Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
1f447b25021025688a7d650558e9b077_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f447b25021025688a7d650558e9b077_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1f447b25021025688a7d650558e9b077_JaffaCakes118.html
-
Size
332B
-
MD5
1f447b25021025688a7d650558e9b077
-
SHA1
8e2789ef315e714881adf535c8edbfd1e460f7d4
-
SHA256
8dec6261c0d971a3eaf057185f0876f0e42c07c26528da724c17b9a208e4c448
-
SHA512
76848ef77a680fe97cc1852ccbc3b977150b3477248e0f2aa379311dcd4c39cb3027d1c056617be8c11b9065c034f34ff6d05c01648565865740b252c8060cb9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05659032da0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000014bf3a5dc09ff46da8ea394ef524104accb0bfecdbfa4332c6d4d04dea4275db000000000e8000000002000020000000d65f68712a89e561b9c860b04e39fa5a445ae8832cae3df4252930f8159f71d12000000022bb2df20ef4a751617d5d425983bb334344fdf4ee6f292bce5f2dd1c9520881400000002d4487bee670ec13262b9e30bb3f02ee17f4e023298beade70a8cd78c967f0a333f59ead22efb7f1b801552fca6392944071e34c9b00dfd3584e322e1e48ce5c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E19D391-0C20-11EF-9CBB-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008363fcdb0be5b282c4073fe6c3faf20c7f3524c80f12d42c7f070772ebaa60fb000000000e80000000020000200000001156440ec87c6429c610a0b60a9f81acf222a6b3535d96f882bd6a57ac2634f1900000001801b74d9735a50ce4cb7e11bab9116722f75cf261222e94585fceac2e976cbcf3c9a3b2206f27ab7a50489420b4bb982cbc5119a1ed55113c4c1df47687b71ecbfcae4b6f768dfc7a2541bd6f6857c660ef78e458df2192eed5701838aa0da215ef5f2da976a273a502bdcd249e257545cc96ada6b493bf277631e6228bd178b3cd40e168a6aa20953eac81b4ffcc7840000000e4954ac1883821eab8daaee6b8f63b96be726bd9ab1bd2c429eb22cdff5eeaf868016a8b7177a9f0b41cccca5243f6855650944f7deead043190cf8c746b175c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421213651" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1284 iexplore.exe 1284 iexplore.exe 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2032 1284 iexplore.exe 28 PID 1284 wrote to memory of 2032 1284 iexplore.exe 28 PID 1284 wrote to memory of 2032 1284 iexplore.exe 28 PID 1284 wrote to memory of 2032 1284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f447b25021025688a7d650558e9b077_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52038ff70be7f1f12e027c25452f0c11f
SHA127d7d8f3440c00e221ae0e1d65258349a3d22046
SHA2569940d45cd687f06167b53a834ea1e746d6f55582bdc3c3aad32d76ab1048ab31
SHA5128ba18c9ca46f31e36947ca44d2278e8aa0b239346144b2ddf735168135dd66ca594f77e6fb10e8b95d24065a1c14756c552a8b6333ced6d8f1a65c1efb28851d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a48f98c3050313e56dd63132448e739
SHA160ddb6c1a0033cc6b526027a0047243321d9bcd4
SHA256de4c71aaf81c7b4f64f4430068445fb197a4b7ac167a6837153a4a417501d8e7
SHA5123f2999d089af120a7e7c80b135f5d39d2f8ce0e4441d08a0f70be5cf6ecdc71e66e0d738422569e746ad236ccd3f888932ebc8a34a8a783ee54138f5c0162f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5d3c521652eed50422adb56b0581db1
SHA12151283a4db56d58cafd0a6657258fbddd0476ee
SHA2568a293d43ca0ac5e3df8f8901bc84c75096ad8f38abd21a5c9656d39302d5ce3a
SHA5125ee61a26a4249cbeefd0b7bbfa5aaa3214693666173dbcaa4ed3ee1d97fbd0053c47db3e68c265fcde3f061f7f95e539bd62c2eab05228aa8cff7ab5f76497a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2924c1304bb9d75da01686996254102
SHA1e701cbbac4e01f29c94f92f36dd9072dba68eea9
SHA256f0367532d00d1b84cbd72eab06242efd4d63d4587489a5911a73745603a3a966
SHA512521375c516123d695f147bb62c5127801eccf0714943d62e32eb7a8e796cd4e50752ee65cfb3e767ab86d6077cc10530f657742b1fec217381ceada8412908a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad137f9af4718ff3d5798e1d6ff7282
SHA1584587a8ed7d19af909d0b927fd020b6448114dc
SHA256f175bde11b01b04da5891a2e7132cd547ad4af6f8bf9eda509ee61f340d17c20
SHA5123d83810b192a7205e8aae21409f4295b9f7fd45b1f332f1521bfd493e862f56059d46973ff7aa4ec9ecbaf5669680c8cc69e1d6ccc47d7dcafd28dc5e7fc7ea9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5138b321b32c9447ade03092462b4ca3a
SHA121fbfaa2a34e759ee5bc1a76cb1401b5c3c637cd
SHA256b73d087d1f2b1a8a71cfebfb6ffb0a31516f40c691e6762a85cb4d8415db62fa
SHA512faaf715caebb0d45be613088bdb6296be84946be5548845ea1a2861d8d523439b1f2d4728ad9e5fc3149a54dfe7505e3c5483fc4546ad23a758ab5b083ef64ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5309af60b52553536e4675c19fc589c92
