Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
1fab4a8b896024b6dac15cdc35b787ce_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fab4a8b896024b6dac15cdc35b787ce_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1fab4a8b896024b6dac15cdc35b787ce_JaffaCakes118.html
-
Size
494B
-
MD5
1fab4a8b896024b6dac15cdc35b787ce
-
SHA1
1ef40eaca3dfdf8df89a57bd037b93660ed8d6c5
-
SHA256
2dc4eb1fb52a467b7f8e064955a3d11e368e86be62e15bbcb9f13478735eaf5f
-
SHA512
157d011bf9b95e43a17ea1c26236dcefb56c1b9b3d3112c91780b3d1a7612c967b9942365b9af4f730d065e4230223edcd259f2cbaf9ffda037f7d96d8a880cb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304c9dee43a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005135cf9a966b96c97502e00b77c4eebf6c612b2fefffb5c27a2848dee8fbc81f000000000e80000000020000200000004ff7c3fb4757f86fd73bce35afe07e7bbbdf99510b3b86eec2c44d23b477fb0590000000c5ab4957a8aaa049fa7d7589aaa6c58ec8f4d7dab14eb5867a6b5fdff3d6bee6332a3aefbf7878aba214cded711f008b9c4c932adf0a7c53f1911cea458a6463adfe73b964365661abdb1963604767f06b3fe88f878274391c51856fef906a6fc5f73ed42d7ef8a08f5073b18049d798372c44ad51fa6bded1ff6ef3992c437bb4598c28f0188f8fc644c98f132d4e71400000007a1c57516446273c1c03a9930d91abb533563b64539546de3118ff776ca12c26bd57fb03f100ca53972609af29345bb40332bb4530575ad3b30289451d03dad4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421223495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A228051-0C37-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005e323439d50dffc46d54cb4dd3c97bca54dd8c785942c47b5961cb34b6ce7f2e000000000e80000000020000200000008dbf825394bc2d4d893b806a6cd4a0f764aa32099995e2526a2ad03e16e8acfe20000000d20b7e6b6a2f67fb0022be0957a4bde6483083b929cd7df660a510be65e72b4440000000d85d9e2ce24a40310ea276e77dc7dc2ccb0cc67f3974f71339c513b8d96c5a2f609e07135970ff183d42396b9c483f1e7600ddf9d662e64c6e608b75f2f40175 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fab4a8b896024b6dac15cdc35b787ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5134b3a8e87660cce384dc1393f2135c6
SHA1b7ea7035d66da26938a45d9ef78fd43fb412c8fa
SHA25626005ada2ff3c16a3bc6d50ff2ae62e1526321bd6938c45682b70d70bf51f20f
SHA512e98e8dbb43d2f8568ef3dd0b21c5dc9eae22c7b3bbbaf8fc4f87d46e3fa86ff49e9b5817c6b7bec59177a7a9ccaf636663b285e7640a54e96cbe9e9e6eac8509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567de550ae7888e22f1e6aa0545900310
SHA144cced97926c8cf3cf1af37ce3d945b0c5bec48c
SHA2560fd5e26564b49e3159b7707380eb543f183e820eb97938d8c9970a18be96da90
SHA51244da096547cf361b6b229a15b764109b77e47cfbdbb80f25d84dd5a1ea0323524a1c07004fbc9e0203539d2b6d6534e3dde37da9e190b91366130295a5b0dbdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531616de26b8213c8bb739599f913535e
SHA1a59f2ed7da31688630b68e8dcc353f14bdee1c80
SHA256adaaec3b60448824b91dc89749e0fb4ca410b1b21d087b47a96f69409454c395
SHA512dd84bb99c4c7467061c0f8d03ae00fb7d3f44c060777c29f0f12569322df10742fcbe3235e9c60facc03239355f310a95503fbdc8668097546bd88e5ce682bb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd7d96a141578e2b5f3bebaf265ecfc6
SHA11bbe8c21a159896665c64896d16960590fc21538
SHA25645aceb08701ed194172d0fafd231fb45fbffc09bc83ab7b03cb6b4d9b17602f7
SHA5128e9a57027b5b92a55ec2e3211a933f718842b2bd320f6c2ac8f18f7fdd1074ab2d65de22b63fb5a5ec906e34cdab3c35134656de24270a8b520b5bf3d3a93ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae9a8786cb4bba03ba70ac05a208a044
SHA168378dc12b6554fe0108d477784c92f2cdf3289e
SHA256b09e398f35c090c1da861a2854c4a3f79ca2f27383c756176e7c464d37efbc51
SHA512eec432612d0c0144b0ddc1ab21b104e15d1cc90e988cf64dd75f92337fd47dd99d0ec92842a2cdd1d230f306f515886bbfe394cb37a40faf738137903896aee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59296e86567725fa89c76a26df04cbcdf
SHA1210aefe6520d659dcfaf8038fe023a62825b1693
SHA256e7e14c019084dd46c16cca4429f45a9c27f4efd1237fcdb993abaad9585bc262
