Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
7b94888f315033e1d7cc5e5d51ed809f_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7b94888f315033e1d7cc5e5d51ed809f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7b94888f315033e1d7cc5e5d51ed809f_JaffaCakes118.html
-
Size
300B
-
MD5
7b94888f315033e1d7cc5e5d51ed809f
-
SHA1
2b76ed1cafec000c92415a2c91b945ad14787c90
-
SHA256
6fb666204bfbffe4a2dda3a5ff89329e08731d456b7713e6b3fba3bc72060d3a
-
SHA512
597c09ef30e521e70f48d4d8fe1a07790fa8f6fb394f5067b52bac3147ed972d95e1a784687553a03a877b9786b81fdd3621ec98c81e85a6687f2d6c0fea5149
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003cb4be7d8c709536140f7bb3fdfb7738aa233a643f3a4071b5a1ff368e20d244000000000e800000000200002000000022d63b9d1e3f9e49d11eeb424f3590e11159ffab3ef3660484bc70f4f53998f9900000007aa2eea0c6e81c619e6905699f223c2594756ee25dd23552d180c25f4b37839fce0f6df5a17e4dd61b8f7a2414cbb9ce7eac96ecf6d31d75bdabb5e826f3cda7d48c0f3eb21bffe460e90fbc5d2ea89c45611b4bf113124ee229ded6297272db7173fbe77dd9e5d3c6a9a7ce6d2db1080d4c47a909e63fbe8e05ffa78bf35c26d6c7e2bb7927cffc39e20e978bbfda3940000000d4274ffd2ff99c5fb3d85a83e17c62a50450c900eb624f17b668e909406ef87bce5a15d8e8e95610315800e1e5ad6f21a7b5502364d4f9d8510ccc803d9e390a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423029684" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000663f9e3c31fb754d9a23935ed578cb296f6729ed8bf8d65dfe979dd61d8cfee8000000000e80000000020000200000007ce1353d908041dd2b808f2cb7040294959c4f6f42cbb5315d5274e4bb675b4020000000964c3d101327e0d49e365b46f62ece02122e755e164e642767af3e4ce38244da40000000e5818c1242515a0c0d43a2c08f53ff7d4970a7c3c81d766bd17a9340028b75f5669d687a0c24b005f054d95f1e992cd290ae7bf6167e5fdc7ff964534f4ee0b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b7234cb1b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{776F5531-1CA4-11EF-99B2-4A4123AE786E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2392 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2392 iexplore.exe 2392 iexplore.exe 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE 2160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2160 2392 iexplore.exe 28 PID 2392 wrote to memory of 2160 2392 iexplore.exe 28 PID 2392 wrote to memory of 2160 2392 iexplore.exe 28 PID 2392 wrote to memory of 2160 2392 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b94888f315033e1d7cc5e5d51ed809f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527901da70335f9d2b87ec55d54937a0d
SHA1236d1173de6d8a9aba04f45dda633fe7200abc58
SHA256143334a0acc9d71234de2482edc9724e78e5b45ee4b50d67b2813e8d7dc6cf8f
SHA51291d1758983ef450fec4960b607f9b26ce740d0da6732d427f589cdb1ab8b29525ac784a1cb465e6b3f67a7ab68b01eb887ca0faa0eed1b75991c38a1c49b7323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec593637cbc68482880777bb514554a2
SHA123121b49e3052a13f8a97bbe6ef52313c5ca12c4
SHA2567bb92a1f6748841c0c5b00a0da130cf44667b9da971ff79a2280ae5b067410e0
SHA5120dcb37ca6a973253324a7a3d78740c4e391413e88bdf071755bd9cf5e0772eab75ed2d436ada284b050bb34d05436ab89562b0fd9decf6d5afcba53197b4e146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5d912de6d7667aa483fdd4ada6ad033
SHA1205450441113b22e63ef95811237730b3bcab37c
SHA256d98fc54595f51afe3b79039c5ab05ea5b0f5fff2575e53449f4bf4aecb2f0962
SHA5121bd865c7868575e6b833839d5af140b11027e1f234a744cb83c359d5bff1952f5f719436dd961ec3a4cfcaf262f8d77b4d9469047ae5dfa9fa3e1375895bd78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535282c3f8afefe8e1dc66968196ce6cb
SHA13a28114b0df81525bf6ceb7c9f70a2ead6d57cb6
SHA2565489458947230aba0eeeae12861c6aa3c7f375628bf22de4bfc54afe16cb71dd
SHA512a66c1db49013c5cba46fc13a5d023ab27d6235e4e1484e8b6b08577f954dcb341973c458ba7e2d50be90552349410cb1a055244b733b907f988273e54b576e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5033683be7ac2b0dc6839c0985325e8b2
SHA124be861b9b9c8cd8e1716f906c297e54e99a833b
SHA2560337f41d5ef2b51f8050cd22347646487def0c0ff52f7dedfb52f51898e24925
SHA512724a7ea0307737da6a7c36267f649b00717a8928749cb3c34851fdfd426279195874393c03cce03a957156cfbd1480d808e8bd2d1caac8b9ba472cda9747f3b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4314cb416a1f87b28df031c5328d0b8
SHA1b16a4bb293fe3edb17b17b9f86242789115c4b69
SHA256516b618e4116bd3819d04a1ba023a9467ededc2c07c817cba50e1458df778e97
SHA5120cfcddde649a8102dd50cf3caf1eb1fdf6b5a810b6127d2a87c22541913fa021d00f522c7cdfc9d3059780800fa13321442f0f4f4e77ae40b63b089a1b405b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d72e641e89960ce146e9b9b1580142d7
