Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
4b19547f00206837aafd595f721db2d1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b19547f00206837aafd595f721db2d1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4b19547f00206837aafd595f721db2d1_JaffaCakes118.html
-
Size
975B
-
MD5
4b19547f00206837aafd595f721db2d1
-
SHA1
259b1c4196ecf6e4814454a752eec4a83e18c721
-
SHA256
9e0a5a5d4c513c2d11918827e09c9e390e9bffe0a5de73aaaa6280ac4544f4fe
-
SHA512
12d679af66dc55228c43b1f404d8060f67fca2e73a35bcc2cbc89f4ee946dedd7abbf14129e386923d5a8f3c8f60fe4a9a6a42c3015ea350995201aa6f853bac
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b5d5a38da7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422024811" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000341663e040fdc8bb97b2c13575c25d193a54cab4057d179be6345f410aa05b38000000000e800000000200002000000069c2ff5771322cf382e9564976f84a05be3b4fa07934300fcee06e1f54326d6390000000f64688fe4a2b813dff47771f8eed59ae6ee6de3613db6b94585456ec86a3081a1811b5e704bc4ea793ce00ad9f02c9e9383166d228d719931832419952e31eb104abb6fdaa34071be1d83b82b71e9c03bc359f30d8111b7f7d0df1a1cdd287e3ddfc62d2ce2ff9c1c20564fb31da1a8be1e5a8a9139ed100d045f0e7c17e17f101d107e8adca7fb5bda2a10a001adda440000000b236e1c3ea10372e43bd39130fdc496b1c8450e6473f5b2b13bba60bba5fb2210375e781c75d03bb501fbf14c823788ff7ca7cff1f1d1603023d4502055cff37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008de2fe39defe74b97c969a6b7da2f305580caefd056d8424b37a40911adcb96a000000000e80000000020000200000000baad6a1ff7410bf2c6475f89fc147d61238214af5c2836df52a26e88116e62920000000cf0d94ce8b1af4f9f3b522aeb3c96159dbdd49519e92124d57cf896b98c7a65940000000cda87d323eda8de124024d0097892324cb26b1ad6975323b7946007889d1952c9ae47773406eac728d983bc67d5728311aec80f23b0ba7f09312b44823b1daeb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEB68B11-1380-11EF-97FB-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1808 iexplore.exe 1808 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3012 1808 iexplore.exe 28 PID 1808 wrote to memory of 3012 1808 iexplore.exe 28 PID 1808 wrote to memory of 3012 1808 iexplore.exe 28 PID 1808 wrote to memory of 3012 1808 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b19547f00206837aafd595f721db2d1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5056fb4a36224342560cbca0ed8ba3d30
SHA1cdfdac5f8ce7ff066d6debc3819aa5249c5cbeae
SHA2564d0aad6740e2110bdaeb77f5c6ed7b0ee42db58f8159997c1213f0c4125b66a1
SHA5122c55bc0cff149d801793ef6d97b1db7bf42e312c2346d7fb37c338bbf574682bddd858e0e3755b4edb2a72c83e229454ea274f347db02b013295a0631e5b3c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d28d19d7e01beda39117b983afce24f3
SHA1b344dbf516e4f3fc6358657c47a31b92f2491d25
SHA25656e2465e5c424e311849de744cf6633c97478810ce10fe31b5cb7a106ce88957
SHA51291696f93467fae99b5fd52ba64f59b733ba9c874c338fc1fb7a016dcdddb013fa57ae18ddf4b3807c56f84c903b1863872f0d31f911fa54362aa9b62ab19bca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526df049bc4c5e053e8039f0b12ff7e8a
SHA1a40bb285a99ae7f34da00707d4bf686094caa192
SHA2561e1a4e5f92f189f73012cad4f3b0e44fe83e0b890461d34d520b0c40fa4a4c3e
SHA512614001f9d8c66202d646f78ca258e97c81999559436db47a24b58837121be955edcf1456c3d7f19a5a76f8790f46c3131ad06556c1a67bf65c90b55aeadb25b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510a768a61944a2634b146af5a07fce32
SHA1da011be7b16925eb1f1fc868fe860f8ad39c0f79
SHA256ca549c946bff0a4974d45636076d887c7807928b0f92364861e9a44fb8ecbe14
SHA512361de3c10f3036df96e95788c9598245956964820a3b921b2b0a7be5a511c61505411ed8422a0105bf369fa3266fa047816a809659d468f344f268d306b27485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ee2f2d62cbff1e773414265271ae05
SHA1761e1ef50a67c97b26b267afca486c99fff516d7
SHA2565c3b962c2aaa503988572cf26d8a2a892ccf7d5f6e0acdab97d39f7815bc5d31
SHA51227ec01ec54224e19e65db44283cb30198302be58f0ecdeefae9e145470efdeb37a1341d9944e24767203a6647358fa53cd6574a1718095dda6d1e4002f33a289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e724f6d23337a1f866e3249e128e648
SHA1b36f5116345434b5f24734b5d2a6eafea53f3e07
SHA256d7b0d65c2deaef4fb7ff8e7fa2235000f33a1f5022d0242e72bf8127bfa99220
