Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 14:24
Static task
static1
Behavioral task
behavioral1
Sample
2a613d0ef71d146ae09aeddd12aa4f65_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a613d0ef71d146ae09aeddd12aa4f65_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2a613d0ef71d146ae09aeddd12aa4f65_JaffaCakes118.html
-
Size
918B
-
MD5
2a613d0ef71d146ae09aeddd12aa4f65
-
SHA1
b11858bf61f954b2a598257138ae8bb7ff2408a8
-
SHA256
2529ea0b9c39bd963fd193cadd6a7301b993eff011ff29424851e23c96e8f1d5
-
SHA512
a0c89bcfda1e5a5e5fac2cdc66611941696f1bba6585814edb6650653586ff3f4fda6c248513bf9e5ae113f8825eae5adae5715f9188a83c54590ed3522bbefa
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203b999d1ca2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000041eb479b3165af4347edc5c73eed032f1dde8e27de2aa95c50759621f5d168a000000000e80000000020000200000007587d78c025df2df43db7b4393e6c488e175bb3c9523a2673d629b5f004c2e58900000007e52f87b876565ce6aaf999e8f7311e398bebc7ed8a19fb50a8407976dc7f04ee77325d856eb1f8e66a4e5c820fb03a448079513b2d5d7c72ccad09b5c9a75a3fa3e6d5e257be9b6e6eee8c8b7f4fd6d566fa4fec8361147a796520bd47cb24e351b741c69a6b607dd81156205bfaf3905d650672efa50f9cb2db91ebc2139ffdccea921fc48a649e640ceae2b7e26fd40000000b515a7a97f62f94de022cb499a7e5f1746860893fd449ef9f17a8e3f3b42804b836889106a1d8ac26ffa758c539cfb8ae02e99aeb8aa1feb81b36554f0c0f202 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C91D65A1-0E0F-11EF-972F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005b9cdf103a376cacbde885a29f9eb110af44d87202a4bb805fb4398f67bab594000000000e80000000020000200000003c6b1006a77c50abd8d892b2d4b35df4fe8a06f9e90c3508c69e850cf659ffdb200000008325098441148ff901e089f674de24807713f477dce91372afd5523503927bfa40000000e28c0d91e5fdaec111f37e3588cd569716092a15b351738c8412f3224e25eae89c46c9c5024971a5950117559f85be6422a6d0a813248d303e4f4036b78df223 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421426510" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a613d0ef71d146ae09aeddd12aa4f65_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57dd0b18f0f28b45f6b290d2c8fe3e519
SHA1b36be94f0e9db02e9b583da76be908c1d6a9af6a
SHA256e751f2b3d83aed9026f8107b25fea71cb9a455cbb1d562cab663cbcda9de8753
SHA5120b9be374a2b0aaeb05d3e1dcc303869075e09ccf3ed1e5f37a14019ab84f247ffcf55a061afe56cca3fba5b7c075bbdf275eaeb74ccbd3a31a12f23c71981ca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d927ee4ee4bc65b7f58e37f0bb7efac2
SHA1ba6dc0ce577dd2afad65964cacc5788d09155748
SHA256e4c2fabcf580cc3a699c3ecb7981c1ce728fa5f32f1e1afbf795c9aec817cbe5
SHA512259d35520e8348f7898df3a339bd33b024686b3835a61b8bf1c9f1191bbbe83afe0621e2fd3c1bc7b84f96ec69cd60c2424baeb26511d74e4093fbe35a0c1eee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD519847e10c0d4882aef515e2c32e5aa39
SHA1168e085297d7e1548ac3d155266463090a7404b5
SHA2569dadb2841eb89d0b6a0f70808e5c3522f1522184083d26fcf9d7ff32a544234b
SHA5126cd4b009c9d415f2c918c49513fe230d1ebb0a2e7e92d8d48b6323051a80986eba95f4fbe16a82fcd4c7b45bc25e2f9370cdfde81730c15c26d02a92dd934aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57ed29bee5f1f3dff039e8a714e199d26
SHA1dc7ae77d672f62f30642de76f279b4ce9745fcd2
SHA25694df01dd71881f51057261d8f4eb02c1efd3080f4c8b217c0948430f34874759
SHA512671b2cf455e61870bd3db4acff7d2a2f124433fd83a74389a2d34b29a39894f7583661e72c4d6a0592d9848b515fd5ef471f5ec5f2e506cd907cb5a6039b95ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c603c79f435a39eda19ff7c61ebbae7d
SHA1683e5783c6b46f5a9cb46a69ff426eabfac6617e
SHA256367d90f731c2429b0b800143b0677f5cd3a13eaa242910de8ccaca21d35d775c
SHA51257835370e1677ac45745ae524fbbc1582b1b44d8c88c134c79833eff4a5d64c73c8acca011463ae0675c81350ae849880c28c9e4a369ed19205d558b8d5e94ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5968b165a6ee97b4b5d35b64678aa5747
SHA15d7ce6ff1a13ff45514a20b3f17de715c65e4624
SHA2567d9d106994344109775fd9c8c20f58056557d3e0f99d361b460f205c2ddfd832
SHA512495d664396ddf31f3c2b02d073c061ed69f26ba4b0e57451edff203b54b96f65bbc7eec4871d6da26955d458e98877f80095f16112c5337e17967853e34a7d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5515cdb9cf14de628ca094f5f70af1645
