Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
4ce696668b79e1cbb228bd56f949c1b5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4ce696668b79e1cbb228bd56f949c1b5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4ce696668b79e1cbb228bd56f949c1b5_JaffaCakes118.html
-
Size
3KB
-
MD5
4ce696668b79e1cbb228bd56f949c1b5
-
SHA1
0321386aac52bcb059c70f64af43bc1999295361
-
SHA256
0f200f071849d1a177cf465cb6ac4fa7671bc79cf51ab5a108eb49b134e8ce40
-
SHA512
564c1ff1f8d1666dc82bb786749ce6dd3a8c461075bb1a641f16a48982852d52b0ccc61de6a48f7f1f9f67f97729c995e2e82f2cf42830373c595701fbabf035
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{340C0C51-13C3-11EF-81DB-4E87F544447C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007ebc92dd1b1e41b2961190e637d6f385848aac1a606e5ca1af5b919ecc4863d6000000000e80000000020000200000007a9aff677de6b7e5a79df5848e2facacbf1462140399c03b9929e257d43d80aa2000000048d543495ce828882041dca660e90ab56c4eaf849b3c0eb72bdb9a1ffb324675400000005c55bc6f1354516b2d343977a60d447453afd0ae438336f7e2734945ea99622135ca64ceaffc3845c19469de4ddbc431d71f1d4df5ea45fe4ddda0876a0e5a15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a039ce08d0a7da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a023520ba949068db8bfcd74a0b0b0fcda9d150f5a95e7160a6cabf36cbe0b6b000000000e8000000002000020000000dfcb6daea08c920663463b35bf15b00d205ed2499142576be014034c930e272190000000f946857f71ecce5571f6afe4316a189fe801333155a6eb105c6829b80e7b978f0b2a87051432abd695a9e380f757422ab92a7b74bfa1351179e1986caeedbf892078cf7fb823d351ee306d49edd1707856ebbb8098592b7d089547b28106a4dd5ca225e4396eae7e494598110095729e4872e9d25dbe342eaffb0c948d72d9b568e0681b07c7a3dfc4647d239029123140000000a6dbb2298f865d38121042b38bdc5a6ab9e986e6767bd702e88cd7ade155790bcd03b0c7979eda480ee2882d6e5060adb0ff2cf176ef0265e6596485c81ccf6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422053326" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 848 iexplore.exe 848 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 848 wrote to memory of 2016 848 iexplore.exe 28 PID 848 wrote to memory of 2016 848 iexplore.exe 28 PID 848 wrote to memory of 2016 848 iexplore.exe 28 PID 848 wrote to memory of 2016 848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ce696668b79e1cbb228bd56f949c1b5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b9508800c4f53aa86b3447467f75774
SHA129ec76e34f9e6b2d8fac71eba38f75ee295f083a
SHA25618b58f4fe827002ce760cb06809ca9b1612ebfa258db83bb2f3d3ea8a13e4400
SHA5120a6d1f582b7d7c209eb8a01796cf6ed8d87d56efcc62a76159100fe8a15b7df599b7a8e63b6f95e0e7b33b81faef0a874d94816de7ec2c036b34b20f646e95ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5583df1288db245bac58aa6bfdd079cd7
SHA11208939a1416010ebc98dd265acbbea0ae5906b1
SHA256129af14c665cb06ac04728dd7d4903f800e5fa1801eeeed6fb677c2507ca28ba
