Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html
-
Size
231B
-
MD5
104ccee075bf6af4844524ddbcf56f56
-
SHA1
b742792403cb0a3d5044e2800cb901eef6a3e665
-
SHA256
ea75594bb60becfc79bb167b4425803aa84fef872871ebf788bbb4405b3960b6
-
SHA512
4789b64bc1e5bb0000c3811a5eaef95ebe321d2586de59b7acb3c9480d48460dc248c8d556e80a456a642b8ac9dc7213e13a94d5fc9230bf35a827550f671350
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000085e29053947c02cd85a0b24f291a1ebf0e7c0d6bc8c8a6bfd46ce44942d6acf3000000000e8000000002000020000000228fcd6fccfba007a5279f061efb74f387f39389f4802de03f82b8a82925a4069000000068f4d69ce4ad2c93d0856a09f2ffc128b12dd467b5b8fa03bdc1d89a7668c2ef40e6791b78ed119c27604d45dfd2ca2eaa3a723ffce4043d2641e43270d712fdb35d95b11b000fc66f1b83d0b8bef3481138e21c8b5f434a2a9e973ecbf1283274573b2daf65579e795d4e7807d2f4b3bad31b6142948cb7107066940672d55cb1948edeb40111430506ac00ca4f978c40000000ecfb52eb46a21eceb397a71d9f596dcd9d9cb75ddcef9e9c491927b3e4779e37b8aead928c015578da8e2409026959309cc02df84a85f88de2230f4ccff0a2ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ed41d7449dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d32005f4fa5c88d1572c78928d5a5ce3f40eb8959131dc4e0510ad5c8e54a843000000000e800000000200002000000050154734f4f3c1b278abbc2d87daf9d90acbf0ffa7844e651feae0ede472477b200000001baddc156b29f0c9caa2e1396119896b017d563632a3327f892e1b8a2d39ce1f40000000e8cbee1afc32c6e92e6e04106f2282948d0ee2fe8a5dd6be53ce290ee17030247f11c61c9cda5d98d24962ecb905e5c7014a3d0104f067f3747673a3167cf06b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420894029" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B071F1-0938-11EF-9387-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28 PID 1936 wrote to memory of 2556 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\104ccee075bf6af4844524ddbcf56f56_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c521f7d7ef677f300d4995bde128956
SHA13a3fa7b17748d160c3198f0d550f576a15ace9bd
SHA25640b0d319c871a7fb6dffba0cd8273343a622b6ba61adba2accc3c74b6c1ab032
SHA5128a61dcf802c519c589e05a374e56a2745e07570a32b4812c8098857adb9c882d84269b2dc4b6bd6217d5468814f76abff7448af7c0d5cfc05c06a78b40399acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f54f31a86bd3733c56c7b2d2cc1d0c
SHA160bc6b5a3ebc5900d9cf9cdd57b1c5e129e1947b
SHA256cdfc2a5bdd0bf6dcfac5fc658f983d360918d9c162002e24aba08c460340d8a9
SHA5126b9eb3c5110f1019ec449b5ea0720d6711fdd0875b65e8119508a5f35f198cadd447ac6d70685ae890430c7c0dc532da7018fdc65744efa1648fa3ceac5a9dc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581cd569ceb7ce058a02e30688a994d15
SHA179b338dad8f76b2a51ae66f811b5696cb1109957
SHA2568d066e6fa253a8d91019b1042c55e450b0c91ca49fadcb1b430fcaf98ccc3fcc
SHA5122d565626eb753938615b845357cf93be7a426cf3b10dce889aafa42589d81484af79066a986a1efc1e55c12804a0d6d9d1c2ed5a6cd6366c2684cd66aa1d9d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a748093f12d51ffc87f96302665fba2c
SHA1a3269bee417105fd34085505aa3148b4b71c4def
SHA2560104c8275669b51e6cd58948f4e53d18ba7c3fd15b40c38443c1944771c61669
SHA512b55cd66463c6161352ae4770da8473ce25fbd3d2f91f5db898817f9d58f25e38e6d1b6d141c655d9b95d94df24a0e9e7c1ca16f8705cc9751d626a0b4f926afd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59acda7f5a13ac516bf2b93aa8a1f5d9e
SHA184ac2e8c59e872b9975c4d798f6453daf83b043a
SHA25690e6eaaa165e30e4daf297319d9c1a81c77bef9b31b7fb7e9a6a474174e41665
SHA5125fd7734f607726d1fa9b7349b6ee140b4f2f1baec7686b94abbb6981ac9d9266e3011414fc6732110e71964bfdea4dd3280e29d118aaaa878763a8cafb68d701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbe5afabbd9c607d5fb9a78847d31c4a
SHA11ca0a47199456a3e26d763bfeb6ff90762e12f26
SHA25604271ac693f1b316ba6a8b41d037f1742a6de2be4dfb305b7f71452f096c0d1d
SHA512eb5ed44cfdeef72c687df31987f7506ab73405618257faaa826a70b3ef00d601a86c5eaf281e3bf28ad6681a27dc4c4025274700126309aea9eacef1623232a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a39b759014dcfaeb0e85c2cb29c1dc3e
SHA12ddcc999ff112504807c2fe7e96c7234226433d7
SHA25684347908269f2a1b432e06b278720cbb663442af54c0b753cd26cab702e12bb2
