Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 23:56
Static task
static1
Behavioral task
behavioral1
Sample
1ebfe98e81cf206b30f2cc59ddeae09a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1ebfe98e81cf206b30f2cc59ddeae09a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1ebfe98e81cf206b30f2cc59ddeae09a_JaffaCakes118.html
-
Size
5KB
-
MD5
1ebfe98e81cf206b30f2cc59ddeae09a
-
SHA1
295362d35a2de4eefe512c08f1fea9b8eab36749
-
SHA256
7e3c6fd0205f7c532b1dd4d9f1d255455bdb685d9ae714b575db423b14ebead5
-
SHA512
9b34a0344993daf9ff3ee962c48b7d71acb92e27fb0dce83abeba05f7271d9e088c1e24b01c7293f0c30763ed666bd18e77549bf10d8a4ce19d3cb940a6f7b84
-
SSDEEP
96:1HyqyTyf8PXKz8F2yMUKnp8XOeFB/r7K/NVKKKiEzDBPEFPuetxTFrvJRS:1HT2g8fKz8FZMUqp8XxB/r7gVKKKikDx
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04fc42211a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fc8759759b613bbf26ae704de2eaeb3daec3160f8adc10cd3aa46905473a00c0000000000e8000000002000020000000e023880e08b5f22f6f7a45956e3570418945ac8786b104cc3658b1ef65985d9d20000000d5a4d76c75f80fb7de7cf8ee60dde7edc885a0f6620016f68a42d3f5210b2cbe4000000051abbcecbf04d3909e50f442cecca5e427cff2d8c666dc50de71be2077ccff7e986d6fa3a5a125fca1c1ff9ff73bb741d38906180aed312d1f1ceb4c32a2e0bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002d7e10bcf21b88a29182fe6e8fbf61322ff7d3aa3b060dca4a31c974721890d3000000000e80000000020000200000000636c9ed15cb008da4a17b6beed50defb13ca554f479c6e423b86b02aea3a96a90000000f8506d637fa94f6c3976da96f439e60138dfaa191b3a96cc6a3edc6711200218c417b0d2f2e46d443c183294b4abf7ec2636272374719b7d083c730e479c5d48f2716035cc82cc4a9b6cf002dd707825e605c549aba0bf1bb38b251b522336b0638594b89311e659429075ab6aa8a3950108ec891fba48726befca9a1e519c58d1369e065f3beda7273d3c922cebdf3c40000000bca4f4e44f710ebd5072f44806d27748c8e44dccb4bdb281ad41dd09db5a88da5550add8d6748be5c93588cd98bad84a4ae4739a481a804ad97aff6d617174c0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421201678" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E350211-0C04-11EF-AE77-52E4DF8A7807} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1592 2912 iexplore.exe 28 PID 2912 wrote to memory of 1592 2912 iexplore.exe 28 PID 2912 wrote to memory of 1592 2912 iexplore.exe 28 PID 2912 wrote to memory of 1592 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ebfe98e81cf206b30f2cc59ddeae09a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a80926ecfa61074669496910ee5aa19
SHA1e5b46b5f739ff4af4ca3397567c538bad01c0e95
SHA25698bd4a0fcc2c20fb52d082690a10fb4ec4422a3364c1c6c0478f989d3c4be21a
SHA5124e3da74da45b4d996950c1c4354cd0647066655dcbb101b06a70a4de9d7b1c84fb4aab619fbecd0c2d3dad35781ffaa5b27b3a12ac64d86416c13cbe69efb469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511a403fb8a568d2282a854fd09e28e11
SHA1ceda3c9e4bafa76465ccfcd93932af6257707a2a
SHA256b40c7ed2ac834cbe7cb100319c4ed57932cda652b063593d73e17cdcca7fb9d3
SHA51253d398d5429a08c3b5d0af720c88c4d974fd9d70fd1b2e008dc754486c469ab4baca22940edcb92f570ff96ddcd0df50754984340f1c1a4f4e48419d83152543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53378045d994f87611ca4594b35fdd4ea
SHA1b13b748c52649c952385652ae0ef92d753ffa631
SHA2563717643e50972bcae603dbac052f43f8abc3b35af9f2d0b04a1405423650a397
SHA512bd3195dfc146dffea148dcaebd869b55b4106029c3f9295fba62370dcfa2f45fa9c02d199999fc0e2ba46c5cc5666adf4acf412910120d206f6c26d522637ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8449120915b076228bc39f411b4773
SHA1e79794f2fc64fb5fd5096cbdc4bb65ca4cd70ddb
SHA256c6dafab8c3fd84c5c76750fa3b909528c0cc7a04ce6a94add18fa812a76d3424
SHA5126ba60e29ab4fd3de694933d41fcaf6accde0aae72a64b239d36713fe5c5ab9e6608233533fcf5ab1cc33e707e4788e15801add712caa72ae2da958c5a150f09c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3364baa5307dc38aca306660eef9d44
SHA1997f0571b2416b71ccd7d404f14483bf83244de6
SHA256dc1fce5a078a91c89e2e4863222783f3b9114be9f6d87a8630d0b230e01b188b
SHA51239fb7cd08b0877650b1e676a22862549bc8764a7c7fb4cf4c2a8ae0e0fc12e667ba5b78a49f4eab8133dba0a5dda6b236c3230670c02e2c204713fba3c7b3710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a21f1780d0b94d6e39a8afda128a0d7
SHA12c0c030793cafda36384e21b1cb10a13b80fbf6c
SHA2567161b742d31cc0202caaaaa9669c07808e02c14caa532156d52d625b82b11376
