Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:53
Static task
static1
Behavioral task
behavioral1
Sample
68ea3097332249283dfa1747d5bd1dd5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68ea3097332249283dfa1747d5bd1dd5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68ea3097332249283dfa1747d5bd1dd5_JaffaCakes118.html
-
Size
2KB
-
MD5
68ea3097332249283dfa1747d5bd1dd5
-
SHA1
c26f47d95a7bfff600be9e06fee5f654dab89559
-
SHA256
06b64dd15df9144b1437ca773d6ab00b8fb7ecfd7808ec7c354e1acbc3670587
-
SHA512
e0c30549ec2486e92acb5becd2e86d355aa485807e64ade7cc979d6726b500ba7a63c8493b2336a5876bc232ba633a18e66c2c3fe5ad6327e38881e8ea962a87
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422580274" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1974AC11-188E-11EF-83FC-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04d14ee9aacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006cc2f61782b11148a81e0228072baf0a000000000200000000001066000000010000200000000bc7011d5098a603b2358439fdcca13f06824fc2e97992a6b77c0935da24414d000000000e800000000200002000000013742fa3e6a37dc15a2907d4196d062f2967df84a4398df0efc6543565caa78e2000000029223bcd6d4ef43cbfd0a00baae5be903ffc851ef8b5812e57aab1ef3dee752740000000306f128552bec11cd126df595dd9bb56101aef08908df67b2e1e74ba558f11ac5a4422361e21617183297bfb955c8ca53061454d0c18766842610b3fabea3ef4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006cc2f61782b11148a81e0228072baf0a000000000200000000001066000000010000200000009baa192bac3f2216e9855714cdf74961868288f8b36ad69f025938ebe58b3d95000000000e8000000002000020000000fb4abd24b4df7ec541eb411a29828ccb896cc5e91629aa7e538cf25ed809ab6f900000002ed16195b7e81ee43c4744ca6cb1acba0e1a29063c6f04f26c929d9da3b8edd1891003d0ea50bea3ba48770a10c50bf8552a76272789dc1cf2eea316138f0b972f14ab846a0902ff10c6d9c78039f942ec303ed9297e2fd754fbbbb5bfd6ed6f347e790c4e7e17e6e70b2ddad9ab0d011177e61e0614f29035547a9e9d686dda03bcca0d6c257d413147eb0c337f861440000000c489e8e0f6e1cb24d65d393707a237565ad145d9479bc6c4d0bd7ce66897779fcbd1982d0e6fc0556080c33c7964ed925179e4d520390f408726fe4842515010 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2696 iexplore.exe 2696 iexplore.exe 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2696 wrote to memory of 2224 2696 iexplore.exe IEXPLORE.EXE PID 2696 wrote to memory of 2224 2696 iexplore.exe IEXPLORE.EXE PID 2696 wrote to memory of 2224 2696 iexplore.exe IEXPLORE.EXE PID 2696 wrote to memory of 2224 2696 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68ea3097332249283dfa1747d5bd1dd5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a201aaacbfae948d77947d5ee64f76f6
SHA1996200f00b8acc5bd0a0077cc1532b49058d5b1c
SHA256f04cc9cba038386b652803328bb501877ccfd3e0dc0629d0db20c95d4001533c
SHA51246d7d309126633d3b01d4f9888c487a2bdbd52b8197f80e7b12222258007f134feb70a09b0f40c0dab7d5b36f46944e8f84061860d59f5a41640273b90bfeb59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509a4d3779cb27a9b62ccb3b3042d6838
SHA1c7437197678441cdd566ad30d3165b716e66701f
SHA256b40f34cac3ad7352ac08b59779cc1a5298b904077839f69d41177be82f3c962e
SHA5127c58637830b788d4149eaa2a74709db1062e29dad145e323b948771435492b05ccca7c940f35767de96c955750f82c24762d306a3993a7d80f1e89ea52b501fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f74e67d9bce748828ebead1bf343c165
SHA10f423c80590e4807dac75cfb4acfb7daf4e1aed0
SHA256c081796a3800c4de1a2783005a23219623da01d2ed01a2097a5def13ee416fb2
SHA5129540fe3d35907bdd6e03add9da758a80f5887619d5d71014fd734fa327fac325d312eb97024dfbd379dd00bb2b7a4361007466e824d4d0d82e9957e8bdd1f682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d1ab7297894bf882ea6de660575d32d
SHA10062ca56360106359961a5cb91897492ffefb39f
SHA2563a528d762339988a0e79676f9beeac0992d6328d5a1fd6902b35865107a6cf07
SHA5124ca1c017ef9ab7c0a9ae4e31214b7d6bbea91df0d45f2ed8523e20613859a1955b29903106140f75388204c99f9abf71f966a56f2f14c9e92fbac40db1250d25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e9e989350df041807f2106aa715bd4
SHA180368b9f402a9a6159bf670828376849f3f761e6
SHA2561077feffd8453fa884fd9c2280f3dc867a55af66aa3eb14391258575559661b5
SHA512fd4b0b690dcda6498cb96ad2eb8f09b38ff8f814b9fa40cb1adaeb4bfcd9c67c15ac7d3acab8c6e2cf7e29d3e6172fa457cc18b4b24022af888c0a08b4dbb4a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5507fdf5b8c68cbe3f971bff1fbca298d
SHA1507cbebd3a45d1381ce218ef1fb98e6d013f2aef
