Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
14046aea4611284575a055aeb6283a18_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
14046aea4611284575a055aeb6283a18_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14046aea4611284575a055aeb6283a18_JaffaCakes118.html
-
Size
300B
-
MD5
14046aea4611284575a055aeb6283a18
-
SHA1
91e976916023e785ad9b8d7d3810c81274c5c0af
-
SHA256
7f04d6e94fd90a12b5846962ef6a234e6920ef22e9dca46d7de0b0322a15c3fd
-
SHA512
f5ce42adc911ae380eb6df4ded4acc987bf8908397769a8493f1a0fc63e37d223c9fa241480f57ca50a6e58fd2cfd1bf58c26f170aa2ecf985687676cf35f02c
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421010286" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0555e84539eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFAD37C1-0A46-11EF-A0EE-F2EF6E19F123} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002fe5d8fd8e8b0191c5aa869e4a6f07bcf5e80fa4f847a28da02c206ab7efe2b1000000000e8000000002000020000000ab5d200fb889ee6ca20b8c0d1609ddb876ecc5bdc760fd8b7332d9feaa33dbcb200000009f2b716d49c7d9a918cedbdb611c4a383180da6eac403f2306abc4f3a53227ce40000000b9f92b333a6b529ce57622f7fb5f2261fc577da330b98ff92378c6dbcb324a8adad2e57b64018ea9a14622eeaad0dc0f8c495ccfb496f670c14c82a2ad569517 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001df0291c596d7276367480cfd3dfaa6a6aa85876cad66e08c86e3dabc16510e1000000000e8000000002000020000000052d0df5bf8b72df51e537e2e690a452ba758a90c2b2a922c1c4d3052163e3e19000000034d58135304df0f8ef882777e0b10bd19892053ce3992d94085ec77f9d9450924557cc21e869ba661d7c8168a31fdb2ce0df98e86179b5e639d13a95bd493b97e6c283fb4a940262e50db29c92d94dc28eae0a80813a9c6e4518e29192225da1d7420f1c607a10e0ae3516371ef8d4fa14e18e01998caba7b4fd3fb4beff59b934546a962dc09579f4a28fb88804202a400000001fc9ec25dfe59f8730ed399bfeb999a0f5e5e729da5040f21360cedc4707996c042ad000c867308bed41182e8225f6ffcdf6d719ffeae72fe08ce46403ab7c86 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3020 2876 iexplore.exe 28 PID 2876 wrote to memory of 3020 2876 iexplore.exe 28 PID 2876 wrote to memory of 3020 2876 iexplore.exe 28 PID 2876 wrote to memory of 3020 2876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14046aea4611284575a055aeb6283a18_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518da90df23976ff23ffbfd866d246e3f
SHA195532fd23d581ecf0ab299f3736eba6ad04be805
SHA2569b7f27980257488a860708ef8718435d2131c080bcaff3ad094063d82e876e0e
SHA51223f9329e8975a0dd4efb4874c723b8297d1e0fd96b6a87c552505e656e2c3edb39ae89bb3695603326d6a81ba49311ba9f75af3f38b0efd122c165f6e2204553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530aa8394270fa85d5524aa5f3ff4a1de
SHA1a9c3b35804f6ff81e847c8945a8c77870e374884
SHA256107ac6416f174a4f63a89d6bfcc079e93da9a316abe55622fc05d6348b515a14
SHA512bbd6cc775cf022a906f10e73db25c011a84191bebd083dc30e9a58f1947113e986fb99af22b80ec52479c15fe07b874ff9b2812f742a1e16c543ae3f092ec973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579a1c55725464439aa538532167f8314
SHA178c7b33c614ec22e68bf39cad6fd7501b0fb732b
SHA25625ec229a0aaf3f92b68ad2a49b09ca292699c2b6bbd88d2e327bbe04f05faf3a
SHA5125c7318755ef758cd92a96596c0d398226a12195884425a584906a4fb98bf375102c5f6438dca8bd384ccb4af7596e205d504ffaa8ab6a9481bec0245b1fc6944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d0df22901edaaaca46545b33d1653c
SHA1a057adfb3f5290a7e44019e76501f75497d5e67e
SHA2564067e645e98548a6e41f076b3e6a1f1022a0490452fcc217ce4fc9fcb02d85b8
SHA5120427671917658972633f28de8efe66998dc858c64c4e9f4c6b1d21bad6e28d2c4a6b98741959f18cc004c058118f8cb3fa1666fcf829fdf8ef99a0a2edec45e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8c9a38a6fbbb295926ceb387bddcca3
SHA15ea6db4bbb4e233a6e33baf84fef5ffda44a560a
SHA2560c80f1099a6a0e871231be4e340e51fef54c8dd87a906654e9815879f0679dd3
SHA5128623acbafeb72b6ce2b358fb61b26108bd6545b28f5a6dc4bc766920e205f85697abd34dffe3ae08c59de484b396bf3066dafc2a74cc69ba505dc2833755346e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ba414fa04d5ffdafa60515f3141e262
SHA1e4844525dea9502cd29ae319451780deb1815a47
SHA256f0efe9eabea6203eca50599ffdc9af62f8f2c0c18851519f8bc718408066ffb0
