Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
21b7293213f815f8f7ac94c067d65af8_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
21b7293213f815f8f7ac94c067d65af8_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
21b7293213f815f8f7ac94c067d65af8_JaffaCakes118.html
-
Size
2KB
-
MD5
21b7293213f815f8f7ac94c067d65af8
-
SHA1
314577d21af8f3952e927570f3647f5ba576f696
-
SHA256
67eb6132750068fe513d8091df4d73d6bbd4199207dd58f1df04677b93a975c3
-
SHA512
6aaaae3981d63e5eb4c298dd3d201cdaa4b90207360782f5c62fee0374f9df6891d3a17ac935b23b7aecbe84894207886269957615931b9785e7c839d54aff89
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c4d500c2a0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C464F91-0CB5-11EF-A4A3-CE86F81DDAFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000556c296ebedfe7db0768b577771f71b44caad72c369a9d6f7e40dcf8a86d3aa000000000e800000000200002000000055e487aa9f83aa983b9bb7a5fd29c7deaa411c488f65e88058b3e618831a8da920000000b08d4d3f0d795eedef5436b31afb08157c946c3bd55e9707550e23915f55dbb940000000a27a8861e93d4fb251f72897b1e901ac9a6b243c1cc755f303d4b54eff61aa1b9e61af40913880f2eb77f2dd7fddcb32853664afa4145ca34cbd4839628a4921 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e66a47397f13c9118df9a7ee98fab14e03e33c4ecaf77d614d00406e8e1e4ed2000000000e8000000002000020000000a295c6f06943b897044faf17c21bf6d60593b6fbdc6c91c78cbc73cc165545b190000000ffc2cc0e4eedde9341dad32969ca7c3cc8d58418fdc7765db3f71888ab4e3925f2c1b4649f145c11768142da0d4e97fc104d6e5a4c5300a50fb03be4c97224e0884dda3351fed27f7b4efce525305fac972c297d7a622ee256a7ba3176166b05d5870cd77ada57de948265cd7a0128752f075b7308bae7ed3ca46463d804a804f1304f2fa2ad1e76a80bcdb0241af8714000000083963a1764df022e62ce690f15115fe57eb736b5f3ad146094976091021fa6863f2497c8dc98f00dcb0ecf4c31a3e1ad4309050ff1e2a2a353af72c6daf020ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421277641" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1656 iexplore.exe 1656 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2884 1656 iexplore.exe 28 PID 1656 wrote to memory of 2884 1656 iexplore.exe 28 PID 1656 wrote to memory of 2884 1656 iexplore.exe 28 PID 1656 wrote to memory of 2884 1656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21b7293213f815f8f7ac94c067d65af8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5835194987071f8f888d67575787d457e
SHA1765c0034e5d32f1228ae4f664e94d61ee0e382d0
SHA256c68eb1e88995d0abe65a6c1a0bc7011390cd09bda680002e0a439109564301fb
SHA512ab0615f599dc95f0311eb8bffd41dd1fec55ee4caca89b10cb60c5132737c98fff1f0dfed92b0e4ada47175dacb4ccd794c2bf98bf8f9308bd8cff8ae92818b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d726ff6f647ce567db6cef0c35f1bc4c
SHA1de3befd3c026c582888537d73577fd8153c0173e
SHA2561c5deee4b85eecf3e018287c0c437506537f3869523dff4ba182da39657c00c0
