Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 03:16
Static task
static1
Behavioral task
behavioral1
Sample
280a5d2b74ca708500e2d377a7c1dc6b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
280a5d2b74ca708500e2d377a7c1dc6b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
280a5d2b74ca708500e2d377a7c1dc6b_JaffaCakes118.html
-
Size
4KB
-
MD5
280a5d2b74ca708500e2d377a7c1dc6b
-
SHA1
165589496e4de8f6f08f2c3f32a76d55c8e37d42
-
SHA256
acbfa323f5b050de20a480f2d1435072814b1a0895325b19733404466ff18d9c
-
SHA512
fa4fa8cff6320190cea9723449de32fe1e5ef27d9d8855b4d1879444ea2a3b85d7a362f319cee6905c99840795cebb706ee0e33d435d3a8c9a3cabbdccfb3259
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oQnzfd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01b7a5dbfa1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002d01e73908950dd3f3fed6dd29ae331abee3bcfac02dc2404dcce86e7bc1e00b000000000e8000000002000020000000f1b2c8cda75cea20fba8aa37dbc74dc5feec3fbdf589524094e9f0e0b7e418bd20000000928c0a41e5dd3ec8fa98b507e63ba366d4f715464529f435a624ab90229d2ed440000000ddcef4f22c64b6a88a718edaa23b54551219022be29ed72f2e90aa438c21d39da4145aa0a90ed5bec6b9eb3ecfe7769d9739cb4572e661b682dc6765da4bece2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008829f7f0bfd58ee995afaa172ae765f03fb3cd7eda7d03ac194fef4472313251000000000e80000000020000200000004f49f333482102b7b1387c0d83d054ce5057ce857c5a51b8fc99003d544fabee900000005aeed349867b2d881810db9624c52028d1d3dffcc72cdfc719e569f39a1b562bf0ee922e6a99b1fb2018bdb28ce193b9bb3468e7185bb223984828c512021e6cc66560253c71eea7d2eeec7e2011e6ea6a7d3b7260ad1831d6bf4774c471f5f8c381c798f8bd1e4b409f3f4cf9ec9b351e50ca1ba41a8f190988dda7699159c0aa618e13103eebb085c86af383c70a6540000000e01ef4b72dae26c50a96c5ce2820f467693a002e2d8ebee6e545cf2687a0ad481b535bada6fda524647071daa70367b53e43c35f920d1e2ed6cb2bb1cde7ea55 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421386459" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88DA6A91-0DB2-11EF-A339-D22A4FF6EED8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3000 2488 iexplore.exe 28 PID 2488 wrote to memory of 3000 2488 iexplore.exe 28 PID 2488 wrote to memory of 3000 2488 iexplore.exe 28 PID 2488 wrote to memory of 3000 2488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\280a5d2b74ca708500e2d377a7c1dc6b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c73e28b316efcf61e5f25402f7fb24
SHA110470410c5a2f265b9b070a0c8088c2b47f96f49
SHA2564bd6d6b65881900b50784728eaec5602c0997fb149016798f581cb1fc65f4525
SHA512a4810dde22cc0cc27c2b99c9710b5823adbf0405f61993bcbed53d08f9c69bf681d63af332ceec132dbc790c2eda23835d67d8e638911094c3f32eca2503bea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a7ba03bee98449d3b7b0c22ccda4ff4
SHA142006b7bddd64aa3d8bb13cfeebeac33031d165b
SHA256d210473ed54ed95dd9e0e0343191a6b9871f5493c5f3d0a105e1eed51ea79d26
SHA51273ec213d6e830802025ae971672cf35d29fef5debcd21deb980ab30fcd75ce4587eac7a1db328a6aa5f86c01ee779dea515c3202bc9e8a8fa6da9eb463d2c71f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d8cfd65562a849253f23ab6e0abb890
SHA1eab679c59d4c9d1ec106c6bd266671418670225c
SHA25651c354aa3a5d6bd9f1eb0019a60088e00ac30c778049d12c22cb4cdfe447f224
SHA5126914747c9d1d0aa652581c285de5b739e5296a30a9040cf2d3c9a58fb0e01201b7f2f3d8867dd1db031fa84def41ca6bcb513e7613011f204294aff10936bc14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567d9f867b8340a27740b320b0f03f20c
SHA1bd68ddea657d6e95b8a8412217f743cb882e6621
SHA256b79cb784ffa47307081300d920f8cc35972dd521d1d8b8988a0b7d674814e424
SHA51279836115c7b42782a892d16a63aa6a3a2534b9f5db31ffc7ffd1bf68853c8db711eb775ebc2e481977ac14d72777425b6ac2e85460d709669475fb99c0bf2f31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebc3860890c6425e34e55b3da1bd03d6
SHA1625fab4edb5d425d7c4f493d4255b64da0f12961
SHA256abeb39a7b9472438ece24313737de1114cc791d79595e298eef57885a91010e1
SHA5126a8c451795f640c527f3d50e34e58e5aa5ba866d77898264836911cea05ee2cf96e064602e9a846b64e29e97fe8a0b6750bbda5263bd14b40f761ae305227f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5389b682c21be2d4a1a09c265bf9be02c
SHA113ccdb94af5811e07b33eb4968fae6d21907fcef
SHA2569df7f43cc92ee675730ae3b601f5d5835615f15bfff39f415ed45aa1d9b06c3f
