Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 11:38
Static task
static1
Behavioral task
behavioral1
Sample
0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html
-
Size
299B
-
MD5
0e6389947a91d8af11a46d17ae00ec84
-
SHA1
fdeef42eaeb1a8440fd704403c3928fc7dca3d0e
-
SHA256
57a51d4b794f63094e02d05ff531b09ef82ec8d10cd526da040b534b7ecdb952
-
SHA512
c030bf6713210283771d8995825c5fefca0f299ec4e5923f347a10b8c61a09933944e9583e844c814bd84676987886b08d21e25579e64b76d6c94fbea7e3c3d5
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000039942db23ff8f2419fa7ee058504373e355c32b5ffb3b0925c2b044154da433a000000000e800000000200002000000065c840ee97f24d4646bd71d271b298d51ffb9600fee2ebc3fe163cc56a1b527d200000008eec1cc35b456237ff92caea33792646386ca19025ffec2521763addd683eb38400000008d131b627d931591c0d0fb17e6202d117b6e288639113b488834a81475a658d40915a040efdc4581505056c92979c391c53e82ba6e4457ff3f1e0adcc87b954c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003237f5c10da228de22ae1f0d637ca73e937820c155eb6413a54719279576d49d000000000e80000000020000200000002024d28e1bdf16b4ffe0f15669911cc8337f301248dde97cce7f55f2c7a447669000000009a503b0ab1d26e1cbd5ac4ad1d3d842d8ac5116f2c93d3210020494e2d03aab76da5ceb780d475f77ea912f732c603f138ff9632f7300df1c3379ffa0f26d563d740e585e9e300e670149754a045631fb0133ce197560074822e25ca082cd30d4522048c9b3185f7ab0f9e1a2586e67a3782734324ed0f4c6c7170ef570253d329060ce551ec00818abb4f6994fe2d94000000061dcaf9ebe4cc8a19eb16d7771eaaee3443720486deb1d24b396cd40b8e5f7003eb88158c77b5044defde8a88ec46f92eea3a9c63a74ab1899f3c51d686456f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90F72361-0878-11EF-A3F8-62949D229D16} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420811807" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a0d865859cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e6389947a91d8af11a46d17ae00ec84_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd46842acda55142d5553b7447dacd0b
SHA14b3b3fecbe6390cf706e6cf5e2d80ac1e42a3d4b
SHA256d33486c2dedb0ea5eda4ed41aee9b8cc3da7a1e45c1183d6cfc4a2f50d040000
SHA5125f7d377c0d0372f1c1db76b9de4d962e164a3cf216a46b7db7290e830a4230f57250a41bbec441c00d2b6da050010e4cf65642c19617f9969c3760f63f15733c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550be36cdd7f84037222a30208a3f1c8e
SHA1eaaf17b0520f16fe6c83f79cd2c92018fa73c4bb
SHA25621ab71bf150e399b688e3980862fd79a52e65d49c5cd6c6f006c901059e7faac
SHA51249cf04efeab22e611e0684b12876631613a0c29aa6cb3c65a07c70231969e13c33fd6678a4fb09f04b21a1de6f2b2d32b9809d21f5cd2b645f90af8e8cfafa05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d66fc7ce08154557a67a053ff0e30b04
SHA1abf2f8685097e8d87f1ceab518ec220d2b2f53f8
SHA256cc26424daa82c07a1eac883f9b264fc12b96c4bc2ffa47c48bc45c5fc7642d8a
SHA5126bbffed6ba7350493f8f470ca5de8bd5a44e93231d558b4b82b3ecb300eaf3dc7076054ae7408e6eb5ee9b451ef6df0c4749bb5df0ef0f839392117bf797591f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c4fb8b05bccf4435c45171417c8c0de
SHA1629ae6d78fa9409f3ac37c3f38721dd0a397eb92
SHA256cc6e211f7efbe397df9f2db99145b62e9ed4a0b1516f2245a62884cff27922bf
SHA512f7789b672c5ff1fcad5a7acb54f553b52b656f36054bb6f6332a17ebc959e0f3ae36998d10cf9e296a7a18c0f81c321d0e7ba05beb3dd1a9ec802a1069ff00b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19da598c99af3d967731488706b0674
SHA12f1057f895ef73714ebe5ade216ea9976c1d695f
SHA2569b7a18fdbf8b5dbd26a414deaf1718bb0daea3a5e573316b5b45167faf466a71
SHA512438db46fda1e14efdaa6b6b3b4e5bf54f6aa8e2b216ff65d75bc971541862deb45b3e9d0e6e2cf3ecb4d746aa08f1a311f49ad0eb8e619ad128dc7f0e246d0ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5672165f3a6e8f1c600471f9475d889ac
SHA16bbd4269387fc53c083e52380ee5a8b58fa6d414
SHA256fc372b795694449037d0192eadf4225e90415f849890d1220b97f2592d3d10c8
SHA512bbb1852bcd2b29c41731c5c33ff838d2fb131cf842da92c38ab73948f0b6c3971936d85ecbafb30efe36075a3989a71f8c7e116cb57dc6d12bbd10084f9f9923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561d3a14afa9c83eb1c26bd8f17d0d717
SHA1af06e511302d5855425b226e6cbd073d7cd16632
SHA25685f36107ef61f80c876d900a3393f617a566012a6baa231335efcd069aad9c5b
