Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
0f8f3957740019b4618d264ad0204ca6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f8f3957740019b4618d264ad0204ca6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f8f3957740019b4618d264ad0204ca6_JaffaCakes118.html
-
Size
2KB
-
MD5
0f8f3957740019b4618d264ad0204ca6
-
SHA1
1c3ef88add71be0510b7388ef412462ce49bd63a
-
SHA256
3bc9754f445aabc626df6b794b97672f0155b0278b790b886c2778db7805ef6c
-
SHA512
60a94ebcddc540543fbd5e35bec2e069c41b46ec8963f0424e9988429c3676e356be1aa9fd9efe6310fb652815bc7257f7261e46cc03c426a31ba4b0ae289cc8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000056c85c6a1283ed6288c82ead0e75395997275aff35397bc3f78493b5d86f2e65000000000e800000000200002000000052c279c01496b1ad7d848392210355695762418a0bfbcacf1abba640f284ce5d20000000c1c579f14fd093e9926afb723c3f82490e0e15d1f0c8403496c9eedbf3ec19f74000000033cfd5149634e3c797c0e843a44b04023c61962371a2c7f5fb84640160178a61f456e7f819dbc3778835d28ea8bd0d528597dbbcd87ceffe5974a50900a491f8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5019e45c099dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000b46f077e80540f85f0c0d99cc46d665c37812608f550f9e19e24d5ab6bb3597000000000e80000000020000200000004e6292b02071d0d05847322fffeb16a17f36691a5c46a77ebbbba844538db0b790000000d55e169627ef2a116a27a17f65db2e540719efa3fbf76139866e9b5c78129f4cf8b1d4d521bdbc180a0087958281170a51304119ecda111f649271848dbcbcf8de2bb95399608cd741855001186cc7a9ab1773b9f18edf384cdfeac534cf2d1ad3e68db024bd3cf4e750d2b2d10ad90c658858efcc54a629d8b80c807f38fb167273c4c8cab9e7ea0ce343c582e6bc6b400000003e7cc193679bb9e2079e5c573314c79e7b69e86303aac6f8d7888f2e7a40fe616d12db7bbc226537f955cb40e57e4d34de65580c021defebad9ddc350bd82260 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{884A6B31-08FC-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420868485" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1904 iexplore.exe 1904 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2508 1904 iexplore.exe 28 PID 1904 wrote to memory of 2508 1904 iexplore.exe 28 PID 1904 wrote to memory of 2508 1904 iexplore.exe 28 PID 1904 wrote to memory of 2508 1904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f8f3957740019b4618d264ad0204ca6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50528c26e3accddb7b75053adc921282f
SHA1671217d8db6e9079c82186b74f6d21f14201293f
SHA25613c3ec9c16c7040b9deae8497c710f32429a73a365e2bda35897b773a832c401
SHA5127c7d702b2e39318a17d518d9056f56596a120cbd0e178500210a12e391f9ae3d57bc6f9b247f2969b169cc34dd43650a344e8b6275cd5a339d3342d76b45ba2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c70e9ff05955a4e1b7300f06985c50
SHA1f0a933452550c626c8b7ab9a33988a6fa79d6db2
SHA256b5c9ece3434e93164b761e9f0f0876efc216fc1a2de816ecc1e4253d41f7465e
SHA5126eae240771b8e5f796ace5b1fb98b05514e1a22cc5580fe35086a55fe5b1c1d4b3c78fa5520ae0723b87f65505964f61b691b930132116ecd9b348f66bad9376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d48de538a147f6f4096dfc1373117c4e
SHA15b86ce462ebee2ac8f7e55d724429f4f6b610621
SHA2567cbcbf23ad90cf41c1c2965443280df6a8b1d9f063ab6ed032146e4e1984a6c4
SHA5126dbedbea847c243c502a81a859c7529a30883fa645c91b7c8611d3c6b0746af46bc77bcb6b64a70eaf09a70cb5e418ec1ba53e2f6885dc30b628d8845a4bcc4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cc96fe3c3d5a731313392c2d4746799
SHA1deacc5d2b6198db6d0edf0b6eb64950e208730a5
SHA256695ec48f9c17955cc0ade76ff8c9d30fed142aba3cd111937007774922f510b8
SHA512cac9bb01da6bfa9876eed3b4e9204a46e1c7a81f22797cd22ebcb7fe3a0484541ec60686f8799ac0ef21954eedb349f3b0d56d18a580aabaee01188c76dc39fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bfec190336500efa62e2451ea4385d2
SHA157d8a46709f3ca450875e6247cff17b75f01d994
SHA2567d9a7b78bf81a76ace56668d333011806cf2c442d32323fc690afcbacebbc65b
SHA512fc1e0b6f2ad10d5207928d324dad8f1ac460fe9797028695a80576c9e44e2e95f7c192a011130774bec233cc9de9f56fd4223ced6b21f2226609e0d0bb49fb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ecde56a0063057acae2cb626eea6951
SHA113b2a7704c39d14f59a40043a4c87787b8e6d1fb
SHA256511688b397c758931bfbf0aef016722e0524b884827482610377c44c326382f1
SHA512d65c8c813d3d18970208b63e3a3cc5443362ac3c1b7b46c8c2e4895c4322ac0ac09cc58147785b5dc03bc954b06f504ede24a82925c2b9cf319fd2afba42f66f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd3f7966b33bdf3ec4568ac9242ed79b
