Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 11:47
Static task
static1
Behavioral task
behavioral1
Sample
1070ac718b3ebe3be5b3f1719c925f04_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1070ac718b3ebe3be5b3f1719c925f04_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1070ac718b3ebe3be5b3f1719c925f04_JaffaCakes118.html
-
Size
2KB
-
MD5
1070ac718b3ebe3be5b3f1719c925f04
-
SHA1
c03a830caf9dd658d20a51fc2938610d8b79c450
-
SHA256
99104ea07dc4f5bc9fb2c62b0d1d58c0a290ef1a01d72e93080f68965cf18866
-
SHA512
6c50fdbc31d75a5997f08987731e0c7572fd87b05ae382d5e50ae6a3b6a019c014ba5dbc8f0d2a41b564aa3b5b1e78619c8f1c79ccb001f1643ceba81827b774
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50761ec04f9dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420898717" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB5A1681-0942-11EF-9542-4A4F109F65B0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004f53435db963161fe55a00dd88b333b313d299266221fac79de66a6ceadcf959000000000e800000000200002000000004ca14d517b8f01ca315b2088ec2a8448f4d505dd34ea68485d27af4c39222b72000000098792146206d3453ae45239e16a2b70cc62fee9a2460de8893c92faa081002854000000014a13bb41d40e5a965d6d87fdea14fff2a018c0f5b9d30d89808f982f1708765663f69d0438787e46d8bfed1e59d810b5ad747a080112a873f6a58ff0141fda4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d4009bc7ee939944fdd74cc897d727d8fb5d0372bf35dfcecf185b683d421e4f000000000e8000000002000020000000512efad2ae09a4d0a94e526dd80e2583644b5fe097a039c3b0277317e5981c1590000000a544a5a15c3900c8024220b816bd9e88257a13972a6604abe79ac0a03eea255dc1833f1256f198317300ff093394798be5247a7211a1cedc251e8ec9a20c1bf9c9d4fa7b966e61fd1038ef3d49b13c8fb02c070c759b15e3b0760de1a634da829b210176a299933cc947e582b8a45a3ca8f18c149ccaff80f1590740816f4915f9e75058b19c76ff62496623f39ba7c040000000c39532ae47061f59b78ebad813ccca4232ff640e81d2c0fb06d55ffeee55560c746c497e530ba5d239d4ad304890fdfa37988d97650ef314a0c9942ee6a4188c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2648 2112 iexplore.exe 28 PID 2112 wrote to memory of 2648 2112 iexplore.exe 28 PID 2112 wrote to memory of 2648 2112 iexplore.exe 28 PID 2112 wrote to memory of 2648 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1070ac718b3ebe3be5b3f1719c925f04_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8c37bb66bedb90e2ae976f77c4190c6
SHA1ef05965db9775690f29c9bce8b219935098d14ae
SHA2561bda5c5279316ab5fb709ce3b7ddad156b1f6104fb7d2bea25c4bcb0f9df5d0f
SHA51267eb7da84b6660095f1ff9a400ff3c78a39cb738100ee7ee8b51a86e40c252df67f76156e93614e0511fa622fd3aa44b330a38d00a37a22b7cc536696bb7e8ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5185b12772e2472d58723a2d4ea4bdbe7
SHA1991f3277cbb4248dffdea44f02b30ef126dfbba1
SHA256df295e13977824323dd133346a2f1bcd0d7302c47a5eeabd53db43fe79b0bc05
SHA5127e40b465ba94e5199134eb2177d6f003bd28f5f47bf5a96fc0567fa92fd4b88470fee25d09f2db186ff00a98c957c62924742d6f839226256b1727e916928582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c0dd8167654583fb59ecc658b0ba692
SHA185c2aa583221f76f76bbb9b35b6ca841775a2f03
SHA256fff2ace2b4c27943845b9a4052917c0ae3b1b4c30d9a3788ee26982698b83c3c
SHA512b6b51118a59e22834b8bad01af5e5d7c4e66d526de355d9c0b3af6afd8b6adc1ba742b493115b1befacacbcd59f51b2084408fce5b7531f771da409f55d8982d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3109e9ec460f041ef6fbd15566ee47b
SHA18adcb43e8156505a2d15b5e079c2f1e4c3650808
SHA25666972ac8102991bc7c3f12dbb73d874e9d2900dab070977079586c919fb910d0
SHA512fb1be9d5457fa1792e1f7a10f2a04a8fda7a553120608d0fbabe466a953fc2213d10ec0618c8877af0de40326d232179d3eece42760c099710845b1c98e77600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510ffabcd2304cda3bc464dedf912d339
SHA18c8d3bf4ea218915cb6f3cb9f5fddbca8f533937
SHA2561c12eab88c4dcc8cda337e9ee3c6f458cc225e6cbaf539a96be342c204a61749
SHA5128e0f3e3ef3c5b955382eb626618ad63ee20a5f3083de559ff918101cc5567f78af70cbf215939e93d7cad904bf98890eebe8af1ae5c952289b9ed6c4af176a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c2adda2ee4ec59fd465c7eb2b3a5e01
SHA145a9a64fc4de6f03460de39455e1eea84c988574
SHA2561f9777c9ee9615eb36dfd97e6dfd056ba0c8922d5fc2142f1c0acd203c7d1e2c
SHA51220190e797de8a9e500d7a0be148655589cfa2321f8a50153d2e07f5df755087254f5ebf44085cf79143a3348e38c46973070a450085a639857d3d47923394f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9f17bf41e0d4c61fb4a2d0914559577