SHA512fb27bae7f87d4dc782f71d9ec7112918cdf9cb976a7b25e88eedfdaaf6c0f332504e594c36b25af2e4d87539334bdebe646c2d2ebc3efefc4d62feb0c57cc744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d66db1c3d34c3dead1e7536748e2d784
SHA1df06d96963ed080b107dfe90d53678bb15bc4891
SHA256eef5043e7267f2dac62f18311d0634a51e15aa970f283230f1eb9255b8b4682d
SHA512266af5735ef4d1882a3ef14775acedb90320d530b15c3daeb6ae931657a872107fb40d74cca396917fdfa74aecdd55f8531afd3b2edd9e1f6a054db9fa8f361a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565730420338df4e286667253e493165b
SHA143bc634fd0db214149457f09cfa5eb280b37328f
SHA2568f151566b6d5775f536c1ae74f0805727e81f62c84a7f8dd2aa8e63fdfbeb289
SHA51200b3998035d7272d42379381da32f94983db4c8c6b375529b12d75d4afdcc444b0ebffc7de503e9d6f08ee6173edcb46ee2eba16be2d1dc2eff55c7d71de22af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8339ae1c829dc8feb317648e1f3329f
SHA1c7f82bbe2e1a4867152cb7b298cab73ff9a46a81
SHA25672f8be2a7edf623fa0abaed5c37054dd3a94131307a444ebc96d951adbca3b85
SHA512fa49a66297ad5a7c1bb7814bfaacf3625cc81ea0a00c36fdf9b0d4aaefe3eeee6715beeeee9734a4b9e662427bb907d677648c3524bc5f48923ad51618d364fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68ec390204c2c2881fe20eb006a5886
SHA174212bcf9a9d9724ff935b20fc2c9380a31fe6bc
SHA25649b5bec65f264c45253ad87c228114a37fcabe10afbd639b337d85982d4530b5
SHA5128dd92873f83de5517edf44904cf0294ac246328018ca01300a753bec0ac4ebbaf069258967dc17b4c509ba8c6eeff4b0a8779330732a752a535adacf3c8b4e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa9c174d89908ad1ef129c285df40862
SHA178016c5d05f87ccb65606e93a67f18cadd238f52
SHA25673bc537093959b0bee2286c1bcf6ddc3cad4abd6dad6a6bec2ffa2eb9e2a94a1
SHA5121513c7aa581f774ae3738bd2b6aa755a2dddc495d47a8efe781f11f45df1392f08ed7fde5d1e068f5ac93db9e134ad59e08080bb90ca42423613a92c33757847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5df963c36a345a869ffe6e9f0b37309
SHA1e9a68928d04865e99d582225a0eb1d7207284b07
SHA2564325296c700f1fb7628936e321aa2bdf094a7ddd80f493f608d368d6d8863c0b
SHA512892b2d2af61b5b0e39be689c1c7097bc7fe4614908368bc17355a3e7183f548803e76df369953627fb5ecca35d21b90abb963d97d2c01e716f872eb7637fabd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d32fd3d55f0322eee0904c550467ae3
SHA10fe27672890b85a5c9e6061f7ee9f4ca5d7e3864
SHA2561351e6d58e4d4692ac12dcd448549903861e8395fa3313877459cae90ff887e0
SHA5120c736d5fe6d11f07d6eb273d0cdc68531b96d39e8bab8f3774eaff4a69afa34923c0c4d705d52f668634ce136340ad3b4a32d52a8b5f88f354761674a2a7316f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54026bd97c4ff35422e4bc4e904ac361f
SHA11138a4c0519fabeca1478b627b33768f30a4292a
SHA25623b64a2f4f290b33dabad932fd5cdd5b2eb9e71b6051c79798b2f1e7b7e59093
SHA5121911232fd80be43477dec1250e01c80d98090e34e0ac2e3d2635ccc1cb53884db409e96c8f496dd144c36168e81dbca4557a58c972b72f0e0429ff9b1cd0593f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503a1f0bf5040eef6815dbe6b81c6c57b
SHA10c6eff9f171afd7e0b5b3e5b1720f582fa6f927b
SHA2568d55a79de9369fe8f67a2060e92373d4b2cd0d0b87c4894fb0fe4df81f9ac062
SHA5127443677fc5530d3b7986c291dffe24013939637c6640d2f3aba6af24a461bf48e22253340e1aefe3293b8c989d061d866317010b2c70b1fac39144aaf6944548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532fb50b52bf3cb271d09c7ac08fc6c8f
SHA1dbd4a9d5afae3fe8d034fa1d65a26b44c373ec4e
SHA25629df3889b13aef8672e8d64e8b154065d74c3368540f5b170d86238378c82792
SHA51204100ef8941413c1c808346798f89d125a90a4d3e1596b8b0f01688bd11c3c1be49e6e062be57f528ec7c6f33aa755ed3f31910da8e4bd62326db44e423ff425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6193421543389fd5f29b9219b0612a2
SHA1290e9025e7ce29a63d2f4688129107ded7bd141d
SHA256d80e8cce475d9e485cc0ceefc21d5596eb9e378c2e3a079d73e4600e3fa2512d
SHA5127d6dc90989ff36c864873182752406ba7167e1541d375b4b4c7abe4004a9d5126e5c82e1cc64dd1621f423cd9cd9e08e37e8ddcbd9b50b2fb4dec7ed368eaff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cce5a642fa96a8c0e4832bd30121b2bc
SHA127d5a34983f7e677fa66b6e917e739f350cec140
SHA256722c4761b3a185b77e3f8fef40a150ba9378e60f298dfafa520bbfe8a0955412
SHA51207b119adea0417ef2d067aecc9a844168f742d1b180983b26d090d5f7d19e54389b454dcb8b7a0c00102d74da681e2148dd04ecd8732d938fe555ddef4206c33
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a