1b573e1e62b6915d3da9a392f6adcc2a21f5bc
SHA51253347d347f444137d65fb02c230f53c0d6911a7635cc679c7f4898fc3151400a19236660632e1672cb357696d698f67299bb0f9d42773a4cf4d73518533327bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554818c2fdf42ef43268518002e0ddc99
SHA11ad436d6a05ec96a15f6e2d25ce9116deb261a30
SHA2561d9d612539b4a4b3a9d37a2a4a5f2211865f24f169b5bbd1f89fd46cfa96184f
SHA5129707788aa6f6b4da42ec1a79db8b802b940122b7d2565204d834892e618de8802bf8974d29f2ab353476b7fe016fc71fc4c2d02172dd5aaffd52952b99b39327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583e610064af24dda1b991158c91f3a2b
SHA126088b828c5c210880488978f7f998073ab02812
SHA256fde6db4ab0647049b425f327f4d7ff7f1f3b80a1ac9fa62f54c4856aceae8ab1
SHA512a507b0bdde106f6b538ddc8f5d75b38a396b1cc2633f33b9f9e6921d9ac6c2900f33b34be49ec08af516041fde762e0ba057c28301669087078f27d2f9424d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543431e3bbb6be15d37c19cb53fc0c3c1
SHA1c9f2842105efde8672f6132dc5001fa96d92533a
SHA256616ef4d0910b9ec83b3baebdb4f30b486e62608e5e2d267a0e675f6c51a426f6
SHA51274c8a1177f4d93f112aae531e7ce8ddf2b7c8b32e8a721f52659cabfe6cb9ed79cacf43a8f221938bb9129782a5f62f02dc998c9919739caefcdb205343949ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5891968d615bbcd8ddea5b5012e7be46f
SHA173d3750039f64637c6e03657a5e413bc47717de4
SHA256043ab21a1d0e1a90095d4ca77eb796bcbe592e5f622e4c5c75d01405c2a48538
SHA512250b4716ee098b1cfe20f7c0b021b8c33cc0e4336822b9fba166eebb0c6dbfe76890c9d8fa25b0b1c3faaf58c042b88147828626ce2253a6994ba82a1263b2ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d6067542b918f1c563717fdb0fe0be5
SHA16c19cead2f138648529d98c8fc09da1ca69205d7
SHA2567f85540bb0bd816b3a0f516286f4a5b32d5943bf890bbca2125b22f1241de783
SHA5120aff16171edaa5e60f2bffa19caa491dac81418044e3131f8c48aa0c1cb6dde3aee5844efbc5782c34f02895b031c99bf875d39de5d620b9a7db9d394633d5ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d39399615789ad72b79a1eb2ffbca964
SHA1677238a7c9992048dd41b34f88d43693bd6cc169
SHA2563eb1774500245e9f71b453be72c012ef2189e3bfabf2c01e7b30709c4ffff0f3
SHA512f399e3f2369a7f07dbe65e9a71501e9317cdcacfcfd5de8ce6796bda9c883eec0cf2f3ec55a04b5e1d53f2f092e79b92c885e4d2bd9661bfedaf9d4d5da55e0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54011a05e9f09d1dff6ef7dfd011afdfc
SHA10b3fc1b7f9662690a278ce48baca8e40f708d497
SHA256705f72a77bcad2c2a44573c0b5a57f4a893da32f35e6253f3761d7f5d29c3efe
SHA512995cccd792048577e3e28f04cfac514065895310790842760873406f0ae2c878c10274d62e6538c8b27582cbd3e7f4582fc8da50480e3e1f401d2242d9cc9731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b99d4cffea9a6431dc7c07499119506
SHA14eb7bd3ddbb0fa8438ab55ca29d15014297e0031
SHA256a0dbb45758ddbc3eb04520b5cd7f4d381101c7ff2af06ff72f52bab6a35b93fd
SHA5126336bd82c34facba1d36cfa53d186e370fa063fb85bcc7ac633f5d707e8ba9b5e9b9f9d3643bd8c642e51a4413a6ff94d860f238d51f81b42fff5aa449b2952f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb33c1e004147943034e2a7e77a9867e
SHA1d3134a39170f1159c732bcab8b462d3f2aaa701d
SHA256808e4edef2d21467c6f18eec36325e645c152cc456bb41e85f9d98df52bcd40d
SHA512c2379ffc0ea58b253e9be897ab0d07af839f82681d34398c9cd5cd8b29f50ffc3b3359a587c4cf5eb5953d39e95b9755ee1fdb5317a36eebf7f5d94a8329ab17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6538a9cab8af3f9556d26fa525ab05a
SHA146b37b2f58339c8fc94deb11234df7a45d8bc201
SHA25672bfe410e62b9fd99df782c329bba50e4d938fe6aa945535167830892b047665
SHA5127f59255a24f5c4791dc187c6b3988d1c24420d51ebee4110c222bb7bc0ecb9019e0c7efb4511534672306e32873ff90f4d36d097ba5d7ed53040b0c9eec1ffd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b0a5c6473de0a5c54b788ad4c799b48
SHA16922b4d6346c39910b43a1afb39a074bb0a822be
SHA2566a38f1f680565f1450ba73100dba80c680009312ba3af8a16d519536d07d3432
SHA5120b25119036abf9c0b4711f61db93e9fda9083b2ac208c3247af45641150e817820c0373df14f3b415cdbeac1847452d733a8c6c614ea0f94443ef4920424b97d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b695f4ebf7a68bd6b18f06c891ea8aeb
SHA14cfbfccfa6d199cd3d4cd85ca0e087f499c2a0a1
SHA256621d8cce6c872f0eb112a98963f905c43d7331ebba62535d1e741ce8643fde38
SHA5120190c15549a757c94a8ad99a930b2d44cc0d29618fda16e006108c5d20378db9ce74a9e30378012c72dee8503e305d582ad566d87d44631d5e4504f05f0bb9a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848e038a74dd9e1c3689a3b8e4328a46
SHA167e463efad6de2b779349cae5d3e2612c052647a
SHA256c21176908e77fc390f7027250692f62131c52b1dfbf936a234b9da4ec8062ba6
SHA5125d76e87ec7cc25c74b9d3b05268958a3a7434c41abee697dde5e8da34244517f937af52646482f80187f1a7f4c3974d7796a45ceb5aedcbfc15863a36b420576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55847df9e547d57a837074c127c1ef33f
SHA194c0c439edf2a9e09e128e716226df08fd66480c
SHA25667c6240b87bf10f8932ee46a5d95783f04934de0d9992b5543ebc9be8d382079
SHA5121b824991831b70b8485b6506a371b3502ad96dce32b645e354990235df8fc9a67e8aeea825d6ec5eeec2d18da1c9da72a308acee148e6e4d858bb60a88207a47
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a