Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:53
Static task
static1
Behavioral task
behavioral1
Sample
68c2a4b14d0239a3d7c440f3e1bdbb22_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
68c2a4b14d0239a3d7c440f3e1bdbb22_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68c2a4b14d0239a3d7c440f3e1bdbb22_JaffaCakes118.html
-
Size
681B
-
MD5
68c2a4b14d0239a3d7c440f3e1bdbb22
-
SHA1
738419ddd58841c5f1b3785886c62d0aa2027322
-
SHA256
8a078e48ceb33829950c63e07a45d2550434e5ccd4c68957d09313c69b728f27
-
SHA512
d0ced062788b654e8912720c1c3fb6fbc1eb2c510a7b4baeaf7957f46ca4c30d907be70d92e561a51fc26d915384aa5cc3e95d083d6f51ba0aa1f58ed65cb555
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C09FECB1-1885-11EF-8C71-D684AC6A5058} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fc248492acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422576689" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000e5a19fe26d9f134ff505b32ffcd0395544b6bd7d444b9237b2462e6cdf48bc5000000000e8000000002000020000000ccda6d6cf307478cc26a292d1237f18100e9fb28f535777e4f100425eeb48c9d2000000000f9f5ecc0cd8c30ce91bbf792399bf345e5974742a5349f43bd6bec45ace384400000007fdc81dfecc64d80abe7a44abb09c88f8e44572716e8168acf78fed36087e0582b9977c3f9d0ae608aa7d0e266c3d18514f2faa9cb113295b3a849fef2b9a85b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b8d894e4e6d7e57dec94d53b9449f8e7bdde27153c54e47071873505fbd6ffd6000000000e8000000002000020000000a4143b41c15f8767a03c4794c838cdffac42fe8b7ba4e188f3761609ec782bd39000000036377efde7dc54920b72b94a5a243135e550e624e1586a3beec4b479f0b19e175d2bf3e12c5dcb0298ae53f67aef335a5a4a97a007a78863071c04e9d79f202ba140f433ea2c92107db9838f6357c078a2cbc0a02cf839609ae99f4d91e1126099acf259bf4e8ac48c72304df3a9537c98b6610535be56752a31f8e201212cbb7f8d0c5dea4d3d4cd213b4bf56533451400000003cea9d3483f33efffad7cdd5dc853b0932d93a10a0337233b3290f5048f35eb63d7f0f293aa8da5b0ebc82eb289a424d59be9adc90d06546fb7fd0b202787428 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2208 iexplore.exe 2208 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2208 wrote to memory of 2556 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2556 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2556 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2556 2208 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68c2a4b14d0239a3d7c440f3e1bdbb22_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c62335f5b18a9e819939064612a197a
SHA1f806405ec1a8b6f9fdacfe07cfc6acf22781fef2
SHA2568145fd00821fa6cd4c941818f04d614b28381efb068eb026426679a0f8ab4230
SHA512b97f2f82c5fb3af3966e6afa3cc92fb76579e52a5ecb456af666ce26cb255a522eeddcbb7941a10c6f8948c18eb9d2685c6d561290f8433ed1824bac461fe4f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551550ee4210b2c2b72b3cd3d2a3c31a1
SHA1eba2a1cf4404209cb2f7bc19c3751587eb54a584
SHA256decd2171cca4025bc66e469d26ba3186b175f3a8ee8b0ad31faa1bb017a2e5f0
SHA51214ff2652696e08950f88a9d34c74742d05e9869898fe6a7111835e8dd0812bcf83b1062737f996ea4b99555eb0635d22c34ad23063b2eb865d2bcac910981fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b920cc9f007a24377c038437828458e
SHA1981575688f161fc4bad2acbdad3a5ea9cdfb02c8
SHA2565f0a0e2943ac0c9546d0f5da81236b600d6e672b60c881621749f645faffd142
SHA51296b0b07766b6019c321eaa805733499ce493ebfc691e406e028320462ca5f87617b15c5cf240f64da1896509983d3ee6c948bbea7f44fc5667b18bec4a545f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b2a64106881ff18f8448e9dabb867ae
SHA1cebe7f7c6ef892d8150a30307236f1f19ddaf2f2
SHA256757fb4003e7d3a634b673a05bb4d94dcfbd28728324de26e7f78980f136ee01d
SHA51218862a498c8d289f91ad3137dbdfff4ebb701c57095ac462caffee32d86533438aa5d8b4a93001958f1b5589d78e0f17269226242eef6f9898ba428a9b34b6a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583eadb7445b7f678b887c7b66289c0de
SHA169dba87771b7048c260603b5d57c8228d97b0806
SHA256fde078c581e0b02d7a621b7671d75e2e55fcffa24b959a15924fe75a36ddf790
SHA51204f7d861fa07bd592eb0307d36e3d129c32917f9464ab7e4e7d6be12a17a3a21d8ea39c651b5dba17858adb1f0c5757acf0f596fc68a425881cac608e2c70ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55efc8a023684d7ce643fecff5711c4a6
SHA1143a7b7a29e3d5cd0bf793e01ae514686abc27d3
SHA2567021504508b5e5b371188c2cc695f8e533a9bd8b2989416c4c55abcedb066687
