Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
2692b2816889a39db9af9e0558993b53_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2692b2816889a39db9af9e0558993b53_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2692b2816889a39db9af9e0558993b53_JaffaCakes118.html
-
Size
2KB
-
MD5
2692b2816889a39db9af9e0558993b53
-
SHA1
c544cf59ab83096dd9bedd5ac1a7e87f5dbd1dfe
-
SHA256
c9ea489fa1b28f06afa1645b25f334617bbc1ffb737dc6787297cef81e78f073
-
SHA512
06ce6a4be6af2b20376ae7f62f6515dd023f7e16cd10ae3eb983bb187045cd2f58c9aabd74c603f52379d3e8d3676f45ba6a3db6eba44d8c5606839bd1ac2f1d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C02D46A1-0D78-11EF-A5B4-4205ACB4EED4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1030b49485a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000dff7b7d83121db7e554123f1ac24b39063e09c45bcec80f4b968f593a4c96790000000000e80000000020000200000004477c09cb7cc86ed62c7fe756a169e72549f3306c58e5c0f65ed1a8bbeec6b019000000085731681b0ccc1fca7f4ea0065dc0d7cc745b55672766fa7848e49da0de26878ae1e607db114018b337ef2637e764908d470997266781d5fff559919e3ddbcbd56e923f18d631186c3aee4afbe56abbc63225209fb64f37026e1a71f31891b686b192b1c012c707eb1701e30d80c076e1ef16cac585662a7e5a837cb16df7a900d3c633730edb0f330883d3540aeb67d40000000e682b64d0f68ecf03db43818726ca0cb9991ac014a1c7c3668efda48af0cc2f491bb2abd570ae63d2e8c507c7659725e718a89b1231964a8a6fe3595d29f946d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421361642" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c417b42d7ac60562d431e9464c4bb744425673cc2cb20fad9f4596d47beb87b2000000000e80000000020000200000001b481176c4b6c60ec1ed1974826ed92b74fa2f2fbea67c46c648e28e9b1d3070200000000e4a69d0642a27b4d599f32b1ddc20383bd65c075e342775609002fea4b7709d4000000091e7d913af9239bdac290a2b6aa70d58667ebed0149906a28a58db4bd7b5fef892a3d1e9ad4b27e3f84a10d67ca8c1e5b9aa1ddbd020df61774e4e5fc565c5fe iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2584 2248 iexplore.exe 28 PID 2248 wrote to memory of 2584 2248 iexplore.exe 28 PID 2248 wrote to memory of 2584 2248 iexplore.exe 28 PID 2248 wrote to memory of 2584 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2692b2816889a39db9af9e0558993b53_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff2cc9f89a56a8dc3b16055bb961b99a
SHA15f36f606693b88a2b37544fe19fe71b408a7b7c8
SHA2567bbc33c8d899236c5b7d5c90495e94b3d3c5e54b97081452d32155a8390c92bb
SHA512db2236693bf40ab228948358b4465029ecc24c9f91878cfa4ac481588077cbe6c8ee81cb75f261b7cf0fb83810f6cff0fa315bdd9a231a506c1920f031815fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583ae4b3177ba044dce3777476811c512
SHA190ded7871842d874e8407dc7dc90bdbd2d5e1052
SHA2568643a6bc1a5e9bedd547c8ea699e6d2f11ed5df8b421b397e3653c56c8e67653
SHA51222dc355a68412db5c2a82f57dad3e1faa69d0f89fb6c2e29f5fd52317b569e20387f99c9c6c895dc0aa49714f5c2cbdb3c2a237e21228bc59003475c2af3bb93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dced2023939e6a63dd181cbf696dbe1
SHA15ac61b79e455ab516acad73e4aa351a5aa51c370
SHA25642f7f69b3970c6d6cbcbbd4254822976f33c6cef1cd01fb5add035b15a40db9a
SHA5123102c03bfa29d82d785675bb810d9e2a12a2ffc969a08c49dd00af85eb226b2b13575a2692aa9f03a40415c22e1ac1b2ec3eb8a3ac24bb43f2de5b172416e0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512ce3601c37a9b6a5790b009a674edf1
SHA11886ee4926ef66aefa54d16295b5047ef35715cb
SHA2565fe498e7a18c96b580da5824e3826a01bdf04410d95d8bf948cdc423f8105241
SHA512a93569bdd1970f7fb802fdd7b283c53efa08fa3c671ffea1663b58296aea7ad3e202dadf5d6f5d0b4eb74699396c4f777273e4dc7f159c0c709f8468b60a6e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580e2953860fcd79a2e82a2e23265706a
SHA16d5de8c8323afaaaf380ae496fd0de57bee6c892
SHA2563e26fefc5be97710fece841c9b08a80f395dfafde3b704d024e9d8d56aa806a3
SHA5124a9e4403c8d42f82c7db7dc89c8a099b665053c9669ab3955fc31591d1c635cac0def454b4a85849bccc633a0c22834ee5a22ae4e07e75565d297bf0286e2900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5788f90a4b2d5e2466e4d1d117bd96676
SHA1063d2bec39d9503cdb0b4a9d1d782f60f64850eb
SHA256541de96858e7a9acf3e50416aa4ad35d9b0efc7f004b8f754553bbf3101a4391
