Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 15:13
Static task
static1
Behavioral task
behavioral1
Sample
0a08d8dfce877a23160949f30ec03788_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a08d8dfce877a23160949f30ec03788_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0a08d8dfce877a23160949f30ec03788_JaffaCakes118.html
-
Size
9KB
-
MD5
0a08d8dfce877a23160949f30ec03788
-
SHA1
094da0703a3f422a012a8650a0e2944449b72571
-
SHA256
97016f92c918880a0a8ecc8acee462b96e962e96a19eaa1309eab5aee3ee24b9
-
SHA512
c65877fe5f6a78542dd97ccda7cbabc6032f6a66e33aba36e2bfc75f1390c114c19580227262a193086e1ae6ca1dd33662fd4766d5ad9f683384da8882f3305d
-
SSDEEP
192:PuGyK/t91bUVfUZwCteBESejY8mEwDH3jL3Tn90j/TU:VyK/t91bjCSFRdkzLjn+j/TU
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009e6c72d126c8f8c697720e9d82c2dfde211f53b2036ac800590019c358b76e1a000000000e8000000002000020000000c42148fef561ebe06b89fd4de51d01cdf0a43df2734f96da160e7df5252216e920000000d92d9204ec7fb8ee9fd45ea13daa03c895eed04c9ad15f4e8166bd1fbf341ea14000000015b562268647393c3bfd4e21a240be31a682ef2de1c84924c6eac892607d24eacd33d29a014a187c9af19f9bbe1be6f4bdc1f06431fb9d7ae9458a3213f688d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b0130b119bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35A414C1-0704-11EF-B937-729E5AF85804} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420651880" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d922f37c5671284b84a4bd7725780be965171f3f1a977d7422cfbe133e28bd91000000000e800000000200002000000030aa2a1833039025be9146b7c971df7ee93d966e70e923d45637a721559b3a40900000008f25cbceafbb1a74e3a98e86a581af707dc646c3054f46fe2281fc5ce717992e230bbb22bd8ac7e05c545a5439014e8d7626f36dabc1f66830e0e9dcf2db051a55a705d85548b3516ea0159e1746a8bc299ca401a013b6d6e398467654557c080882680e5cd6bae099b505fcb4ac1870884934206ca52192ee3b7adae4200c5f0f705b4b63b2925378113b800b63e71240000000f98ec3c8326c612e0b21a539da517f9ebdd0a843f680a41939e9fb01c1a2613d87f3ad4dff38ae493962358cde4a5df839c00ac13e8198491a5dc6842a4ebd9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2976 1720 iexplore.exe 28 PID 1720 wrote to memory of 2976 1720 iexplore.exe 28 PID 1720 wrote to memory of 2976 1720 iexplore.exe 28 PID 1720 wrote to memory of 2976 1720 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a08d8dfce877a23160949f30ec03788_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fbe0247455922dd2a54d463c8257509
SHA181d7f2e1d7ac12ad7aa4e8ac6cc6c24d4aad9b29
SHA2563cdf9d85958872955260e8d69d218416718726763f87f7a0397e7cae4b5468cc
SHA512b84061638a71e399dd58d7ca188064da62cedc0a087872259b6ff96d7696a3ccf4ccfc4c98432fdbc0f3e8b58f036dc7abe7abd4e71fc91629f8e7a3d698a2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5175d31ec9650f38cb1dd3f60f2b3913d
SHA186990bc979925ac4af18e66b048ca386941f703e
SHA25604bb9bb1ab40528089a8a35b6ced98927951aa3715691a9df6a4163a85273f64
SHA5124b5b6fe5a4fb73c4abb91854458a57ab31cc9eb6aac94f9ed7286ffd2fa2eb31c8229be23759db2403f9cfdac6fde708e8a70c8771ecc6592c9455cd3c46904f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5170a7664273537aaa4df5b6ecc26edf5
SHA1e910090594fc85015fb3d05c21fdb3e2944fe9e7
SHA256a6b64bfb6031895bf4b5d6c4b8a5cff1cf3e5b481f8d82ac174ede3655f4ea45
SHA512392fabf75c332c22e99484bdbf8c9b0b0159cdb7521876ee552b298f0868b5083950ec402ac7f06c657c45ccb5da687243d061162706ba77acbd03cbaa3e4561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595077485b10668dc96750434568efaa6
SHA1a736afd12204d382e7f22154a377822327cf80cd
SHA256029fd7c588584881ac15c576edfc4065f69b0f001b9131f58f08c4ea421b1632
SHA5127f45f64bac7df8f52716dc64cd15b1606d781aed0b290601fbdc2397cbf0990ffe00125ea52b7d7f50966aa5f312a91edd9b426c0d0dda3bbd6d8451be7eced3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b731151a989c4c9950c4dd5df0ae2621
SHA1cd904f9749efe53b17ce97e953973996b3f6234c
SHA256df7193eea43ec6e414d33ea0ea2db1cad45fbe421b077f57d5147413873ed068
SHA512922ee725c104a832cc2e483a7f55bfdc11cba1e73ab40be4e4994d7245cbf6c5d93fbe2c76bf526a1fad62bff87da3647b701f3aec730b9e845cde2c68424ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c3c09b1f6a0d9d4fd9cc777d6e81ef3
SHA1042119c57a87efc2c9714c1906648c2db7a11fe7
SHA25680d8d7944612c2e7f1bf2c50f7a4c6db43ee1d526ac8e3ce3d5f57a932bd4cb7
