Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
0f1c902d04fd4570936781118c9fbcdc_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0f1c902d04fd4570936781118c9fbcdc_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f1c902d04fd4570936781118c9fbcdc_JaffaCakes118.html
-
Size
2KB
-
MD5
0f1c902d04fd4570936781118c9fbcdc
-
SHA1
e306d8b75715ebe3b6213d6233d3594cc5cd4f75
-
SHA256
4acba6461f48b27939be5224739ca00f6a80a35d8b98b7d912203184fcd3107e
-
SHA512
42e3482e885aa1c6ea90f86ca113b1fcdc8bd966aca64eefa3ffd4275a335d77751b3e33e7c65b54fccc93ce86c35a57d1db23860707d62d490ee96a1eb1f0c3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420853493" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009b9156a5652aa2edf606f5a9996b7dc5d4adebe495df472b79ba3eee7e891bc7000000000e80000000020000200000007e3894d8826cd765582c32d1187ec0bb8afb20ed9ad1b80a1c55a7cc1f61416620000000cf30712f051c89363ab4cef6090b44569ce40ca5d4b31ee46252e29bf1d9426e400000006f72320feed8a93cc3ec3c44ccfd46b90f9c7c54c22431c67cfeb2f1a9a353cefa72f1d99da7eaccd8a7f6f562ba814b44333d2e28ae157f0e88833cc3d7b0dd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000785957994e984b9f39a5803df28eeba6ea7286407756cf2f4f6befba37c68f3d000000000e80000000020000200000008b142fcfc5690b528317a7efeb8ec229366382cb08445603f5320f68305e20df90000000de218bb744528691865a897ba72c52e710f5d55695a2a11d522950b9b0412105c246f5ca05f70936a8b51e44ec832f7ec8f87cfb3a48beb76c3f30078a38f14ab4142dfb85ccea396babcf18f8ba8abc3e726efb628baceddaf251950e332a14f6cd7a1fb319d33282ccaffeca00ff180a622242f3c60727c65df6ee0fea291bbd184ddbf20088d3ad04f44f3644aea3400000008b9036f05628469d8bc23d5126b51f05954f3c96d09415203258ed3a4a8c7a89a93bf0d2d872ed99d8e33e0d44b520dd4ea340ea299da13da73d2e8d0739efed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A057C1F1-08D9-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a0f274e69cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2428 iexplore.exe 2428 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f1c902d04fd4570936781118c9fbcdc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5224834e2355ac626bea3390cbb6d24f6
SHA1bfd3d29bd8dfcf79322294990ff5a9c3059ebfe7
SHA256969a9146af97684b980415c11cdc7e035900acf843d91247e8e09b7456822e88
SHA5122e8230cab410a3c8dd965dc37d2c3e08d5ae45990c9415554e56875dbcbe07609aec80eae8d0386735bc9a8d3df2f7249bbf31f3dbd7b6cf16df96cc08d95ce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d0f2e32bc00250b956392b9147cce14
SHA11ff08a8a1ae67ad9a8dc7cceac29f8f476c517af
SHA256b18dd05e1b168877676e8b3519a485ef987a6ba9642cc78b4488b046fd5a0cc8
SHA51273e1d694a371a3a7d33a22aba47c14281b89ca902e32a2ae5e1180254561b997a3dd5aa19cbc7e2de33cfc468c3f8b038907b2332b5e184fbc32fd6e201db539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf37d5a1946f4b22681e245b6fa05fa
SHA19f444ced44bbdca892aa7d8edb856813af284ac1
SHA25684015ace6d735a7ff19208bb53e6fe774f80be34fc4d01dcab62b820c9900665
SHA512324bb3aefbee27af879cf4bdd986717bfcb014795517c7f1ef2811f45a548bd98e67ede5a6467955a4ac8ac29d6864492c06340a5f1c966334d0bd1fbd3c87dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a98a3713a495491d2b0d40a58e78cd0
SHA1af8000a614ee6ac348ae7eccd0562835777edd1d
SHA256789a5d76ca44ee8be89f7998a9f44e97d35636b18eafaa9e394c721b7623a84e
SHA5123dbd461b8b199b7632cda945c9b2b8e9f634f1dde09ac68f9e044feda06dde495763be45b012ea9a9cdc4e5de1b3a7a7a3d64d02a2966dc09ac4a8e15eaf68d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf3d796820eaf091f7fbef70853fc7b
SHA12aed69136ee1fa24830f2e74098ba73572f2998c
SHA256e0836be175cba57ee0d86a60866529c733dff71d891c94b53dddf8a90c29d0e0
SHA51263df6bd3828a94e86d0936704d26f8911de0fdd67aeec4f8cc2f2d6eb002f6db485aca623c6aa4f9bbecbd7cae8e0e9fa2ce5da2b3e481f0ade4c41fef55395d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b2975797e7822bd53de7297b3164b6d
SHA1e0f7ea6536640fd5d6ed1ff79428bd77d706c99a
SHA256411ca3bd0a3bf8b7bfd71fbef46496fbc60911d66520d4ca26baef3b5e4d6312
SHA512b747675084a3f56e23464ced26595151eb532df545e8170580ffae6fd206951506570601f159ddca7be92b6f7deb26be0f38cc2e6af855bf4e39931df1c1d7b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5208786fa3660a56e36c1dd4c39c0f7fa
SHA1caa9364a513a17df8752bbe81a1c14dd46167934
SHA256743567c5b925b1c12733410d17103e74b61fe7623b75ea8b052a966fefd15b26
