Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
8247f1b4bb973feb34ded81085869f0a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8247f1b4bb973feb34ded81085869f0a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8247f1b4bb973feb34ded81085869f0a_JaffaCakes118.html
-
Size
204B
-
MD5
8247f1b4bb973feb34ded81085869f0a
-
SHA1
d856df5f00d2927908520990d47b64bfaa917c1e
-
SHA256
41a72052c84d1567fc646d67aa54e25d000007b51fe0672caf20d8160d5b0a78
-
SHA512
8962f2df463bb62504c961e3b8665abbcf5b3df7f8d8334bbd3eb456275b0016360d32ddd4ad3f34509bf86319cebe7e94938de27c405cd1a5e9c76f97768e7f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043b0bca5808c2b40aca00dd768e1d67600000000020000000000106600000001000020000000d47feea8a3a84200c5c2c9bb89bc61c0b00f72aca5096fd48178f139c750915b000000000e8000000002000020000000a1002e0f935fc6a75ad96ac03e3dacdee2ead8503fe540885579ce2f17994fee90000000ad48ee0e1898f269d4db75dbb38ffe0f65c1231a6f5d86b89721f60fe75ed370400a6274e80c1eca12f615c51ad570d12ceeca6827db4eadcf7bed8a81755201ceddc214d9dfaecba6e4aa0885924d542656c605f88dda324fde22e8a38c4f85aa37982699ee4bdb4f382b2e776002ae7bca8f6e9652c7ec9a2de588a2d7ec17e233d7a6edc00515cfc2931cff85c31b40000000a5bc6847586f044a107fd9b1f32d1385bda201a666dc82f5b6a0b2516cb74a3f1667b1711a2e62dfde44be87861e8d31187cb6c2c7fae51cbd5cdfcc13a1ebe5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9006c2691db2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423186072" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9537A281-1E10-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043b0bca5808c2b40aca00dd768e1d676000000000200000000001066000000010000200000007ae9bfbea1ca4cdb937fe002e76d0b6519c1aab1c2a9c91d9261420863c504d1000000000e8000000002000020000000d7126fe53c5c9c678afb815cbb31afd7272f3258eec8caed99090e49156cd3c420000000066327355ef68c861a16878ce29bd4d6d8c13d1a916ed89ea3fcae3970287c114000000098cb0225b471ffbe28184ccf0a2fc5842613b2430bcc2c9a4967357e64d376407d22a50321e7070e12af2dc6a5e4ae8f49b86dc75616301464b96d6ea6838170 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE 2480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2480 2368 iexplore.exe 28 PID 2368 wrote to memory of 2480 2368 iexplore.exe 28 PID 2368 wrote to memory of 2480 2368 iexplore.exe 28 PID 2368 wrote to memory of 2480 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8247f1b4bb973feb34ded81085869f0a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6b7e25d10478f690f96efcbe790623e
SHA1f94bea483e2ea133b9412fab979962df06668e3f
SHA256366a8328ac22fc323725ca9976210b876d4df810a3bc07c1dc3d78c62279b09a
SHA5123cbd3201362835a2b56a125181ca86b4ce1064bba8ee873ef028d06cd403ec2ed4a6edba0613b52c39493172ac71f9898585be2bacf4d0163321571e06240d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d485b485b82ada465a6c4e88819a182
SHA14a67a830ef187f4aa63ef03b66b0bbfddf29de4d
SHA2565bf69899b2387b6253805974622ca5e52cc9188aa3d88508328268841a1c792c
SHA512c727be838da13eb7bb5639308cae9ee44630123626554c02968d4fb86cad26e963d2727a87c40993eded0e02dbcbc75811025764f5ce8e63f4334316152f7494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524f781944af5b696ad5c06e143a7beff
SHA1df6f4bcb2c52c196ea1207ff19ac7730446b2741
SHA256556c7aa92433526c1569bc56afe99b3364559b9bf0b7b8499b40f558bb521621
SHA512bfa82910b7b296583275096e9bf06c13089179096fc836ad580d777c79414a4fd4647cc60328f44c0bc12eb641e801a9485716a2aa65fe2fb3f9b7b7154d7d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eeaf8dd813bb9ce643f20d6e82907707