SHA1366a02ff462008e7322ae0d4cc06ff174373f057
SHA25659ca865664aebf1b9a1eba66b10ac3d418b54747bb358427bf71c04dadf46926
SHA51289bad4f3da822e249b73265f0951b87c3e57a9c637555e63604d74cd7e6546bbc2d5dd1b5f6263663624effd23e8f086d70782578057a602cb147f96518efeb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD508b134a674d3cbbd37fd6ebb5bbb276b
SHA17f1ed41aa2351ae0997504c8fc1a386ce2443885
SHA256f12be69fbce21b1be8201a8366a3057256dcc8b8baea2d1d81d351dec7afe714
SHA512eaee340e73ba76f31268001baecbbf38cb54cd2c24f11f5fb21ca415810a1cb33d453ae22dbea380589431914b219c5d086b98b322d99a78f6a41befac21ee04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fdfca435671b52b6d56d8a92315b49f7
SHA1584ab35967d14859d08785f708e13a606dcc0085
SHA2564c374ab8ec4cde6f83f92666ee1aca2e5aadd0b6dec304798f0d1fd9ae6fabe5
SHA512839bf06f46baa5b99858b410968f23ed0342b686a72f39b5d70f6687a5c8981f1afdce8beabcc117e1bf2674948c4feaa0537676943120108d048ecf97b55142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ad1513d1d326a6e6d7e68d2b970e8084
SHA155d5a8eb954879df419fcdbc0471534ccdfa84d0
SHA2566c6abf80eb9ceea4252f323d49eb2425c0b30d0f4f341b27ffb8dcbfbaacc148
SHA512593c08cb77d9390e9f8bcc3386aed731cb96d7617fbadc89cb86e19266051d5094fab79a4d2259c03b88fe946db26862d496b04e49c01b0102b9def43883ed6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57753c6acb39028f5ed3796ac83be75db
SHA1a463604de2a5d58ec58edc725dc8b2d04d88cb85
SHA256ba0653bb0fb35fe69b360eb82ff995ff0fc97ea28885a28de7750378ed3dcef6
SHA512407f810252872cdc968c1c609ee0a4ace7f42dc21fa59f6766e3f9543a831215d4a8fe5f9b39e9449ceaa7299972732774ff7055156786cbf060a5d87e90bbd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f380df26db186e832c2e3bd1babb5d35
SHA1a163ee3ca4a60e3426c6b7c85119f24d4bcaf764
SHA2560f179b7c8bf7bd28c4e4d35858e543fb0a3f9a34bc7d24200a548dfc05e48f6b
SHA512c0e950d4e0e2cae8b13675ea44c2db7efe30dd1610cfb327d1aa8c5534c3aecca66e6adc70a127e9bfaefb44dd9f3dbf6b08f822fb9ebdc6d20dd7e220493e89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52b0563ef745f15b2ca616cc423922286
SHA16144688949a2cd24fca8350f940d836a46b5399e
SHA256ce7c13e3a4c0dadcd638f8d8366435371dd0772b867c289b8e53d320f82c805c
SHA512d1ebe93556fe91211acda92f20f2784b2c3d839d36b02231ba3eb27505148716abe5c4f59a59ad6183485efcbdfb70ac3d24035aa803d4519291fcf4b7a05bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD526eb939c09147bf11d12ce1ce7780f76
SHA12f01c2c6aa7bc20b691f11b1c1f2027003850cf6
SHA256986bbfd002f9a04320a14ec1df7d1dda29cadb8ea5bd068e69269a57c90080f0
SHA51286e9df0a491a069145e19684e4afef222645cc6b72e99f20c1a672a73f54636bcd6f8923e38f178988ebda4c10ed3d25e31a4451f6259a9f6b6583c869a73d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a1d2cd7e77b37cbf63bea34a0c4a446d
SHA1258c7c3845f6281dccde625208ed8cbf22dfa96a
SHA25658f24c1e6eb2c926ffb414b3e7111c6097a444fae6d9b992cdd8c4c8b5ac40ff
SHA51253444ed9f2b3f4a2507270b0362e7bd1d952773ca9aa2805d275ee1ee49c2072969f20c92581ef79f3a638e32d804016077ca0ba18734ab2c2b8abe35315a06e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5454df9fb88ef785ecbc9ea132a4c1bf1
SHA1dcc53f06233547d972840aa6728281308605bdf2
SHA2561d059c90c66b04f63485e091ad8fc8039ebaa17ea0f745e9943ea7ce4f3fade2
SHA512bde7be1a3e380f17276b7a449e91d558d8ff055472897b8ffb5f883fe888f255a988d07741e55403aec7b4af8920740ba10763ab785fd8e5e2c793704c154476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52c06dd98bfe2b1731d0fa74cf1d44035
SHA1db82b0049519fc17816934f8bb7833ea28788616
SHA25626e5250fbf239633f8c49cf123458edfa6fed3456d18154a1f29fc95690543ce
SHA512b9f539877adf7011e064776f7dd6872357de82e51cb38ed1aa6d4b4efab823d507a9a3e3a61acb51a76eac6a4216e6b86943059f0701077c9dc3e280513db673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57a91d7c36fd76383b92544fe25ab5932
SHA1c1d42913f28667b392a4cbee8835df203f95cba1
SHA25668045cfc189fecc4ec548835676289b73972aeb4d73150ebf0b2e95691f04bed
SHA512a961a0d1aed4fb4089c6cc7dcb5e78e40b44adbc74990d9a2d30430883838aedfc2ab50f5865f2b88d8fda655def060860cade476e20dcfb4f76062e99186e2a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a