Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
16089ec3789ac69ec36da9a11fbca4fc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16089ec3789ac69ec36da9a11fbca4fc_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
16089ec3789ac69ec36da9a11fbca4fc_JaffaCakes118.html
-
Size
590B
-
MD5
16089ec3789ac69ec36da9a11fbca4fc
-
SHA1
a3b2b3bcf6d0ef28f747c744cdec3a8f34b5d7f6
-
SHA256
bfcd7bf977cda32dd5ea9202fc5c708fad2cbdaeb0883a867af03d851f02dd4e
-
SHA512
bc2792fd2e738f0f97fbdf83dbbb3fc720adbba40cf683c6a80754c2e5bfddc642c5eaafb5278937e43f520119da2fff4dcae51889cb4e7109a0ed004d0e6021
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009037ef6d3755599408ac37ca68c0ae53609a02bf9953a1afc96ba41bb3415998000000000e8000000002000020000000c7a93f6d3bfcae37aeec4e5b380f61d00168f58477477bd3e2d61276c5705aef90000000ab857920e7b607e13131fdafd7860ac5f335712348f3a8638ed85c8c45eb256c2c63095a21b1f735dd1a7683257ef2bb4745712a217723cfaea89288607f9210c93c041dd4c316676326f207042b355c53b270e5e4780988e7d38abb5c210e59ee6de13a35eedf6bd6185c1b334a35e9e08fa49555fc649e9f7ea58f714fe7bbf909bfb99df4e901b8707954fd3b1dec400000009befd42fb3d21b2309428988acda738b33dff4e2e93f2b8baaf0ab12ae7c8ba65ee64d62ac2c150ba0224b91617a54fb48ee9c32009d3667ae7f3e666f385250 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421046107" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000099ffc0ddc13c038b61f7bcd0826ce082af8bb26498d1d6bdde4dd90eb00db9b3000000000e8000000002000020000000ed5f2a716603c5a8afb2adb3c18a6f459c3623d106d12afcdeb1e0ded2c744c92000000091dff90dcff8165ba1e178eb4b3c997c3b8aa46c23862f257b59c3a1d10eafbf400000009d0080a2b1e7c1c9e30b32bc9375b3dd5c830fc438d564719d840a28c3d8c64cf6490db3668458a9cbab6a911dd9419baa0078a12e0855a1cb2fd6f41653ce34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16A23811-0A9A-11EF-B5E8-DE62917EBCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f228eba69eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2200 iexplore.exe 2200 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2804 2200 iexplore.exe 28 PID 2200 wrote to memory of 2804 2200 iexplore.exe 28 PID 2200 wrote to memory of 2804 2200 iexplore.exe 28 PID 2200 wrote to memory of 2804 2200 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16089ec3789ac69ec36da9a11fbca4fc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594f6add50ddc5be652b787cdf62afcba
SHA1e2aadf06e041f90a8db52e2bf5c71da9f0c6a0f7
SHA256879515309743896050ee5987145fa12cb8e91e2e71907cce2bd85e726b875d39
SHA512213bc25967afcc5868ef622dd46634c24bf045251f145277e8812fef7cfdf2d01f8a7faa96c0c5930d92e0bbc3bf59332475a516440d2a928e48802abdfa0a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957052a939601dcf20163db43d8ba1a8
SHA1f4379467ecd0f700725c4d1f065a34d990a47a40
SHA2566e2147f5f133001f1838fccf373ba05ded575228f01c9ae9be729fdf4d0c7354
SHA512015d62aef7513b35c6124434719bb186ebbac6f375b1160bec54d4f84772bac9eb0d3648d6b9db9dc10b4c63bb4baf08aaf32e496f5527c0db8399ab6a5c0b8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977ace97964ec51af99feebca2489dc3
SHA170e268c5f55816d16deaa5aa90726b11776ed780
SHA256e74983feacbb8264126f381d9a3ca38957be7b951e52abe659b83c57d7dcd787
SHA512090d064722daab0e121d1e56bba10b2c9a077683019a1cdde5cc3cc89c62e2cd7e50ca03f6e818e5543f4230d9cb9904f5f808f53b0ec86cd98eb8262b65fda6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c4b490f55683daca760a275588fa303
SHA182ba6d77d4300fea2ba09e6bb6dd80ee00c61d69
SHA2564174fc8bf52c617d8903211a886d23a3fd9db78ba631a90919a4a13304f58cd5
SHA5128355c94e17e24ac2e36af84207f7faefb780e4692823e28043556b60f7ec770f4dd4ec32202566f924df764a5eb4e69289edc735bfe353bb24d19462325a5506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536997e511e51a56b64aad388ef01e1e6
SHA102439322a01422d4da8b70b31dd40cac2718dc8f
SHA256fdf675b7e54493b4977d6954bb389d3cc26ab70e981f8978a2715669540cd6cd
SHA5127f0f22e7aaf59c68e6460b92c13a8cb2e384aa7425799e59c1d5c7f6023f239f2baa389179118039734b4e36602e3c3e60cbeadab69d36d16835310b60bd237e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d00afafa9826286f126ae581a6702fc1
SHA1888eda910ad56355e4d0d37d6c5b8ca14b28e169
SHA256d9995e0521d9c3a341d622cb075ccf8e641f53883fecdd13d027b091532814e2
SHA51251a154e6b736abf75e51c4d0c36e7b1d79f2736fc0429374fddeef2803b2b947521fe8f3ec188a1abcd5625553e3231b2693ac4c4e5d68de70739bbd441a3fca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57958962a0b6963f0414120963e1bbcca