SHA512f824a7194be56be8cfbcac3ba1fde37df2adeb2d58ca0c01cf95279d576a1548fe71551114afdf407d293d95c49406e21e6cea96ccda2fb99f3042eb95abe969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d96a020b3856d3886d48571c6f4dc1fd
SHA199d7d5e2d80ad07f57594e86a4da6c444f8871dd
SHA2564baaecd81768395193aa37cc873b728a50b6097303c363cd4ac8c56861e333f8
SHA512e998f0f45033d9887681b2eb2597fda01cb52aee60eac7a5ddfbd7ca350e7a5bc3226de330e353fdb12c8325aa7d5adb813ee2ddac823c91c3e318e28c2b5f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559379ef784340f22025f0ea6b3f6c37f
SHA19f54035b47f75c6bdbb1062068e58ac53d8b902e
SHA256828690fa7589519063fc948682e682689d280ce75c43d2a61e2c46d9d817bc82
SHA512d06e0140762a92f7ffd5959bafaca55248b7be8e92d7cb57ec39a57bd0bf9eef6616d39478428252f0c411834debcbb4186c49116da433f01ee3286d3add7817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5244a0b572c6cd27020d9ec2589c74e69
SHA1ce23dc4725bc455f81c5b62cfabe83535b65d42c
SHA25633f0d58991825a22f1af75e46c1ddcc8dd725926c826cb3aa2d02eff1e5bd1bc
SHA512f3ff8bd1a177801f465e69c6098d6b8346bf256344f0f3b92c0db3787c1c0418f8e1f4c28ef4327a4bf7ea964b3cfe24dc1ae2f121048ca3ce06082ada46441b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516eda25fd258c1909e469ada7ca26814
SHA13e861764936553b9bc3b6e98605ef7b53d4e7a72
SHA256d6f3a0fa28e271f6b8afa1f89a18d42f29a486eae6afd68237cb35389e97aa9c
SHA512fcdbe40b269184c5ec8e5de83426ff12f5efda47d1a815acf16327ffc2674d4c8ea662ba7ca9c4ccd3c7adcc6b39e967e9bf19145b8f17a13aa29304f0744be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57790335e4fbc3dfd1b31907f5b7bc3db
SHA15ec4a9578828e527dc6ce03b82b99d9cbe66b4a1
SHA2566205d62af1d69fa0a88595afa70b206701f48c555d1eb4a96499e3774b3a8a9a
SHA51280a70aaba0ca62f3ad0fc58649d8f3c3be6512878ffd3df7c324fc042a69cc5673046f90c35076af7ce688d468a3c73b676be2abf05fdfce013be079d304babc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa7cf93b3df50abc58949cd33cc9b145
SHA1c08974617ce11da3ef94a2e66af32c7c7e724509
SHA256b748f196ce75155f9b7431ee4ae9fef69489dd77c8461b350f03f2edc932613a
SHA51246a40541fe25350ff456a51b68f5dd806019da86db2d059d409331a6df5b5533271d25b18c97314b3d593001148100e5794bd6a46387a7c993d21babb85eb610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e2c5a8e9198ed0364acf41bd7f3e1c9
SHA1ebc24bce1551ede9920b52c2ab6c73339090c295
SHA256f916cdeb60ca876dcd2f066d554a8834e2c42592758371ac7fc1462d4b7f1a53
SHA512338d6fd0b6ca3d8d1133637e39e54b15feaeb066860aa0048e2b690afe09ac8d706fb8c8482dfc85087f0c411154e6c0c81b74ff5b3c610bbb62e1aea8f220ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d59a941c9c5a5d2cf37eeeeefd6f4e3
SHA14084c6b161340b97a98914442afa5fa741a7adaa
SHA256466915980d9631a6e95dc931ccd5a0193a077809c71e70a010986614be40e90d
SHA512e3d883ef728df9e5fe4f75996d209afcacb803bb0a945e80679e058c727933f2c62e7665b79a097cc8184ec56bde87d911d94346e028b24aa62e3de6e2ec0e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee3aea7aa7e30c3c7149b60dc9ce63e
SHA1e2c8164eda28dd1761516157678f9896e80404c7
SHA256451ead314672e20413246cac2efa8087a70d7eabd7cb1d9e427bef2af293b8c6
SHA512f02ff5d909d0e9e46ceb27a1d07dcd39103b01732dc130cb3ca97013259a2105fcc2ac04773d939a603849cc2de066ac05358d3c73786a22f8599058f4b461c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a8046b52ccfe544995f35f4bc91d0d4
SHA1635b998da280c03ea6f348629712353f0cb132b9
SHA256cebc5a7c55fac94e5bf880a392e91fc9427d7321bc3c29537ef2e994feb07a8d
SHA5126d394d4239992ea874a0003209c821ba3b3dee5d96a4c0da7bef4b5df8c1fcd2c5980db8d3fc6a9000fbf0ad1fa3696f4cb4b583211fc61fa6985bcca2cca89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba0636b8e1f0a85e987fa5fb10cc42cb
SHA11d9d7e9f35bde12d2c39a4d1b9e255c0efebc882
SHA25682fa3c04195783a473746b9facba72154564efb92701d0e5cd4981e9f84b515d
SHA512b3493c5d073c043d3a5c798c6360740b1f1b242d08df48b5c02152d89b6a709a9d5971add1a9c75ed25c252edd2f3ccfb96511aa77d4f5d48bff8a18ace9e12e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd36cbea78efcbb401aea3cc8ce90c50
SHA110a7978c6dcbff77a77b02531a7b381ba993abb7
SHA256dc42923d4e770888bb34fc3539b9054159a3cd45ae63c2a9b59cb6f7792ce2e5
SHA512e9dc69a903420ae18a3c1a4fde1ae6d100729676add46d5b9413281e20a8d62f6d647661b1d84cc7dbd11868e2724d0bd28091043c9ddd394571992bf021366a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a