Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 06:08
Static task
static1
Behavioral task
behavioral1
Sample
7bf72d45faa9ec45b739b198e0f824e6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7bf72d45faa9ec45b739b198e0f824e6_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
7bf72d45faa9ec45b739b198e0f824e6_JaffaCakes118.html
-
Size
879B
-
MD5
7bf72d45faa9ec45b739b198e0f824e6
-
SHA1
7648be871e3cbdb4a860e692c843d61d51dc9816
-
SHA256
2f7a5212531748d6f68adb910490fb01b15c9806a6bc467c4747c0b6cd2ff940
-
SHA512
bbe77677e87c05729670ab3691af08aaaf0da50db78a8946bd4cb4c83bb63eb0fc6b4ffd4b6e899deb1d49faa6a2e94e06cd21421ffda607dc85f1d8043c513d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07ff293c5b0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423038396" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEB51F61-1CB8-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061bec6250ce3284f855dc88fdfe895d500000000020000000000106600000001000020000000824dbeb3ea15b58a3877cc086b0880b2be9d9ead56d2b5b96a70f7363a1dc8e4000000000e8000000002000020000000311791d79069befc0be56dc304c58c1f8f016a504c9ed1edd131560cba79c9b6900000003da1974335843960128ecbe63a5cea0ed783fbb67d161f0ee4e27bbd53b419f679529d7f52f3efd7e7937995e94a4a2a81a9be12aef144f46bb99860e2e335901208d5a0aa7bc49a56c39d3731b999956e530efa5d084dde4d53da7cdaf002b6a5c2fa479ad10ec3a6d3a280ad26e09ed824a9126c71fe15b1fd6775ca0f8a780b5e7d73a1365552b64197468ca97175400000000e51b96f772f2ad2d0a4ae5445b1bde3accde9b79caadbd60eaea413c6b81aa03652bbe1d3bb4c5d9f1c6e4c0eb3853e1437207c2540425431cdcdda247246a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061bec6250ce3284f855dc88fdfe895d5000000000200000000001066000000010000200000007167300f1766b1ffb5b249ad81dabb52604431361134788ac8e17a1be3713a97000000000e8000000002000020000000e1a96012f40089f837d5d9267b8cd51e51bdefd8223c4669777dc9fc0844cb7e20000000fdd5dff6a6e3a5f1bf92f8c7300329b162cdf9388f3e9a38a0de68d5bb01892d400000003276610298c2ec2a351165a0eb94ee2527e548a478bdf4b90ca029e4541e8a3f718b15008276ac77eee52ee3339bc2a9f03596586203d2b24c327a1eeebab099 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28 PID 1368 wrote to memory of 2584 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bf72d45faa9ec45b739b198e0f824e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ee337cecb37bbebcce8c75848a94f2e
SHA196d57fb8a92c978fd80c109ebf03a89f2b2824a3
SHA2562a1a2bd1bbc1a2aa1b6cfb04f03c4213857f4d97f730e6f3fdd45f1ef0843a40
SHA512e3eb600c8592a66b7069290b8480bb10a2d957cc73865810cbda11cab09fe8334400b5d1b195abac17a4d5f36768248a8229c014e8134b18c71010ff19ab38e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0fb669797665877d4c3a8cf6f5e4825
SHA158880a2f0f6b9318167e1105a56de58a5a57d204
SHA256af9475c0a0b71aa260aab2235f477ebd06d5dad7139c1a4c5774812bb6048cdc
SHA512ab2c4a83d94f063d996224f3c967736a726a57278adf56dbe65b9b87be036c039ee24f6b1d968be0de45870eb18e059834c1741e9eb521387984788feb9d8157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51992de8338282b6abf732274df61405b
