Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
2f4bdc482cb6f2bd6db0c852627480cb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f4bdc482cb6f2bd6db0c852627480cb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
2f4bdc482cb6f2bd6db0c852627480cb_JaffaCakes118.html
-
Size
2KB
-
MD5
2f4bdc482cb6f2bd6db0c852627480cb
-
SHA1
a2de4cdc7f39a1775b0d63d3faf0204355442140
-
SHA256
3945fdf18bd91fc8066eeb94a5a990931c88d5966eb026a275ccb4562a5a953d
-
SHA512
e7e47619a5ba093621f67b1b2796b4dabae56c665e6059acb8ba6235a2c6972de9ce5ab98711bcc4917dd1cebcf1d218b00f4233ae0063a7af637f36fba57c61
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000001ce75e85598ea4ee048b56d4a6a94ce2ca413a2d1cbd9270172fb2fafe25d3f000000000e8000000002000020000000866ffd3b25f2579a231f1d871c77ab98bf3c4faf8635a21c2911270acfa74078900000006724bfad088455a469435af85b08a8c6954298dfff66527c056bbb1f4afda9e7822c45986d2b4e1978549a68a4999b78988f6f2a7c295fb393777521cdf1d87617adf0d8cdd44c78c6d0103b7187e80a012d02b46d47a375fe1f0c920a316b9cbed515f4ad676aa76f1941ad47b2d39e876a22f97a35b2dea29def79e3eef3e16e4230cbbb9086336926e99528ef8d39400000009980b159e8038160b38bcf6775953dee84d693c61e456440ad42485d3ac9b592fb0d35d8eb9d01ac16ba4211873dcb11eead307efe142484b72b37f55758e445 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7C98C81-0ECF-11EF-A30C-E60682B688C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421508999" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000079ffcbe6b34719d223f2708c3f5eef58a5a5d257a26edc0a1de79efa3945dc31000000000e8000000002000020000000706e9069fb5bb8b8c0d50a42a58c021cc6b72c7576d6a3f8f5ae6aadbd818f9d2000000047f4ab3b2fdac3afeaf011b94d6a451e0cf71519f22a8af40dbe04ebd794b7bf40000000de149fbe9eea750e2b49b38c72cf7924512a74806e006a9bb0f6d31879ad789b5c3438ab0d4ad975c0910adbc5783c6fcfaf8165e64bbf9dac6738756d8b6f72 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fd9bacdca2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2548 2168 iexplore.exe 28 PID 2168 wrote to memory of 2548 2168 iexplore.exe 28 PID 2168 wrote to memory of 2548 2168 iexplore.exe 28 PID 2168 wrote to memory of 2548 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f4bdc482cb6f2bd6db0c852627480cb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aaae48999eb06b477d91cc726eb10f3
SHA16fea13b0519c0dc356be8d8755ef28bdd171fd21
SHA256d90625792885910fe1535d9200ff28b3ed1a19c6b8af39ba0358349a86d1b09a
SHA5123b4bebad064853598f2d8129d79939af3611566e075bac903a6c866fa07594130b144f752c6374316bbbbe5b82c5a803a96636434727ab9838392a6dfdf6585f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cca1f3943d615fe564a6270a1e07ff2
SHA1f4f7bb55e6c439f7ba7b0e2f2051bb57c2243576
SHA2563179ece09160f5c1aefc78d3a5d2fe1ab6d1f5f98f2e4ab29251452d9b297656
SHA51285cf5f1516a487a7aab2d16ff4ff5faaa237f68b3d54aef3679124805842cc4ac21a92ce4705db6f626792d6653fa82829b15641631ef063bbc3be11762cbb43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5087a3cbb5bcc0c30d6211a092734bf50
SHA10462941d599455bad367dce3fac2aacb7357b022
SHA25689ec8e878afce4ec5ff9ec24780d35cdaef3a3c4392c4394f5086d8ea31df2dc
SHA512f9fd02bd39c825eac505103c1e4dbf8191ae6550ec1566eb9023f6940f501eed0dc7debfbc9aa1d1e56ad7dbc6cb8e0abbaa25d47217be7519da0349a6b85196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8096d43ee775047d9c2e8cea4fe879e
SHA142a69b02570c7887540ef9f88c4cd115d9e3392a
SHA2562e437321202c04665beb1bffd4f13cccba0b7d3dea73354a47d049902294f9cf
SHA5125478423c866bd1ea7f7a2ae6191b287b8d7f8b93e0d5e072489434bd75a8418b43f0319a761e68a167168cfae63cd8641034b686b604c221d990411642a03194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da9eccedbc56a588f5f627326c04d75f
SHA1b305bd216c58dc9035d5c7739f712f4c5d312049
SHA25653a908394bdbccbaa3a36483bd687c91dcb1580346ce41899b3ba5c30bae7c85
SHA512c18fbcd0298af74614ca20c4789870f4491d9c61dffad7f2deaa0d3f4d63270835087a6153f0e42711c574798a4bc0fd2e67794f0fe50f7aaf3bbdcdef579e71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce563d54dfaf6f52d9db0cb1c3e321b5
SHA17f4ce49c31c61535c90915987689fdd4d9b2dbfb
SHA256bc4a2c6b18fec7920f215eda061affd23b56215a9f642b849168751ba0d9a59f
