Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
7725780d2e92c1bc6b80848d32c0a4ad_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7725780d2e92c1bc6b80848d32c0a4ad_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7725780d2e92c1bc6b80848d32c0a4ad_JaffaCakes118.html
-
Size
3KB
-
MD5
7725780d2e92c1bc6b80848d32c0a4ad
-
SHA1
6a38a5f6d1fa7e3f374de09e3ba5aa10b9ce3fab
-
SHA256
7d4c9f37124d05db84746075e94b871418ce9706aa0279b439318f83944a34b1
-
SHA512
3c6ecc07d86ff3df1c345c64009d4cf9cd738ef632172cd7ce17a803f0facbb6fbc6202582e3aa816f368d4beb648de66a69bcff0969b862e471fb03b3d6b3ae
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B177981-1BB6-11EF-8DB2-F2F7F00EEB0D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108cb95fc3afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422927497" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ecca30de45142085f9ace06f9fa81a5aafe17f43eff0695bd0d425c55a972ad2000000000e8000000002000020000000e0cf7834a7fec90f809bef728e997416bc1531d0332a1703b9dc55aa487fcc6820000000c810ce263c0b426f8e645cb98c987817d01d8a223f988c86791432a4f46ed81f40000000a4d54fedb03824dbed99aaa7a15bd1c73988170bdd8538304038e9d263d6324a4f627eead9b0de9b6fb86d35eb3716e2c343406b68b0f8674a5797a947f373ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001236c433e80fe9b379a199f87994f9afd359609239199596e77c7e2a0d482e03000000000e800000000200002000000068663694d91f9104e563a7ec570a2291a4dd9fff6069bbab68a704a897a9a855900000003400a0e508520aedd28424925e877746fb22203f6662ef0abbcb66181210937e540a9b12bea02d337b22184f167ae2216a35f53ddfb1ad6c6db81fdbabfb955b9778152c844eb783c86afd5499f3c2a1bee9ab4ff8b945fddcd2824c1053d59fea0a1f5ba62e7af9e3c23df170f73dde89a8fb33ce2330c8de1570a8659bd2f19b6f84b137991dd91f803cd6efa6705340000000b014478aa3f00dd391026a9aadcb04df8541b35b144a6d52d006789465ee4e1bff32143f83a7c8e6c4831e8405839f789bb3f53a7df9c920a64a81c6e7358b24 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2412 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2412 iexplore.exe 2412 iexplore.exe 292 IEXPLORE.EXE 292 IEXPLORE.EXE 292 IEXPLORE.EXE 292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 292 2412 iexplore.exe 28 PID 2412 wrote to memory of 292 2412 iexplore.exe 28 PID 2412 wrote to memory of 292 2412 iexplore.exe 28 PID 2412 wrote to memory of 292 2412 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7725780d2e92c1bc6b80848d32c0a4ad_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c544bd999b90343a280f96ad770459f4
SHA1e88cba09696bef8b58ad307a4ef7a0fa70022285
SHA2568735250286fa0ec918bce16ef6c9a6e3da6afc238f715404c86d132ea3ed9284
SHA512f022590c104648b180457047751b0ad57c66b27b98b63235e2375e2637cfb3325d21c143c6d4b647989848264047ed699ef133562286f6ccb1a9517242603bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a602ed513165e2a4d211206d3f5188e
SHA176ecf0c470bbcbc2bbdac8d1f46ddff47082a251
SHA25677b733b807a25f3edac6a4e0a9d1f47747408efd8a2df40362e74f37c7d1e6c3
