Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
226b8c000615569940793b6101cf850a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
226b8c000615569940793b6101cf850a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
226b8c000615569940793b6101cf850a_JaffaCakes118.html
-
Size
8KB
-
MD5
226b8c000615569940793b6101cf850a
-
SHA1
0738c99610c6e2c4e0da50ecceb81a4bbd97a3ec
-
SHA256
88aab145532c70b13003923dcd754074fa209667bbcc694f357e8c9c1dce73a8
-
SHA512
359e63ff352f73be78a905be0202c34f4f5973d957dd28097aebc855dc8b20c311a0d4f62db182ef1b1991927d65406e4977b6a5fdd78a5e89437ac37d53074b
-
SSDEEP
192:9B9fo8tgbW2ZWEMJNj8wqop1OnjqJUXs0:9B9fnr2ZajnpJ0s0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421290384" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000da600e7d5793a0694a0f71d94d1d38db6de394e2e0b2cc190bd8e0fed277ad29000000000e8000000002000020000000c7585c52003529450b9ae061554abce4b0cb0dc4d94aef99766ad9d847620602200000003247365a5e2f5e8b6d161f2d2b7181c84bd6b170bc52313a30b563f1c5d87f794000000031e2038112e09d0e485392c429c34e9e026d54e8980261a38e95f3f5923ba9b97f27ace53a79a668d46b9bf8cf6dda6cedd1c847e27ea69bf0c9d20f54ee45c5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6490D81-0CD2-11EF-A336-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60803aabdfa0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005106956da22a33af2678dc5337c7f3d192a3f7a8b261036df8324a3435de9216000000000e8000000002000020000000b3474fea753706773ad599fbfd4a0d75bdc8b80e1f11b1e86057bc560d9458049000000019c07297f6418253f404933b55872bc68ed8fbf6badf7f7efa3a0f80d03da8362fb089cfa6d075c9cbebfccff84b6da31ef5d28bf922bbe8a9eda3719c228f0b4732cb01fa6a99bc05f86392ace5e1ea68bc784865cb82c40275b5ba45c41a3f0753abdf31075782f75cf85f262c34cd26e59e5f0718fe3d668ce2cd7a383b9b8b247dae962a61cce3d0cd2b791d76694000000097c48ebf79b0196eb3cdab44af0997e690f8b4bd6b25fab5a5d890506d96abdf310f7df82d891848e50fc414d4140297f0ae9eb1277dd250119170731a18fe19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2692 2184 iexplore.exe 28 PID 2184 wrote to memory of 2692 2184 iexplore.exe 28 PID 2184 wrote to memory of 2692 2184 iexplore.exe 28 PID 2184 wrote to memory of 2692 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\226b8c000615569940793b6101cf850a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58235990c2946402e8d794ba2fc5e642f
SHA12411553212743d7ca6474b2091898dfb4ee9f452
SHA256e98921dafc9a969f77423ff7a063f0d4b4efff6be21021d564c572aad0ece4e2
SHA512a6bbcd04e19a3ae8d95330cb4f3e1185fb78d70e527d34b1a773e354b8a6c8df7008d64a11e4e81c3fe1059834e268d1c1ef317ae8ebf582ac3391e1aa76c331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500dfc2c8c02921fe35d3cbcf66d1dd1a
SHA14a36008369f0e41c27d309a645e385912b68c746
SHA2562fbb30b6d556c7f4e276d936ea84498221e956d56105e0938f5bfc3fb36557ea
SHA51233e93dbc12c0dc8916ca34f51e97c1eecc139e206e82d5a463a77c0ccc29640c3d84ebf4c89c302dcd08eeda41a96330dd054ab41be7ef9285e5e0d5d9adf6cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebcdc55a53869b5a04f8db98f0047826
SHA1cbff2632e36feed62ad58ef39f2727e11219bb7c
SHA2561d7e1b723ac2872c024c7e25b29ade8146d4a7864578b1749a6f7821badb104c
SHA512e257b66e997fb188629f6525237f3f965b74322331bf382cf3421b551db83a08deac69875c7cbf53daaf1d2fdf1064ec5df389ea7395dda8790c675456c487fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e786c6f01047bb62df9b922bd6c44cb
SHA1a4127c892d4e00611a1ed038c0df4c6fc2cf1366
SHA2563afcea9278cde1a9cd00df6baf4a20e4c6836d977b71fcdf7b66fec1ce2e4719
SHA51226b0b99357b5be05fa5f11ec63faac2b7803852d1017bae5682cc07a1e66762998c5c4e4303c59d603410149dba3abab803729520e55f526b347d99f771f406e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f931def39c6caea13f48882cf69bda07
SHA1f52b781f552baab086f4b2a2cb2bd9718d13e225
SHA25612f2e5f54dacc19c8d208151f362dd911d8d478dcc1466e067bba04364a47bdf
SHA512fa364b73fe9adea14542bbeb8614a9f749154d11fc4422584aea7bca769f6e1f58c0619c990e3b15f9efc128dfe020487c535badaaef143137eacabe7fd0a758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544331232e880fd3cd30a025b94159f6e