SHA512781f0d9d0d5f00c8530032c7c57225c802e62a2e8751dcccc6be99627171078056296b6b73f396529190998edce1054bc94af1598a7b71529c05eb2b70a6ca79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fd126aae342138f46760846fb887421
SHA1f59d8a4ca4e84539cc5dd2cacaf0a40ab70c358a
SHA25657b6bb625c4bf7e2257a91b4a269a182ee30015eeaf6f368da3257fede013fd6
SHA51214d298fde39324c11d76532a002c8964d0fceb30ef115667bf406eb8f3f2187fb30bf6ceb976a1254116e5a93a237a677ea11c0aa5242a4c9292b45b879f55d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d72ec829f2b539a4838b6eee23035d7
SHA1e7347b4484edf1a66ee2444c7992a9d3874e38ab
SHA256a755ad87068308e8627b48a5c7b3cbd5c09fff9b8490cd04f5f95d8782555c26
SHA512c96d86318d5cf6212b052c5a3a50e16abbc146790a585b012995f32ae90c9f32f2fd9192824a5f0f90b9d002dcca5512187e5c9b9ca3df4c78e2af964d590bca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569f8de741116c359c710d7ff6fb24396
SHA1743b7ad42fbe80e9fcacbfce09cc4c3b16820975
SHA2564810f051fbdbf81b137e00f89eca8bed1d73df97f145b98a06ca1a9609a47643
SHA512c159bd29f160993692a5209aab2dbac8d1626f45c32e6742a432b2ad45d9a4ed3af0d2c3b6f168a9852cb9f6cebe11e66fdb5ba7c34d88f7b05a25981436aa5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b687db815c3bfcbf0df8c60e49c59fc
SHA1afc84d88a140eaa33f1ff982d6b5fd69a017cf60
SHA256bedfbe31bb9e9f980c6479eba3de9c118d362c697ecf854448824423b3d8a0bd
SHA512629d813848d5ca7c1039c3c5189326eaf2c65d87bcd40692779cc46178f79ec9c06ee1e5ae88d6ef8856da9d4c3e12fdd67d348d69b0ca5eeebb09c60181ca31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7eefbe049ec7e4e3b6f3671e5cdc492
SHA1757e70725f2a1229904eb0cbb7a5f2a246f4b46b
SHA2561f0cb1e625346b9802ecc20d019915ca32fb1ae651834f1cbe31d8f28fa036d9
SHA512747fd5ae7a05d067581252e5641f5cfc31f772d49fd6effb6bda1ff9861188e439236af9e84121d20eb5f236fe23240cfeb6f9c57bd4e2b24bc9541313701364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdb38dd1d1b2371508e45b579cf74bd0
SHA1f6d38204b7233cb710056472d5986acb75479f3e
SHA256268dbe1024c7e308456093593f694ba8f80962e1e31d6646f0559ec392b3b5a0
SHA512f6aba7838d69325001abdc1a00811c9473742764cbb17835b2a6ce7cba0687a2f9bcc2610b813a3252f055174e3e02fd6f175fd4dd4c60bbaeb20b3c7a1f197f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e98de54bd5e721ed848a212e878a3984
SHA1b261adf4f3e707cdfc7ffa76479fb9ee9a389278
SHA25646b14d4cc0461e5cceeaa2891d30b9212d22ccec48a73858ae2428777b26800d
SHA512d8d737df1c7e03cce35299021e9b7e39201c95c1956d48cf513ef496714057c1ab6e09c14886378a5a7eca9cceb112cc0d1e250d057c3e9fa03ed933563bf53b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f9e7f06267faf87cd10dda6513969e7
SHA12d2f12ba345f7f09ad9782ddca560f04c4570cf8
SHA256b51cf07c5fca6e8d22972bc87a0dc84266968c9cabbb6f4ba13b58d3476b4003
SHA512436da1ce06fea17fd6037928cbb31090a11ffd3895f9236c8d8f7960249d64a2ed97ba88893587ebbbbfac0536baa90e810f2639331ab5ffdfe9414d8e423361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57064c29d175c1825fae90adb8c9d8658
SHA1c0729740a2e276907529d083f499b57011b1ab87
SHA256abc5b855e1e6666201d7009668231ce149484b21c84aa8368e22dcc435470a2e
SHA51221beaba4f1b9da91e5afa60a16626fd650fcc8ffc49f8b190fc6e10b7e7aa05da9aa6a8cf5f65d836129e12b5a20768c121446ed50c0b103fb5990333b05adc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1481db8f6ef8bac66cb6186e427fe25
SHA19146563dde553233035d68ec30a7f135543fb017
SHA25665650ec7d53ffa575b0d37b4726e4b32e6bcba524c7602c35738c28be83613f6
SHA512607089962b5744078b5d1fe5809973f5d09013bd2f70161e1278c34c54d48590adec5b20194320297d159789ae40f2d9d51c31f015c57c5dabf0de40fa53445a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528b97669f0c4dc1fe865b48e33221c44
SHA19da3f98df918d770c408e80031860b6b14d317b9
SHA256794d89eb2b660a572a12fe562c1e7651bbe42ecb32b9487d29020dd2165b4548
SHA5120310f03f0c1afe0f3c46d2fde39f35833bbc3e7a250b0b6f0c9243ad891c9d1de6e2073d5c045e9582b6000de8ad45326829569664ac271b23f8c00476900521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553dc34f6c8d30be366f03f565a63cbd6
SHA19f29f30bec5eda73779fa5d7aaff8e97c143b072
SHA2565b7d6c0fe5fd28e230bce8cf7c4a15c020f2dca967ac9a7ba402eb4dd1eca99b
SHA512c55595afc5bdfe4a5482c7f0382475589ba0ddc378bb9b17f2b94dcc13a106d5b68853f63c480a486d8a5a46a917f509a7376e0183bf6b69b6e724ecc00eb114
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a