Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
28002aec0f94ea919f4bf4923d43d613_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
28002aec0f94ea919f4bf4923d43d613_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
28002aec0f94ea919f4bf4923d43d613_JaffaCakes118.html
-
Size
463KB
-
MD5
28002aec0f94ea919f4bf4923d43d613
-
SHA1
24fc3621a82bbbb9a280e74ef59e8afd6d53154d
-
SHA256
df0138b21edaba882647ed6471dba0e5ed8211e702df69853b25251d44893433
-
SHA512
48f11d33e74f49e3fb20b986a4943166a27de69bc79ad28a5c1dda76acf6b9e8a0f4ac1a16c0ba2f3d6cd6b489e13dbef845e6c946d19228f70518097e85b472
-
SSDEEP
6144:SjsMYod+X3oI+YkQhQUsMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X3n5d+X3C5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29D03C61-0DB1-11EF-B97B-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0355902bea1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000715e38ae3a95377d4435b272ab3575486ab62d5501bc8e6dab3f242624eb0b91000000000e80000000020000200000006b69f20953e6f047e918390a5ecb2ab0dd070a98377a5224258c67115cf881dd9000000007f61fde008a4c6b88f2d619797a0c9ae379e218175496b5061776fb792c03c225cf0157a6eddc37087f3e1b49cc9e8b858c07ab4200e9e41a913ef3928151d7b7b868a1aa879adf0eddb70641179cd625a2eef97790e9c4d49b3e4b162a258a2b2a31a6eb7dfcc6561cfca44d25a7e13e5b6dab95d9066332deb82bcce3b8a96ebfea2da5eca71e17f1d02cf356733e4000000002aba7e71e3d7aabb70ab4d38f2a7ed8e9ace1d489878a17a288691d9978d4fbda137d206ecd19f795bf26af367758ae3c01ae2e51ccfb4ab68e0c8c72e35c57 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b8d7629bf56af3a2d8ccd721a9796df26768b93e450055381ad45e65caa8025c000000000e80000000020000200000003ce062200871fdeb4ee5dd5a52f5e7ee6ddc418f7c322c98708bde47e58d40e8200000007cc933f3f496cda1fe6a996f95a3789059a223f0a6312d91b40bd0b5b0b1e994400000000f217d2306b57379288c2d6b707de9a40887df5d1628bc1366e868166136294f0b2a4f840481124e118b32b79a2bb4fd72edc940f340f9e83867444d4439e211 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421385870" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28 PID 2188 wrote to memory of 2412 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28002aec0f94ea919f4bf4923d43d613_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c455ace33cba5a86b726f70497b74ed4
SHA1fc8af20b548fb21e20a3904838c589530051acaa
SHA256d18790603fd0dd2442146374cb155f1c1aa2464db8bc3ff988475ce75b43a23a
SHA512630b67907b87383d2b30576cf238678f370df3fe9ef40a568b016bfe02a5170b54281351a9cd35cf10e827b6dcd880a896042cc2b5264a268c45b3b3bc0c9d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb6ca99073865c6afcc64eadd373505
SHA10e2f621a2af1fc0786614adbbf9ad332392bfb70
SHA256218644f55f1be4aed03688a0ae196c62231c5d0458682c5386d71349e36ac7a2
SHA51299017af939f7e927077311e5b1ced2d4f150d5b5d81ead51edffc970747da0b303a8e53b262d125012409fc97d6880d85092dfe8f88b1b461dbccb950952abf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a078e4d4feb0db2cadc36dc365203bb
SHA169c7a7a5d2ace483ca3b2c152e580812ca1872cd
SHA2561081b0ceaaa2d43f8a9020106238430f7e021d91c5da6b41fc81e05618eb7c95
SHA5124fa7ebffcaacbd07e206d31c25b6dbffbe8745a75655d4542de19c8c517f139fe970ff4168d219c23af805ebb18630f568e4a515e65faf8d161c6158c2bf93a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ee2f9d8d1f06174669eeb8a474ce945
SHA19016664fc9f69f62a2c1b5c91964ab6d36c48f94
SHA256cdf307b20a6193833fa98225b7cd8027f691e0c8bca1b20156dca6112b485b9a
SHA512f10fec9727d0a1c6378c075f1752eb17b83c447f3c9267224eeca9eaf4e1e2b8070b45dedd335bbe46abf0bc16eda197d1f6ae36e7db8bdb7a470a5eb95f9d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fafe6f344b903cb324fa782e5de043f
SHA19a45886f110c83e0565132da61f11ff3e8381f46
SHA25655892eaa19f3db5b9356fffecd68ed5a1209d5272c587e94144b2b9e1f6e7337
SHA5127bf9d66d51eb77a3fb3563ddbd39c5b46b8b1f889b12eb20e98c259b44fd607f692bde66ff9fc660fbf08e3166feb96b4c825b2d719b6a9bd372175172222936
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52015656f3fa0a9aad831bec233d83cc6
SHA1b6019427e5200eafd0c8d32778fef555016302db
SHA256852be59157481cd6bc25c9d58ef5dd4b5133fb8e1e00226484d734ea0cef9a0c