SHA512887aad7c781f3b01eeb3274ff115f5bcecbc0b18568dcebe66b006fe22e95f74bc1619eb26797c3321bf3e0e4637c6bdd5d18f7e0d1882b4d0ff00faedf370e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceef93f7a7aedc98967fc662ea127acf
SHA159d5c7dd61065ac2ab16fc5fa83cd3fd9867911b
SHA2560f28b8555c5540c5ccc9ea6ef4f64267aff977fce537b895118f1925105e3e81
SHA5128fbf4c5070d1fcb42a5de236f97d3e4c57c360661ccbfc230891ce0178828be78b85eb10a4f6f8bcb0d67691fb743a6231b64979bd69d0e79d6c3ecb1c0896a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507decb2cff978944d74bb9b2585e6297
SHA12ac99ba5ebe23382f5f70a40523e8bbe69607701
SHA2564fa8b959c50792a9e886ac065e34a2640e1704d25b3e4c368cf6bbfa31487948
SHA5125c8e4690373bc9343bc08cc653b1fec44d2597475c07f6cb07092ca1fd36a46abf8ffdf574ec93c1e3c4dfb9ff6dc65c785e934509bf15c44bcc77c6f916facb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539c0f6d6fe15760a655f003f0a09c685
SHA194b5108ce05baf53234a9c5dd33596c0210b64d0
SHA25611bd9999bb5d538adeaab3fa51d985a4a0fd48e58fe742100dde7c9c528ca798
SHA512051499a9cfda969ba00242485678134bba7528dc1b557babdb86cdc04e5bd59f0ba46dac29d55b61bb54dedb397a6673d4b9cfe4764529726061baf2390291ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de1d49f9dacbfdbeb837bc7be466d081
SHA15fe0ef7137508e30cda2ab9af7280169b1b6ce78
SHA25671f93ac55f894bde9c0e3180dd398858c78b14cf6313e2b5f69a35cc6feac5dd
SHA5128ed11ca5ce288f63064660e08b70e8f00ffe289194c15847db05ff0081170ca19d8f8570d7c64d40150b0b02d07102c9a508872217b035ea5719cecd7a6098e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b625322b61c9d53e7bd581dde57e2223
SHA1d11c539b4ae2577251fa6b6da4357a45226c9f23
SHA256258071f5e5ecf30dc064bd04659e731642b5894354c790c8a9f8ceea0364c379
SHA512b341b011bc057ba0facfd195274c150c520c73485fe3ecf22feacd3682e75de61158c9dbea43f02792d5d3bf3df6e4501964473fe0f95cdda763df7345dbe813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538afc4e582368f3e4163a5125da78e29
SHA117dca9bf366a5f3ad0c9ca3ae7a67958fc67bce7
SHA2564e47a9080fb94f599a7e0975a23fd2e5ceb91a8ce9af4bd7402ecba727202b42
SHA5126771c8d140fca13347b429bbcf0189f26d9841c4516bcae43d0db44d4ec3cf63c62d23bc941d7d1a46339a6f80a3a612b5a9f21deec4404a38f929d956cc91c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523067772e4e14eab00344e66cbe0da92
SHA18da997b51adc773d5219d67cbe9bfe0c5bc25b6d
SHA256ef48305b54aaa4f73d9034913276bd39975b7b1d88b977fdfe536fd5823ea180
SHA5128fe5292497eb63ec35ab3b508071e0c22d08b15baeca9f43953318a7fedc57ee22fd9273169bc686967e67c92199dfcfdf8f8a587f27f62b21b2ecfe720a1a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596cd56dd5d9e54816fcb157f52db4865
SHA153d30242f8e077c2fae949ad5072789f010db139
SHA2562a2eb766eca42f806d01a187d42308e9c3a89b77430d5982d75ee8ada13716ec
SHA512c28d0bd952760ff4d025879ab40609baad167ea134906059f13b98e025d7bb1a44e94247fb324daac33e145e2cf6a320d7a0379da8d368eab27047220b49efd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ffbab0e2d5310dc4a48313433e61e15
SHA10ff93dd1c906909180609f911da803da910e64c2
SHA25639e0ff6167ccc65614198d6759c2e036499c65a298327a84e532663b206cd4cf
SHA51235431dc08101e999761ab17abdb26cdd3cf0ffc3a3398540bce3216015d5a3c2a5c650438d9ded45eb2284121d1f054f24b6891ec3196f925748f3d754adcdd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ad76ec78872c67ec6cf6ee5c2e796a9
SHA183c22a244b23c6b403c09681923fe1e96e62943e
SHA256fb8d2afddc4a35cfbe5d7cf8f436c93292b517526b2295d173eef0180f270074
SHA512860a79dbedf717f97ec0497efac2d5a4e8342e24dd1462610592d7f88d0c04e50a825a03941785d2cfb3d7c970085b80e36cddab8af514d2c71f025f6d12ec34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d40d700ab131622677a77b5a45330cd8
SHA166f7b8b27a03d496e20894427680c568f3bcc602
SHA256bdb8b47ccd31055925890e747251582041749431ade4279a33ec900296c2481d
SHA512f7760bdc127e76d3dcc4d0caf299eb82677329c1f867162b5a90ede6a64843ab04f265b98b36965a19102dfd5448ab224083d786eb21260311b911c91b5d1ae5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a