Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 21:39
Static task
static1
Behavioral task
behavioral1
Sample
21d500291c7274aeb6352cdceafa446b_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21d500291c7274aeb6352cdceafa446b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
21d500291c7274aeb6352cdceafa446b_JaffaCakes118.html
-
Size
3KB
-
MD5
21d500291c7274aeb6352cdceafa446b
-
SHA1
a5459ec6f3106f11eda56159c987e89ebdfccae2
-
SHA256
cf777012869e3c26e114eaed8ec7ab4e8a929a654ca8d824aaf5ca96fe89b11f
-
SHA512
ae4071709f0c9b9957eb1e00841f295d006bea465d0f688a486caa26c81a2a9e2c6bfcea42e64477926dc2c2df53965e84d94271e6a9ba21ce3c369925d7e239
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53E30521-0CBA-11EF-8D15-FA7CD17678B7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9021a028c7a0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d91208c4e1e314eb270e8c534902cdd000000000200000000001066000000010000200000000cd5780b63772eb5a21676eebb044653dd8e803429c78271259ba63d4fced2cf000000000e80000000020000200000001149b4f0b295bc429ff9be4086afa82d58674ceb380d8fcde974c6a6b6b4700190000000277460f25bb70c6c4dc38d5f9628ab53a0fe8b4ad9709df64c26f16761309549fdf761ab656df220026579e798a968cfb95b24f96495f6c606b4efe0d82028e7a03a1d2b22aeb04eb77e80f48f155b7fbf5f3433894e8c1684d3e684faa3a9a324ed06468e1d4d9d4f191e57a19601d99302e43a72f88ab9c8566d48cb5f4c01b2de0597984dd67c6c70e0152eaf22774000000095ee433083fd330f36d6f9fce3654e9c1cacb9bf2b04f0a369778df0fdceb08802192072a299570715025820c23e30aed8a145f2d0dcfa0f7e99e253b609a620 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d91208c4e1e314eb270e8c534902cdd0000000002000000000010660000000100002000000099959e8e939aad35556d0ca25e5d1e3b1da51ef839ca70d581b3bd8da59e5b18000000000e8000000002000020000000b79e8d722659c68968ac1b488ba1008b939cac85be4628aab7c0e2340d8ccd5a200000002c7f6af5ed695f9277eb685ccfe743bccb9f86dfa9d898d9f39dd24610e741614000000029d8780ab4c185f1437d6ce27abc59cfc381dec2edc7c9cd1b35f098c56afa87f7b9ab873b127a2d2d6764f0d21f7a430cbfe7bd09ab4212cf28ef2db107a343 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421279855" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2172 1736 iexplore.exe 28 PID 1736 wrote to memory of 2172 1736 iexplore.exe 28 PID 1736 wrote to memory of 2172 1736 iexplore.exe 28 PID 1736 wrote to memory of 2172 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21d500291c7274aeb6352cdceafa446b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5e9f4e540cd1350460d9a9e49b1f66b2d
SHA1de9e06264830a98d3e90d24832c13d189a5ccc09
SHA2565d2909ebf9403f608ebb139a3f0e19dc53035ebe7590c8b19914d9b6d19cbf71
SHA512c133fd0e78dfe50abe44ce43117d707f77e6134cc086910be0b214565cf059f4fced3349ffab71ad573936648517fb5f4a3b46769afa45301efb34da5a6bbd5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb485b6bc074562979f074c71fcc9d22
SHA125dae7be91f8e034f5419112b204ddcda9db207b
SHA2564ee41f947e8cc2878df4fa5bf3e27a0ef0ed0190687acb2ad03cd316b9073287
SHA51283e2b993ca5f2a57b3dd983c80a0ad2bba1dd4d0fa5bc161cded304698c45ef23fbabb9cc670e85f30d4c1d32a3b22f4732ae6fee82c737cae0cc003103ee8a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529a9a286b4529e5b1f78fbe7518930ed
SHA1e03f7b8e64d9de353b3bcd778df55513f1e2f8da
SHA256a407791e2a4a8f5472c08f1dc91d215f5caee296e648c580b891ed546a7d10ab
SHA512edf043b034872609b877ca47e1f0db974882c5d0ed6bf877b99ddb581b0d6a3ce320730c726d7e0c088eed63491b1367351ec595573ac04984ae91be6edc188b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5981883cbd173cde992aeeaaf9cd9f5ba
SHA116916f52c8182503e5ebcf1cf205528a0956a936
SHA256263bfd74e8bf62690b4f31f47e33f4ca7a38b38602dc3211ca1616a165374f5a