SHA512d14e0a794f878c4688e7c2f7e6fe205a2c10e57dd44f8b6f4807539a26935918d40465d8703de6026857396b3a5709b0287167ebc5c4c79b5be447bfc1649afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ccf0e2174a91c42da4b0c694421e107
SHA1012b69e9e43c0bc4da75ac5e13c9991546aeef35
SHA256aa162de81f011eafb879788831b5c951bf6a6a9f7e49c5d222bf5886f90b463e
SHA512481304dcdb9fd9e5f7a182bc001e476629b1110c278bc2a9707b4e5ea002c33dd752e1093db9573f8b85af3c397a10c476f11cb4f6fe2507e710fddfb3905c5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5705b6b924c7837f1382768abc5c0cc27
SHA11121729671c7b268a77a93d37b9998d005370dfd
SHA2561f90d34a34d7e1217d21fd092a4ed5494dab1998e13519a9d99149fdfed2027f
SHA512e52ecda56e52fb364d9c36ceaa043d474a50764653b15a4f88c9cf8c8f64c5e8990b63aeda4cbd22b247cd2bbdb277d0bf881a238d4bb6a1bbf717580c54d04f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529992b345213206a08032f2b256af514
SHA12063a9c3dcca2240aabd925a46a7d27a4397d2ca
SHA2563a0a59c6c9571c0f8063823d6172c1b3a8ab7ae82db16283b80e7e5ea0577f1b
SHA5128f22cafe8d614b18dab52fef20fcae4c4670468039e99e2cf3adffad1dacbaf707bb58762f055d0d78d58f2133b4f703479210258d418fdcb72457818a424010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b6b209e8716dc02ca09bac867ca954e
SHA1e057cd2a1abd84ba99e447cf04716c14993b333b
SHA256ec0954f4a46108c54f7468cf7c16d54ce3a6ccadf648fb48baf9186842b3b2e3
SHA5127288e6b0e72f71e4a839c443158ddafec438462a5ea06bdcc4dbef7b60956bd194d50b0c391bfe6d80f088c071e4752f7cd2f80bf0ed3ef264b77fd1fcfd797f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a104187264f94deea875864317799a4c
SHA1ae45b19859d67db99e1f2de711c62435c0dd744f
SHA25615f702bd2cee6cd2ff6038b536be4558bfa42012f84b5c58d94ce06d6b5da43d
SHA5121c07ac70dba23b209b7a8a5d6ae132b0307a19cf397696c1557fb775c245e5168623d09c15869ea5a2e1ac03162361cbf57a49bc21903345d437d9e1ec823910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5963b024c99637ea07135d7869021deb7
SHA10faae9a4ffa25ffef617a8cf876322869e8ab5eb
SHA25669f670829e9af9f4ea2471288c2c16e17cc1e6d45467342448ac6464d142abb2
SHA512f62b9cd7180f9015d53a303bcd111c4a61f7a8fa48ede0d178958211eaeea6ac5d0d75a8142ab44774ae52e68450f4ad326883e0a8851337b92c1b8d3cee4085
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbcdd79ded42364a9159328c34e2edf8
SHA14b3d7bf6a40b6d189c28dfe5acafb311ab527ea3
SHA2565e0f957167cbc9a704d022351b3477a4a5eb37bf13d51c837ef3c976be53441d
SHA51239c1c10ae6e4b5f5827b4c5fe66dc207d1a30c74cf60942b924ad823c741acdfd969814ad1fb181a9f7cae5ca977f73b80a0ed6cc6eaaad946d1efb37d255929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c22ea4dc2da6d4458ece34c26e10b082
SHA1537ed23a62ac25b716984c20c7ce1bd80524c9cc
SHA2569c3212a55e11e59ef2fbb4ec1fa3e834ed0b76fee1151732b667c669e8866253
SHA5125b7aa5b8ba1def379c8a7bd3d5ec94f82332d2f9c68c0148b85eff9a8574ace679f074099c0b550fd65c0a27d2e3de3020df3db45cd0483f5dbf8eac8d1bfaa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f578810bf0a2a61c1eb020c171b240f
SHA102c4e85657db15fa96226ffdaa62bd023718f9f0