SHA1224d17f66790fb3eefc2697808d73e7479530d83
SHA2565ea36bd0fc69c00f2f21d1dceca8650b2e04f2956eab6faa9eb9518c8bda1c1f
SHA512999b7e22072b8cf628d738534d61e12129268040da3f38b83d5611190fd966426348c5f1f6684f3edcc274de616f6e0a766e4508a70f31a9e42707d918028e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f2a6ee57e417b556cb046eae4b16ee1
SHA1d6450ae2387a7e74248e252af2e4375dd96cfaa0
SHA256014a6b44545a7b510f2926e111f7821686421d45491094579ba8b963bceeb339
SHA5122d5668f040b6b36c4e25790012838fef0fe3eda32e4b4ba7306d3203ada6d287523caed57bc5da6209574c7896f759a43501b44466a659d285f2bc6f6df27d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555c0aec3f21a66570a657e3782bbd000
SHA18ed3cc55c3a49791df7fb83cf64bdf9d67b11732
SHA25683025b3c30fb96d15fb45e3a699c81594a8b2f4ad0484f602dd0fecc7d59f841
SHA51260457680878919d07fc95b2aa2c6e97253c1cb2e1493d0daeb42317ba0288e05d7922a2bc8d50427668233df4d65785dd71dd3e1f4f640e03470df8f1ab7216c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd054c32867c4c08727ebbb8f90caec9
SHA19a88cfa9067a30a269aca0f8c9e6d3aa0cfcf225
SHA256f35f881d1235c2189fae9be06d1ec302f0178b4d1563bca1069b0ac6e956630e
SHA5120f7eaec273bc84958437774d4516a28593f39c155a9519feb249e3f641170faf337f4f886354001f8843c382ab3bcd606500b81792766fdd257cfd058a9866af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d9c01e2179924dd1779c3f39d15a80
SHA1a2c69d435455007143764778d5ba4b6c18760cd2
SHA256c3ee429af22fd25443c4d88386d67e7b491728edc873e8af12a918e29b6d66de
SHA5121d002687a5b0b2ce91e2fef5d3d500ff16f856a2f2813e4dc54398952325dc74628f57ad0e3fbcf8102113218483d7be8ff3e34f703a13e4546b49489f5db6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ad11d7d3fd84d4784fa63826db26281
SHA1983903953a9e58943c3f8edda35b7c55e97bfbc4
SHA256575e4b7139b8d61df2f231f319356c99a9d6d09dbe176159e62e6c4d05038ba8
SHA5120c10c1baef17983f82d6e269b45e22e72125b20ecb8ed5635f7079d8cdf88c33e3d8fa88d50612ecd9fd3d1407b368e685ff056f9ebf0df38c43ffe07f24b247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551a9e55fc59143c35a1d85260d77a976
SHA11cbf381cad3a4264bb3b13ffddf5f0f7dbb1c27c
SHA25685bcdad548fac031fbda814dfcbde8afbbe460a4715f30fabf770004b0c954cf
SHA5125907f9f7f10cb9b2048db0dbdc86efe1ffe2414b78614a4a1da55655efab38d47b2e0c7aba9d8268c1d5bc9599fab530230d26ded24b55249303ac858e70efb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e410ee81bbc8a1c5596b86b02c764faa
SHA153937b00e84bf0743af4bf0b3398a059ed451626
SHA2567ab70bc7d35d716537b3c415517f99c3f615578aac6da2601cde081c3ddeee79
SHA512bb2db9149a9b2d9f95989cd1d30787de48ca7a15f97065b6077bd31937bad5be8e6e042bdfe9be14fccc5ad1231d28e5d449a510c4f4df0d8bed2a00318be114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5194154b6531885763ef24ca8b835822e
SHA15a7de2ecd96aad6cb13b8c0179b92991e5cda9b8
SHA25621bdf746eedfd4ef957ba454293a04363161974da31f57d146a5a94fc3b0898e
SHA5120810e33240c66f464a0ee2d4fdafa32330b62691fd42e9df81937828632449d53ea5b60252703052818817fd6b1f8e78e6c35b6b59069afa72f492942da4a37c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7e52e2416535ed20b388057687edd6d
SHA13f4f6f63a6c2e6d7af03ec6a344f3aedee39807b
SHA25605b28d1185d902df25f40529a2c7763277846aaa62a2bb10240baee81f16afc6
SHA512308d0a5da56d17baeab16cd26ee3109ff4c7567f223b7079f7a6602ad2830d64451bb50040d82984c574244f457c287b44657b2f9689588128e28a9e2ea1a070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51db7469994a5d841c52cb93caa8491f4
SHA160d80272e49405b6fcc9063c6f3de30d4e104c2f
SHA25669c5e1177961cbf34327e647cfc9c1347927ff8c8ea104470d75530e6bdedcb7
SHA512f31c0a7205df8d50b8018ba3a06a2972c16f010e99d24e331d8d25ce8667aa8a33b97cfd5aaf8e94239d9f50ea129e03ff5a5e2c48652f6ca14aa5d69360723a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e114b083e0e0a5b0dc654e6fe59fcfb5
SHA152dfb940d361ce615ef6df9d34ee54fd0870a408
SHA25666ba87c78e3bee3d53aa960bafc898c341c671e32af237536c205028e34e018f
SHA512472e7ecb8ed7319a33ebcabf2df27ce462427ef3b41e731361b3e62c5785b84e145853b50ac6400a8d2b342ecfa7103f03ccde7fc8a222e8fe356233d86ed2cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf746852eafa40b98819c04e4923277
SHA1e4edd860dc70c9dab131ff5346adaf0554701d88
SHA25669ad18a51b16cd4aa0914fc6a0247fc7efb6740952715b22b74f6385156c1f02
SHA512930b1930655026f81d8650d34f06a1253760dae55282e5b3debeee3f34c4af6b94a45cc67bb4b126b7c7bcd8732f40c85eb3a9af604bb801919d7f8a68d396d1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a