SHA51265eb93893c7223e327e4b637ac7ee0387bbb6a67cc2c1a5ae15368cd09d3c2dd6e684eb7bad9a9c9033f9f73f16c2b38e9a14760587afb8074330fad3595d2b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f455d1cfba40ad9706b10e4d2742cbee
SHA18107db40d7410a0f1c0b7f4e0a78b8e93487a243
SHA256efd0396105531ec4f045e2a6edf2563a02b15b4a00a892c88394e6634d21ca3d
SHA5122cab8addb6e87d8e50acfb954c603a02272efc95712d9c872374ae29791426c72179b0fc0eb6f1ac9b5181c9a9a09ac920dd4daa0f620f1882125b23439ee120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c69c3649f1a5d28eb0c5502e57207a2a
SHA1a255db0a3c618f3563ec50154911506111a6913c
SHA2562199b12a0a233ab47523857a316cded9a0ca07ecbcdab062a0d39600d86916dd
SHA512778df57456fb1a0e45eef77cf5dc1cf49da0f3717712601f2941fa42a3e5bdf333241789948e40ef16ee212dbac376c5036e2e6ccd8dd53840b7fadca1c682f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581283b892764b90a5981bfa079325855
SHA137a332bf1cbfcefb85c90713ab6722a22463d696
SHA25658277b8e821ba8a2e914e9907d9d8e68ac159a7fc0f5875df50641accdc780ed
SHA512b667235e5cf754e969e594e56cc3d1bc03eb9485dbb91221ab308ac107f8a5331c92c51ac6816de9bdfcda2a970809e0691bd3db82055b77c70764ba0c6d33d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0290bedbf343ee0e4eecce7693ce027
SHA12fef0045a649ae74892fe52307830d1844c8adcd
SHA25661546f354a456c4999a97c5f258016e51c23e469a2913eeb428b9703911f47cc
SHA51224eaf0a2eb21774f2f4c9789eac96cbacf18b76dcebae09f02c9a1e7254bcd144e11738eb255499a8b9237dfbcfff225b81efae446f41d7a8703a8b72fdcceed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da29d9fdf526e8ace25ce2be5ccaea4e
SHA183e9f6ac7ba8a11d221972ddde69e447c726e358
SHA256bacd506de43e6a20785e231179fc832047abc3e9863e7aa8b8a277df29cf6c02
SHA512b6e86aea488d382dffa2f26696cc7af230a92e6f5e59aea3a6c0d2aa4ca9431317af08ac4c39bfda38160f40bb79db21d4cf003495c9d27d876ba6422406bf63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5326e3cfc4b31bf815d2a0fc5c386a97f
SHA1f1cc9a6b5b98e42cb288edc14a287ad7969f02dd
SHA256a02fa4dfe9459846646b6e2f6d1732136eafc85409980a99db8c78c7205880ba
SHA512d8bd57f51f8f44ae26de5ef885462e3a3d70278d24955cd14a527c432d4fa14d72517ab7bbb348a04f6a578c0af3b2377f2ec6f45aff3b73ae850ffb4609579c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bd9e2d4614cdae2d15f52404fd6385a
SHA1915dd470b4a03e96f3599e52f10936e894d86b3b
SHA2563c0219367f3bfa1008ee22a6c6d9aa2e9ea72e97d88049e72ee4574ff8b6aea6
SHA512398fb7ea4dc9e37c82f6250540eeb30113808bec58c97a98743d55b29b50b228491bf5bcf3504972d19b96dc4b7f1abf2e1e11d00a692ff859b9731e4128ee19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5825d766e65c7fef740c3246d2fb4a6d2
SHA11f115e986bad8be124218cd75533e7698e734719
SHA2567622d5151bc3cb84af9055ab0991541e8b6abf828b7044156d1e8d127f1dfd17
SHA51284d8652d98849ab1903e0584ded775056d2c30de2d9f6c63254b187c36d8fe03aa5e7683c2641537322ec6d36690bf2185be076ea136a661243bb84fe2f51098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ee8d40c00adc272c46742c2ef9bee7b
SHA1e77b6d0957729cde1b4c544a8448a055262572cf
SHA256c5d1e3389cc8ec94e9a3a40495f1cd63cc52181f4ee60b9251ee0c6bf3194dc8
SHA51233521e8af8d4d4bbaacdf0799c6d55a7f1a5193139344ba49a09653b95774523da3546be6c7562a81cfe97acb16b8db5bfedfa556960fd7331ae38dfa79eec5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ce2207c9a84700fe9c8a4d772700178
SHA12e2d4c156d0c2cacb67df005f1957afc976abd6a
SHA256ab726d7dca32021e39a848b2ecb24b673a2c29a496b4e9554a0812629ee3c360
SHA51219a4d1680d2c372539cee4afe838dc32e3e2697fc071c052b0a2399d353365bdaafcd2f1bcf3a57ea9a6fe369d97b4a46efdc3c1f50c066ff2c722f197e4d67f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e8807327208b717d119d26441fdef59
SHA18704067a55884bd094fffd8bfe94ab647acc1ee5
SHA2563a50636c9060353a81ac2557f044da96e2225d52a6c756005119c103b934da0d
SHA512b6934cad072c7afc2d05f30b2ab8970515d53544ab65f191648e6c019fe9ea03e3c940267cc8c2be66277373eb1d4cf2a17b94c9587c58197ef506c2d4dd7c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566fa99f9ccb8f3fbd4aab4247206482
SHA1fab9f25cf5fca5b2ac4b7a66f7f1a50a278d424c
SHA256008d3b3b5b3c3483e2465f880d8fbaf5abc222831af06ba129a082771567dbfa
SHA512f0e79000867c31f568cdccfdeb8a98639db06c2fdfe74900e4954f90e1b6103d9216f9ed9665532f1afb33515cf0d372b236a64e8c62c9730bb2f58b1be0d04e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a