SHA512ea6ed7b3977c5c2f0b5f901b1082c3f95d3da30aa910b7434ac72905fa24505272fed1b5195c808686036fd31a42c0631e3a2e6c15d066f94664c7c1f0a36dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5676ae3d7c26552235ee9d0bcc63cc6bb
SHA130496a3d40b03f734fbfc71fb1cf9fcf28f5e4e4
SHA256c6a6c8e40da1fe61029d6938a7c1a3ef3b6848bab54e3dcb86bafa1339f6eaa6
SHA5123e7332fc3d3e80b4ce2fe3e1011191cbcfdfa1d71b563604afc402dc40898f16ad596c4720f1527f6846e0ae1ff75ad9440bd2c80869cda024b0d84ca5cf4f4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5908fe75a38645d6cc437045e64d217e7
SHA145fac4fccc7683a397458733ca5bbda974ac8307
SHA2564bd0859cc6fc024a951a99af016c10bcc95ee011f6d1ffb2524ad8045863e275
SHA512d02dc6597e173ed19d5b12dc0f3ebd533e8ba491f9267fc3271c2247e714c1e1cf380c6624fd0839afcbe49ebdf7b1a85cd2764a89b51a31850e5a605410d084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea6b027cc55311d03b9650e66eec7a8
SHA19dded699769166f4ab422ac07222e9b1f93e50f1
SHA2568f19abcf8b8492d625c13de6a7615afd4945e809111e607cae3a9262815b74a1
SHA512751328f65d721f68cc8a0f34bb7d02f379c1049130832158771afa8e7cecb52dd24e4f1a55ea5b0aa6972354ed9e09852e3fa45c00b09c7b49e7da37bb0da96e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc91d68ffe19c9ecc6fab3e2e5567aae
SHA19b55dc13a0979dcbd230499f12f5ac5c9adcda8c
SHA256975c7578aa818651a8c554ffd170c3548e4095afcd62a7b3e98b3800f7a0a1b4
SHA5128fa4f6d9957f723c5df6fdcd3b2cc54d47c5bf5bd9aaad7bd85467fca49f068b42395a9ebff84b59bd62a50a257a50e31da18e4cb2c3c44ded8765392138c920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553775891edeb81c3840453a3634f4f85
SHA166bc60cca035b68881aaf837ca228f4becc9b977
SHA25685eb7e42af277e88141e2b56927d0d196904f583e428b74421164423c1a474b9
SHA51210b80a8b133c5396ed3560e90d3d39951da72f01ea16cdf8532bb4fe9bd6396d6c3e9b15d68812329a54883121b10f9f75981b0f6d0d551b0d990911bcd605cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552fd15eff111dc75424ffe5a7cf1808e
SHA1bab1e931337c512f29fb60a3bc55d6587bac3eea
SHA256f6c874ca54ed816775f591b7a6f730e3c976d8abfab60f9a9a670f2c3353dfa2
SHA51224b28d38d26502463dbddd498a1978963d0f6a6af5845475071383b307e6680975208e35b55ab38f83f39f45710e0a084aebdb423d3df6339975aad7f2d152a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fa894ac28bce2deca8ebdf1a0ad8f97
SHA1d1548674cb1f0f270a9598d56828672c31d48f1a
SHA256e7029fa0c49f5ac1f70810bfb836ef9094c37b24c1dc97403ad653fd3421f5ea
SHA512a852c08f1aedf8e809a661ee337d6579e01bb3749d3b94fff97abec6d759ba9dbc3198e223ad34a91c3efc691fce7b1fb6b108fbf6b99a3039bb74e2b2b2c7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56abacd989bec7ba3c17465219aec6da8
SHA1f7669bd3f2ce0ffeab8b04e842ebc477790f114f
SHA2564f64dac26e08f97ed92f5d27b96614d9f020f22c1f9818f8b3ae89887af21aa2
SHA512cd6ac15d5e8b379c05cd4abacbeec29a004b4dea1cbb36841631e38fa1717a77172342958dcbbe30370d0f7597a49d11af8c19cd5ef7cdd11ffc01c97bed6013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5789c8b3a7488b0525604af946098fd2b
SHA158f1ba2e1384b9088ef845ea718628186d15df00
SHA256bb9cc4d99f625ea8061431d7c150b279364a92ee5f5c8d7dd77504bacb41d21a
SHA512bfab65f7edb34c27ba071fa87b81a5239a1f69f993a92bb260981d06e404281f78cc352d5f7decd3498e321faa652fcf4bd8893622c6ff8cf036d42c52494c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57769bb6354148a4563fdabe903a59f9b
SHA14f2feeb3591469a840b757a57fe46a51392bcff7
SHA256f9070b4d47e106778acff550fea476a150d2ed671b9eb889e574b569f9d5c658
SHA512934f18c480218c27e98b5b16015244f73e7218fa58fc24a5330e3dde9d45f89bbf96004f0651e5993e7875b12a2209e9aa5c9d1ffb1ef614c5372f35739c21f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5375502a6ed2d859273f8b50ebf8f1faa
SHA1b43707d8368964c12383948056d1c677e8b8b4b9
SHA256fb245fa640878644de182ef6376f9a1bf5d1991448fa4a001fe813a6931e95b4
SHA51249eaaa2ea8c13e001f575a35e478f44966dd37af48a9a25388fdc70ab42a81fc79ea072a7305714fb9820fa49022dc61ff6dbe6f92e146a434a048b277e4e622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcca7ffcba6ad52a34b4849039c10102
SHA12048eee0b3ab5e8afa82da88b3ef777e7049e70a
SHA256f3575c914409b674dbe0a06e8401857dda922915dcafce30f333edb4252959c0
SHA51261096363b1bf1a16c663fd680594bf9303d86a58232c5b22c599e326689c38ea47431c840fe14f701bd848367dbe3db864210fdb547c4ce5112277511c7b5a2d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a