SHA5125567892ca28bfc621528dd27a6b4dda06f7ec8e8f891f53fb62752c956e51e933c0d48bd6f593850b9d510ad2635b878d40d5536d3fa81d423f0f45fe9e7fe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed0ff65eefc343439a2f3ccd12a660d4
SHA15f48213488233ff39ed1e160acee693506beddab
SHA256d1c392047992f716b54aac3b4ddb7fcabd351903609ae4468c2a591c3ff71bd7
SHA512b9bbb18bbc38523363ec9a5d99a8f5c6e4b66a13a66a7fcd2549a0abb49995f87f0fc278089f054acfc3c3743de5880f2c891e7cd6df312abd44024e0b9e89ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5656a86dccb951026ae2ead8f9659c519
SHA1578259d9a7113aa50d070a8fbdca86c9704980e8
SHA2564ef0ed121c173b5330da09a0eb84ac726466bff8fdf7c177edebedee3534e75f
SHA5120fcc9789c9c6eb59d99e310a2c9caf5a3bac6630a56dce8b72a7962be391227e5e422630460af2dbdf600b92095b03477730990c3e0c832d27e16d356dd8caab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cc2eb7feac1510aad5998080ecc51b6
SHA112ba152c7d185ad744bb020a806db984fadc6623
SHA25698826236bb4847e54e2c369e02ddc1b5483dda35c3bd617393d2a2a2fe87e7af
SHA512a9c8452488d06aff4619c1ab425c948afd4b596302145d854a88cc78b41f6164a60e0eb0f7548a789b3459cd7f07360d38c0cf2e7ac3ba52d499b8a1f5c1bf4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd6af1ebed865e82b3fbaab5c0f6f8b5
SHA182949d0c3d85f48d23572dce831445d416a1dd2a
SHA256b030b04c93fdf26a609a17d96dcfa255a552de120870986cf19ef5a9368a9cea
SHA5121a882e6b3cdcce7340bd9d208ed550909fc2a9e957eaf8eb988629492ece0a8f438d5cb78785a563f66d7ba45ec02cfe16ffb69fc3f3dcc9c4f548a07b9c76cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce486b8d9e74dc90882086ece54445af
SHA1cbc778f5514e34d7147827f19e504ade2c086e48
SHA256744cf53a6981418ccaa81e70a7adfce9b9b0c8d9dd6536bf3303153463e34e13
SHA512b05ce52db428fe56f0dfcaf8870149a6f17be2ae2231742598f12d342adcee93061e264279bb467a270966896d7c8c60e79d1738006c776f1ec75a3a50fb0227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b49b3fee53704b2190240aaed6d4f8e4
SHA18833888221c0b4a496d69fd6e67ccdd96c3f6aab
SHA256d83216487c6ad42c95ee2f5e4341dd8d1b1531df4e6f22b7e66714b33f0f780a
SHA512af9a77d06747741b4ce0fba24fd2de6755c317df95f3aacdd2c52c4a2dbc85033099bf5c29d258bce6b7452aca8db52987c03c23e0665fea3b59b00a1b57cf1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e10645f449daf67bbdd8848374417b3
SHA11940a18b29289d05b37053e4238ed01cf6acf2d0
SHA256b6742a96602f80d4b71f1cae418083b74fdda09e9c4c65b6895082747639929c
SHA51248760b8edf212810f4530e909280b6541510bd4c8f20b74d41a0e0884a3e48ac5e76c519cd5763a96159de51ab728cf7067832a97be4c05a9a56c7ebf7b4989a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3f4345647f8adf248fd53a3f76dd125
SHA197a1d105d60a932674853157d4996fb35c774f7c
SHA256caae32f7833a38d2093335507ce91cfd0fe005b53f6ffa7b20cfbb07ad2b1c8c
SHA51285faa63da3c29811189c936487b09e65119bc70bf541cbfebedc0b1f00ffb96b68896077e001583810831df656a54d90f779be871b26d007700ca79414dd2907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516e620c809353102b8f775dc35d6c4ed
SHA1cea7a4c5649fe33b7ec5597e3f44fa92aee9f7b1
SHA2562bdb6cea8f12562b6b3505792f141fa2a67cdfdc9f728ba650a926d6dc1d9133
SHA512e4c6e163c168a2715a34e52f03ae4c94370c98d3b77686780b7d0fba0cb4f05792046d603883c6bbdae96aeac0855bcc48b77d46971fbd0100c5f571a380f649
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb277a28e16239dfb49bd272bbe252ae
SHA161f095fa283de0bfffc0e141d793c16a4163261c
SHA25661baeda41108f0f83570eefbe7ce5080ab2da36b4b6e2f3b2ece23d736894f5a
SHA512ed4d50839b92c346af757e378aa901c68c53e75b7f3654fd72a4bbe09215f24a8bdd5135d85f7768bdd3c1f14d272362bec0792b0b2947d7fc4016a9aede2700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de0c6e189de4ff7534e578fbc633b8fb
SHA1e1fa0d8a3309e3a414f9d2b666e10bb28a866a9d
SHA25613ae388533765e8af5543837fe4462afb0897cd10f956f3e1b8c528fc23c9aa4
SHA512e004e382ea160cba7279acd481743048e51ddd548ec7de8d88d9b49944f6d26d448980733bcbb67f2c060d5294e911149c1bfa24fe1a9e2c673d1e297683eede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6b5e0a03f91b0084321358022021c32
SHA1f17a035b5d917dae62336f84dbefa8e5a4806086
SHA2560aceba2337d149ce9078da9dc6be994ee560d1491a124d40985c6f66d72be908
SHA5127d7851b2e4ccc7f40e29ebc65cd203b61e81b7650a767686b32c319e4b5435b77d1bac57f5b82d753719c56e70cd9f798696e2a10359a85264655afca715570f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a