Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 14:33
Static task
static1
Behavioral task
behavioral1
Sample
4699ca98d294605b94445bb028ba7625_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4699ca98d294605b94445bb028ba7625_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4699ca98d294605b94445bb028ba7625_JaffaCakes118.html
-
Size
735B
-
MD5
4699ca98d294605b94445bb028ba7625
-
SHA1
e5246a4bd26acc16d8ba1e3eff52d3f9fc7740f0
-
SHA256
e1c9b246447b2c5af316c540de77a0840755ed5233ac2e63772093c6dcf9ab40
-
SHA512
73f90b286779d6b91e33fd38433f04510be739a4b49f93dedc46a0af49d3017aeb26291c18c08f57c774ad37e936622ded535196076ec0a92486c35af0ca2969
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421945450" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bc2e73ba13bd7dcca7de94c7b210091c293b9459461dbc82d448cfc0ae7c86d2000000000e80000000020000200000006e9513b24227b47341c8b820cd68f2abc056345c9bed497c39b662e45f77f966900000004e7cb7da0c8e7113b64da954db8adc5fb1a245517e601c539c3a766ddbc3fb2e11a90f3bef3dcaad77c8af328a6de44149572e7e7e68966497ad48e8e904b0e919a398110863d350c3e508cc5c55bb270cd121bf0f6ca2f528b1ab7dd1188a27199c9d6ef5d8dfdd2b4e8fb8b01ae42492286078b0051d2ee6bf7ceabc08e35981dafc5a393ed87dd719fc3567be176e4000000055cc9d9d8ac647cab438a3fe3a3d986cee488c0a1553ca36b4d96e11809a64447997746e0e5acf07bf3c1d86994dd0f2b3e96fef12e645dc7192eab59b532b9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202af0ccd4a6da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08D27C51-12C8-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002710239022f693b225440e1162adb9afc1572fad0102e6a88fb833d3f777cfad000000000e8000000002000020000000f75ab6ecc2f9c37d131a5561dfa208dc49354488462d2c9484d6355f5d1278a0200000007af2ba86981a40304ba0577883f9605117c162e10c5f41fbdad31b06e0045686400000004443093738b075965656c46e407388f5e33e2a882b4f322749bc8c14fd9e5ffa57d98317a49380de6d4f67237a94e5fb41437fa5cc0becdb990d660567399aef iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1968 iexplore.exe 1968 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28 PID 1968 wrote to memory of 1936 1968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4699ca98d294605b94445bb028ba7625_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3490f35dfcc3e05953815c9933d7f9c
SHA1072b256161a17b72c2176ba99aca3d17c3d7f1ac
SHA256e263065cc439a21433a98b017794326470bfe30160aac930f555856a06acb4ee
SHA512fe05f45e1034654700f15eb4639b721a64de24880e312c133959256642b946dcc50875c256d1d131a875e84ef4f5f7ddc3a7bafdbf4536433410731a27d98b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5702ae4c55c5383eba26c75d036c7668b
SHA19afca0a99684a2b6f5c35e7c08cf1a0168474ff9
SHA25680cd98fe6e565a7cb1d314a7421d0f77785bfb3869f212742101b104ef644755
SHA512590c9e0521cd948c7c7f035e2c3bf17cd4be96b1bd4f647faadab5848145498951ad1de1541f30a49f1331c29ea1cc4bddb45e4c96f96dd173ee950ca2007dc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad18f8a741b6e9275e5c0471584a17be
SHA1f7efd4228bf1a077d65b2e9026c43e9a992549bf
SHA256c509a00a3d4b10d00026f5830a213dadc87b036da446b29bb45143cbb458f38e
SHA51232bfeb0afc52143f8f7a44344c5d22dddc2939c062961ec654c48688d6fa0b9304a56363a85cd1abd60933c89333d2807ef51920d32a70095d942cf48fc9d03c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbdf9a7c3a32794be1986bf2106bf2e6
SHA1870e606918ff02a0ab062c5de430c812b6e708d3
SHA256d3a6376ceeb1b142798d0cf3d0c025e336d85adbf55412497e267cfc32d9d0c0
SHA51253196918620937e324ba815cf39abab98cf3b0593b7d2e61a9e7e526e715b7b695c771f4c403e8e1d22bfc4559987f0094d73607d97aa505055fda916092915e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db157c93b0fbd002a419c33bd769b7c4
SHA1d94822dd73f154ed74a93eaceb5a62f008b6ca73
SHA256e659726bf2a80009464949c6c942d6cc2870d73710a2e73b5d1c1a86a84c5203
SHA5127813673cea5cdd9f8e6cf70a09c998e9ad471c3d30bb24c7fa0d6b8c9f436b1bd48a22296e1d1b31156e3603bde9905eca896be96e05a1bb594dfc7c85911ed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516660323e9617cc66025516472450d1d
SHA153448adb9506aa40a9a060ee4a2ac7c2d72c1375
SHA256f6a667484b31c13551aebd7bf73c02ed863f59ccea420163ae0eabeb6397a7c2