SHA512366eb1a7d56052e10d3707bb43b178fc2431fba68d2b55e58297c3b893c958141c92fdb6b2b02f1131b565b2b2a35829d539bcd6ebf7effa0fc82045ac74709c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5277ce940315beecf5e34f2b7f4ca37ae
SHA1725c298f4f8bd493b31689fb3483e68af1e3ac8f
SHA256058125c513f200066116e8aed5c2e0ea8503aaeeac6111da10d4f6cba4ccdfde
SHA5120bd5a32bec51397f7f995ba7106bcef4277a682ab80fbe6002a68ff8763d45f11b2a56bae14c471e0e73f4911809e5d1dae7b31376717c9deddea677bd6bbe0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542893684d940c1af1d9d262687abafdd
SHA14109455de11c3b45ef33bbdee7f896834be49448
SHA25661ca99b6e887371844f2cff38a07dd5112ba14e9fa6f1aaa400569202e7b9f5b
SHA5128b16e28f095a151963790620641e7ec3b86d65904892357510f3f0bedd97bd78a5a884a5d4f01900590f4cb71a7a69274e26fe52bd8a7832a44ff990c3adbeb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b2ee02be49aa18778a8be64649c143c
SHA11e9250c20d6b40d55af60f2506c3c8ccd48cb563
SHA256057e1ae58aaa0cf557c2a5ec78075e9419e541c9a388593e4745e08925be75a7
SHA51266872236fb299e4cbc5b3d3c1a6582d1f8c1921b304a1b65754088f1b8b057519bfaa0b9922c5f13ca5384e2fd6b7e411561f69e17c1761dc9a5fb3b00adc20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595f44b0347774ac5a71340ad184ef726
SHA13e58a74bcc94ed005a2fb7a105cc8034332e2d88
SHA25637dbb7d9eb7ad0a6697a16b2d7ec514d022502716c1e9993b24718c1905a8c97
SHA512915ef59bf5db143c52e5bf0be94151646d1760f2d249432d5643964362ac15d852cdcf8d57f4dc6ef8973c9fea06b0a40e41b297e0b56849e5808856738e3b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5210833ce8c5a49f9fad957dbcc749d79
SHA17c1bfbde20ba2658ae8c0aa9ab9322e55fd16b13
SHA2562bf4f79f6518f2415fbda96a0f6f914968d64a734deba77d6df8773587c8c17c
SHA512520a7aa59d7fac5f828f7a649156bab0be07963f107950085ddab585dcba822a267cd4baf33bd5de50442a93bc843ee47df0060c35c5179b3fd58dd7e0b68b4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a8ca8801a8d206d94e6c0de16e42eaf
SHA124cfb93465c68c783714180ec35f37dda0dded7a
SHA2567f9fca2faa3e512e93c3a2da6f43cbdfd26dfe54319984c7cd2ad4b729b78734
SHA512b42e51a807dc04d690ef57c8ff8e5e5a6c736894b090944998784d47dcdf10e80734d8851733fec5a1047cd47241af3675f55306f782fd3ff434497b840ad8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525e5c9bdb8d3b9d0585770f662cd0497
SHA1fcb13981b5d66703ed485eab426c8a8ee3a602f3
SHA256f93c578121cb544ed06d80c5061723975c0dec6ab5301c126bcc63741cae67df
SHA512897e39fb755b6e6c3bb4540f70eccecd89fb42f68e14c61f6efbd226ba4afcc19f96bf1ebe0ce215acdfe36882d4a12b49994efabcd596697704c1c9b4c03bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd03e3ead8ac7195e1bd0603d6159e57
SHA1e7323c1fab08ee37d36bef6216b5df3fb2b25522
SHA256fa89cb2b7464fe583281a854cffd57e06d8a32a2d1e452123ab6eeb963f13483
SHA512c69b948bbfc1472e4c25ee919ec6b2ec096907b3d484b9e5b345b75c733ae6c7e7773b5e4d64d33049d41b0d2254b78a7c5addc6289bf23804b73adad230466c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d33ba0aaaf56cdc9768ab0034d13fabf
SHA1702e3223648a9237cbef01a3e453ec76fc9feb85
SHA25650b895ac08b8b5a38ad058dc8ebe0aec9b2d74dfef04d20ff27c72e07c7f6c65