SHA5123dad6ea7725ecb1617f0b65eedff7535036ff8a3e38fdb80b2b831d23e4cc6740342d6a29d1332eb80e85e3a9f6531eaf966ac536209f48868b44bafbaed55fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5048a4b72e4c22099e7acd2d83b9b1a5a
SHA18512a07bc805a2aed7cabd24b35b2d4008f507db
SHA256a8190678e5765887ac39380ddcf2656a62c49d51958287aa34acaa9ec35387bc
SHA512b9b226943bb0d48acc99df8e746233318f6de258729a137bb916ea6d39b84e0ea58ce2bf69800dca37e579d8abe28bebff19af01b975b1f9549492d5a8a0873f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1151c580fe41daf65e353f85e33cd93
SHA193d9d8674b69f680101841c19ad343c3af94b455
SHA2564c7879e867919501dba4e5d5e0f001cdd08be6345e026282fa492c4af3531bec
SHA51297a2d8d95a470d123434beaf14740d42da27116eaf65e18a568e153f44b555747e56f1b1e80ce2c283fdecf6555ed3ffaec1596af429342a7849783cafc83c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525d60f2a2658f377208cb81b03cceb05
SHA1925b0fdb998f548c9325104d249858af94955948
SHA2567acc0a42219db205843060a87e5979b63057eeff443e221256e031408fa3b09c
SHA512a3a7c71f1dc6b054870339929a97c818a207d985b2d834b41452a5e87563e08b458e817301a4f1f4aba64fa30c278312913a070caa0db951e6af0687ef6b20fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55496b5002b3dbe661c847ce1d9c802ab
SHA15d1429746931c51243c9d6dc58fe9d2f716b2ce7
SHA2566aca7f9572d5b399a6e5239ef17b29a542a4a427783aa82f1ec6492fc6788276
SHA51267d1f3d3d50b86b0b83bc7491a8d05a93448fe20b4ee6b6be8970ea6bc81dc6b5a4d2d3cb9da490d691aedcbd714186d525e4ab6ebd1c2cb3ea4a21fbef262c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e01fd02c6768ea7a86553eb17d7912
SHA1912cb84fecf2471dbeaa4f5213fdcfe836e45c8d
SHA25647d1bbd11ec75f3f4205a212c54ccd91858554201122bf9e689c29173e070ad6
SHA51271fe98b8bf3097d52248ff8e7873a47ffa877b11bc95305fd1938896839b6a2c8e76648d14e70a2eec13d56be7b03326560416b6dc1096e4eccfdad30e641835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeee31258cc37c4a33e3cad82173a769
SHA11e35d729335c7aa7b61b6c875c68972b242d7df1
SHA256e246fcc0eea6f8a798649a235589203e2113a37bfce1ff626e52d5171003edc1
SHA5129a5cba0898a455dbf77e13d9946f7f44e134257c958c2965a6b3163248a870e0143d3fffd30a113cff64ac0c37a526ae14d002cf642a6907ce4d9f8a9cc1f85e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf20fea5a26eaa2f5d4e65dcc0ce7fd1
SHA1e810d096cccfe673a68292273487061164f313fb
SHA256b9c65e8c867fb6b1085f0861d0d5d95b6250fba6c0729af1de995f92f229da25
SHA51293d60fb919722c8d9c21d8a1cdf0d44e5ff6c26158de93a195da1bbe0eb8794b70551b1f37540cea3ce0f2b096d646ae204f560dd1d10ff92a9eb7078dcdf08d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a8cb8f8e00937e73662d8012a4cd8a4
SHA1b014c1f4778db3e282d99b14b7b0baf41d7a6d5c
SHA256214bc4a3bce873f9f229a81743592c25cd00fb5cbb512a8d90198590478c6dd1
SHA512dc0863915635460376f09db49ff8d8e91e41d869a5c42fedd3d1c922bfbc529520243604e22f2949c918cb056771d2ddedb00fd1f1463d7072f4341bec7b4d00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c60c7466bfab96aa47d33fccfa5f92
SHA1cf8d3dc717472fbe6a444578a37107406170b1f8
SHA256ee9b490737cbe287ae63f6a154d008466cd78ff7f75144bddb21e9f21e52f584
SHA51213d095db130ef9298b43a743f16d1372f96422997ca4a89ec50b1b0b8c60ce3eac4427a2cdd346bcd53c93d90469f3a6aaee6075d92819b814f8281b8c862058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530aeb17daf247c7923c071ef6bf6d8ed
SHA1701840397e11683bd161e74d944df4a0c1fbc1a1
SHA256ca709064d6c145993b0cae47752399f49130337de602a589481bbf2e63abc3db
SHA5127c3f77a5308498cce210efac3960586f20322fd423a0ca58fcc2187c055f3aa0699cb2113afdacb5122568a5804131a166c639aefbb29876531b8eb2ff11fe01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6debb3084b7d8ec3ca60d947b1e548
SHA1bfce789ea62ef951d47e1b158ce35cbad24aafa1
SHA256603e2e7de719e09b654f7c44a496750aeac8f16e2e2ad643cebe325c47949887
SHA5128867d17bb081757ce4285be92cb2c8852b9456c2ec19f0b7a775354611ef847d7c8082acffca37b2f0d3988afc7b5c81a9dcf01bbc213651fd11ba38aef7269a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3510709d783a923b253ab4bd4c3ed26
SHA11cbc648f90abea0acc93e862b738b3dea8e7e4bb
SHA256450f66fe3622653eea963cef8f4debd2dba49d98ed156ed8e3cdaa797337b2d6
SHA512dac39f06dc771ee01833f5373d68d384efb847264ea8cbfeb36d94cce21a9f41f74b52d30169035300fdbc2682cf98c926305f7909d16f266623c320cf8e4970
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a