Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
2e69dacb0a6e73bff53184947b9803c9_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2e69dacb0a6e73bff53184947b9803c9_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2e69dacb0a6e73bff53184947b9803c9_JaffaCakes118.html
-
Size
2KB
-
MD5
2e69dacb0a6e73bff53184947b9803c9
-
SHA1
88575261f2022fb57b04e5edde37f38b68feb817
-
SHA256
b23f5a4662e82ae3f4386268136720d96c1eb3cd7201467b06307c90e0ff3a4b
-
SHA512
835ac5802b5bb0aae159e7c1b12b05fd259f6bf31816cacef07bf5f91234ef39ac59e3120a8d02947f5f0026397030ea8a1fd7ce37c8ba0a42fa9c1df9521d23
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001e14a14356a87bac34b846686c24d736d09d0272b1090112ee0c4902ab1f4159000000000e8000000002000020000000beae9c5f58d2e0bdb97ccb4d8bb1255dedad629811c8ee049b3091fa3a5e223920000000628ecbbe5e8f3c05e1b4dc2d9f9e5a3a53d8ba1c8535380c0b4d6bb7777a8450400000001b44fb14b7c7efc0cde22ffe88e3cc2b039e5b04c86a6264af610405bd1b7b0cbe6b81e9d52b8dbe026709f2ea0d9070e62161c09ffccc9dbbe1321e39d2573b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108addf3baa2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004ffefeb57559ac7a2063404d627c63c19cb7bb2c407c00bc20141e7381a36afa000000000e800000000200002000000089176c57cee15cb0e54228678fba396d621f6f743dd8a8023ee7c86d2b3d89e890000000dd49cb799c45982a610586cf0785b9abe4aec9b9e1cdcc3091ee4d96a79a6c121a714e0845ba1e1da40cdb7865a857ec57b91c9efe827773189d2314b5b92d710974d03785addb6924394e7607944be5c770b07060edaab40ba6fabff9697d8d3bf217f662dfef35fcbf4674f44743a74e6bdc0f64ffe686af8f3713426774f7b79110cbc3bdcfd6d894d77f23fa34a140000000dec1847aaef7093a584ec3cc1079044ae671bd472afc5290d404e755f1484462a397a33562d61303cfac7018dd15c8d830e26c8e6ba34779bd642342f859a51c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421494515" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F43B4E1-0EAE-11EF-9DB4-7A4B76010719} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2916 2240 iexplore.exe 28 PID 2240 wrote to memory of 2916 2240 iexplore.exe 28 PID 2240 wrote to memory of 2916 2240 iexplore.exe 28 PID 2240 wrote to memory of 2916 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e69dacb0a6e73bff53184947b9803c9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d68e6f13e59b5836e960efbe172bcb94
SHA13afaaa0b647b1679d90e1d577f2d37d39e41867d
SHA256e703a9952cc1ba78d4429708c0f60b4724b02804c4931e12ac99950294c7d45b
SHA512aa5f1219c60260668b562a9e5f0365c475544a193cd7a376617661fb346820cd00f1a7b49f2ce7465afb2550dbd283b6bc20a0c393b053b6717acd7fd92088d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf639150f6403e664dc13d95575b60aa
SHA193c528bcbd8c2127020ec67677a60c23537fe747
SHA25675649f8a3e36a71800064eb40dbaf21ffee9e1e963771e71e3abdba1b0ecc897
SHA512b240207c8f8c9246a858d5a2eac9bd0874eccf0df182bb752dd7d29dc4b2bb3a96aab2a5a82cabf5864f462e1c2e3bca74b24ac2fdd9749dc2bcf10817f0365b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cb012c932fed317f45a470da6400cc6
SHA1a87c12fb108b72bee09338f14bf876f6efa28f11
SHA256266f7132d234b8b43e9c3b67dc63f5c30d3750b04d238c0318dee3020b0c7a4b
SHA512966c85bd2772b27ae8f40b928db0f9243cdbc4039e24391a94ea4e9e3844a37fdd1350a1365b93cacb7504681f1b5b63be0e44f6bf945e7dca3f0580250de442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d03795b588bf406269c6d142f1bd5d
SHA1bdc18f0d69f5062c5319bb8ae6c292f79e3133e7
SHA2562de11e6224a79b2ebbb0e50565a580fe0467c724dfe48abcf143ff52de356a06
SHA512b752dd6e81109c8f9bc46ae0c324c65b56d28d49b28865c1fa675dd3881f66fc3f8201f2b78fb9860d13b9ca1501c3aaf63e2a51258fcee2c1663a719f892c1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570e1189523a890805839ed75cb450510
SHA178d81a528d8b39e61d2c791235648a14be3644c7
SHA256e442adff888c8d02c0eaf49333da9bc634e1344587023fe847efa151130ced00
SHA51229975b3a19802101332d020da9001cfcf20f728ece93052ce9aeede50c85209f7fbb1fd967e5cb28001feadbd2739a3eb29190134a0fcf23a52a98a933ce709d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517804c0c4e386d1b54e499e755de12ed
SHA17350c9b58482466be6edbba962f6d4dc8e3a9de8
SHA256cdc38336fbad0252dcd2b6d03b5a042c2bf92dd71af526312930a2c77493b361
SHA51296464500785b0eff2dfebc35483b2d4771e09bc2cf4c185d2114be42c1b00e6ffebe027fffc11b78497ffb9096814fd7b0adea52a743dbe1cb73100c51900f70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f79c8dbf147d2b819e12c45cc336f43
SHA14e6cbe041ddb158885085b25c256ac2e63215a52
