Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 11:39
Static task
static1
Behavioral task
behavioral1
Sample
71d4990fca19ab31e9ec859f02bf415a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
71d4990fca19ab31e9ec859f02bf415a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
71d4990fca19ab31e9ec859f02bf415a_JaffaCakes118.html
-
Size
3KB
-
MD5
71d4990fca19ab31e9ec859f02bf415a
-
SHA1
11db23f85229aef9590b3574c5e44f0f81ba2190
-
SHA256
2398c3bee698b3c5ffcced34fa5ab884e08db22fd6622db8fccabfb536635f26
-
SHA512
79e517b37e3a2935672baebf7002f1ada75cf5b19c26f63ffe2738febda15ae449e6178c498db2d0e3e33c214e4cfb1e8e5ad55288d03307c44af26d88d4a72f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000dbb233a14bb25d2c78ce4ecfef874f83abe0531b80247de3585ccd143143747a000000000e8000000002000020000000e8a464871f1e2d24b6ceda8d73c7550eef9fcb391061058e6343638d4329bde22000000019b5300fef57ca4b9158461e37be3274b47651c633ae6c97263b0bc3d60314f340000000d7a568f643784ab662a0433d1f59ff749fbaacd3d093a41513d753a3391dddbd4150b7d287c3bcd57cf338649c9422c2d27a7111edeaac4b3e955302a5723c45 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c0b54d98aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008d0ea92f1b6d058df2bc0cf130af861b42b28f2cbf46525918ca689fdaa67206000000000e800000000200002000000033953f465d10e7b2afe084e2b9482b13359e1124e53332f9129abd287f88774d9000000044f611c23b09cf1816085dab3d000f22b217b83cf48a054156a21a1c097fdf5585e0101f2026be785754849377d9e595a8c691287101efb50b4fdf55ddf3d9eca20ba5fc39c615f7830a493bbac70d21f41a44d98764fcacbc7b97bd41662b6b6125dde685f74a3e64dd7bff72b41e31f04c320be54918162974e4caceab167aade3356aca3454016cea97075e2ddc94400000001ab8e63d1aeb8da618fe0931bd681a741db574791f8ed33634810b25411c19e89fef647d252f88e0a8415e5a8e88646da8de82a0f30ab29cab4f4dec20513356 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422799047" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78EB0051-1A8B-11EF-9A67-52FD63057C4C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 iexplore.exe 2484 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3044 2484 iexplore.exe 28 PID 2484 wrote to memory of 3044 2484 iexplore.exe 28 PID 2484 wrote to memory of 3044 2484 iexplore.exe 28 PID 2484 wrote to memory of 3044 2484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71d4990fca19ab31e9ec859f02bf415a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa59caa13af962b4a762479d8136abe3
SHA10df8ae26f89c6cb4bfccce89a918d213ab543845
SHA256c2e974e02ac32a62c2dc824e6e3b2c849e875374fec12f1ba33801b971fdc6b1
SHA5125037d0eb1dcbf4f84b6af0c13c67060bc1e956d045821761c20ae594cd0485d03212692f05f4596abc47688150b9e65db547795f585d48788f33b6e5167634e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5959d3d0483744292396de4ca817a2e14
SHA1a33635900e17e4f0be6178a7bef656036e877682
SHA256e33250203af180b8f28030097c23ba945409bcaddb7e273b7d73db942be91682
SHA512095d1e9348ec0e34c68b13005f960a05004cdab2b39fd70460d20297a8657960517fa0bc1619c01d0a6aa6687120ab36de4e9428199764888743196290b5c14e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f251ca00e5dbb2f16b8d7176b98eed
SHA18c89019d1ab52a03f56d063c00de4686c894f6f6
SHA256e0f1031fc8f5d2c1289318846be1bb46fc996e585d90ddc8f59506f90d936cee
SHA512a30d620c30c0d6c5f7347c4d169cbb0412ea493ab01afb75d08188608ff738506538595f80e81ddde081b4c7ff9f86e73218c0bdab59ebb53cce8a3c54a81329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fd6f75c01bfcf7d5ccfdd83cb6b4424
SHA167da5a44dc4f94458e8b39161283782fe8194707
SHA256a3ce25949ad9669d18e24b3e7fefa023fc7b8bacf05941daf07cf1c2c4c7a297
SHA5121b947efdd701771dab5d0cf3df86ca682f6fc5951b41d6d94a3d582383a74c73524d84dd32700aebc618e866acb950d191f680a393d31e38868f006bb8eac1d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526bbe991b8c051812a20ec4370398ca9
SHA158b418d66b99d4cd639108f102fb7f9240b08817
SHA256db45bd6cad4aee27bc3334feafaf0767b5e507fd572eba5af0f31cb3e320978a
SHA5129603810081593f64f7c2e5f18e0d2cb004aedda28d1349753ee9782df4f38b9f9a48cd054933a4a467ea64260d9fbb4f3f79fa15382555b49aba69bccd9c3db8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522cfc05d1161ab3e68e5b2c4cbed8444
SHA13513cf2b78fbd50752336e5a9aab1e7d34b561b6
SHA2568977132f7d11769072e64b7074b5903a05e10ccb476bdb9238ef07c420efd6b7