SHA11595b4102924314063c6864862590c86eca62503
SHA256aed08a96ec853a7d56485c14789da1930591f9c6bb5ec8c5406db8dbcaee4680
SHA51255b31d1ae3ead5f4a3ec514d04284f3a1ea0fa3b00141d84e827c8500e6b5ec10ff10a8a9f38de2d40d538ab1c0ada35c59a52b4ebf644be153693f155dbba86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0014de1251c4d2f1107f4c0e66ff9df
SHA13f5f1854e8cafb180bb7f83a5d644116b0968ded
SHA256ec86902cd5dfd94509644f6d13e24d63812c2fa77501cef3fae0f7e0ce3a701b
SHA5128405e75a2683249b7076d1c56d0ccfd3eb5e0fbf581e77ec24bb69255e543044a838c21b650a652297e88fab69b3d612d49c07655690ee93fa10622f96ec9d1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fb2954b66e2db4190bf613e869e8ae7
SHA19158079206585f7e674248c401165a74c3f197d0
SHA256eebe73330d1a0990eb38fccb3bd62be02bfbd9fb1f50120ffec85fded455f390
SHA512a5e97e15dc3f3d7aa2952264545d6a36bfa370145999b6450e567931721753285d53537af359558a3ccb8eafa0d46fa380b95bee2a0b34c69baa65f50e521b58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fb7a9288614e95d504a5b2aac63ea27
SHA1751984e60e392d365aa504cb03799f1e9d0861e5
SHA256b08fec8b5c720b1e8e50a178e1663c27edc4c55cc61380cafd7eb23395f5323e
SHA512fcc7732ae2eb347d8596e9dbf685b61e6506498c11b049746f02067a01c0017249586c2e33d0c37f355f73d1ba68b451a8b4fe5d44394854ac344b7cda430a0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dff45e2fb8c5295694d765b2072b8a2
SHA1e8c4451f053c34b53d97b8a725e1c9a2a83fc76b
SHA25600b0065ebcef34dbe78ccc341505126ad08d655dd190c97f3ea8e5917cb6b171
SHA512b684f982d5bbda41f31dfd6ef7a13ab4470351bbbeff25ad9910c0324bb7e7324dd9c93a2207014ef17f3df4cdb202474faee3fc5955f4f7c803496c8dbfaeeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58883a126a614ef01aa906e79b51ca569
SHA1896fc1b917b38fb408d49f576eaa248a4474ff88
SHA25604e1826073beb35401a4a9f094c0be4116cd30a9fd95b090b890ce94c8a7e549
SHA512448b0644595ee0ce4ef1aca2ea7006f276f29b3dd0ab034db8bd2d5c6370d03167aa8ebd20cf9b3220eb336cd17019042ffefe454f143b5e96862f0408842cdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b18bf21d3377c8b1b5929d6cceed182
SHA1219d71605a8c3dab251d7eb3228cee8ab163361d
SHA2569838088ac5b66b101152b80b22bbd52aa8248b25b112923c6add6d6d70ff5702
SHA5123a73a57bb8f29d9e399d862795d3e67aaeb455aa3cfc2ea44a61b0c21b9d51f49c74bfc47b0e31a3809eb21448aa0cdfefd55159c9e242d49b24d1b071eafed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f0c5199ad29881f88e8daddcfa21ad9
SHA140c95607af6f641b2265e179de4224e0e10dd1e1
SHA2563dddb08515ac2ac73696b49ef525c2daa5ddcbbcb021ce736a06e5aa33a2aeed
SHA5124209c3ceec0738faf772f68ee14474a0a552f5773559032f49f6e9aced8c29a067e1e0c7aa094be868596fe0de95e65385ffc1b938589fb58d8e31b9a822f9dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e66c323d8e09d678e208eceeb99817e5
SHA1fa9feddb622b81c89f79bfa10bbb687219e85b1b
SHA256c2e57029557d6616799ea8f4eeabeedaa8aaf5d8a039e622fd432e7f41ef092a