SHA5125fb9b20d44f4e63f3002cae92a09d28e205b763e21897548eb974b7a1966e8e73ec13d9821416be683ed1ee1d2786d6a2250bb8790fd754a6eaf17c688f3db70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a48346ab8d6fd2951d4ccae4c1549f25
SHA1c240615eea38e27363d486634ac022a237b1bbd6
SHA256f44df23f446ceeee786aab1292cc46d5adabcfd72490bdfdc81153ced4892fd1
SHA5126b3c678e584178626ce7e0c2c7fcdffbbfc44065531e137520fd54b792f35cc4a2bb9ac629be2d4de32a993e2eeedaeead8960deb6305ab7f0298b973ea7a4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f881e2e9843f14ea16a53b83d2927de3
SHA160ae884c8195ba54112e1939a023bf0e54ffd782
SHA2567152b1e186776c5bc617e4a95d438be00f9393702f9075b313b61caedd86b621
SHA5126c5f85c15c28ba8b81b9a86c450322262478fcfe7869b9b5d5a65951caff44a7ecb87cbc20c8eef415086aaf0ad472f9ced19e686c7d27ec42f37de7254ba946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5921077a2128995e4b6f260d0f106abd2
SHA1c8920498e7d62757829d700d26d3cbe49d218718
SHA256f1c4224c9af1abe7015458cd693c1dfc0c32868dabb1c9b16c095084e205e7cf
SHA512fbb40d4dfe99275cbe05ec3c6f09379e2eff8a0e9b9f384b6deb4875feff4b42f9d293b64785e1d16e5ab00c79651e7a4a20b9db2ea241d9c085c1c82e04fcfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4fa27c06fdfd08dfcde193ac08e35c3
SHA132ca8667e0de48a8cf283aa9827a6cf6b7dc974e
SHA256151c051d0108e902dc06f73d9c228d7182a7c6c09b9e36f556a97a713811ea3c
SHA51256220977051b661b3bbfc06d398cf72137a460b59b34274eb15d65a942017779b0faf50e7aa951e96994c73cb85ba88d96915526ac46dd9d31373d2fb5b9cdc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c08e96f28a36be669cd7c749dbb31d90
SHA14ccd42b10f532b7794cd80bac6d982aae24d4434
SHA2569307bd740a682e52311d34e052f570a85b556af9077fd97ea8c529deb7731b85
SHA512e81de69e508734481da84da8637ed7205e7895b93226cd28be6ab0d7757a02a8fc4369d59fa2dc6054f44c0dc258c7d4f54f7284dbb8a63085ec968de7e1feef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56163995a4f4d391cf0a187401f4401f3
SHA1a3ce1394876bf9dc61d3b355c437f6d8973840fc
SHA2569720961fb7e1cbf0a81940cc01c61589626cc35af3dc2593a9dcf9fdc5997865
SHA512b02863f751dbb76e33cf63f8d2374c76fe16007f2c59e39c25767602d6c2a718c8bb59ff0113013127583c2d3512314ec7deaf958f7615e9f495557b551b3791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6743b8c107eb9392af2f2a09afa67b8
SHA1e3db23ef715caa6a2d1e31c35a373ad901ee0d46
SHA2564e755a544952f4388d010460f44eb484548a756bc0a200da60d84adc2f6626d3
SHA512182e2be1fbc27ff5d01652326ec9477263b667f40289c67c5c1f1268975ce79cc5326d032b6cc226ffd104c5139b9e4916685e9839c00bcb69fe424612d501fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55db72e882de1222c628b80aadcbea3b7
SHA15a89ebb31569de54c2f3d025aad7925530bd9a29
SHA25680162b38f2dd511936e1fdbd8ee4b079d0fc62a41b7c42a14090711fe2802506
SHA512839681347f83b70dae8fec998b15dfce5e107452c53bbd85ed0f6c2cdca8cf1b17897de5a562312cd289cefc262cbf56f58ba41fe19b913eb700f0bc971ac2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d392cfa9ec38af44a5710fa268b4206
SHA194bdd9cc2fc558eaab9357894c749cf1629cb0ed
SHA2567bb10691013ba3ae0f26d6e38913de4044bc8a537c31d3d015eccab1a8fe4e43
