Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
10345af3e6a3674574c665a9004cf143_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10345af3e6a3674574c665a9004cf143_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
10345af3e6a3674574c665a9004cf143_JaffaCakes118.html
-
Size
897B
-
MD5
10345af3e6a3674574c665a9004cf143
-
SHA1
2eb4fbbbcb683f791559719337138e2105a266de
-
SHA256
266acb8f243c63be6bf0668a3ab5d26b54655195f76dbb4c55ad2a97fcdb680d
-
SHA512
18b4a6fd2a323c23746b85f459ae0eef4df9fd648f34d71aa45af3a81c4d1b97a784e13c837205b071a3f72b04f33e869e08784ab015096a99f5a21826b097b4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420890844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97473851-0930-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000fbb00b492c1791a9d583c1182732e5cc2dfffef885469cdbf5a0d16ca05f7176000000000e8000000002000020000000802e6719cdcf9712529ffb6a254ff7aec012b6a90d65023d6f87ff466d7f16db200000007ec4ab13b789dbf6c7853f8fb065a86970492a84be6e9ced4d5eae953eb270c240000000153d195b067001917986464dae37c0e72f3fe12badbc97d358d8e71f307da1fb60578d7857e658d834144b5c698d64233f8ef9b3274d841a141330af2955b297 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000079379a1561bd5e05afc6a877feec38750fa63265c56364da637dcbc360b992b1000000000e8000000002000020000000177d784032df4043f8e81a81c8518f2763cb24066d5187a715d4e99836d90e28900000001899910855da2b7bf2cc4c90730d5195141e4e77810da27dfada8e53856907d72158087f0e5af31aba1a3369ccfd7982d06c0031ee9c4eed7132971146372f00e2f8caf1cd0040f62de3c1c69aad2a9317a07b1049c48fbad40f9a816d91a0a1945303d57abe58cc1f6d1a023a901c808dc8b764560ceee1d67e0aabfd96ba916b23ad16c40927af62e7a5a536f89ca240000000803be896b66faca383567202710e4bb7f98a0617ab5a46257d8ee3b174a7e3632dfb417e284979cc6d34dd811aafa88cd0d6f40e8caee50c601f6c2d30a9b88f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503ac66b3d9dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2036 2156 iexplore.exe 28 PID 2156 wrote to memory of 2036 2156 iexplore.exe 28 PID 2156 wrote to memory of 2036 2156 iexplore.exe 28 PID 2156 wrote to memory of 2036 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10345af3e6a3674574c665a9004cf143_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD513440c0a4b658e4d4229344d7db64332
SHA16ae3e18ee64021d88089c19f656c334240c79bc2
SHA256ed01d459c682acfd45e600d646553fde6b68db2755483507cdcbed9e3abcd95f
SHA512d8d290fb937557286d9edde186d84993e4e59fdaf5b7d707dac1630ccc87cd0f36bcead1bdc6be5f0482a71aa6680570541cacaacb18470e05f98503fd19e16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c7b36f6a6ecd2dd1d6068c33e721450c
SHA14e8a7602f436eff0d768c21fc0f4d92c0980a680
SHA256d3f9bf5978cf46d79954f96a3b7bf7c8e419047b296ead6ec16160c35e98ba31
SHA512b28ce96f7e39020b389f7eac156e7a22cd628e98b37a65149cd8f7c3c137a9c88ff09c4266f6d57369a147c4c9abff1175696609757da62e33e6306881868b6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c5c04350afe0a4a978f71656346003c0
SHA102c299ca2b5bd213a1f64bd895d88d4064e93c77
SHA2560ae36387c1074b18804ad6652bb0bec049a4fdefa6a1aa1e2b4e83ba4c64701f
SHA5126a0aa35dce8ebc2aa3c222030a783416bbbee71f3331aa572fecf0eacc808d8510a9a70e69c2306fbbf8e507ca35bf4111daaaca9574db37b601e18f688650db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f10e5fb16cd02d8728fe06e565c6e246
SHA17aec77b56a708163b038048fa6bf03073e2f9426
SHA2564b5d195029613c4559e345d9efad574ed1c47a39088d6d18a43012ca1d78b3b4
SHA5123d099bab7e5949a2642f18141d2e03f8d8418e6d1aa9a29f135446efcab658b2342e5a20f6aee73b3d3a2c49903f7e7d3b5fa03edf466fa91d694f569dfbf301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f67154a6aeb45f97dbfb8afb8f64103a
SHA17d8abac2ce5650b2faded94944342351245a948b
SHA2561bbefdef9134dcecbd821ff5f441ea0d385b713502661aa5c9e17d37cad8f88b
SHA51207502c3fb5f8be7fa6f1fbd574a631e9ed69196bf660b143038f0b946ef63c4d1f632fc48d9548aa6f1b899f05f292603e7d9c3000721619794864b9e98faef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54f2bae664de8e262a3ef41eef0dbe9a4
SHA16f4985f028925ad4ccd236c0d329dc2bba0e31fc
SHA2562bf829be3c258bb0af7b12d3d499596177c5baa917ed16d3e4c5387a42f8197f
SHA5128fe030cd8c51479e2d47a537b29fe83a3ce943843714889c2103b6a47aa65442dde77c60be89f4cf1a3bfde99f0152cabbf5424ba01b14df049b87144ca0a640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5659d8998af1bd68b37266f938b04cceb
SHA1ae027e427ea2a5a78be38fe6952b04681b0e3218