SHA5120f71cb0a08c9624813b56f2ac64956c4b0ce7187786fd528fc803fc20a72fffbd292059d3b2b590f2fc17a16ff02ed6d405af3dc6407bf95bad0eeb2db6bd8f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfe836a704b15362366c72ec461cc8ef
SHA118c6f1d748ce861b2e7f8a8cecbc6dc67054ed19
SHA256a547e2f5f065c45327d6eb72827aa3531f146b4f53a57a74b9d383cec00026f5
SHA5125ed4cc59acf7d248b4c9e03e460fa601adb1560afd551bae645c57417b1b256c573676732240cb2153e149eeb8a58ed090a8071875046814a4bf55e8cfc0d9a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57822779b615206ff2cd668b0251fce7f
SHA119342b1e7643b464eacee85360e860695b263b67
SHA25696ee7968bdc378191c8125cfa7dd5ea603384a3e9411506470267427175bb471
SHA5124d5556de048a981d0792311ab338973baa665764f53af49e00700dbc20fc83237c2ccce600535a3a3500b87aa9001a4c03dec6d6a039ae11443fb1cb871b0c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5456520cfa1e71351befdbbd2b982f395
SHA106ae4fb4e8067ce5ae24e7dc4d6d209673087083
SHA25695bd6e3cecb70481152d596d2933638265d886c92a061a93a8011678475d4f4a
SHA512a77b5b856f00cdd4a7ce378b9b22e2076e9dac3674c0cb1f14b31bac29d761254461a139cbae60fcdf445bfc73cedfe02f814e4f0a683036d11eb8becd328879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a76bcb9eb8fbfd4bf759486ba07d0e0
SHA15c21c80e4fc2d59a55f4addbde107251080324d0
SHA256bfca7f9909f5637716fe9f9ec90f65d861dee1291ecf639af87591262f61ad8d
SHA5122623db8070d0879430c7905003bce3d28d148966d66e7cb649be021b0feb5176f99d16b328e0c41fe7104635a3d80c941ce4c1e27c87fe402d7a29ecd4c4a166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520c6f7a353686008b2a97b958e8dc3bf
SHA124e17cc804d1ff9201032ff523c7b13a8d0b9322
SHA256e15a21a67d31f832546b11598b3d45e1832a8420baefa739b07cb69f1e69f17b
SHA5129e0e5082c3b059a6ede10eb6c9a0ce9811e9bf6d4a8426b3d6658a47249f34cc458412e9298fff79850ae140c839f54bc14c3da42d841b58353335f9f100aba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd05da67462a0a721913c713ba977403
SHA1a3f3d17cf05e8bf2284a77920dc4bf7c5882673e
SHA256c241f25fd763a2ac9b6be3a021eb0d63e966c75ee64e806ddc265e5576b9ec77
SHA51278b9a4ab88f7a22ff893dee4b3a29b979f393527f5e545b380a916fd7ebc7b00714018081210e40bdc206c78fea695bcde3b3ea2a02b402341dff2c676ac6d0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e39f53b77142958d4426440346154a1
SHA1a57d4d720490d243e921d0f8194a900c2a52877d
SHA256794f77416a6e4d0f8c77fd74cd28356da406e32a2f3445b08007819eaf00971b
SHA5124b97217de9a380024e114bb74118bd0eef606b588c0f1225128302684d4f8270cf9928d7d5c879a11c3f9416cb402e9a7eaaec18f874ae59438db2c2ab58ea3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595fffcdaa6d32fd82f5c354dce5bf537
SHA13b300707b68caa75ae98c7b5cbf7c71098068255
SHA256adb823ed324b2699bfa0ac593eb1665bedb591dad828a9a4d4f5a93ed1109220
SHA512597babf30ad326709d473338d8dcfed73749f009ab4a6f96a0debdbd835b9989eae009352502f154311a0a6c8bad23b91fbbf77ef2a0efa56cf57189a478bfe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591acab406561c3322b9a7474e40b69af
SHA1beaa8b9cd442f8d8d03fa58c9cdb2fe5fa36b8ac
SHA256bd83e73dcbf6f55649043eeb34c741141f1fd162e8ea85492f6b39364f93208d
SHA512ff18a069f58d59fae3ff9e7736b9615dd5d9d768fef43495893302ffc7960ec7d2f925ed300c9cd216db45484caf4d925328216fb356f33f242467f39491affd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d5880baf025046cd6dd100da0fd2b08e
SHA13b7601fa19decf3beb91c9ad9358c30ff12e4d41
SHA256cfcb0872fe9c20b8fce03e54be6755f5c33b9430059430d046f9b351bc15a336
SHA51204fbc4894a5d7f7be064611e9a9949236f5fe721b6c2bf3147f063f216c3f77d67e28b3dee478edb1ea74c9ab877295c2d5eb84817d2cf368755c0d9ee144695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a