SHA16d34fd577ec8d636b4eae94347a11f39702ab22a
SHA2564dc4bda58de8a21482109f6defaf097edce43fa8b0937a0e8c0597b37b01c566
SHA512aca3768b83c659e92cfe4a17b8acd1eae444bf48bab8c1bbfbe345f8614d4517b8a5c1c030820fd323b681ca43b6f1bbdca0534cf61cd9148c4fd6296c359fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541917d67523ce6e08599d5c6031f1444
SHA1f8e242f87aef27afdd74cd9ca310be56bf5ab5cb
SHA2560a748baaaec6ee0b8e446d596b17ebfd85e62be8eac0be62d951a6a5f6bb50c2
SHA5124cff5d27199b8b88785f15cb96407fc732b372ea4f90d74d13a3827ed21665fddec737c29c31232923ed45cacd98dfa4dd8a562494afae097ed78cd21a8cdb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b397730383d82d7d5f239cb1ec86ce9
SHA1e4b658ff91fb2ae9cc6712c2e6de7778b018ba49
SHA2568155e0b7ec3e94cea1cc5530f391ba3230bcd784f137e425f66360bc0e0bca8d
SHA512099806a577e58557e9312caa5140f1a861e5fe1a53b823d1411f3c735417ac52c846c86483fea3d6e5cc77f6abe221937b66619ca71fd396c0a114d95a30135b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ba3056bf45069310051b8f628ad4de4
SHA128fd6b2d0c8b166e02d329d714040e04fa5d077b
SHA2565134b8ed35e15874cbcb95da9542ab766524e7770d84ef931f544c1032715233
SHA51266604cb31d3c086af2b8cd1c5db16208f112c45def39db280c3961010319c3966a9226e0181ce4b8ec50d408f45502c06b87ecc0bc8c39e68772a85068dab524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5423c2415fa864cfec57c5bb4dc7b1e7b
SHA12ac9544bcab5d72623b2736c08876a08c7fd178f
SHA256f2d8442fb17d63a81c2a2d9ce1832a35e154e1a5f626a800435a44cbadedb365
SHA51223f56148ee16619101266c68acf2d59b709d80788eee1eb94d6629d73ea82c18f4b326515154dde24d56771b4ccafd7d7ff3a294e686fbf6d4a6bc8e158be2db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c077a43e17d739b89dc66191a4a93a77
SHA1a18637610427365822cb234d70c73d1e1e70dabc
SHA25668c6dfdade4b17f99735fe3ee468b42855bdf830184360d4019f3d31c1685846
SHA512ea469347cef3feb76f25e865d303611b590ba44c0fc5e5a8ecce01ec10d0cf00b75058ba65ac7f91b7b73abd4eb3404e912e3835f2296c662b9af815eeac5b7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f28ced15b01fd6b8f37aee1a1ee32869
SHA1eb262d39f9a34251f42639f90b57ff83f9a27be0
SHA256b76c9ff51cff1399c157f57266dd3ab70c6cc9051074325fcb0bc22d0be96c58
SHA5125a444af79c7da08b0d470b699272af8c894d7aee11a84353374275b473649984d764bcb9d084cea1afa7a9d46de3fa03b0fe73a120c9d561669089002f132a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572eb113e633bedeccc3cb0f184bffc5d
SHA1b899fa52afe9faad1b36184824d80d615fa1ec77
SHA2569371f7b3688663483ad9c5134cecd9719c2907833b38a963c8de6f5e0d2820b0
SHA5125d9d98ce3fb1d3ecf66e32f5ba35d6949e680ca5a84c104ff056d34c38a640a941f43cb9107b6fa92118a694baa07041c84332076afb774182464f3b5f9fe5a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7b07f87f41e9b4579e91fc72d9185f8
SHA138e14e459ccb6cb004f9d51a9faf9d101f9a8c75
SHA256693f3a73497d0082046864fd41b4848498e94ea710014a8fb7d51a543c8a80ef
SHA5124715a438a144d80c8e5068485644f55f8f05a5c8261101479d14adff918cb354c042aea399a48dd2b00b9288b57cc4324a05009c0f21bbcfc6f811d7d930ba31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b96abf91fa2032021169756743e16b92
SHA1291efe5190c49d901bd105544f784b1ca4a5c2f1
SHA256733bc2b0216d2f6d829d3b1edeb0ddb292d7a14f492b71eed1aa70282416c8a0
SHA512027269b7c46d7c02c6b1d289a89a3fcbc8079144871a565cd1ada5c08eb293d0c2a3a67f37eb498e7fde0e8733087e1d324b06ec740fbfa98f0497f93cabd4a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e67171b4e99305952605e3326719eb2f
SHA12d15f724512f0736d9a5548ab2e28b1fe60db324
SHA25698a626e26b7975cdab76b9e435eb97f697ea06603d592dbde6a04a24c1be62e0
SHA5128c71116f8aba87806734262f524571dccf99886a0e039a55a16ceb8045607debec0138ace709199fe7c00fd8aafd50aea7cf868458ec80a1a934799e8dfa267e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a378ae0dfee43b422229913137001998
SHA124dd2b7aa7a8dc2dcfb48b0b795ef693e95f884b
SHA256e65796a405f47467bfc2104b21d9c246fbe8c03f431f192fce2e3b042e6b702d
SHA5125cf6f5cced4788aa301613c4c3f38b41cb8743344a515e59ed5899cd2b32ee4a2edabd11ace6daf6eed7962ae2cfda1736f6bb1380bc59212ddef7a46e79bed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1bebba4689bb1f646784c3d25697942
SHA1816ea64d516fca292ce3254144d33898b47bf565
SHA256f1ea079add6ec3e8dd6e08e2e31dca41acf778af5af635bbc0b9824474a88202
SHA512d2988386abc032260b682a6ce221d53f3d3ccac07835a3a91e6f1964eae2501011ab83cb3acfba36fd6cd8f37e32d6a5b6150f737b089e175320310cc6995fbb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a