SHA512eb5745e42ee7aeaa905ca197547eeb0d6fa9354558ee50fa682856bef07e5f4b2a73714d78f4e304e1e98603a97d31690a8b542cd0f74f2259e367d58a3d10cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47700635fa458644eb967bdbfc0b1b9
SHA10df961d512d78c15d2e78d9072932b5b15b53c12
SHA256bf6df52bb8d818de5ff8fc90662ccbcd8c028f5e5c008e5e4af03b6c532a8f9c
SHA51269f3aaf79f6cdb3df754208a905e2304eb452e285c65f4781eb12ae7f93494512e10e14cb3faaa392198de8b29d3f18f6e2c6b986345bd2f016f0371aa2e3471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51601efe957623f3a88b913c5d0226340
SHA1181902391ee178fa52768d8e70f17dadde13df01
SHA25602d54a8c105fee9d90a5c9c5e286002dd194c888c65e6596f7e19d3c4ed505e7
SHA512ec77ab751496b789c1f5ed25d6201f05d588e99e9202bc2b624438a31ff0b39088af0a1a7df1a48813c0c7aacb2e362efcb1ac8526fb282b4add2cf808babbf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5956df5c55d3c23d8ff0ed814af60df02
SHA17a6bb14c3865a61bd620a64f25f34904d7d1ec7f
SHA2566fa3bdaefb2a3822a75a01f66a23cd38f0bc84acfb34f759f4da215354805a10
SHA512f253dfa95d05fc30e595859d70d715e2ad298400ac32d7041fb34e6ec28174c527fd809019e686a2b2c1fe4a2350cf82ad3c4c5f7f5164de4e0b9ea3192a5fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a66a1663ace0fea8f99a79e48e4677f3
SHA1d8fff4a3603cfc2bab7b006ca0a9c819184bd95e
SHA256c8c375e29e2a8cd6060ed402bff5dcb7ed9498916f42a1f2e64d512092573b48
SHA512c96721c5834a8f10ff537c35e632226bf5d6d335837e22ac58ec0449de9fa73b988595990f1d6119b928edff07c48beacfada005a843559e88697bba43092c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9d02fe785cd488364b4f61bbd6488b3
SHA1f26e243b0a526dfb3fbe01055a6d25f5a270e55c
SHA2561a9cd3a6a391be9fd7b3cc1b36486be734119fd0e969c91bbe3be03f388ff0d0
SHA512f5ebb6e3dbdb1bf394795e63d31348da897b74ca01416ac141b29ca243c3d32827d524989579543e28a6d97767e894c848c5a63b77378368a14e6584105bd966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593d21f78b0dba9bc3ee9aece1f4cd4bf
SHA18d90e133ef01110e754cc64c79a6a2ffe8aaf519
SHA256e0903ffb7e2b1413c34665817bc9aca785ab2709fdba55b0d9cd3334195b3301
SHA512b29c2467a59edce895d97c02ee1f914863de02527f6f5438d0d07e357bff14309f8d7e5823d28d5b9b812d418441ec65ef1595c2696478097d833bde3d549f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b31eefe8735e076d1ea72a53a67a2d42
SHA1d301afcda09d25e9d9456e653b5fff54e2380f54
SHA256d6b89387b6f4e2c611dde00d5b7d0ac0c07301a263888c38f1f5179242c960b1
SHA5128fb14f35f0f0d80d56ed2cdabf4fdb97a317b1b7a1a18278d54ec4fed5f7e727c5df3e1bd852614f75fbead6423a55b92528e40377e0dee197236ab8f587ef54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f636901bb55b8a149bc22aa74247a6ab
SHA105bd067ec4f823586c071d2f28c82d8caf5be465
SHA256f55c74084e6aa763e85bfb1437466d84e0b3277e856a7565913bb3bdb46957d6
SHA5120308cfee11c95d11aeb8e75df609cf24515e4e6bd24343e577c44afc4027fbf1ae3407d9c4a229aa0847f8ce508076a4ff6e4c210555e24322d80bdf8df62127
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f55fb60d7f4e2e0b352e500d71a85523
SHA1b1b1f083ed7cb7e286210b4b7924fddede6fad77
SHA256a65e4843a7231c21f7ef8f950b061766438dee9aec66489a173971ebfd4bcf96
SHA5123d2d2fc7c1d5cfe9491424b6444b59fdf339fe82905e0c3478cc1f7eac6139c1d0a33f82deca0ea192254bb610c934dde14aef32e2a8a791f4b791c71d26167a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5864463c5d209680ebcff6743340b5fb7
SHA1ebe1fa676c20917c350f4fffeb2bd5d9be824ecc
SHA256fc7030740784b485dcf9bd5d7b6a9510327eaab6dd85dd306b422cacd1fc4aa7
SHA5121b72dc2ccdeb5d47ff85fbeb0bc6e155119dcd75fbd3fc21de37c6d0cee4ec1bd4922d92d3fef16cdd2217fd804b0984df0a6ae2f4b0cc941969eb010d7b8b46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa663c75c90112796b0a4afdd6502d64
SHA1f746d6f865bbc6f7abc8ccabda998334014aff96
SHA256de648bea5eecc8dc9b45c313e45c0da2a01b17d19603600e3c1a26abf24b1a03
SHA512ebd54720aa8e0e5f6fb0e7b2e146792747dbcfa135488cbd24dda0865a7237857ebd679213d1e8bd03d9297ce3f2aab439526ef9949489750379dd093b55e1ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e660d6078505935dcbd567bd60f9e3fa
SHA13a78f6371e47a45345035426ad3879735c61450a
SHA25644de0444f65ec2981054d7f84baa3064c8180521b2e543c4810514b8417f8b23
SHA512483078c484e07fa672782e2752e49cb743223446a9dc8f15d846213861cc134cbe3c0f74bbba4e5d1fcb78c4ccc612ce94ad9c8d945ef2146e84a3eb0aafc26d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a