SHA51255793defc3cbb160f0995f7d677a5803190023803183304bdafc7cd616bd9123a34de0129e60fa2c055aa6a5328fc01b950d545ad5ae6f7e4bb75641b20d939a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52526193e99f44f77b2d6df506735fe99
SHA139cccd666098ddab7d59b9e8923d3421044dee10
SHA2569bbda4520b328bd86350d90cc94fb5f1506b210bc71c9f9a51cc7ac7c227aae7
SHA5121e3b3f962cc419c1aa485e7dc7fffc3c8b82faab719ed597fb1e9bfcb760d1f850f87ef892e0009b2a36701203a18d90fe55c74c5d33349f97bc08ae5da95719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ebf20b31281b9672e35025899907314
SHA1bfd08a2bfbc19af2106c4ce27b5fc698fcc2ad37
SHA25655b1c642d4af6d6246944a98a5fd72454a8a0ef30dae2b17dd8f2f90c3ca52ab
SHA5120740b07228ff277759dae94b25c085a4b04266ec4ef60c524654c43f34709e671c6d272c802cf06584db3e0a649234015a33f5ff7450348d5996c629b471612e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da9adaccc37c9700d14eb19b8c8bcb97
SHA12cf1290725c27f33e045296452894e5f1dfef884
SHA2566a58913805aae66687eb4053d0decab3383e1e9a93b2828542c138a5c2b892e3
SHA512f100564cf684bf9fde342058b3a4c919b96f0195c277191fe1b1626f7d35ddc26b386a61131537d4b0e8e4f6a3271a0e2941a1f25f5a5c8b2c520e0414770d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c88e76ab7424f016eb680e84eed0dbe
SHA1f627cf9ee3ced81d589867762c0c90bee43507ec
SHA256b08c155b8ffaa49b286c1fa373a4d36d7f19578ec8d4f23d5e28c4d6a684f19a
SHA51266ae68ab6c36767c71b85527c59b8e0f2cded85eaea202262ab6f17495c56dea3e74791774c07289ff928b44884cbd6a9a909d0880cc696a2bd7f44a5625126c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502256e80cf75dd63f62a1b7f733542e4
SHA10cbead974606bb1491e5915c85cbb4f353d6966b
SHA2560ec479a40badbb3a7257b30bf1f759abeaa684ac231815111ae805a508c6ddd0
SHA512c7ed1dabafc882d073a2257c95a29eee61eb5a60223ec2c32541d2aae14af8e8f45b0d5caff6d8de16224d56b17836ef911f990b9a501a43271bc5131276051f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f93bc65a9a0b436e4502c31c23d001
SHA1fa81529f2f0c7a9d7377a9d9edfbcc41f4c8b137
SHA25602c84538599884d133379d78734950c9e4167815e64e379ad5af97e62b129c92
SHA512d889e19bd07862f6fc4954426750fd55c8bd1974e401d516ca4c66998f4b44c717705885385139fa9b9a23fe607e6d20f55e47a335769a4369aab4f7f58ca622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516aac0d835e16f39d5b4c1759ceaf3ac
SHA192eaa3d531a67da13e81b33c05842653d379e2c7
SHA256a6e281765fec504ba9805e51604a706face40ee3199703e3b67dde4fe4c6fe49
SHA5122e2c8a27f3c10d83b3955cd3abf6e8fbd9aa8fcffc0606f2625740aa109c5bf4600d94cab5e02802a99f27972855da395df8b21e8eeb9f366dbc7fec0066bfa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54863ae8c1ebc8c8d25883f666bcc0045
SHA156bb166528ef3442f4ab44bbabad152e4d360edc
SHA2567379245f51f437da2da33a39148f657fa78e66d9944a95a57c8f6943112d71b8
SHA51238f34dcfb2c4b8bfd1be4a2099d7fb597c08e3f0ce391a923239069e74a6f3ff9d77f130e918fe134f374d74a17df6fd1fcdd7dbd29f58d70834324e691e5e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dec63653ece43b8c55a17419f47c9208
SHA16b54daf52b77c93d076f695b580e1fc0a41cc7ff
SHA256863496d1661bcf2a52bec1a7f7b1afe6ac79932f05c78e889e8d4440dbdc90bd
SHA5127b082206c67efe37483f08b1bb607f70e5f6e4395093ddca139a02ec7f5c6f1bd975859e6c223e7d1e19e375b4d5b42928f787d198ca90a336c94af3bf8088ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536447c57e921e9528a9d0efac33ce8da
SHA16248e9418f71b75fad712890e9788c59b8700e85
SHA256961b0ce6062a3048a5a5b025be406645725a777a870b57ea3f4970f3771ad142
SHA512af1e61822cae758fa9396a7be7963e447206c83c2a2005ac51f2973578189e303fa0a858c1d1471929d247190557ec63ee19d2ce27cdc47cb34776dfd94d9cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516a4864c426d94bb56b19d13f7d21b1d
SHA198e8505196a103a2b9680c6f3cbb5d7c2d101416
SHA256f5ff433fde443947d6a09fc0ea943149a52d41bfed61e17f9bf0fe24d9d38e42
SHA5124531a23a65be1714ca3150ad1d6d46ac1d4ca9a80649cfcbfacd86ea8d5cbd8e81570aa8765ef3b61df0f0a29f96c66d421a0c3704323ce3314d35ac03545adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597db86c697ff28059059e56d0d83466b
SHA1ea01ead93f8ad0545404e9e65a68e124f3d4425f
SHA256653fe7338b7b630c8742db4f3b8a52d154455f9e53c69a764dd7bdf684a48cb7
SHA512a4f0f8c7392f2d5f9d880517a2a2fa92906e0e9d686f070f6f469f104b9b86561591ddb7e476845e0d48c5a857cd464497b9898ad490a70536f39738b5f0103b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a