SHA1c1778ae3fdade0286817bf037e0811209f6620dc
SHA2566d7e5e4d3901e94ad115c60b4079afe1c997a8068e9409182e6aa1c58c95083c
SHA512b7bb08d48d89e06ad233a6c7db8e7030938e9f4d0921a90b1e241d849e719a024dcb31fb756764188f3661462992ae081ea862ee757d11e27f61548675f151c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596a5075ec0e58bc0d3f4b3889509aaaf
SHA1f77aa11fa6fe622437a1d9f20d852dcf5d7b5d66
SHA256e997df762e8aa4b91ed679f7426d0f06592e30b20e51e6dfa3c5bd9e07ff2fd2
SHA512d2719461c4e703b941be8d2f0ff6f96ecafa4edc915c85c164e36def6c106010806f41b022e8f3e7235e933263906e47003ff47d639445e519d8aa394803ffc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b386def920e2a79ab4c9f6b30771599c
SHA1ecb4f025b490f84522adc409c80d15aaaa87ff35
SHA25681b95943e7f950efb520ab41e9065d57ffbbf6b0800f223e02ddf4937dafa106
SHA5126b742519d10f2be3837cf69e3a6d2444883ed5841752885bdb177fae03f6cf9c263410d320f190207af94d6b5a253b0c13dffbbb6d864326b3ba4043b5df4538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e50125c029f2d80c4a8b5eb0350210f
SHA1305a8b62a46eed8616974140179d32cae59b62d6
SHA25619299349b0f3486a8d4ffeb276af7aa1ac622a907e3f6f0098eca98f1d1956c3
SHA51212543f53f4a49f4f8662914927806237349a9ff161013155d7ee6a1372114aa3e1404c1212aa17e5f6b660719440cfeef01d1c6e9b774d44538f418f10f54c0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568554016c141007c0e08376ae370ea3e
SHA10ffe5590c3793833b2a41469445216516a7c0948
SHA25613b8fdb4a5c62b361ad1fcf0574ab578ea1dccafa3fa9e4ef705a47c59803235
SHA5129b3f6e4dd1ea80084393867755af87aed120b46c16879d05ac82f78ed6ae31ba9162e809411ba493d34395a730a9b9359d439fd40462ef54f76682c4ec257126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c787504fcc97a80b3272d5a296ec82f7
SHA1d1388e52028c3353c9cf72d6a9ded2a64921fab6
SHA256e91c7a94942cff1a3e0984515cc35bf51501a93545ae9e27fc7f3e03f0e71db5
SHA512915e6f43bf68b8934227386fad883a2a46bfb045e064dfecacabd732ec7d0958efd45a156f5430af1539707642311a1ed57645363695e427402a1354e8b46c7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5085784b9e351c297fb8edc1edb71c33f
SHA101f4e316cfb7bfbcc4b7d7abb7fd7ee79fe47d7b
SHA2565eb777a81e018df3e79043399c6e2264197280a7037fdba7ed15aecbc6b43356
SHA512ccc8ceab501eedb0bc3cab943abf9994a0f3a3fa74cc19ecfe6883bd6c0a03bf9454797c93423a5ccb668aedae3df43e0f807c126a2fd199db25527c415f5d68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f675beb581ab750df7c900a94e54527e
SHA1b8866590bd036892df0d9cd33201102694ecc857
SHA2568e029c9ff6161bb242bef696bb8a740960848239a9ff300facc147a02d80d39e
SHA512412daa339a9570045e0d0884935b329a6d18248cde2986fcc2036dbb543fd6fba8a5e819f1fc9d1dbe66b835e937c438b8928162383deff60539299c1f3941d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541ce40ebc04e264842ee9912d9325bf3
SHA15552a544770af9cddd70069be1af9e3a49d5ff89
SHA256dcb2292894ca1bf160647f3641405f23803d86411ea1a442ffdba5e39641af95
SHA512f5953a394029fc4251dacd16384dd853306da80b7d1f689f5d66dd953a2f9a85b91803b31d0ebc904a29a9e4c877343169406b29e7a7e18d8812cf22b1315303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e70e590ebbabab97921fdfa14ad5667
SHA11201405e4b9fd5c590b6c1bf922c4bfb3d8b86de
SHA2564a5f99732a8d2ce00006255af5764f665b44ca90b8db96b61ecfcb6c9b6d3094
SHA512cf5023cc613364860138453276d54ef0b7929ed00e4f19fe01393ef6a3a57c341b4e10be9c63ed1c3096b0042576e00ddc5907a7f9d39d11949cdc05b5b42acc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a2a3b105d4f50e2d5f264837e8289ab
SHA161244f1edb613c9cf1c9ae8b58a6f24357849d6f
SHA256469915672b62f1aec1cb07b6445d7850375124ce881473b108142a56165cf267
SHA512b29d1550949f3deaeaf30ab39c2893e7a7699b41c1718bcde1068eb4ad4aa016b04f3de3786781983f6644a9183996def3fbfc71a59ee13d4e07c6095774c33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50278147150182413d3b284639b730961
SHA11aebc0fdcad0c9ca7d4a270b7dbaf3e504563c96
SHA256e2923c90cb331bd1ad5d60f1462e77b841f90df93428800449d62fcb687f15c8
SHA512f17536bef5da4352245994428e0bd79254d5c440ded188b8816aaba3d67066091b5ed845bec7d22be3f2426ba63b8529007ca4591de811147b3a4b5aa978ed5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae1bc63af4424cf563254367031e03a3
SHA1db25c14a4d17cfe57baf0f661f57afe8ffb909d6
SHA2564d76dc2fcef7e328653bea1a6e7df3bed2eee735eb95be9270785861e40b3043
SHA512260efc31f222c40fb814e87d18a56ea330868ae81a7e65abfffb4459a1280b433fa084e71cd86054e95b2b58b6bbff2cc988064260d0521a0d9c6f99fd85492e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a