SHA25650eacf7f836a27bdad7d537283341fb2200685a3a5ece4a04419776b0de57aa5
SHA512a8cfc57c72f8164ed60044d27134c8f42796cc2468655791441da6dc94e64811d5e5a6c1d6f68fe7335f0fa7f6cfc4a4e74c4fb040d5e90cf3f7e294c7cbe53a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a0bf4fc20afe4fea75a6f58f4f3677f0
SHA1f22804667336362eedb85d9f6cc7ae0d013a97ad
SHA256364f59fa209204192ab76af0894406da647c5021325a947b64a297a22d98c022
SHA512037a200a9fdee7ac17858af9fee76562f4c17d3b78fd9dad195fcd249a52ee71d9add95e39f420579991521d53a074a2f7584eb6d5abdb18e0cc1f8ec4a07c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD564e20ce332a149a718c4eba3fa48a8f5
SHA198620554fc313fc9b08fca612d6b9b4af302df5b
SHA256f393b07453b40df745600cbc2dda59cb6542bdf6ae20ba7e1846d743f8b84f79
SHA512819469c565f2f40f27a5f9db20b6f63398af6037f04180db3dc400c132de94f0423f6b3c32f92fa2200d1611c248c7656a74a6ca69cfa9ed844d0221d9be1367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55b0254d982b78dbe5c2a9adc05fe624d
SHA1cdf7272af493658e320ddfe313281b3f43c1b385
SHA2568c56ecf9ed773a4f67fafa3a324434cf36f0d3d73b91e6998ace47d11971afed
SHA512123d092e6af287113b81926950de99a9d91a6931371bb0444f1f652e3d9e17ee314d1c63b8430dcb1ea062587bed1ce8cadd2e4f1ad8dce53592522f9e6476d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d69c01dcc4a24ecc557399a6dff7c404
SHA168c4f635ee5a2f84031e41ddd488eaa6a430b250
SHA2560b7fa5d522e0ec8c99d3ce02ba617c7f5c163d95a74a6f26108e1c0e8bb30e26
SHA5120c2c9c933fc3fb5fa813b5cb8aa887c3ce2e060d4df467a0fc8e9127bd330941226f7f40ea0da9d0b86170f5e60a7ebe005e267f1cec1fd3fb2b6cac3d7ef0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD509341fb8701e7358eee176e8dd03f3f3
SHA10bc954a59155e8ded375ca9b2eeeae66e1d54017
SHA25649fa0cf2921e69ba10cbbea6170b92328bace66a68ad37886a395ffb6ddf2206
SHA512430ded1d549a7d403a17675975635f7bc04ce4c4543aef433cd2cfc1833c01a82f9f36e47b33304f0e60f7af9b8e6469eede1f5a036152f0aa2c6c86aac927a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59654010ba4739ba6d73951b9c437f23b
SHA199189d559e736636ec50635250601f78f5c970c0
SHA256535d7c60e7ba39c4a7acfb2035e65ddf3cd9a15d0fe0f703c4703d24cadfac02
SHA51213a234d39d3e235833c35bd7e1ad13a8b8982438ae45a6e0e231d073c635fc0ef143c10aff8489668950bde68766fbcc78b35a08873651c16f340c22ebc350eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58e859fe3feeb525c44d16ea2dd6d469c
SHA19c0ed717312406bc18c803de8692fece96603d13
SHA256296345665adcc056e9977556880fb142ce1c09e234d7ed57bc53f0d82cdf2e4a
SHA5121242baa5a5c00b27d1da4714d58aaf899a1933c91e2e21543bb83bb82019d0bae33682e0dd341a8c715ac651b2b23bb55e415a83b01803f345e15930bb582da9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD533ebd612783ba252ee2e69f416d806fa
SHA15986be90fd9d763b136282bee4600f9fda85e0dc
SHA256d6041e193f9155339271fdd2515c021dc0de8a7aed4ffa26e1d001d205263cb0
SHA51240f3175c0dec091e766fb0411be614da86e8e5ccada9cb91d37f1d2ebc10706dba48f46f998e98397d879e7c0e03dd3f475cb1e0e5bc9cb1e8c04185f6604b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56e919fc6c1b9423c2a3803e3a5c125a4
SHA18808ccc9f69ca0f6da7d51278e1cf8177d87144a
SHA2565c075326adb9a7a1f774ce41570210766a0c2bd6543f42c38bd47a893bcd1532
SHA5129e57ec52923f1307f5a91b22d2e27f3472be4da399365f5a36d774e95c0800fd25bf3307d3ed3c51ecd8afba957222ea5aa5e4cc4568036200b7c834fe3c1429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55d19cec3fd15b442ae0a9e0514cdd1c7
SHA14bd8d236d90a431c68f52a98ab4d8ca6a47214bf
SHA2567faa02fac8cd8c45ce00205054ee841935a451ae6843a4700171db6bb4208b76
SHA512fb807cd2fbf6a462766bb59c8c649803cecd23585fbd8d6a8018cd1029797132a55c55f20899130bf3340814e6587d7a26a253747fa69db127aecdcedcc72179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50bfaca1ad3ab6639c61438864cfaf0f4
SHA1bdeada290e6fb98222f47cc79d207995ab1473e1
SHA256d304a28c9feee98f91c4cd0f0e7c4583cfb97af2802b3ddbe007123a699fe447
SHA512d9cbd48a2981df98106a9b23334ebb29ac906d008e395ac933869bdc6b9905989a5cc53e82e2bced2201068960c5e4a76dfebb54015c7c65a71c6b80ee985e9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5382d22a8a74e9d24e37cb1d66ddb31a5
SHA11a8269fc33fbb317e6c45081ea8a29b3eaa764da
SHA2564e6ee677837e615cec393b5d47e01dc2faff31bb04281ccf16fc823a1fb6f86e
SHA512c1d5443340f14bc17d15fe91029877f02adcb316bf7b5e4a306ef6761222a19f33c8bb90ca627bb2854d7e5eb03da854db3f8383c896a2d55e3908060a3c9a57
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a