SHA5123e040d012eaa5e6ac5853557145912f12eee2f718960c2738bc9d686536b4cf7b3bbac29fb70c74f12c3c9d3dc688a31e92a7c71f9412946ad54fade464e67f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e30ea6d53cb0420389b4784f7371e580
SHA1aec6d407b34456bbe69736a725dff5de8bdca767
SHA256a6e7fdeeb6bbc3fc58d6abea74f24d3889bf3d9dc400b15e27ad49fa93742eed
SHA512755694d31340365754fa7b7afedb1a06604650d53dc607b3c3343595db377b52641b7c6d91f4f4f20ba3f1712d16dc47d4bc9e2ae020d0c703be836adb9215ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a19d54f96d5dc0f51cbd3b403142eb6e
SHA1fa6983027c70f7e9f3be72a9bc6784f2b2fa0f0a
SHA256edaca0ae96f2b0769a123d0806dd28cd5a825376b83d7fb41a2759d3cc318ea3
SHA512a424bc2145a782c6f6904cb46697609ebb886fb680f29d82a98c12c117461a1017100c96127012693602f944547b91aafcd2a4c094e9ee8aab326646edf443c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d91dbd8d7e537d053819e86b6656f2c6
SHA1ec041d37b5e1e97aa9c09a1290b726a5503930e2
SHA25684d5aac6a76f036ad5df42442917bfaf4dc91b105f520f1a1b5b0fbb67b8999a
SHA512fa3259e4e6aa644fc6f0fe0c71510c4547293a1cbff001989c48edb89da5ec665b3acdb5a0b030ba4825a893970e52e6bdc38385a7463a971bcfad8276bea916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5ffc2ceb8c19abd47ab7056d0ea1e43
SHA18996d5b935cb69c2b9558c83e3799edbea88b4a1
SHA2560ef300185f04486a78879c2e33869ca5d8a6724dedb4373e0aab5473446fa654
SHA5122dfb2866b84b663b30dfe0f53f4af31dc4d6019cacbc1b8966683d7671e6da98652b5861fa605059a74a6cb352562216624e48d20ce4f47d2d489d4c543287f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552971e6834849450491a020b9d61b9c5
SHA1cc23ef8039174dc7b505d8a97f34fa25eec30572
SHA2562b7594c541f51cfbfca033c51749bf9d56c1e2224de4ffc86b571f4382bf2bf1
SHA512b75598a4d6080428a6ccc150203604773520b9b7961d5089d85f551fd90e224e68eac56a677fdf55c085f4a20df468c27f34cdd97181b046b175854ec0d65ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a599ca96e4cba6091667ecac03b9650
SHA17ce70541a4103f81bc9cff6ea487d6bd63ac0968
SHA256d618024af04651bea47d04c10a53531a816973ec1562ca8ff8649625dead01ac
SHA512d2dfb2bbabb519f09db0fe9629dd6c1f4956c19bea5ed263404fcf24e371f9e4977c916776194870d57febdecd61ed52d76ac0791eab8d7df61cec7789c94161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba26760972aa3545db46b55ae0398249
SHA11e81bf1defa11dbb3207562af4764273b75d8af0
SHA256ee9c9c57103c251fa757a729c86f558aa7299f23c062c00d52c60991cfdd7304
SHA5123a7d07b02cb66060e366a9cc13bd0f95b38c17daf62ae67bf5e775e65dcfc2e891b1fac7d6d39490838487696386ce3f46dd575950cba2b2a6c1727eaf0f706a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efe280a8b569291b27538ce5f6869147
SHA1b4c17771713c8ea5418b16eecd547d8623f1a810
SHA256836c641c885a5f0102647a7a0333d7dd865fbb4a609d9ceee2ea4fb022a13683
SHA51261ac3818c4934666747535fde49afe1e6994a19a9ccf56430ee2b80bcd8e251eadc5e60eb795b088da1a8463dfefa0917d7a6c1b8d6544e5b053bf9cdb6a9c2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8e5ba74d0c72e5b5d60f983f2585efe
SHA172296f99fe53f410ff8b2a5beece3a12b7a49716
SHA256b66e1ebbf06b5ce9a84fdecae6487f0b5d404796379b6be10da724c946ecc5c8
SHA5120ebd97ab28eda6797d33becab12cd23751b216567533018266099488ba349406135ba7bd659abf0708ed2359424d75a6333b9e41882388e5d5dc62d52878e382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b16f9eef13a7e3d64d69e3e77fbc23fd
SHA1b71b1351487b714f408adb8ce92a19ed57631d32
SHA2569e165e436bddf879bd45e38f4b1181a5013d4e1ead7a200dca2c6e9f1d1de43c
SHA512a11e883fc3ece38a488d03449b0541b7108afc7aa7997eabb59d47003c0cef69ea68b85f0923a85b0ece8b9e30ae19acea28580837e0c296c00a6edbcb453c0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519dd2b872e7ff0ef5e82b4e8ab1b84c5
SHA10348989a0bb866e5641cdd5b420d4d9a5a885197
SHA2562a913cee8f2f6a27184664dd702b17b482f06e2896ffa47f1e11efe0827064bf
SHA51263cd7848286bb26cfb616f8a9f1afda1cc202a57f6d976be1945887096e03f925f0d9af27bb4f91d2d001a45c86d3f70464863d6004c7a955374f41afb14fb49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a4e74b63c021fae19d932038516f8e3
SHA17c54077f53625fc132b4bb993e749ffe2785291a
SHA256a661c7a7f628fb57ba623ff5fc2721857eba806b245b2a7adb13defeb403da9b
SHA51217eaf2089e0eb9aa0a76432d6c48edb8b61c10d030bd81cec272ecbf2c3bba0a6e13e64f950552ce8f454e5dfe8fca71c6ed8e9ed40d8c1e75be04961e0bdb8b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a