Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
66257029773ae291f5d47f372e048d2f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66257029773ae291f5d47f372e048d2f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
66257029773ae291f5d47f372e048d2f_JaffaCakes118.html
-
Size
2KB
-
MD5
66257029773ae291f5d47f372e048d2f
-
SHA1
a485fbb3a327613dbca04cbc2348cf1238fb8107
-
SHA256
a985d1b1a3003b8b58c7ba831842f76ca18f0be318065a4ef4e243791f7669f5
-
SHA512
f97ba80732efb5bd06f20f166e9feaa7e7fb3a9d39bcb717b5f6de464513eeb05138029367f9254ecd5a4c219a11ff681637207ceebf7e0b555da8df23a479e6
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422517368" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A325CB81-17FB-11EF-805B-F637117826CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e6c9389207a51dbeefd580283c9f596dc398e74358217146b3922a280e303588000000000e8000000002000020000000fe4fa4a7f70978c2f1bafcb4bf896a03bf38903a62836ab8e0f89f4dfa0dfc5d2000000021a0241c61dcd52818283d097538cea2ac99dfb65ffcc9af36b8312d142fb55e400000006a52b4f94fc2e9234d09a9459410eea709337789ec0fdf50d526bd7dde67a67e963acf7831c01a6c70871c3d1655935eb98d5411ac13a870a110951f25b28848 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200bc77708acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e895808f0f8bbbbb3d7d132b61551c1965b95f32c1473c0952f58386e0a900b9000000000e80000000020000200000006cc91cb45fb06a18b3dcc863c22e47191a2894c220cf1f4a3c9be3e471b7eb6a9000000092edd1f5e1947fdfc04d1e7626b0aa1b35aaebfc9a58cb16be25469281bd14cd9af4f0ff33bde5eac421fdb409b1bde3016aff5dc39d198dac5aeaf39e5d94e2f8f9c0f0a7c874c6a88435273b10eff90f8202873fc9629597fdde0a28c074155fd0837c2f8f6e61af6fd0108201154db9fb7e8e189dcfe7a75b7a6a89c0255d1413789d3947d0f3b3d7d3ff0cc9240e400000004816db0fe4307e113178b8f2738143f95c0056a7ceacd55511857947080fc6e0eb2ffa5bcdeb9ccb0159e17f16902aa43aac5306c31841d32477680d2f269153 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66257029773ae291f5d47f372e048d2f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fa5473190823d9f6da322cd2781314c
SHA1689fbd377a81224d3a930f719c61cd15784143f3
SHA256d3613fa1e5d96243a6e33d68486eedfe95a48f213b02bb8c43e9c5f33e283a0c
SHA51256e94c426e6656a953a2a21ea1f600fe98537772eba30313aff8bb8e34db4f867de1c4846c3f101965edf01cbd727b643c4cf066b5f524e78deff456618e248a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5492876c0712aa6275d18d4815666378d
SHA1017f8dfc282b40e4ba64fce0738cdd6ab76ac2ee
SHA256d517afdf914a0ca0e1946e61feed9fd0eb8c0f88635308c2a278a9256755773d
SHA512386b4d1f166ed29c964accf58d9a3af933c5fd60fb9cec6aab33a0265633b03ab321c7b284f33159a9664d17084fac958d601f148db31c96470bacf8eba3ad9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f451d2b9de538a4a2eae9352fe5fef7
SHA17f34b3014cb48539344c94c903cef54223c33888
SHA256dd3c192951c93986df16dfebf74ff5bfa5691743f092d93107de848bfdf1ec25
SHA512b61d81667e49e1106b1cf71d965be3c6f4e09458e15b354f2fccf7ec02c530887bc89a313a47b5ed96f8b813c55b3bb049dac4a984748469500dff8516dcb85d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f3edcfffd734dcc49a77769ccb3a324
SHA1f07e08add2498a9b71318ef672561c8d9102e444
SHA256ecbcd1790f9de2298d29159c8340e2bed3682086d8c29b6d300c9d552fe27834
SHA512ef7004f7fc21683636d0424821ea0eb82b31ecb73d75b3a8675487e0d9ca3637d9e09a65a62fb20699c84401dc1670011fa24f2e35dc9a67bd2012d502cc29ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5028147ba0c64c328759db42c34a7e009
SHA157d271a95f384527b5412a3f50e5f8fe464b2612
SHA256efd0b3cbb7236467c3d79f26895d7b463c0c97286630e0d2bea6cf3bad094953
SHA51252f27c22e99aff78c507e9e0f484bdddf932be69deeaf9a548a3409af2ecb354aa9555cf9cd6a91c639d9fb3496b5b3ee71cbd96fc14517105f290366bfee5b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f41d7dadca6b04b2b14d8e963893f474
SHA11e1988402d267eb96bf5bcf055d244280491db36
SHA2561ef3d4b5cf4565cc65efbd1e961934ec53ff75153cfdb107d431a0af177e71e9
SHA512e271c5090dd8cd8dfff68f0a59a710122c1bbbb8af158ec7604c1fb0055b78f1b8f3016eb518aac231c84182338a2c326044cb6b6cffa39b98ad0f02253d04f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539d8d699e84afa6ce982709e23432b72
SHA1e96f2ab173945870f80331b513f3a25e465cd5b6
SHA25665afd5cb8555e2c6d444a37db86345f06de2156ae6a73190cc0f10462fd65e63