SHA512be49c69e57c4568a788f297027bc20f2851a1df3afab183ede5ed7e820592c4758e6645cf00b44be2608019cf98e7b683f0e59c4eaade77280c7f372f62ca918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554e73468089553c157f7fe1121b31938
SHA11e613aeff7fd6517ffa0e02983807081a39d1ddd
SHA256a4298272e622f2cd155f6324fc52cba42f17eabb77d2daa394eac44ad9f279c3
SHA512f57efba6103fd425f8e775799ef41079109912c0bcbfa2394a02dcd528b7fc07de85e4ef3eac1129078476ed7e83a313462a42627c1deaef1b4f1abe23950528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f77fe38391ce8ab6bfe8a1ae3fcabbd5
SHA178e2ff4fc30e98fd45ee7cd5aa5ff47426d0a78f
SHA25616e4729b745af5f0932c0f9ec89cbba9a04ecffa97308c8eaa6c3921130b6b1f
SHA5122493adf9509b805547316a5f81912a3b33d9a80cd315678da8b718b48b7980e2e87f683a7792ef3955205c5f1eb6f2026703525949b5011ad57347107c9f7786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b8ceef1b34341de2ad82f193f9ccdab
SHA185815e6887fcbf85d3283a20558b6b4aadd00f2b
SHA2568bb72ec85e91163bd63d007c255f4110f95ed06153140ad299b15652876b51b9
SHA512bf4c9c70f70b2cf2e7260198ffa7a9195cf92b569d639b69784ed9c803897804813312116d522b2d4c1971c17aad8e91fa119bc66ce13c4cb7d9d5f24d5baada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545bf29d7a44d72f732487df691a55f19
SHA18f327090db9151bd69e593544dd0059b2af810b2
SHA256f3f5d0f6a7db5fa7ec24e91fca657774e88ae55f5df3fca760cb2abab5a3fab7
SHA512fee1d8c8a6d0f3e8f18dd2c9b4974a3e43d6c81c581ccd285340f02c7a4db2a76705264c7f9ad54d88cacb4e311c4ee2249b07e65dbe89d3645094e8684b9953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555b2966b82e7a449ec92b69513f507c8
SHA1ee9aba6c2f17e28fab060883d6089799844f176f
SHA256a3a186d0e44f937eabc922bbfc4b19f1cc14ecf1f0559cfdada350bd40818197
SHA5122a7c8023f9e9bd2fdc96e5cb36f841b47ce4296e21b88c22b1f16dc05681cad6a4182695c0c1a34519b5014ac4bee7b308f6092ee395ce628abc2fd701d97c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585e770163a1dc6b05ab056d6d652761a
SHA14e4d721785f412cfbad95d5188ad548f9b4f4dcc
SHA25669fc67f853185a2c49b0748c0624eb9599ed056b56c5b960a1e521d76cc72d65
SHA5120b7bb46d539923fdd1d43672919b8dd99a53144c1f4178de9694e2fccb6bebd14aa9a5e6251b8b1b629c8d0e663f9f7db46777613bab968a4604d90b2098c857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553e0b8ae6365c1138e3fd3d9816217fd
SHA1b1d464b020bc93ed1f16d86e60c6733bb468d348
SHA256c665339fee30ab7d6ae59684691bc8778b3c3cd9441cc95eb6305bcfc98a647d
SHA5124c187c4e7bdbb86cb32a614ad02af5300ba1705b100c94f54842fed3df841611661c8553f50626dae68c3583326f20f7b8264f7a17ba48f6c0a20857b8998e77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bce370a6146e3532eb5b98f18efe971
SHA175367d52817b7276b50e3e75e086fe58fd42fb90
SHA25636f659fd0dc3b398fb0a34e533a79b9c1c9034f44b1ec2ed47bd77357e12dfbd
SHA512cced39a9178207e5e3fddf076466d39b4e004efb503187e2a647b70f0c3a19d4c1fc5adc82076c994c2217f63c96a8877d78b028456c44a35ab73aa6c9640bbc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a