Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
7a15d6d3ec8403750d3102161c57c055_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7a15d6d3ec8403750d3102161c57c055_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7a15d6d3ec8403750d3102161c57c055_JaffaCakes118.html
-
Size
654B
-
MD5
7a15d6d3ec8403750d3102161c57c055
-
SHA1
663d555d0cab25d08f592abf745736081dfd3632
-
SHA256
c4d1b1f1bf19bc534cb60d8f1b84fc3b509a028f52f274918d59111bdbc93bda
-
SHA512
5220902c051dba8330dcf8918e10255d63c0c8926b2f589db45cf638a29953669ca787c34f664f319ed8693a56e229e4a6056dd279a6798e63a95f0bdbee9f58
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3a87ba6e56aee4dbde5cc0c51cb9e2b00000000020000000000106600000001000020000000fd6602d453e67e715c2613cf877319849aa94ac671575621bd63ee73293863d4000000000e80000000020000200000007873dc578c82e23ed165e3c64f2027e801322b09c2b3f37d7137388078c91df9200000000bba41e766da3b050791c938485d19c3f2b2c62dd749299ca415a7add3c70377400000009a89fdc46ec571a844cfd35dfdb17319fad23cf78f34a77aa3636acde65641dcafb1db50646538aec6c5170d663ff601245c9384bb783fcd8bac00a1c8025369 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEF45D61-1C56-11EF-8CD1-FA3492730900} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3a87ba6e56aee4dbde5cc0c51cb9e2b0000000002000000000010660000000100002000000010340a6e390c6540c75a9701bced95c8a4093a7904d87fa455228eba5c38e305000000000e800000000200002000000061fe427bffcf2d4c71158ef88307593b1f8e60d60556d5a9e9d7db2de4b82bcc9000000028b098e87fe7fbbbdffb57561bed5d00f6855e1de008ca7c10a489f42722d6062559bd218dda8a135efcd100c45f81ed3b766003c7fc3e579b2497b38050f62fc1f51a01e3e2b564f8d39254f1aef8cc27fa788c90cfb7dcbb1d7f49a8411779c7cbf157cbf05d86fc2066a74cdc1e1653760929eec6ca2dfb863c813da727fadd8e298f174bc50da622cc6503a3bddb4000000007aa5fbf30133575a47306cb825193c98b0617e507115e0642a9a11bc26088cd25b2add6122143792a42566bafc9961a7262899fbe8e2b78b49973ebb381cc7c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422996385" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308997c363b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2368 2184 iexplore.exe 28 PID 2184 wrote to memory of 2368 2184 iexplore.exe 28 PID 2184 wrote to memory of 2368 2184 iexplore.exe 28 PID 2184 wrote to memory of 2368 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a15d6d3ec8403750d3102161c57c055_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5001824beb42fd3425c7f7a0a4594c774
SHA1b0d5d9753555435141e9e4da45d19b211d56c577
SHA25666f95732ad0e6d74161791e0462ce540eb407ff9f68ef6935ba3b6c12bd9b4d6
SHA51267219cc6b3c618de196e72f95201306533855ea39ee5a383369af72a236d8941bdd38afbcae1de266b792b1aa831a6264e8418642f52a88856347bc52cb7caf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512f8fc3ea87e6fd4a9bee04406715a2e
SHA1399cdfaaf49fa9fdd4a526f89c821062cfe0d68c
SHA25646731ccbdef00a8d3cc5b011fc2cd932d363f742006fe7d29cc155e6d0b93b31
SHA5122e1088f35438dd85c3102dc348ffab9becb899f45b41e29c1cac8255697a1a3cb82656abaf658659570cd27fe2aba1d9f770a6709b3612a4d1552706920cbab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54665ed3e1963b84d869b81b04cdfc1a8
SHA1bffa0a4837bcc69b5cfbd987515fa4dd609db93a
SHA256253ba0ab6fd8f010257872373215ae572499feb75c336d1d2966654dc4749332
SHA512ae73a88db7a814fa52a00ed8a20d00c0d8be820371aa8beaf90195c4f537d85a573bd0633f34e36c355d8688789cb270d9e7a76e4db7fea91f508d14edb0a22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5166e5c8209f6ba5d279d12abbb8cbf72
SHA151edba1c877ba0fee883890a00e5293e57407372
SHA25605eb6bdc6ab41fb9d3d3dc84485743c9edd8bc7c956649e9c4c1116a0e440f21
SHA5123460c5c3cc19b43e0c0c1b721583ef0d6599f8c284bd464b4fa3de074899dd17492f61a19970d1d34a10a6a5fb19c77e8883e3c3b588093b8264f231e68d999f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5689a42e536741ea62e42413184a5989c
SHA129ca1a40ecda418c171a9bd5275be35f09f9bdfe
SHA256b4faeff9264af739380848603e7fa5e4e7d2b2c055eb24f5a5d3e96410c0c510
SHA5128888592d330b7085411cf8dcfc512e3e0e1d388cc345dd0c3989efb6c2609669f5ebba2fcf8b5a1dc7eaa4c10b6a07ed705eec2223d4606c3192e8a494f1a4e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d76076e657d8dadb647f165605146ba
SHA156d632bc4a929cc08e3ee9ca00d23a1f45c8c158
SHA256bbd6f006f877da51ec4d8e39b4d1cee1187cedff2aa50952740a17e31cba59e1