SHA512b336767f285c921d37b915d552c49f302f3d4b9ec6a8ed0c8d2300844d0a7095e660338d5a0906be68a409acfe5039ecf825e290ee05c9f338b50f377b8720a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b535a1162a7d7a3b011b4ba35ed2ebc6
SHA107cd8f988edcdc11f4c04edc63014aef740325d3
SHA256cf226fb8d4070c5ffbd86f4af7c5aa0d6bdc85eee371375e1bb0cade49e81851
SHA5126da6ae3a21742187cc4da41ec072d2143b4a1a70b42bf667917f21d053e68985a0bac6455c7e2c25511ccf418df81a1abbeb884c2420f36ddc5c210f797b2fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538473e4bc47aeaa61ba5b2bb940350bf
SHA1c47d7214b47c8b478a65066c4608b948c632afa6
SHA256f094d65cd5a888e2d472c6cedcf4e7bec1a90789e4ef9851f0ca484419222b43
SHA512ca29e54e558e7c439a9adfcf804e9dc656da2a85e6a73f1cae144a861ac0e96df65f0a9d4a023d546b8f044fee681891b8d93bf7f0acaec459c7525b8e8071df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e614d5d0cd4784ffc50fab6b21ae4230
SHA1906ccf53a1ea2d659fe5b42c9ac9535dcdc667c6
SHA25673934dbd268aabb8043d08307e1c32fc0bf4d42e504dad52a72b8a658881c7ef
SHA5129511ae676e17c63d81262e3c22d3e7027c0718b8af19ccffd8d2c379a71d87f4fd6d73096d421b8dccd5f5cc7596a33b9d93d24bd356ad8e42a6c944eecd9d4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bcf9f658703ce8237ef0cfb800e1a13
SHA1f5d197f9dc16ec90ab7e7619e0c87a9b88082edc
SHA2561026f1a575ee2fab8bc02ce9c99720a1ab282c8f1a5f77781e8ec185021958ee
SHA512ff0ea675d22865ad4c936895cdb64b4280a4391cd22d60b99f212dc3372cb75f2057ccaa33b53892175da45bcc197a978c03a74506c470ddbec25b0ee0cdbcfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe5da43a9b8c7bbaeb0212611432d044
SHA1012d6a32a2f769e44bec99a042222587b76663ff
SHA256e75e40c3b191161c9e32f73a2c53aa95b2d6c440889501c8d6b4c582c15e357c
SHA5124fc82b6b106d62e432aca5419c62dc3ae8cb28703b217f02b05def1bc14ae1b3580ffc0eddd31ebda721de520134f8aff08acb559f719ab8eb16db2fb5e087ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511179755610ef3e4481e5084f570cd7c
SHA1a78b5a02e7e9c4f79adc5ce4b7eb361b6a5a8bf3
SHA25641cb47b4528524502aad536efffad0b5ca8d4cbccf48390b382e1442614a960d
SHA512d157e491a2de4a06c463db3a412afc6968a9ed260579b65d2f4b9053308c2a20cd3d8d41910026ac3c78686ae7d98a648c414efdc0e401d79de0938a6f375776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6ab78420f6eca8de0f05df6bf640fff
SHA19934036a670349e10d6668a73679854f36c0eed5
SHA256a0c045be5e61e14a368995032067e3d845e9ea051e1d4b9fb4ca6ada6ff6aa6c
SHA512998a70211baf7f4bc385c7353cdb5f8c5e538b5747ef4dbcc420f33d04893e23dd3ed171f9ebbe1e676d89b0b1fdadb0531221da63bd2dabb2b6723f10058344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a675392316515d31d77dd78426d62f91
SHA127c1c7ec80e6aa915be40c8ece1bdfffa7e1b717
SHA2565f7681f98b3558f8e57b8c1325e0f946d60ebc23372e083b3a50d40c21120aee
SHA512ba4f9257988091832b9d40b418787e7cc58fe3151a0a49bcff0932f513cc8d5abcf5ce449607d69714e5b3481337ac49c3b0c5ea40ad35865f5183aea6bf7dc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf39096623af53671b066016d270fd16
SHA13ab338eda280436aecdea10d5cd37f5a579469e6
SHA256eb82da587e5c6748ffe88075a890be48b9d343e6b5c821bea5e74a5a7ef97fa9
SHA512da36702ac47b57d8bb9a394b2464f571241f21232ec0339e85cfe2d3e95c13d03d931376a426df8578e83717cd60bf76723c35cfb9ff436695887123d75eeb51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59036e9ae12ca904ecccd8edd70894191
SHA130e48ec905ea192ddb9f233ffae9b10e6038fe11
SHA25675c40de318e7e25c18ceb4459d95baa9afaca140e50ba0a2c79535b0f08bfab1
SHA5128b2df6c95d64288187187c7ec62327791b3cea09ccd072c436435c1ccaf17b59b86efdb15eef7d4f0f909255d719bdce1c6eef20d5eb5fb70bb9cc5665b6880d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beeb7241e2a4cf496e60d4699490a73e
SHA146f1ad204376f0f9dcf99a2ef3c3d88291407d67
SHA256151895d90158a9794e27c807ce887ff0ef82b16d465fa6e0a4d7030c9ec8e8d9
SHA5127eec3f9855d361b92c0ffab73136d017797efbdc024bd50ce4b3cf65b710a8efac20877720bf688e191e99ed162eac5fa6abe9477852e2cd0a6e17eac1666d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a544549873068a15d4e28f6343f89f7
SHA18698318e8536d1317c391aa243fce43f746bc33f
SHA25601f160f484c04b82ec59a729accc882fad34d2976f9a7539eaaee83a8699143f
SHA5127d07eae972ab8bec2e69f462503fad9417a70847fea80ece80c4f36670f0a6179a4ec45966b52183d377bc9963722e65df18722615e42a120004913237b4be84
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a