SHA2560829ab18854fff9dd5503dc5304ffca4014da996c87c2e04c1969df639b75eaa
SHA5121b7a811f5661a2eeee59694dd08f4601854ab882322f2ab6de72a67e20574fac885cbcf6e8a0071c758c26bece1ed47a511a6c14eac75c8f0e6d3ec0ce8518b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57acc429aa37c1962e891c925a0ea0e4a
SHA13cafad22ec2eb853ef5ced3bdaf3b79e41ded62b
SHA256e3c2505e9cee55cf4017cb65e179f242078c326b765b89967d138b77538cf75e
SHA512ebdb4380ec2166e12be6954cebdfe143b5e81dc130d2df61e9d07896bb9da8b6687723e99722fa664d72d273db379fc077779dc2c9c412b015e47216c8dbc0fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5230e50f7545b42597c1336602b84f3eb
SHA1ff27939ef53978b21485f9f42cbdbf68fa9bfbff
SHA2560c3179076d7b4ef014139fee4c49f5153a7bbee2fb20beb30c3deb801fddf97f
SHA512ea420a4b5839f2e72cff9d36cf6b4108ec45483a812ad18d4bd7897dbbed33baa41d29e166ccdfe6173824a25493fc270b0d18f606b1497316ceab67a3acef08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b33b7fbcf63622592eb5e8e4fbdea57
SHA1715c06025b1d129245141ad7c0bdf164b5b33871
SHA256c9521d4d93e00a02d0f6fb51bdc23a81e9272558ac4cabfe2e921ad6b77b6059
SHA512d33bae6654e7a14fd9cce16a23888d1fdf972c02c08b76f4429cc562a82226b9fd576364626598fd801e7bb9ea041e4e38388887a9d99e094072c0ebe7cdb3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a7819f511667f688b7b7ad516ab566
SHA122d930f1fb7aa86cb28510094e06ea055ec4c044
SHA25619d4c80dea1bd3b5dd6cfc730f0a4921dd442fd30a179f6d59a843c5cd2b9cea
SHA512d007dc053da94ccd1bbbc1ac3a62963c9e8945c685113b754a27eeaf2535141909975f564bad548f26e81b38d02a301490cbd065e5d555a50620dc179bb0bc95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f564e1f59243bc16d9af703460672532
SHA1e7a962bec5549b333cff9be88ae1cd39201a4176
SHA2562aecff993ec4568df339374676dcb62dd8c993ba15212b731bd265622f90e757
SHA51299af521e4f855dfd2a8d65883f412ea312c6c4a975b7b99290468530b17c43ef65f992b0c95841a46784209dabc0bc536f330908ec2f0a8b813c9473ffa334e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55897b8290b4b0e9163cdd361fce97669
SHA17a571115748fdf3fb70f3eefc0ef4ed2cc3a2d1a
SHA256e331f3361d6b3da515b0912bad89fd3f9e3158a936a09692894985c83b1c1dce
SHA512d1d61db1a1579353b6e31bc4336d492583cfa8e2afaad4244a92d89dc7ec0a06ef51fe74bc89ef6d3b32e3c9ad0fef7cb237c747c13187139cea34a0ec2e1007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540b4854d05fca89570cf57e489590d98
SHA14b32986a0d665b9409d88f5f68a5151e91436080
SHA256555849c3451e32cf6e12cecc0a1bee702c15967e380667db30826482871d6c38
SHA512a845512cc0331ae0bf94fb1c607236d742246b94f78b5eafb4e5f91285e359709705f4d26b414ce656dee08f22cb82af62f5dcd70a6de882141fc5b5e00b050c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eef71ed5d3fb03352a0d236e1f3abcab
SHA1c3f11b3f523b1cc944a931ae938c43bdb7690ab6
SHA256631d07903945c4282e27e4a33bf44fcfe64187e0839edd9d105f8115451045d6
SHA512b261d1b9cdface622b1db63ec0a2d8b0ef1df1a77e2e96bbea5ce46908ac04b9cd336dc1858b79a7663e904f9f2e7c03ca7337984c26c557ec92e9fee6d9023a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a