SHA5129eec7a41f6026af2f5e2c13f3aadae2cb7854810a422a5cd156d886b48a545cfe7f728a3b83a0de78706ea16f9a40bff1b2faa4ccac7f7787f2c758d6ce497bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5915f9b8b171b2f0fa6eed82c859532fc
SHA11b6e47038e838ed6c17e85ae0c501510dd11a6ec
SHA256d41a1dd8d838bf14c44297ec0f56bf42026721997a14fd38a7b02f0d4a5f0a0f
SHA5120c3086e37cb9b36f640d513dbd2bb72165603aa792734bfb8dc5bf02e3a592d8072bf2e671ee705be20f167906e213dd1ae4b9adb1e8293fec2ab2ec0dc4d181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c570407b676fd1394138044a53447a0
SHA13cb077c2b82c0185d24697e8a7f67b3d89732c8d
SHA256689d87497317fa6cdbcc4934d5984d8a8609fd61c7cc56fb25edcefca3e5a949
SHA51247f44318d568303380e57792d019f11d5aa00ba41e033b8146940fd69eb563586625b18caa3ab64432aa8c7b2b5ce2b76e4aa20c35f0d04daef1a98e05d219f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573db0c988948b130818b7eb706a8dfb7
SHA12630fd8d8cf8e5d1b9b967862f32a3bcaf8b5ff9
SHA25610485707d03b88b7b54959312b76b3710a197fcdbf27db3ed21dc773397c1400
SHA512810f725f0ae2ce674b330149ee5d7e2e05c0badbaf7812519d2889dee1653b7e251604d8bae815659f3faf2df04b0a3dd6f75f90df4099725dbce9189bb3e6e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bcc0dc4d181c22c81dd67fb4dd60ee0
SHA1fd7feedf86f7be207bf20a324993504da9e40113
SHA256ffb36ac33431c4e88608283907c23d9ffb73d68ed74754179e6630cddd9dc9b1
SHA5121e5cfce279fb4ada6ce66348c18edbc02d2e1696ce55cb198cd14e689a00b73ac2b288f7b3f67910a00b6e7dab654556e293958713d8a3804ff213b0ec885f14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f937cd65ffcabe444b3e75bbdbd0dd6d
SHA118af2fcce30f0ac18145c489cff1e62a6baa9ed0
SHA256bd7f93c1120e0c1ea4578b56e5a7ff2eb3f004dcb297aecf131b07ecfba085de
SHA512a447edaad772cade79490b6312f87b84fe1f9de9f50d18048e28707f8de53b0eb34113161cc25767d6c24b3ad3646ad85d67bc601279c7d3b9000249c3a25428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5387159ccc0c45143d0ce33d490a6cb5a
SHA1d13f7e223284198d1ae5047f93742f875281caf9
SHA2567e2fcc566d33ad28d31c9f3ba7952c5eae65a795352df9f1f99139b454138c94
SHA51233b72dbd9e45c4c6547b49aa6801f7245f62f9996ae8ca458c9f4a1a68227fbbb378aad90e0fbeca5851fb1ab64c4c3a34b2a03e1ca4e189e9bf402f1ad04ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ceb44fc76040c6770207daf4d428fb
SHA18eb44e98c1793f86ac8d851ae6880f82e36002a8
SHA256d8582158d1066466f20af5d6b2637627904a66bf54cc5193199e8cade3577b36
SHA51284880f700fdc54f0bbe81b45fc08ea4396d8957a2a5efda61ac10396412dfee30a33eb0282014b3afb13e9022f7ed5ddc56839e11ceef920b1e05590aa146398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a58e22ad79c5aa31689a38737772a5e1
SHA1337315f007d7561af9f7e652d06650e727c155b5
SHA256dc93bde14bfdb42bed5d41aa1d17d1e88069946c51b1473d5c27cd009d25ddac
SHA512dc1cca9afc9d7fcaa7ada55f8a5c5ef7aab1b7dfa63e0712a1bc634a6626a0a9f0733d148675e3b8c286e79458c856b2360b4bb6e130b42d4f91fe2476b24cc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58edb105d1959079e3b12925650a67dbf
SHA158c0a8077c3bf1817e2c98dcea018551992d98dc
SHA256ceb3b169df1bf9f358a5cb79bcc7c13b54888a971e431373ee00f982cf43f57a
SHA5121dc5e261af8f0bcfc7c1de9a2ddd1e8e8f95f454618493f732ba233059dc8b13e898bcf63ce663f713c97af0f0c53569273f09e4851e7b188bba3e4e959bd928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b82e2ad071ccb1ec15f9e6c827c298c
SHA19b98bab529b2754adb7782a0bc7ec4a4bfb82476
SHA2561a776d5e81a4e50f58a48a39cd2112560a8a9e35133a031bebbe2eba68d0462d
SHA512868d5b42f9d488ab1ce41465a3d57cf66c790f5b274f871c2b58c72ec9c6eed89fd187becc193f95db91c59564ea9a74ac7e62d7e62063a103ff85326bf65c43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54010b8db50925b9510424cb0f8282915
SHA16811ea3d7a8caa79c7252025ffa6d49c1cd5a95e
SHA256c3edda8a38497d88158fbe0d07b4f32d414dbe9b4da0134a74812d34c4ff6e49
SHA512940f4c6054f5b709d1dbd220b081dfe09209e501338617024193763bad99524f88474b575525422a806a8dce239be7a7d8d7e71392e28e612660ad60b36456c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543cdacb3eac48b64dfec4ed4416af1eb
SHA197096ad626492de3f0ac2827f546ebd2aba9d93e
SHA25664b6dca8935a9a4ff8abcdea7f96cc5f11a6a5f6a72bef287fd1cec81373fa76
SHA5124aad20fc4627ca1c910e6312d9a76190f392183f4f86080ff5b880a65b1f000274d45768c23ded9abd294d1a64d93655cfaf3b4746ba50cf2c1c2ad6879a38d4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a