SHA512f63844aeab1ecfdf408942fddc986ae5f51b6e8b9c685ce8eab3ee0070c52f58f9eed5299e54a2b68acdbca703de7d88564e88bc2360c2885b157add3f2173b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51152add51a2eae1a19fafe52dbab9e8c
SHA17904eb050e304ef4d3b9ffa3da38332cbdd0f137
SHA256c097e6f03fef361c0a806f0492202560edbd6eb40ef4b78b32d7e97a8e5c00d1
SHA51271061f1f5722011012e016b046f6c6edd36b2b8d87c745d826d5df662eeb5d6c709ff365e930b57c5716dfcbb9a02802553e5a70614e9c9b4e10345e01034c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599b292ba42a6fe4b27110adca7a65136
SHA134c5a3f940e7b908e379c1c3d1a8dc77f5014550
SHA256562f393b8a81597b4895603028d409cc21c2617c43193b1536630cd665027938
SHA512fd9fb06621afba83bf8897e25389fe4dbdcd7dd8ea072971ccb9c8e53c6f25de6510484b6729118788b9e1a83d06ca659a1d8c80364b86fbe0022f3c34b15b21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c15ececaf1762878adfad07b46eae84
SHA16b170d225ea7a6d785ff93ced38f42e4620c6983
SHA2560e062ff26c60a3b1ea22725d945e631799687e55dc7fcc3d46a9754feff0110a
SHA512409b5ee41db0829176218683c106ebc293691c3babad4bb62f487be577aa7035f42f78efd3f188080c4f7b297c421cee782b0fff735739fd5ab6bbca4464b788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b7f714d2279448e44940e0ada809193
SHA1e6c0a6f3dd5b5dd8d804a6c045832e0da6d23ae8
SHA256c10c6e84121e042be2a747e7aef2008043ac4073ff8ccee068562e777387ce7d
SHA5124364af5b8e6b0ccb1298fdbe0daca9be5f129e68bf7d13f87a273340f80ceacffd9967511cebabf279decb1271f0348d6ba695e2b6f5ad01c2bfa8e85772f906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba19b8961d2b6e5c51ff7d04bdf1f4ec
SHA15361f2327e85510e84cec23b3c435be00e9a754e
SHA25635effafb37fa078687e9f6ffb04a8cf047b20463b956754d714732e1b780488c
SHA512df761320c155579c1635ff8431b20397dc7bf6df8770a755385ace3a9160c1576c37b248c327d5a36015662ea2d08dbfff96e6b6597301f765a422121bbe603e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5702c10e8fd28311189465670805781b6
SHA10aac69f17c23e7966c4f481c138636534b687e8e
SHA256ac7f13386e96888c4b057c7183062f78153d7f1cd3d325c45e63362ccb2e9b12
SHA5127daef7544dbd9dfbfd6b239d30f1c0852b1d5af5d22502d0b08c1a1a30557c4e4e7e731746280c39554a363645d0aebc46024ef520806b213cc9b0fb00f892ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3090ad6a3ba344bc87c3770d1d0743e
SHA139b1887c1c0814d1d4c950592a2e4a0935302a4d
SHA256a24584ea0dcf8f13b7b1e77306786c085d41209fa2143093b070e6a072bb8a7f
SHA512c95cc8ab6b4cd2660e2ffec03c2486158f0e29682bfba2a568f38c30f823a25d2d502cc8773ad75c9b9d98ef8f34f66bd3617af0098cfc5ea036a18e3d0a9075
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e5f1d4f60180210be7662c5efda2fbf
SHA1a589668f00d8b88b8fc63414e244f11d3e6df0b5
SHA256dd113d98b9b33db0c585a45fec2e22604dce19d221e9a9dec90a4340739b1258
SHA51204f6a17fa8c79ed9cb323afd45123d4f06f1739e8d06a87dbcfd7a253be0ff0d60ba29dfac3d06907c91fe5b464d3c1549fccc879e3b6dfcd0bd54bff2bc0a7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597c3bc83361449000754a210e0fe88a0
SHA18527bafaa73987c601b114f975e7b07d442e2f46
SHA256832b0466d37c5c719a761a2cebd3397e0f3d755e9a637b0436fe3b0580bd6f4f
SHA512ca9fbd3ee337ec8587c4ff179a6dae63360062865b88544bd43cd64534bba25658d194e768fe4318d1c4793196467905759b60808327858ea3e5196eadc64b97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b882c36d5240724374d5a08197f1dd68
SHA14843ba011eee7b860cf4d70d0483cf3450fc106c
SHA256cb199f97cbea67a72d2d9a0b46b8c0c901ccf7f45492ae53bd87d972210e8ea0
SHA512063b8b43e27098ad2e561299cab87ead9ddd92b5086fbe63f38a913a4911201fba8dad01fce11fbb48839adabb8c4b015c81d82e50536edf04bbf40c4491f258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525278a6de4635bb7ab1172e5beb652a9
SHA15d1f758667c2deb8ac3c46a52c408889f1330222
SHA256496e2d565b43f5bf3b2f341eff63a410d17df8b4c8affa6437d7eaa304909d8e
SHA512d9025f000eac76aa6f11520f4771e219abcc80babe97d4aef36cf900ddf056fe84f46203f8055d252f344f4c0fc2d5615edc06e75f1cfd75729080f26e2f2427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b61c93e23bd66d8eff41bfdcdef42384
SHA12701a5162d5d100054ab3497922dee1543e5edb2
SHA2564855ed1396ae3dec001622fdeb99628da4c7ee66ce49a4be8d5ee831552cee4e
SHA5122d0d3628536625e434bccc5d002052a58b12b50a84c00d25175a83ca8c06677fa3c7dcebe21c1f4b71cc65f8c3689c3a014aecdb0151d9bc53acacd1c69449f0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a