Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
2199903d39f2de2913e024a898635a0a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2199903d39f2de2913e024a898635a0a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2199903d39f2de2913e024a898635a0a_JaffaCakes118.html
-
Size
2KB
-
MD5
2199903d39f2de2913e024a898635a0a
-
SHA1
e582ea005c40718ebe8422cb1f9f05fe8b792f4e
-
SHA256
10330de4b7675c6f9fbf065321073da3e3275aa5d0432c6668a03cc911e230ab
-
SHA512
6728b7f3db136417393399a75420b0af44486a61bd2ec0763f2ef319eb353ae723b3fe85580e65dafef249383c015956eab704bf6c9846b789092ee9a44bc4ae
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003a16aa50c7ec8113705e8951f7b0f6f9cb0feb9e271cc1ab1778352ae13f4e55000000000e8000000002000020000000c4c334d17db90f25ca0b45bd341491209fec1662395eb0476225e70035386ef1200000006ef3ce872781f77bf6ef4bf363c51b3dd320f80537a8f5b4fd19a91e52a71ade400000004e6a14125be33bed17ff85650f5944524a273fa267e399bd922d916582c1be44e92fff70c7185f4fab92704536df9d4827ddc5a3daca12e42ff6a755f333e355 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421275636" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8097DBE1-0CB0-11EF-97AC-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403a0555bda0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000514e46ab565724e4f535d2f0e19201060d4787ef5e7f9d2b66a02dcaab16eeae000000000e800000000200002000000014e987efb897e1b4d16b6d406e47584536faa76f418ae9a22d0a0d0ec13cfdb090000000197ef70e129cc2fddb9946b70ccfc6d3c4aa4745308c3c501ad1f7cb0091bef396f2ba3b88ae490f775abf59856fbffe5fe804d3aaf6b7c62f7d0524c81382f930942e7a758ce5aa5a6e8cbc5b7e2cf3f06721b4fe26d3e41e79e2e76104fd3021865607d34892ee0ff14def4575872114c3e1ca63915968f2e241e2e720c1913a8591e60043415df49c04b1d7c52b84400000002492b04283016eff254475351c8635c8bea15386ef110143a082da42a3bab3dd66d907e18b4c43a5c03003b871368417e445ef4d66ace56800f63007133fd47e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 856 iexplore.exe 856 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 856 wrote to memory of 3052 856 iexplore.exe 28 PID 856 wrote to memory of 3052 856 iexplore.exe 28 PID 856 wrote to memory of 3052 856 iexplore.exe 28 PID 856 wrote to memory of 3052 856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2199903d39f2de2913e024a898635a0a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51476d185050aebed99cdc0d8a08352e6
SHA1028b5c9806e104efb937887dfec5155ebae26f0c
SHA256c3d7ebb3d4a8fc641410855d154267fd72c278520ab6d121a875340813ad9b30
SHA5129619dbebdfb8396f913a86a34830e4739db3965a54d70bec77a21f3fa5b9553da696fba9a914c1fa383c3bf5e6ef7bbe1311a0b3e1b7b887e8f03c76d15fbcce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516eecd17d95399e854334a987a0b3b92
SHA18ca72d31378ba700449448f4e2e195e02ee495da
SHA256086dae66140f8eb59a9398502a98c898ad5d082edaeab600f91f5c5a07b53e28
SHA512536a52877c76787be93cdbee2c0b55b8fca5fdb290055fb358934a262c2d32d2dc85f650b6771973155ea691e854dcfe0d45cf776d912f5d6e3b8300ccff5f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e44c3584498b642137881aca8388e3a5
SHA1c1950665cabf1bbb7f17e4750cca4b4b0be2a9a7
SHA2566d97e6c8d6e0c9772e6566f13184469b0bf4319a57a30a9710e88b67a7fdd335
SHA5128473893c9efd46510d0b8a628570551c5e8a995be29840542e61f2e0f80eecc0d00d04605100f9c101af4c2d9b5a575bcf7d85dc69b33dda86c195099e98e672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56af037e5ebb9585dc8dc8effca10a1ea
SHA117c5216129cf3d4676f95810333f003034fcd9a2
SHA256ddbe5b592e3bf08b3087087ad7ab88ff1184577c9a04a73f55b4533fb6016a35
SHA512c519d3a4ea6b000a3b530a083379c6dae2f7fae0765bcae3459fea73fd91f36af9ff984e89716080295ea7ca6136b6e8b7b21cab4994911044eeba8dd5fd49f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5975095c83c25aa8b9b01a3c349d73f61
SHA198138cc7b449aa207613f92b0456c915ba57fc6e
SHA256a8287ca02106f6bd501167483d220594f69f0c4d97f026d2355c2ef4595b4071
SHA5128a389cf333ee55df94a145d77c31c7f22593567a748a26c33e643fac23f4b51953027e8833cfb580031d3855032aff9a45984bf99ef54195da9f1788b1fbdcba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3760bd3b701f115c3c59a99bcce9097
SHA1e8b0330f8feacaa4e14e18f531430ee1535604a7
SHA25675ad6e55055e5fcacd0983a95012276c26a7e9dc3f18765b61ad9286ebbb03b9