SHA5123b885c27ea7e3358f44c478d98facbfce06cfdb3098da30109af1514d415522fb7c7758b992a51f30d07c94c4762c5cdfddd68102dd1b73d4d00cfe3d7a12ab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f64fe5e6d3cb67496ad3e420fcf98f3f
SHA17472761b01fe57f3ca6aca96e95f3ebc593a2dbe
SHA256201963a943754ba7476bd40a69012b4133f852322e0a0893fd9cb39c31f96a83
SHA5122a452ed53c3b86b37ead36aed09b5beb815ffaec21475f0d3a419ed3cf8ad9bbdcbe5b84090c93b200269e9fe508be55ebab34549a990f1b2d090259a51ffe3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530e58f196283427965cb1c27418ebb46
SHA146babeb7545f139bc0aac5b308371cc626793f64
SHA256f82d31bcd2496c163029423f14c84e4a6859b50b6862e04c3296a880f055bd89
SHA5128959b3bb09c25568bb2268383612ea03c9c246d263564112b9b89e88c63313bb07d59d792f7dcfab4d1d64a41dbfa96ffe64dcc01b97c712eb14c5f652ec41ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0fbddb4d71e0b4d14a2e9838b2fb0de
SHA1b19577e6090ed385ee95da1dfd5ec551c2490ac8
SHA256826b76df453958a8e54cb22193248b9e51fcf991840ff00b99f307f3deb9098b
SHA51255b90d19e60688d13efe7cb252a558896f213d460fd6079ae1ac829ab7833bf07dbee2f5d039337f938cdc5edb7a95a7b6ebd12e2841115c9744f3a5841c3e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5bd02071cc019ce19691d229adec8e8
SHA123bb7c83ce06df373fd93cd6e1515dc02677212e
SHA2561da4114e33ceafcc8f92fdc6c6e9e94a016485cbc3e18beb664964ce22a47d6a
SHA512989be80471708ed304892924c0336a27ef7dc618766d111dd6f1a1949a575af25a2cd734561221e7b173d6dbaf5d7c51dcb22dc808e9971c5953e132b699f6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a350aa56f5f0eb50d9b78b9f76a6c85
SHA1d16801441e3c64c4e69bca8cbc81f9275b101389
SHA25691e2d3848198fdf361bfa679c7f9545daee639c74e4c1ab173486b23ba0d7e42
SHA512bdd50ba862971485964d795dd9a476a2cae5f170785c5c3d1c8fc1aedcbe633b13e726347148942fe96b380b25797e0d5d164799c07614ed17ae718ea582cc03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f3f7e9cd59399cc8e9af6f89f71027d
SHA1974eb2c3fcafc8ca25cdb76aee16e55549c96ada
SHA25653e9e36057f590df8896f62d6993c1c7df614ff19e37b33e8ccc8368ee7b09aa
SHA5128b6800756a7bc410dff5a011fa4370c6f9767c4ce2f3a8d8a671f371a2a5b9b4d6760641de50c46b5bbd6ba988b59cba003dfedc96a3e17d4f72cb9949928bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b83c86bfd8af9a90ff4c30c9c87cd72
SHA1b5dc1ec62bbd150277a775082bb6cd38085a80d0
SHA2562d4ca95396d4586fb03a3a26bf77b212932f7a4e9af77f9bafb44a0ac1c67706
SHA512f2c7689143c02733d3bda40bc52fe4cab471e2fa91ad9bd5a1fe244a05159a5aeedd309f19bad7456defa8c78c76a04e6331b54931407c145fee6a7e8625dad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5220b65f568ab41f3e6a87383914a4a16
SHA19e27dc3a868ddcf04fa51d9eb9fc35cfa86a6056
SHA25657ef8cd207a4ac6e42bce3c4d8095192dd70a742d42a9fb507bfdf0256185ac3
SHA51219d13e18a623a57d433b1b9e49def0616d3297453e8e0b160163dd89fb05ccbfb0405a7a5991d0ad8a8387a0fb4b27a812d6bcc35cb2928d3bf52576ad0226ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f74cace667469e2b4c1b7fd72b1d025
SHA13dde6fd8901daa3060b2365b8453ecdd3a53ad83
SHA2566f9060c7d39cb13ab177a0d9dad5381c998bce3096ee545766c3a835a0ed22c0
SHA512642f0c826e3a087b74d2aff91438191d4c561f588f39bbd6e31fbc7adbd3074725a91be7958403e757b3fa946cf1584da321a61cda9df99018e669b39f6b0168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56841923fe3cbdfc1932c97a2e66baf75
SHA13dcedc4ea7e461edccb0eea891996300defa3952
SHA25676d005449c0080ce0a1943c007cc2851f78080d1e6369a2c10f77324ccd42c3e
SHA51252bbe3e4d500694e7c9e6763bd37d77e8769de7c72b900ad4d4bf2fe757183cb841696f0250384c8aabaa9690dfff745be675ea6b09ef3b29b4ed091353e4168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee0449fefcd2d551a5821ded449c3c1a
SHA1cedffb34a3a2dc524c0104dc9ab2e0f009118630
SHA256433244bd1dd79841ae18ae1f00924a7f827513f2abdd653582a0513591001548
SHA512207326cdebd133364a6b9b580e4cb2552393f961ffd23564f367d803b0fb2d07b455ae0f7271c88a411127c12038f3400ddbd3ffdc783540bb9fbae130952845
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b8c8396bbf84cdc454ca9b9575243f3
SHA1e58609984a68144674fb118967046f507f4e420d
SHA256ec7823d200fef75d83a177c91450401a4c043fd6a7cc2916038d2554ddf2c9db
SHA512c56ca07c370497ca7b6f576b46516f48618f8f9491de0588245870a2c5ccbf7c5f473c819e26fd4863cab848a331da5a555a4ba3074474057fe47c5feb38585a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a