SHA256130b6d206a9c7a3b4ac58ac98264949acbfdc2388b05d920a749cd4f1a384ac7
SHA512c27904f72ea77829bd8c837b274142d0327805eeec2b38ec9bbf605835a83311e5227da4f840f6df1e53365909746aef38ea97e5370ff54028fddc995eecf81f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ead22e0b0a07d46a660ac9f015f7a26b
SHA1a7cd7aba06257656535276ef0806af24de48487f
SHA256fc8eaa3fa0c601157c1a217d6cad04dd44d6596bb8755e6ab4e7331af83a3bdc
SHA51215c0c6bc401d1075e0ee8ead9cf5cbf1b952213ec9d95cb9a646730ec5a70f43ab34fb33c163a36267620ae4f359ccaf0833d2c1b5f4e6e68f1c7748b0b01c6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b04bc8cce3cfab4de05afe458b0739bb
SHA14b5a59f2c668fb72615a181816d14ef5604fd809
SHA256a28ee386552419ce5d12724ebc63267ad3a7b0d6b607af6da249dd9f2844a0cc
SHA512cfd133526537dc6f553b4c2ce9e4429801b3d29fdaff6822f511a4341aef1b87f805fe198352918d5eda11cfcc9aa5999220046971c8389faf7c421b8beafad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53da92e41019a8eba3d8fe7b7ed982aa3
SHA19bb3baf7df066411031a60702fac721b2f05027e
SHA2560961e7f861c7b86dc1800d28df5230acc661bef9d7c073e7a48c079674569fba
SHA512b698de55a40202f560af48ef489b984b680dea93954414a4a514f905077437c556d4a9292e0ca90154980197e07bedcb1aec994c5876474e35cfc34946571a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50630fa0ac6d5c2dcb577f40e87849d02
SHA146d6fba6ffd629d4b0520b3ba13e3feb9498818b
SHA25666f47217691d31f57c710959ebfcb13e86da0df2609c85ef834f88b6710702d7
SHA512f2aa8ff7efcd36b16d92c638ea9a44a57dd3525603db6e9d7b5b037e8c93bdb152b329d286ba86e6c3995af8487c74a334de461b7dd92521e2058f772eebb2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d54cbb9f17838d8a352d814ecfddb400
SHA11bae482b1add80ad782748b08580360d1700df3c
SHA2569fdef81da44bfb38fdc3681d6ace4452bb07433b03929aa59c349d1bc9a3cbf5
SHA512e846a8dd934d7b4be39c3989ebb220b39556951a05252411466197b5a39be2c125c1309d59d8f0b87d48583aa44a70ec439a7b08e81efa00fa58125e4bb0788c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e348ed8a5207779a7598ecb8eccedfc5
SHA1e27504c68c868cdb78d88485a465c43a86163668
SHA256a2dff8ec92ac8ff750c2d313881f886fa1a2cd66c76267fad42786983836d426
SHA51250878c60660b8de492de026d74726027a6b3737db5223bf7aa2a9bf606783b2c675d06214c0af4261fe10b06af89d437a501730f301c114aca22b4d94437962f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f973f020586260cafbdd40b402c56d
SHA1707a53551bd41b3866ff0e254c690f6cf1cc99e7
SHA25691075c72e9806be99fe776a8587e6f64b6c1360300887c82f4e80d5c507a544d
SHA5125beb5a044a3a8bfeb87968e88648a7f63e7a3e2675a2740bc03a31627bce8ad183ee4bc5fd025560e2cd64ac691ea85c16bb88abf1bf06a0838dea7a25287da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596f38e813ea98e8ee715d6ebf7439c9a
SHA1255eb89e1167fe355087687bd564558097ea3075
SHA2561a97a9039ac76fbe8a957e227015e66a01495102cf6c014a5036aeb71245502e
SHA51237db12355e7a958dd38e0302f3d51a833a4360728781c39cb891116b547844270e72d582b2ee9b4aee39300880b13d6dc3bfaa42ce13c9a1ae30269cf3882683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53adf388d286ca2e7c52e2f04849af53a
SHA1ab85c897da6d067c0813ef4361eda3c53825bc9c
SHA25668e0d96abb87aee15260ae11dcb6bbdc017be1d32f1d033cf6f3496c471ddd1b
SHA512ad5bc722e779ccdccd2b675dfacd0e170d2bbc0f920065d407017381539e779ae03450b6593d4dac0fdc9c04835c646afe92500707bdec5c7af43cf6e7a9b73b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac2768c5572c4561c8d5800e067473b
SHA1693a5361f24a668f429ae7bbc7e79678d17faa1f
SHA2561dd695e615608a0ec6d5b78f3643d2ece2bef5de7cc22052705e66aa179d8d91
SHA512cbc4f82780fea5ad1a348745c58df64a31445f2ebe0aff0c34c4d5a6ea911f63d006c557ab5de634d7ab3614b2211f6587e8e6c0091e26a0594060dd740ad7e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551e78826d874aa9add8275aa5ae8ff69
SHA1a3f16a2c8b7e0331c82e51aa56d8e47bddca7ca2
SHA25680762a8e7fe4048563088cb6a6d85727245398135880df33ec669dc34e7e1eec
SHA5125f3b37310e180c2cc15b200f759d1a552a3d9937417d579f541117982e368c8ce38f54fbcbfe6077397459a58d75b63dbba858f5577f4f781dd7877d5c284c5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceb59392add88c0597c5586abb435833
SHA166708683dec94e10a1e2543a3450d8d985741b3d
SHA2565057de4131e8ff4fcc4ffc62f65693667f961bb549e7b42ae5898ad235b21068
SHA5121ccd14e3ceac3e8b30653b6706ab5e26283a1a640cc100931e2aeb504b0d469b6a6e3ec2da51a39617882f431488ca022155d4d7a6a07519b80f9cf6c333f0a6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a