SHA1364fe3f3785e286d47120af5795709f868686291
SHA25687c00cf9f6cf05425a6d9da49f9af74db00bdab0f4e11618719feabe523f4a9b
SHA512446f189f2f8c31ecc9436afb2d594ae5743aabe8c41746cce8c49decd4202067ece3fed0651a1748a22e88106cb2b559c8b576882d1ab696ee181439b4e291de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b313b4d1c7b3792299903a8eddbbcb78
SHA10e59a3a6f178ed4fece0a3700122bfc46f1997a6
SHA2563923cd1ac6b42817bb7c587afccf2458a082fcb9cfc71198d38e09fb62eb4dc9
SHA5127f15d791ec7d43d8c843f34b1d0102aee7ed486cbf5710c0fb5ad3b818454a971027a5b2260629070403ec8e488d23808a97ad25326790a82bf897d917df15ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5313daa70d9bce21c6ee0bb4ca4bfe406
SHA1524d0a5a79ad77ed74ee01e0369aa3508c4df923
SHA25668400b7766b2b09743d5050afed88a5cec7d27a3c4f2739cda855c22ff66dad5
SHA512ae9339624e3b4028c1d2e8948a4c076fada6be1699f9311f67debca7ca345985d8f81fb32ddcdc3169df58dd976fd1d049c236ba10680711663dd4f127d8fb0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5022da84cdf50fb3c8e552fa6d2905e24
SHA1d09dfd9bf127209060b23d5c23e875c71cb43ebe
SHA25616e4a172fa33966a127da8cb1d695d49bd0c38bba6b09067bdcb3b96992e7e96
SHA5123d0c19306924370d28e70cb7555687349958de201de5f968c950ac40c79008acc2c2c958e5e0100f032761c45d985378de9cfbf0290b88dd83582ae7935cd5b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1924c5981abe80f720fb9c96d8a4844
SHA1a39a679f7d898001acc9aefd307a3a93c2878c87
SHA256b4f5f65f0351029f8b7c25fb57656fedc180b8654687ed56d0b9eba61e16581b
SHA5128ad5d47565b9fac63f142eb51ec149d739d73514e0056ff6a7751745728600f156fb4ab5aebe189fb13371a211de5a41a94870e29658a2ba9e991e5345590303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d13c08ee876d04abc7afee6ee7bd76f3
SHA1ce48338ed1a09372c0d0adbfeccdade9e7caef16
SHA2565afff6746c0ad9423a561c31b6d3d3286aa7a93f4277868f7af1c6e69931708a
SHA512c3b6526a441aa10990f510d95f69af27d3c4d49e6fbbcc7e09963ae70d538ebcf8a7f3935069cd92c0d36726dbe5d2af725f23af0df613a1ce7c1ec4cf4a61ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c339653381c898ea7555c79bec05ad7
SHA1255f73293a328987cfd35ba30456a01c58d90c82
SHA256c0181fe6740939d8bbc60a82a74729e7507f1c1a5684a926c1ae2c58edec3f45
SHA512e65519b7a811a9a4b0ae7da76567fd1736873a2877774e1620c01e3c5e81fa63f302f15eed152c9838ba07863898dfbe7525c6fa5731816ea3d87f49ea7d2e7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd8a9d8d4a26858a8c0e061af0e16c14
SHA1198928303337b11c68d29e657356d07293276884
SHA25641c616ada8fe9d11f536c094ab738d6ec3b884867a329dec2222f98b24a39b25
SHA5125145637330eac8f29f744b2e240b6e0d9b71147e58608052671f10c47a323c47cbe72bcf5ae068aa81c82fab707e668f060fd0882de59cddbf79d61827f52a79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50212129ec40cac8b3ad638f968fa7ffd
SHA1b4680a62927fc54fb57494c0f1bf7e3344544f77
SHA256c2c23156d1ab60c2551401574ec31f766822e08a0948da5bd1da5a10c5c8beae
SHA512df369042111d792c745bd76f4bf2c71c20aebc57deb38852e806374d6d7a0a0826f0020bb9dd19f56bf62256e3e3153b9be07e6ffc6ba44f3b6832e3415ff5c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f8135b9b60e844036c03417217ab37f
SHA18fa6f9261687770eaf6814ec25976cdac08fcff6
SHA25639b632d9e72ef0bc54be57ba2f0b7fe8b388a4008a0482b580e9746ff07c9484
SHA51265db788f38c418671e6b03a8afdd958f73c251e0f97dce6d88184307d6b1108ca174fd61b62ef947d6d1b978a750169f297174105b63b0e9b90c208c7aeecb9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc4b05fd1e5f5811bb96601e4f99328
SHA17fefa4e845d456d47fe00e29edc1a5d20544301b
SHA2564ed3f7267a1922bbefeec2ba21ee34fd3dca733886afd7d3f5753a6009b82f12
SHA5129bca02a7de111979f5e06c509b05d416ef91dcee3b92b5846856498b202b197784d43c732dbe0d317504621bc260f607a043eca44da82bd62272aa421d56266c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d4fb2c9826c7ee11d1a01b8c7aa7ab5
SHA11786f2b9b62137be964600d5536e58f306dbabb3
SHA2565e03030a87da940d5dc033857a2140c059b2554db74e533c0e0adf81135dbf12
SHA512a9f05e082ef880e9155fe194f8f652aa0de649054a20ecf1f16a83137ba428bab2694af60cf839bfba6a07665084053088273ee9815fee13fc087592d45e0dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fabb243f7ed1c29dab2a63eeb75ee79d
SHA1f1d9cd9f9c4046caa3a2552a7f7338b554ba34e1
SHA25616568c667a13911fa34324dba113191b19856e342322786c726da79824abb60a
SHA51269034c1d44ed309ff086d2c9c0301db0b2a7581bb5e8b89a5acd2b155787203e3c12a5c209892ee4e123c7091a85b5f6021a2a5af0d2b66fc4574f20c1342506
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a