SHA256ba24392d3bf303728c881e1c766b65a4c132796c60531dfc41921d8a91541823
SHA512d9577060777f00db687ae99cf3fbb4698e485db6b23ad2e04df81b0cdfb2823806a7199e07473380ff79ed2ba48f3c4cedd6e4841e5084dcbe43a0b687eee795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1840f008b485a0ec32f8c1c488bdd52
SHA1c2762b51cfa20a5398e3d85fb869d4fe75d7abbf
SHA256479aa69e294a48a11de385b6ad674e26c3d89c572bbf336551ede0e864c8f146
SHA5120217281c648fc4f3fb03ef18729ebfd1f80e6d39c4f83ae74a635cdd9e31c3e35ed0ff923eab239848b27ad97534c0d54f441b5e64f82671bcacba23696c39e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a64e59743eedda4e314efe785310eaa
SHA1f231aac8fe340999da23fd29046b0bac542f50fd
SHA25659f018d13aae2ca314d281731907dd6a3e46d5a77f50483b463817b6ec1675ef
SHA51235e1936f6cfd347afd14cd09d678eb01bc60230c0a4085ea3f73e7476aaf1f9f863159b438985962a519fecbe482823161a709396376e4c5cff1fd4fc71dd04c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa61ed3877dc18fcf10765bd2f97c981
SHA1b0c67c30af7cbb1b68ba7f7e39d0baf0ba16b328
SHA25645cc4cc5d105fd936346ab9aeb95d6e875e394a41fdb25a07664d39cee2125ab
SHA512ed353e898ada3a23fb15a8b892a6cb7b5e835f05f937d7b9936ddbff288f14b20c1d7cd554484571c98854afde748f7e4b94685127c039b36af84caf4e7d6661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecc47e34a26390c169948a85c948b94b
SHA1c8aca39c9693212cf1efeb92ab184de3e3360ff3
SHA25673fa91b7a6c58e8aa01ad23b9a9f57105db321252b84c82a267e32d641db7f1f
SHA512f146ba29bc37f4b73c23564d2f3d3314b4a546361b90951b6cd601079283dc6cfad73ad837cd7192c4a27d9799a8a5e935fa6c439d3d8ed376723b2c65d34542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536970644fed7a5a2bb009b9e9ee3f1d8
SHA1bf0681421ba4da7236b0a7e7981fbee836884907
SHA25641d7650d7129befc15b8f2a811eb37a79062eb14b0c05772d63d6e4776e1bbc4
SHA51210e153d6cf57518ae84aadfb9817360348bb61266cea5ed63d6c175708c58de151ea43989339ab8bf5363353c20d3a8212be47b401bd33cbcc9bb17fed832759
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546daaf95442a20c7c23da5adab307cf8
SHA110423ab54af395396f4b918cdae2d3854c360fad
SHA2566500461dcef8d579432f1d46a8ea2efa5e930034ab39210bbb2c0a17f7b19d5c
SHA512e7cef7a04561fab1e866fa8958a3018ffe8abafbfc9c9c231acf5a1ebb5711359025c0fa5ebf67ac0117bb40995759be02b29481c17b82a1ffd8b016254793c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e38e8f9e1ede64be3bbd673e20779cc
SHA1e66e6e4b63f567521b9248c89ae0d686d9588ceb
SHA256084a53695fcef12e6577db7593b7f0d58cc2afc43f46fdfb9a9d39729baa4fc2
SHA512428b65b970f4e8c992589597c50b352ed3a87da22e9817b951fac3978ad7d328db8e34cf08089528decc1f0dbaa2707561032d40c5866da5326745d2a69a204e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540c93e0ec5ed94d46dc6d7f763b4a5f9
SHA1baeece540fd4ff57d8073e5fca47e15a178f8a5d
SHA256c3bd3366b165af4aea8614f00f8d26c3cd59b354be0583a876251621e53de1c9
SHA512fe4b2fe99f3b30d84bf490c4435df2fa039ab9c4e9f0e732baab0acc9a78e936bac49ea8116845974c46114f45a9d6779b36202d19132be85a8149b853312719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8863fc4b9aa56fef9fa38585787904f
SHA1b55600d5a8dac4a87581869a251d3ed5346f733a
SHA25685297bfa15b06abcacb760c35d858187d4202a9fe1bc468732bf323425fe79d6
SHA5123b28f48eba2d1567333a4c590f6aafd50d6f9275e2c44f0543752763fc156402d892313bf4ee97b580db254363c4cc4c90ebc63c93e152430b825cf91a66ac70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5414cf9ac62ba17c70e5db95ba316724f
SHA126a46ea7c63a31647fa5130bdb7cf385ff5af80b
SHA256e4faad52cf9819646e38bc08119510326055ac6bc90855350ee27387fe27a42b
SHA512f0d365c29078d4845152f3b55189aa0dfdf0bb595759ae7c22633b834a7be90ff6cb9f13bea84cc2f3be627d62c1107a03d1aa96d37f55fe6c8c71876c93a3a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e0c45849e249c1e79c50a04a813b372
SHA145b4362d9fc5facde48b8acfad7bbad78ee3fd2a
SHA256c2c622256a07c393964315619080e482d2990b26f8b381ca73e9c32615336338
SHA512e709f6d96815dfb6f9539f3058bc869ee6473104e8727b0193a79f82d8d84f03615b65b3224a26a70f68cec892a8ce2f57f5dbc01c39cfb69316965074dc8296
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef76d0db3d06651d269682e0462e7a22
SHA121d37f84db31c7a2250212d524b56c24d17a9bcf
SHA256e825ee1761b2ddfa5f5ec1dab86fdfb166dbaae0021558e81f75e8ed4b50a811
SHA5124571b3231f118d71625f292f5cb0bdbbd067a2f1e6f1986c4590770d90a7b3599bd887989025f01ec3c70b230b83a66d7dafafe0ccc87ef3c35ebb57ddd3b9a6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a