SHA5129e409eda316951216ca880e51681c2999bca2054fa7222201a1160d03db98ac76f858d492819fef841d2293f690d3affbd1830ec02f4cd03527cef79dc0b8569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5469123fa5fb29686fcb19c6d0db3c7f1
SHA1d5c8f70e8cfa50cd9649137b31e951f5f46fa560
SHA256238c36d19ef87d67b7519656fa3e6813a7ed85c0176e12f723e897f21fdf1fd7
SHA512b833ca37c9771f3a5cc2ae57d97431dc0eb81973e2e87618be5bae6be463d47adbed027014dbc72ef45561fa7908485157988e77c92daec1a7fd43478fd26b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521ab0b0c9bad6728d6282421d8aa2033
SHA1307c56fa83893f401f27f42dd66ae85cc2e5aa88
SHA256fa80a9149668c9025d417e34738e71882998251af2b9e1db9faece2afc02c770
SHA51227f73a2f1b5446f0afaba0655376f6cc354239b05c1a347212c1a27e5503a94d258b768782193885ca40e3bfc332a7c6dbab41deecdb90e36f5e5ca4638775d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ed73d50420a1e36106ab270b0e1835b
SHA1c3326ee8c2d6a3a511490fefe8d307d65f5a515c
SHA2566ce985b50f0ad91d57f661dd8c78479a3441ccfaf0d5ac87b55e3b184e053fd4
SHA512d384b4dbfca385b54201176fd9a5f8882c6566bd22a7e4c1b8bd00316690d85c40d002e2bc7b423dfac6d39e330ab05f025cdadbdc31afd7a9d9a31660058f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520b424049affd6d670752bbc8d2abe75
SHA1728b5de082f8b92a3e9666865ea0883da50ad766
SHA25638cfb2e46c7e41c373ca9568b7ffbc9aa6700e82493cf5d98fd072e3f9288a10
SHA5122c2871cd4a5720a88c3108ba1f42d4861ac0d4fc733d865f58cae69f349acd61a5540511911e43005a8a83f118bcd5899428cc7d201064b2bc0833ae7490db35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a1e488466afd99286c17401043758bb
SHA11edb5701e712869c5ffbecb5ebab34d517131171
SHA256dddf83b628b1d55b2f22d6e9edbdab8b9d2225282c06a34b964234392beb1279
SHA5126ba884ec42d4cc076117919155d08fd131cc4f7b9f57f6af4e9d36bc524a556dc445a6e74b15b826b513af5256945cc82ce7c2cc13dd982426e3430e760465c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557197fb1c6d8a945c144410abc50f96e
SHA16f6b93fa78ca290088f73f4f193fa5ebe6a33094
SHA256ec555cfbc0238706e8a1d7bfda65d0110ea097e14f8c1528a291691e79ffa47f
SHA512fbd97a65e0ece31f7854df6aefb886bdad50589c747959051d87a3635b414b40c136189f5729109546542b1ff04223937f584cc4d9bdbd5f8fc0f96e49e3166a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5435d203bf60a40e0d1e7912264b71c1c
SHA1932fb3e764d8d761c3ba74d5b218ec711325d5c5
SHA256136823567cc3e0508dd609f8882dede987f5b58624ae11512d9b1761322ce086
SHA5122f8cbd9e1e3d5fae4e545e17cc7dbc4ad325509a4d232d2daad7886d7b6964fd9fe2d37e949bd73441aa0a8287993f4d7651d57ae5f793325a6ad678f9183b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51488426e1cd49a5837e39c99f5e0c8b2
SHA1d4a35304d99e8dab1bc85dc0a5ca3b5fbf0230ed
SHA256fa5a53ebc28843b9336ad174967352aef9e841605b20d44489dca1be4d47938c
SHA5127686dd73e96e446e3260a6d1091fc9485154f62c4fd16254586ae5f2f4e3309c50842f96849a0c853fdb07d21cf038ffa2e572b36e20c3b027c6fb3becb92881
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a