SHA51252bf39f41fb8e96855f6fba9f01429e4b703ec57dc63aff913d4ca856f84c339c87478a35d9562913ad9c32dc42f3391e9919af2133a725d054545fedf543d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c59e2d6e55d6a8f95e9298ae854358b2
SHA1835a1cb0b807ae7b94f7cbe01001269db3c88ccc
SHA256424bd4acd65c8f686687dbf08138e3f3cd907d8c7641c29c9a50e9d8c02750dd
SHA51211cee96e5c712dcfc8c4a37a8edcd61d9baf18c45e461fbd6ac903284c450eb70d59c36bb4c1f601238434422a19585b52ceb4ca697af19510dd5f264634b904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f45c80fb6b4d46fa315c1516292bfe27
SHA1ade5bd1d2653c62a662d8a44eb252decd3b23b06
SHA256ef5c77d5432db3c9693641fe47cc8c079828e330ef41b79ad156398f50a96d77
SHA512a328a4056772afffeb56b2473eb1b18957e37164735e4be8e7e3486b205c150284ae1c0a0b2dbfa723d03c3a9d9ba1dd8019d0b85b2ca26b91a75a89b22da3c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe9d7c203accc8a656068e3290bb7505
SHA11c67a338df18a6b5f9e8376f61624348f394ead9
SHA2563c3a1bd67b07f0524eff319f0645c8d1fbc698b7e32209d178639b8771c1d52f
SHA51240ee65f17ea1344c226a244fb4c281837a94b4851cccbb372cbc2da44f7a8f9e15ccb8b2d8026d6f90b5369d5ecc2025c03903cd9e68cbc63b7f5c3815e02f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b01ed87c3b7e047d9968028360f56183
SHA123770b96cc1a8bbef49e2c97eba6cda1de3492cf
SHA256749b38e45fb7c107bf5f36a1ec743b8ae74d7ed401e1a6c40c4e7e49f4f85b16
SHA512b65e271c6cb63f7293c09d0decc5166c3a99e961ea468be2c5f1520e6b0503546f968108b5ba03189832277b19a3ca270fe2ee479e7936915b9185e6584d37fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae30678616e9c0208323fbc3ddbebe43
SHA11a065b918f69c9bea3d66c9738cb3580cec16bb9
SHA2566f3d92e13151970f576b1b194375be4912e19730247d3141dd4dd65c8183d2ed
SHA512d9cbfd881c45342020d0f11312ea74e8722a1036a48ad2f2a23738533d5920374921c53bea652d4e7d07ec508ae603564474158633a67b4d9239f165c0e50996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d6b23ce3dbeb22117506353b7f6b48
SHA1018033d289395b6028e9f1025c5fafd36ea11290
SHA256f2ff0580b2661de2b23a678088094b3f587b1c8ac418c45ecb064f84caecb27d
SHA5128331fc07404498102c42fa171010b272c345b15e17d4f51f4ed0ce64129c396386865d43a20b9b6c5264efd9ba0338d3d4bebcf826585a949dd4c42fc6a5b81f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d814df3b5916af11fb9da11feb700d7
SHA1bbeefb581539bf14827b56a22d890f6a328e1fa3
SHA256b49872f93e46c251c86eb51653a49c823da8507cff57c03dfee7466cf8995948
SHA512f835731eac84c646e2ec8799c67f1f47ab876dcd97e388c01bf581d6b8655377203efa983fd6e5e95fc1b0dc1c2de0ff5212cd4b3ae819fa27f9bb2a9fb1e0fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e437f4b5e462a0a39da1a9919629b5
SHA11c3322a3ff5decf319571c6193ec3ce62072e4a1
SHA2563d73578647c83c5069be1b256b42e84210b594bec0809f464b8434053ee4440b
SHA512409e797784d3477dd61de4b8fc6b39a6e09b3b8faa90f3e10fc92d28908f22b072d6a3b35d495f36a4bc67eae2ee6db1d2c36cbe0f0fd5a23114f644e26d3be3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5487ff8f4eed1c163850130f64e0aa20f
SHA184186318c9796573f7c2f4677dd5fc85129ef6a3
SHA2566ec77426746d6be7cf6ec585db06ec7ea5e42384ce5b8a4322f07eac55961e33
SHA5124f6a89d8628154f09bd2658a90ab051538f16dd07a47ca82f2705e65925b77d09956398dd0218592f47cd5743aaebb9ad78c0450ad83b320a6833a31f6ed2747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f91ee0c085ec56fc80ec04ceeced612
SHA15eada9c7065c965335d853b87c882cbbea447173
SHA2560d6c06d9446b357603a81d397217d233c60472f2c573ff2a5c263cf622858773
SHA512f46278f2e374d9d6a3b5371b033b2a101a970e82d4827b63acc8975982f39a50c3b34ccaa92b7d875de2682adb54732c07f566e8891d7a91c9fc6594078e6a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9edeb6e16e3a40a8fb0df238395c659
SHA186dd750b98b94fa8b1c5595aa8b5db24b403aca6
SHA2562e0453726391aa494293faa6ac9a4261999cecc53821e876ff8c2bcce0178bec
SHA512df4c65e27f4a4fba5096f33438740935fe4664c21659e1d5e1e37726da22856d87042ac80d45e26c0bc57e88111353215900ccc50ca2143f6e2c5595275abeb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5188f7965344793675e477cf3825c9725
SHA137f8f4224ed929634f4b18af0ffe82dfce4da262
SHA25621d93ab20d69e5c1ffb9dd75a3ac3efb7fda2165d5cecf2f1232f49fe053161d
SHA5125f26c06881fb6f80f5411139e5195ac409a7ab7864a6eed30635d320b719d5d468974dea3b1d87559eb0242cdcb7030a84109e8a307d5e31ca173efbb4fb915a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a