SHA5126af529a04ed0305cc3fd90939a93d26e22c630556bbce2a9d703be0cd336ddd76d19ba57a429139ea11451c274d81ac51a613c21bcb332281369006185f9186c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d1674c13bf5574572f186e6723f8cf8
SHA1959986a0cb87378ad132d98de335acf998f7a461
SHA256fb27b3310258acbbdbd7b514e835ae956b9b180d70718e24043d566833c26cdf
SHA512293384e15afad10c34ad9752b47c5de500770a288d9a02d9e99ad2829f330c60d9265f222afbc9f07ed066672addbf8e60f7e43851093d707596ef80434ba86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebe9ad05f1db713af47987ddf53ffbf5
SHA1cc959fda59df177329d60d9cc2e8137beb7f7b98
SHA256a175583e69265ef40762fed9819ddcb3a9da7d686d13029b0672e36c818ee604
SHA512339972ba103f5cf4024777b9567b2c0ed0f4e91124b2365d0f2630a2110e2a82f2d1b2eed638b4d2ac3a025594b0acc7ef085255c7f62677a2d8522e7acc7ecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5555c9b79f7bf6d231f534367e44763fd
SHA1e87cc7eacde549d9bbc41bfca9293a83ff5086ee
SHA2565782210a055f6c4feb377e869b81a7bf692f4dbefda512688000153d7d451d33
SHA51266a3100553ee1ef62266f0e10ffc0ab6ba8e4cc9f021c46827405f0b7500c8ddf9130a95ba8b89b00a75b9448cd51a9f9a129a097ea029098b040a825c570de7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5839b8789f11939b8bbc0c074dd4f5573
SHA10cb12366f96cfba1b3099744be8de26abf45e38c
SHA25616de0108870ffe61dda6d52f3a86cac3d76072ccbf2d33e736ad5e9497978e2a
SHA512833096ce8cd369e218f5bcedb7f6e34cdb35e23c83b4e261ed0174c474d97db765273d5e300483d7526f00d13cbf9cc56d8f7b296501499a7ce675213f6fdb0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569602365aa62be6114eccddacfe528fa
SHA1920e6721d3548ec984b8acdb8f1cc4e377403efc
SHA2567e24cbceba45f360acc5d2dc339018322e05ad1e13ab320dcfb4951a137ef04f
SHA512fba25a3d9d5b2f68c2dd9a05f981abae778b7dcf80429553b4fbbb55d38a9a9249114f62b8e50c0bbfd0a2cce9fccfdb138689bc28687f40067a249892c1415d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570c7d773fb927e30faf11b0cfb3194c3
SHA17cc0bc0bc9513ee15597fdcea708e979d7da4f2f
SHA256c3386ce3a9e88789322e8f0b6dc81f481ea8e48c7560530d78243d2de1f2a69c
SHA512d6a870f4209e2644608553e6354026c89e7f96388c6031c32b4672369f5c7870cfd566003138df48a835f7baf1105ca278ed8779a59d36834841d682ca6dfd66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff3324e655dcb9181aa73f6113dfdc44
SHA113ce9acffb8caf7d6cd770031c16196f26a026fd
SHA256477c0694b0c01c5dc957896d97c4ad35670fd609a3b2d1dce2aeb75b0e899b83
SHA512ad25e022d4f7286eef044be3a6d5381c65a5b3b032f7db0fa7ccb80a5db9f692b9c16c3ce50fde9131b125ba437736d66c3912a76841d0fac922f702e3b2d415
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582cc4169341f87756d2cde6a3bc24a23
SHA14c4499d081860c7a6481328faa714f0344d8c281
SHA256897d41128e5f4735b03bbecd630de92bcbf300ead58a1389d3519f5389f73839
SHA512a43578da3c6703e11f36a1728646c197b011dffa70c9365a2d4f75f8f010676745c2d12c304981d3d54a7d155580cbde0fa5e2b6522ad4f30987fd9378b1c287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c36a5ed5981a98c040aa08b23f50d46
SHA122ac11b156a7b9d75016d4a069906cd2ff040a35
SHA256602e54fefe0c63ae2609c6c2eb936aa2b9d1fced772b89c080c307d7b69baa58
SHA51204f6528bc1c1fcd5e3032fba1c7c39ec14bf6dbc9c9d180349399960ecf204c0f0666e8f45f1240a2a0fc3767437f50093f50e6e59ae8b929a471455951f4f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5935ba963795b9094e50294aed327cc92
SHA1d6f5f16e3ae12540a354f02874d2c4df47e70451
SHA25614f2f6f7bf7105c737b721d9a282b04ef129fca9e15720b69e9b7f9f99a3f27b
SHA512bc5099250bd644bdba57895a2b9fc15cd95bf0b9992085c94a964c9bc2455746e0ffe53cd05d018a4d41a5961a5589cecce8f8a31704229459d26d409cf5c90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a07d82b01f4ffc6380c9a4cd7d5514c4
SHA14d613d9eacb99f5974f0ec01927f6e5a758412df
SHA2561627844cff90456d989db3a4b025da6c2aa2f7cbef166818bbcab0b51cdf17d1
SHA5125e27754dfc771705d11604c5cd33412d81073ea1a2de0791b445aefdb0d20f7cf69ee14be30c840d547f600562b9f2bb9ac43f6978439e23fb39be0c4c4c0feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7d7d66345e3243f7b6be1ee879bf7b4
SHA16c7fe1ad52c50e8df2664f0c53c690e929ac7999
SHA256b721bf8985637e6b1ccbec4df52667a6df0755456b19a9dd0c74b630194bbe8a
SHA5122f7d7e5c39418fa4020a6e72487e7e6971f112dec9b3dd88f507a7761fdfbcae083453859ffabd67b4d3935707c8b66941da3c46b7caf6179d50f6822d6fda40
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a