SHA5120cc2a861eede03521f91749fce9f93dd4bb39d0b65ebca2dbe8183a5b9f0524a5ac989f114ebb0b52961112cb5f45b910da95dc3f505dd677c9bdff449fdc96d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584e65cba8aaefc5fdbcbf714e23872f6
SHA16bc99edf7adaeaf201e58debf283a31e1150899e
SHA2560cafffd4abd2a7a24dfeaa3b84d0cbc9015b6d89a19fc623d7b5a7b7f351c29d
SHA512b78478d3dd1c67f5438aba7f61470bf4bf1999755dca25c10e455c10b6aa4be3c3bba46c24d6e211475dbfddcac07f38f4e62346dcf84ef9782efe31d8115716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bc8a9b3733cc6fc85b573b3077a6b77
SHA110e2ba368e24ffbc89aa05df2eb8d52992f95a5e
SHA256ddcc543ba89eea87e83b40babab92372e1f918c0c2535a3b672e576b60067cc8
SHA512e8145121e655073dc8de1b4493f367a0e7c153bf82bcc1070606786480e556b3cefa914b4dee5adaac7442759fb0bf8b140516dee8ee762a4051cad40bbb5f17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50574bf94d280b87464c52a5b8b50adb0
SHA1b184aa9e5ec40a172fbe7f5ba6b9f57cd1283064
SHA256d462a2ff26a9a7889ce6d92fe4b3a0ec3b61f4553823e408ff73f769cbeafc13
SHA5125b5b00177404f443bc167c672bf4594fea6f936979c71875cc86f6738bdb8028a9efe557b95a2b334282638018bf71fc3db4efe696a275cd9db3c2ae87d51a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53053a81412d4285b6981b8b6f85937b7
SHA124aa5ff5e04dba874fc3d47842ba4cf4f20ad362
SHA2564381a2ea4e43d90221f2080bae8558331e27b8e6d179767b43b40d10333694db
SHA5129b3db8450a84525daf22c56798b8440de06b1f78f1b89f58bf24bd074ae821a538678cecb1c99f51df1c7a48fc479654e26a849776aacfb28ed2a02a26c68f16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe02bd485fa4681e0f65847f652e3656
SHA150061604e8c590d22b1e4e24029a5c7d7609f1d9
SHA256dc1a6d9b9067105ec6da4af5d41fd3da66eaa66345674d9311935429b325cdb6
SHA512450644fa9c133d446bcc375c032d81566a6434e99c4bfe23cd3d609933e50d627ca99dacf3093a1efdee16c1a7ea5c8595023776a6135cac667ef0db87417875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b3099f42ba174b6c1abb047d2ce58db
SHA16fd84c3d69b989c6a390132d9a5eca5e69434891
SHA2568eb11003d8da397a22028e39598010b5e8d328d44a8eaad8fc1b2b9e39c3075d
SHA512dc7a57d77d39ceffd812b86a3c3c929ed308f55e51e8d45c8ec3a77467b18f689f2f8e449aabf8a2167a6d1a2abfd3cf831e4cbfbe79f1c31b506c341c073c4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d6d290515c045d140f1058d6a79541f
SHA157e855d739c0b3ff20542bf15713a9d21ef93a61
SHA2561503cca2278c51953ad3ef1af3b4ba1d3e607c619baa9a3cf1147b51a62bfbd2
SHA512efa70315a84b4d485eaa04f4d59ca95a4e16f5f6d9ab86126dcb4ecb37b92d400cb5f4552d96142e5ff723e1448dfc642acc013c0b62344873343016c7869f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c1ed78013c41d3b036153dcbdf3ac89
SHA1a2be6727d9e8521ff5da0cd42530c6e7b57b61ec
SHA25624473d17184eec19bec990efb2555f0879d071f369fb414ea95b3c5f74a91e18
SHA51239bbb94f93bd52aec5236c8c6f152bf4663ea4250e1455bc416e574b7cdda17183d5ea42bed2a30a576e0f276b059972cadbec4bdb6c32981c28d67135c7ac96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c488027b731fcb4c91bb59ff46dfa7e1
SHA13e7a9308d1e606c35491ad0adc3d8bed6d07ff1c
SHA2565135c9a662b314cae95c6d97168133c2aba9c692a6bbfcae04b498ada9382788
SHA512effd41a73ed90f3a2bff2e7e3174f290f05cfeb99d1855490c4f3951038c9c6ced0ac45ce01967d0edf523f847dde044ef1d1c64112839d5e617be60b4f3d576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556cfdb260f3824f17a8ce3a5d69d82dc
SHA1479ce01d9c341d236d5f26c06b15ce1801df3139
SHA25641a97b538e34a811d40a739cf426d3e20573108e5fa77de7af3a79916da92914
SHA51237b43377683474c3b2cd39fb1d94686535bc968a0d0d5678dc66e7ff7dbe5098cbc9bdb96f37d9a28fa8a387b069a7d53773147be12320bbed03ae6c4f0e2831
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e88962f1e48d6a0dfe30715a4c735e7
SHA1c429e760f4fe69b5cb0b65f63d3eb65ccef7279e
SHA2563c876a3771c904ac0594801418bbd1ef54751e070abf614d1cebea82127ac835
SHA5123cc658de71e38f03f84ef13ddde24428390693c7365c8572c8a5dfa5d045f18f439ff0a1595b03c737ee485e4600e0927870496efcdda373843b926c6dbb2f10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5135bb68049b1f6d5471ffef280dba6cb
SHA10c81e956d855b80f35ec63414118f3ce619fa126
SHA2562b8809ad0f393c7147b51a73234e61ec5bacb70c78be81c4eb3a71d5db5d9afd
SHA51289a47aab61d587dcf96196cf9062ae6516b89c8c0757e720bb396d2cd25dc2542672d99fbca15a1de28cd948af5100a21a6c9d9e310415d3e3b2c237a804215a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a