Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 12:35
Static task
static1
Behavioral task
behavioral1
Sample
17b1222e12c56f44ef988e8a443c5434_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
17b1222e12c56f44ef988e8a443c5434_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17b1222e12c56f44ef988e8a443c5434_JaffaCakes118.html
-
Size
1KB
-
MD5
17b1222e12c56f44ef988e8a443c5434
-
SHA1
f3775fc60d7de0f3e010e4adf52fe437bebf0dac
-
SHA256
1703e0f8d0c487473f7c81004b07ed9feff8997a4ee447c41fb9701543cc855a
-
SHA512
0d8bc60f09a5ebb44d1c52f1e7873ab40914337a461dac9b5377c7ad2844f71f7279b36c9cfa558aa837abe0751ea120c7bd074448afa3c85b2d479d23680d3c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003e2bdcd6ca9fd21f81976b1a420b932efbb9d8318d55ccb964866cd031eb92c3000000000e800000000200002000000010d92c0c62b14a53bbcd3a9d029c50fe21ce9a74c9f0b47e88ac3ef21eebf2cc90000000c5e53f81f0fe5fc0c54f356e906e276095af3ae3a6dbefa78dac2e7ddfabab340f82977743d7fba1525a4b2c177e6569134a72b9612dbbb282d145af158c583636cbb3918170fd6aef8ebd305984358bc6ad076b8dfc67194ad82459872e1830ece27c7464f96d44b5848fd75c1fed6233a4009cc29a56dd2f2b92e01a735fd0ca64500ad904f360352b93dd3196f5ea400000004a4f5e1ccd4fac98c2257b3c64fa97ff1433e8468de6f6ca5005a100bf6b8575bea37ad6eecd4a0a9688e39d372dbca67f681d1c4b83d122dd794ff92803dcc9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421074407" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB5B4141-0ADB-11EF-9907-E698D2733004} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d2c1ec23a3d100c53ee0c858d677cecd271df056ae4ccb83525c47688bef375d000000000e8000000002000020000000ee517c49e39f34acc5e6ab10c5b7df75cfa7ffd04cf0175349bb2699d7f10f1720000000508daed66a000f7c4fa9086f5243e1f7117aaac2d8d01fd90602e2b13fdb450040000000b45cab9d90c459d49792045f9a1d1ec3e9bdac7e9ffabd916993c5622def7dadc99f9847ceac79e19e195b383cd8e7cb5ef416baca29aefead6f272385105193 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502ee4cfe89eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2016 iexplore.exe 2016 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 3012 2016 iexplore.exe 28 PID 2016 wrote to memory of 3012 2016 iexplore.exe 28 PID 2016 wrote to memory of 3012 2016 iexplore.exe 28 PID 2016 wrote to memory of 3012 2016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17b1222e12c56f44ef988e8a443c5434_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9526808d3221e21745a4a02a33e8d21
SHA19a3e62b5a4f06ba9c58cf89f3819559df22998fc
SHA25661577cabe0ddc77388cd039e84f44d3df9fd77820ca2b04671b14736f1ac78dd
SHA512564ebc49e53ca9f652ce4cbc1fd426c614efe363b0787308c89617c6f1da75f654b22242a38ae8e2cad71d43d466101c29f6fae129449fb24d4111371aa17740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5132f13c0950c27429707620f4911b44e
SHA13935fdfb9472dad738af32e194e9324c632f0b58
SHA256ed5137a66499e93ffa06baf45322e33d9bb0b156b35c1f283a904732d72108d5
SHA512883ad88b0964e3e0c778aa087b292c302d179774fbfeedaf28ce9c45bf36bd58e93c3ec3a4cc65874b0b089ab2a3508a1a2a136c57a911e3fb8e2998a7f5b942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c10c08c3673f538a6e175f60972e418
SHA1ab98a1e9b9cc6d31b2e7077bd82a57e023acf6a9
SHA25654f8750a027c41f856f0b15c6d3051e8806b4b1fb0054340bdbe8cdb5f7d035c
SHA512f006895fdc088ab2fce79fc87f1474cc806b0783644bd9c83747e4ae7f2a3600105cc6461943bb3d567d69ced16c1c9cac63ec9c1d4ee9c85e8504ea4d8a9cc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc29e7bab9a9a0c00efbc3f17befa0c4
SHA1d81243155120f559851d657f9cc95f2afc98b6ee
SHA2569a32d21e674a98c5a38b122ee1cb357671f2ad7781f7fd1bd317be6cf5ded36c
SHA512a6a358c16fedd00196ff0d0f925637d8bba53adea5a3f78be8569a8f5fe8915df9abc306b93e1c40eac4f9935e571beb60dc0e57cd065c438eea2571984430a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509ca6753656737d18de044a2158f749e
SHA1a3a94f254802836ac442c187b61d9c49b076402c
SHA256888933e4bfd90d2a277a591a91bd598f3fcb8d359b38972ba4ae7b228eee8b1f
SHA5126c6f1e42aa7381f2d2f46d79f20d9b507ef12a17296da658fac1c9352d611c86d64683b0826bf2ddf66c37fc76dced13ec38b0c0dba6270892fa0036296ef70c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5791575b489984fc644a0f99eb15fe843
SHA19f5c06cd3311c224bed65365bc25a4660b70e39a
SHA2562d83bc9dcb029f4fa27696b9c9de6e09c180b7f200f6778b8de2920f5177c6a8