SHA5128462a411c9631585f8a3bacae1b1c3eef6ca511d6804a15181cca15e305f826b1a4ac5ac8180bba0821912c8bd43d8281b9ba5462e5f6e05a97344b4573b3918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510c6ed26b8d7d6dc0782090bab26378f
SHA15d4dfbe032405fbf2cbdc1d1d1a4a0681a725b6e
SHA2568c4dbd104748566dbd99418b7615fa62602e62831caca41ef0caabc05b7bab18
SHA512c51afa78569d30f2bd4d96e0b3ba723726ef02b6da10768ac9c959ddba77d3160ee77fc04db2422834fd56636be40d658eed13c1e58297d9107cfd2bd55d1573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590e74e76a173da664c1bf1b197b618fa
SHA19386d965d95ab32ab6e3ddabf1f86579dd31c2de
SHA2561a2a38861a4805d03f332926eca412bb9873fe61bc4fbaa0be076ec19c2d7352
SHA5123280f57ee6fad30131d84e7e94ce2877e7b173be014f8241890084607928f5558bcea6da575066b3574fad053175c51f050a26d423c4b52e832cbfdb68d26e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0065bc0c7075a71f592e87e7f69dcca
SHA192cf0a24c1ac54ee9c82adee937184799f8d1904
SHA256ca94946727c2255a1d36c527607006bb1b86cea70bdfc165e01534aa3b77c5e6
SHA51227585c62ccb840497471bf2a5eb3fb6b159a99f296a9ee9f3a12860df92301399ab5171d74fa7447696c4b28480b7f8ff35595e596cbb64b7782b82d966df6a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d61fdd5cd97467b4146ba0b29d19985
SHA1ab4339d11743b089be9609e9c1965a45e869f308
SHA256f46151a39a52043ff66a1f5c4ba56b427cc825279d79127d5aa53e78da4a2e24
SHA5125e9175d9902dc26a40d5f5d6358dd6c958f12f166e6acd252c093a21fd0d0dac3ff82f549a419ef5172f23378dced4bdf37b7772edcab4a0edccb5e4e4230ac3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ae530d8138bdd7862eb01cc8a686a14
SHA141be5c8fdec35828fe0ff6eaa87b3db90d8ff5a2
SHA256c96232b998d6e27fbd33980c1f97f7bc9071e735ffd378b9e66b45e392843a60
SHA512045b51a96b06478753ca1d16e29b0e2c0fc539a7fe22dd9abeae606226f796442ad813a76faa82cc15d30ef602f2c66fbd03e83c167ec1a32ad60fd0557a521a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8e4bd88166f7361cb87b333efb6c1d9
SHA199007946eed16666b24ea28a9a11bd2fbff8a7a7
SHA2564060eeb5c38a7eddb4201c2684feacf31be61c6ccb3dcb46a50da5fff5655306
SHA5127a0fdcb67f931e191324502039bf7b92bec3426aa973ae5097a0451fc9d2efff1cba07cf8c1819ebb25cc6534cce3f77fb683ee91f2050664f2d0d77d11637b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54beabb7c4ded20850f9afc9903d237ec
SHA15031d0675069bc9e22d36e8d2a913dd93aacb8db
SHA256bc0b17335e9110e1ba99fd129558e97383a66f65c61d6ddaded3d11e738b97c3
SHA512ff6f2d7cd4bbe4a45826fe49a490b23f2a7f4fd2b8e9277d31e8142c86fa4b90080afb9de8ab13055ad047f273a769b00dda0ce217e5ff7f107419cea3886ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54acb2b163920c7b18f972a0ecfc3eb7d
SHA169257b89518d97b5b9bff406cc4bcb76e48c9582
SHA2567c488a35dbf634fe6243cc7ebc4753bfa7ba2d2c21c6675b960b8fd74be3a8e5
SHA5124e8cc8b7d2d3c6a8186df5c293a690d7b7884c6b052d785bc680f91d58472927c1fb6a5f6f6e011dbe08473df92b2bc6759e0379f6c1ade0bdc962c67cdd5c08
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a