SHA1836a3c5c1064029d8202c6e28a8702df5ce0caad
SHA25625efa3ffbeadba53e1c63e8bca474164d3a95150d7c6fc3818ed52d009700e23
SHA5129251630c26000c5550b8fce1ea3a9581c01319a3cd1490db7286fd9569d97d76a59eb6a71fe4e8bf592e536a0bf605c96d0ffcf84991353ca22071879857eb87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539ed558969ccc6f5f7dfa8cbd12de062
SHA101031fe8b9a69473974014fdd049f0f813d8de26
SHA25653c9ca60130314d9cc7819b80d5e1c1a5f3bb5ab8cd1d2fedcc7df6895645e6e
SHA51205c67ebd1244bdc428b0295c0b8ef12c3690a379b3c3a128876d55fe178912164f99e4837f7f80aea73d9242dc5a01ed26e7eaf5d61d3713575073cd18145ab7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520af551e7ebe7f55153a3b4feb37e073
SHA1c0fdb00ab809f3b97bc2fac048eb3e5163d5f0d6
SHA256971bf7d0276a833aeff288d8636889aa2805db536b5bb95623361fa0a17a5828
SHA5121ee4ca35310594973ff4d756b60bfd11308b00f154953236e41fe5bd490f2bb4eef6fc6613ef336d6e07569a9431d311f123d28af2a959ec19721f1b5063da57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6a6e38e46939d624f30a9ea58fe63f0
SHA1a12772322fbe8863baf7f0991f46700a835fbce2
SHA2560829ed92d792ee391fcce8d7a15f5e0a1d1b3ae607c93a379ff256ef07cf5cf3
SHA5127d8bc6c4286fc06442be951b594427dc39c2097b83d0419f9de81a4ba0f07ba701de05f19a626f2ee711f23cd8cdd1ed1156804fa43f0d8a1ec6ffd10aa7e2bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577f628be762046790304327d1102124d
SHA16048a28b1451cffea8a4b66c3884444f754822d3
SHA2566c2fd7d0e5acc250316f4bff28652f29dd73f75fb5146b3d281925a4ac9f0f4f
SHA5124ed721ae1b5cac2345dbe7215062a2ab2cd6577ef950460deb5d5fd00eca2adf294b80a6da549638c945d2c08162d3665810580f75de00db297a8e7a02222699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5842c0e694adaf7828c26a76b8df07560
SHA1cdbc40a911c57df52e783e4e2d2fcec4b75237c2
SHA256cb90f55e1df2dafcd40a5b809a5bb43ee923fa370d9257be4dbb7e18094e45a4
SHA5129bd0dec78009427338f20faecb73394c11038eb9366fa720373ea9bad0b3c5aaa74396d8d224b8db3d7fded53d852115abcf92b2360b1a48d975b09de49c1510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f578b7b1e4477aab959e1f2e449fdf
SHA171373ff7d049c15d6808bfc1ae82886218baba03
SHA25624b2ea7718363dabb438bbaf591235a7b837a7b18b7c833d7352ab80f48d9e6c
SHA512bb575d0b7a16c47ff89862677eb8efc54c4aa1959670b0caf631995dad1fbcec69734b4a1e741de6216b8972de9629c448700448b5d5493e16ab41c651c0a544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556612a7753e04e65143ffc11a3785b21
SHA1fcdc7d2c1200aea198c832845b3853b4ac9271ad
SHA2567ef93260329288bdf38a32341e4438ec9dbaae8dc9e4171f15d5820f3bc149e6
SHA51203b8e2455e6b15a5356eaba3932fe862ebd91a87cef48819eea8b766861a1860fd44976c863c232493f68d1097e197215ff80a6438e17a4db839d5d398e5e51b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8c0f00e140cf805db520c76c9d67333
SHA1ae8b4d225d333e9a342b725dedba438060c6fb8d
SHA25676b0d62a325991f19c8ab934e735a0fcbc9431c19a6da924ec811285d431f7d1
SHA512c360ab5f980398674a0b6c60c5089772271cebef3e7980c35e8e1f612af77267ab0788e5d15c54728278281773537ff1136ad158bb20725e669d33da7b50f195
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d16bcda0ea02c9d76458f54a40827d7e
SHA1ca5562bb354facd66f5d7f5340ac51ed0afd449b
SHA2568af7d88d464d5f002eb0f53258ccc3f68057a8de6bdc94ce23baa482265faf7f
SHA512e9eef0580f125db24e958756737ea3d2921788b6267cd29e6dd0e2cdeae6d67256f4f1bc1b08b7463cd164ba054e40b9d56cc64db444b76bc2ca3799f10760cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587a16a722d85ec9277d0de5815a18e9a
SHA1508e72628c139937a90826b32a75b0435e673c83
SHA25689bb9b2a4485617832d0970e0f6f8945a154997dbfd146242f46657c6e8b196b
SHA5126774cbde2d7e97221cd33f3b413b4107eed57d0e755bc276f8d458506fea8f686d19714e000ea8ceac5bf3d521dbe9d35deff2db67744b9ca7de96cf107f9e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53727ff22c34f7e4a2af9c7a8e5f4e22f
SHA116afc0ecded014ef090488b61000da7aad974ed4
SHA256efcb237a7a0e821173e37de41359057ccb157503dc02bba44ab89adfc8eb8161
SHA5127ce69c9cd22ea5b2755cba85fb2b7c21d07d9c5e107209eddc8bc4db462e4e68f594f8322e7fe3f07784660cfc7496a4c01ff41a7a901d108ad0c551d0c5fbc7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a