SHA5129c9180e0c2849514701ed4de068e2c697b515a2aaffb64bb5d3924549acb8f5d5c987c3e4a9dfc36f8cbf823b79676ae4a3aa249acc22ddf9fe44e551f636aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebd04091378e8552d41ef97413b04d0c
SHA18adca0d3dbaacb1326884d7510861ecdfb95bc38
SHA256c2ad6c956a10a9658379fa00d5ca191bad3dcad2d77c02a1964a997b1c2f78b3
SHA51243029ca53abd38c27877a590605ac8e127bf28c6da730a1c1c8cf7f4976de073c3d36f7ac4b243cc73889ae7be8b98f219fea82a8bf2cfed5528618d4caa8c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d08c229bdb6491b9f0a80eaafbc8dbe3
SHA1179321afc7b1d67d6189118cb36cf653d7bb6044
SHA25624b130b2636a89a1ec85c4c04c9db29759ec12c68b4dbc3127747bc8d9be58ff
SHA5123fd22b57966affa9092b245cc5405e4d8d16e67a9a7d38de9844d6a8a925a33d54b550a381c75f6b3e3537842f353e6dc16ab0b3a29dd12818555d561ae365f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab570dd5e96f0da743402235bcde2a8f
SHA1ca0296cd7e6461ab2c94bb56ffced3a1b1e7ccb1
SHA25659b4b92ad9f7cb56aa1df16b73eaa9c2a540cca4280060702ffc330a86894551
SHA512bc687f6d827fb38cf36790e62de0dc4eb12ab7cf9acecaa994aa809f4c1874ab6dada9c2b49e58a1c6cb48046157e5bbfe62abda6b7eddd6dff84c95e3de959c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56680c0bad4b8b910ad99d121ecc898c6
SHA1e1c2297a8007188c017a35f514df291099f3859b
SHA2562f6c293be623142df25e8801d9505521898281b57bdd6065ae79f8ad734852e5
SHA51207c6bd02cd76ce79ba455d4f28409677a364371b599d6df777793384f479a2371439dfd827515984a16ec1247a7d20e02e35fe67e0c0198da33013b3b105fea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f725798dbb202af402271850e9ae49b1
SHA16d3751df4ef90f16c72016692b6f552013d420fd
SHA256620dbe247fe85fe159f3c71db5986c96030f7a9cdaaa9be4e2d90d0e30b535a6
SHA512cf04d637e421c835192c75c22363b7740ed88964b1f4e8e62a7dbbd746bbc80379632b3aacc4afc361cfe756f7c66db8d046f05da9d1b97bf05b8e454dbd97e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0c21bd577981e872fcd9dc8042d9f4d
SHA154a38ee14a6c9e0c48688688314c1c38be34adda
SHA2569892538d61e6ab674d065452b975a4eb13ae09f5e15341cfd650c7cf6341d8ff
SHA512dfca79c43f324c69d7da4d7992e33f68a1336eae475c45ad7b6935225ee4041f3bbd91922ebed3634a50a4f79c9ea5bdc6b9918486110af1ccddf48d65171ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525e2f291286e90aaf896d0fe9db927de
SHA1409a069519847863ae6c0682563366d7b367ca2d
SHA25653f735bfb671ce70fc77dfb9586536550d3d811c9eaabd8d0c5638fbb4e1f00c
SHA512006d3a727e5b3b324b37c2d5bf19a70e786feca5b133c9387f38c3c213e3b6aa41785c1f8d8b971fad49756da4355c8a8b35711ea334dce9333973cdf18e8159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad15f4fda40d8196c880dac245f0cc10
SHA14654d49e7260669a6e83786c7fc1e488e78a520b
SHA256dd9ad07667d0fafbe046e006c2fce3733290f37d1bdda6e3fe8d86e99fefcd55
SHA51293f16b96c84336e9471752e1f9f986a61a1dfe3094a3ef6b022b4cea3d4eb007b62c644df6fe73f0bc234780a0eccf558098b5c1d4c90bad8afbd66661684206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f934afc45f286564045ba694a8dba1f0
SHA1a2fd9b6b9e6b875e5214bc4ff0abe2a8f686fea3
SHA256ef978b2727771c6f6cc82aabd22134ee0407f6a35591a12f9f30423ac52987ca
SHA512143cef3557954dccaa3299d2353d6b57647de92bcf8d7dcc150c67baf5960fee296c7c9c8e77f12ea439e2f67b532e3976026e641b5bed2c40fca3383846e044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2d5e724723a8157600fe921bdfe73b3
SHA1cd68bfd56b5dd29b67ac3234776f9f20e180c0a5
SHA2561281127854d006b2faa75939b937c37ebcf8c6869df910adfe3e202309ca65d9
SHA512f3912cc9c60656f826d118ea242a98b5d6c07d432c9af86f78d4b83e0fa5d0d42685fda368623eb86ba09516ea4cb12c1206f273da6ca0d69d8e7f96351febdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50328077a59ff875877e564d97145a8d3
SHA18e516c8786f0313326e98927306eae4c886d2644
SHA256ff41ed66c4938fe8bfe156e31cc1e85d5fe862c7c194915551b531cae39ff68e
SHA51261578793121107d2ccae7d4c239d9bcc9c8340a36fe31edf971be1aee476b51943a04143d319e5a0c368d8b11a51f110c09a98f290071d2046634e04afef2b0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589bb15a48bb3c96942bdcc7c078d90dc
SHA143bd30b1cd59d3d7a50e4d355f2519a027ef066c
SHA256f670b67e461df49abb68301dbb75fe5129ebbc95fb05684b06f34b540f762fb7
SHA5126b5a3239ce5b74bf2cf499806ed3bbe196b9626de24f0f31f4fa3109686c5e4d8804c19eaeeefb4fbe25b3bc2af81e334997b1c287b369b4248a8c42aca8350e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a