SHA1b5b422fe608be75dac7842ac6f3069ea560875d4
SHA2561994918f6543c3d4eb5fb31973591dbb2a00e5a03df7f5643ad6a2655ab98deb
SHA5124d29b6df9bd7bde4edc27c6bd09c6eb3c03c49ef54405c68c5485f225957d19b3c00b1323472c8a749f9b44f1b4e989959d2d236179b8a4de03fe45e3959afb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad56fc68e8fac34db7e4c28b0158df79
SHA1979cd0c118b702841f8ce1967d40595957a79c0d
SHA256193cb9026c77edcd512ee0747c9daea08a2e3477823e45a60f2f13c2810bfc24
SHA512927082d89b7f7014acaee9a41e3c321ecf3f7b0cbe286e4c1845bda6deb522d2692e5c5b9ef69d26546cf2e33673761c0e1de48f68101496aab4920010c82a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d359f7c0d647e135533a9860aebcce0
SHA19e50a812a2e82c076256b9728c6de091aa6592b0
SHA25616c7121af71ebdd0c2b5d47c1ed3e73095dc263bf4e009ec1418e8ac1d51572d
SHA512803c3ada4ef068802e4cfb85ac588a0785f31a4f3a1f23ebc64e60d04d98fdaa9fa7da99ec95e0c02e60ffd1502a21b06667fc6676d45a6c85c00e910bcc3164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca0e47de231287638995fcb9c36657c5
SHA163aef54842af50b07d2a191b93c56477aaa82d73
SHA2569b0034333d512be14b0cfb658c4f2b83773b8bdf1f3da604669c66dc9805c236
SHA512bdbca693cfb6881d5a788920a24b5c81e7c51a08f2a8f48fed76bc8a4d14fb0e609111617c1cb2fb24817cb42261831345b09c0572540d71868ce59127093cd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca1342ad37c5b2e5ed05827206bcbac
SHA14fc4c64b4a11e7a11dba690f229a25a96d70817d
SHA2563a6b885f29ca35716f24704e7bb5fcce14dc314646b63ab99dce9287234ec3a3
SHA51248fbe6cb96c8ebc27588e22e84020b982a9b0af626af5f5177ad77b16d0a3ef72c0d8c3e822197dc031a682d1ef2efd4d3554b95b4281e127db197c909535798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563d3a22241a3d04b4b92e059a91606ad
SHA1885ef647e17855d1102b2929700974dbc1b909d5
SHA2567f27cd65bfba3ec7580045c1e0e1822020637301d16fc12d11ac498c80a5b8f8
SHA5125387fb345ba7230549ef3a342a6105a496e6a3b01abdf0602ff2a800f85232082953c0e1d6cc42cfd3d7720f5129d47be85a14ffbe46038002b1011122508c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f685227fb1ea0937e8a77ccebf26b2bd
SHA11ccd0e7c381229fbe0bfc527a00e2df925e83073
SHA2567d340d2f850ac5dfbc07e50d5d09238f614b7d179c1f7a4d1fc9bf7d0ccbe31d
SHA5124bec310349afe964bfaecb78e52f20add518daa63d7e86c13442d775206acdd5f520d997bd7c370a2f4299543c43cc16119f2ecfeedcccecfc3d95e51dc06b48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5834f2c5b28ee6ff1352a61e1a78df88e
SHA1d2a20fbf9c9dbcc22a6b452b123f3d7b6cae44d4
SHA256f7bc1e15b9230b4b5e51c26deb687bffea2ca7df0bded7cec985499949b840d9
SHA512fbc3beabe2e95eb8c40448b5a3a7bee25a2677821bab13b22e90683e9e14fca10fbeddec6ed183a3715c34a7d240632d98db8fec1327246925a7f368dbbb37f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8c50711486aad4e96ca604bfdee7326
SHA1dd027cbcf9093e48d85ec875f791092b7f5fabe8
SHA256164594bf6e091535fdeedcee51f00acebcf0500ee8d3c46729c32ad1d04a7683
SHA512e9a925d216a0663098afcd10dca8b7aa8a6e8b547e0932ec5881c4b6a6d7f569c606994f059884303aea1fb4b2487d3d37c3c7edbdb1ad7c358b1f30ac512ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7b0274a134d01369676aee3778bc907
SHA1a828b95036344177539b32f65b6457cdf3660ca2
SHA256439a308fd294e578ff1ecc6fbb7c720db00a9a0fa23f2dbf68ce46730048f5d3
SHA512cd79e9ebaffc49602186d6b2f28e8a1d227789e3ce19f8ba667bc81eda79f39b926e6e33b0255b53f5c2fd367beb5176b83895db6b60b0fa52085ab1f7530be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5732d5f4b034be0b5d10ece46c4dfd824
SHA18a480216261e7c9a3de6d466fa794173ab77b673
SHA256a53b241e4f48b2efaf12e450fd0a2a81fe6541fe05be512661913d619cacdc74
SHA5129887b16eba23beee23a7185a16b271844ed8b3eeb3e4703ac021a69a54e23972d7dbf838ba1fe09ecd578d517a6e248b28adf76122c923e01844ec4650512c33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a2ee1c73c4c3ba59e740d3a85a330c6
SHA10eab45a658b1c54a428c2ad8b1f9c916ddf1de0a
SHA256fc6ffceb73d7da7e054a5964a69a1844f0fab552e4855727016379cf2125abb4
SHA512e18d0e07e1ef560bb13fd111ad124cb2be76b885b90b4f926372c68ec5d07a764862e41819518bccd7169740b73a85db73837d790b03aae22e96a61c1ba18b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582c021c828fb0611c68120beea23735a
SHA19356b28099dd214563edf82a80bf6c6e551ce322
SHA256ee077099823d1c3dbac840e5f11947aefe35aaef7077e11a3c66592ff04c9304
SHA51235d6a5a8f1b13f27186c2807792deea51081d7b334307261527a111d515d6afa39e69d493ce2e66a7dadeeb7b2ab4675617b0ff794d2a573e1fa7439cb2c712d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a