SHA11462db7043d88688610bcc457c2a98a66b0587d5
SHA2561b0bc38cfa7f90fb2d8b07da98f3d89d9ae5009044dd7e5f937dc9e9252542d0
SHA5125648c4c709218f0a0d85c7d25248f8ed38c545962530c6615db8cd900fdeb37cf29e38b8db578dc73c753ed8b2568b1e59dc8147420c3349ec2ce88a79293ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523a1d344894cf0c706efcb9f96ef0a4f
SHA1ad06ddf28388a6db1c02d448e2527cc0c1770553
SHA256f7f8a4582ec7d60fe3ded03008346eb53e14140f1ca7978edadf01633616c8e6
SHA512d6656cdd39c97a8078dde441332e956fe22dd3632f487e569b43226f1f7cebd3df68dcc068857b7e5b37eca424fc6775356fffc8ceb1defb56533cd693f17adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ec0b973ef35234f9438b9279cd8554b
SHA165be5b9a36bdafbb8800e6e9c44dc267067ffbba
SHA25665e8270b3f1b7f097022c72b5b657e100c3d94dd795d2cb72bc33ce7fc1b5b1e
SHA512f78ce5f22a5c17e6fa55f73fdcc99030f37b418628ab481ccb368c2fdd2fd527dac42601bfd68df624c6ebf3a662aa3104b82998dbf853f0a1f8a4252dc3cac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eeade4edaaa99fd0088e9533282c73fe
SHA14bc648735dee18ca7f49a66dba56d064df6cd528
SHA25613e4d382832a7cd689fdc53ba913ea745f7d74f81d408dcdf8a3a338c478585b
SHA512f7e0a1c1324e4e3ca7e5f83b40629a2e88289f6e260cedd69f140c388fc007c46bb8ba08ff4944ccc09cb7286307985f633d4e425a377e61d860b3029986865b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d88e0d0848dabed5d6915b177f5dc890
SHA1b6053acd1eea3a473805177a32288828db4f077f
SHA256822c771c02012bbb206066423143882910d2b3faa178ce7879104a81e5728028
SHA5121dabed3d6fa3749cbf7c67c91a4ecf50ddba5994520b984f418b1ece9832ddc2e98c4e042a43e2de70e07dc361dad03281025c4b3cf3e33f9ec8705c9157ea89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f8442729d85ae251c9dcce94f712382
SHA133f17601ab1e84de3860b4a15fbcf04222135bea
SHA256d6c04d0c58f147ae341e3b26862af1af743160a3100e7177565430b349266eee
SHA512d50197e44d8ccc0904aa77d96a857e3eb25d83e8e13f55da19c4e55467da6481e480738f16606c4812efcf2876073ede88b61e4329e57e12496c4684fb1e70ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c40f31839bba738deb7ba8ea79e88c3
SHA1647eb7be6c3f337af6d9a9089c13f13100b6039f
SHA256df34a62b13185be68d52593d16252bac5a0e6ceb365c43cd8e3f009bc5b77927
SHA512e2bd72da26f987353d9d09d1da9db17ba86dcdb1fbf5dfae2711f99dd914ecfcb3230c8e8df001cb398f164bd046a95ab1931053abe58870ab2d61b858013900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c097da9e908abde3690a908d7536c0b
SHA1162a67c7927f62b7887fbf0d92b592a7d9f0c38a
SHA25612ce12d5a2329aa4b21f8ca4e5fe1f6618c98dba5325da5aa982582b471e76db
SHA5121b8f66ef56159556fbff6a2793f0d0ac36a24c6b337287ea461cd7a903d8cfda24daeeaa15a18a829eb3f4ea7ef6660329221c3da3f9967852e4d1216a288532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53804f518bfa0418c7521a88f9b0c1440
SHA135a14ba1c477fbf133341933731582569a392c21
SHA2565d2db705b41a0a621eb07057f9a0a036fcdecd674e321f6e09165b1c1857cef0
SHA5123c2394563b68e505c8adf9696acec259786629eb38d32c0e859bece4de0affc24c4b95f6fbe51809a698333d3504b42c6dc43217ea5467d16f8df49ff1141234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ce6711f4da083e55832ca0590c9b08b
SHA1bb14c90254d82ea25299bc2586cf347ba7723052
SHA256a57902faf44bb6319168633a20adfd7d2a2c3eca386a9444afabad2393a70472
SHA512a213b491f8aa9b0e8d58ceb617712487adeaecc3783cd97c57156f4da5241460899360a1a1614883c1b36a03a975925478a9b19dded817f6d6939dced2763df4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e448cc2baff59cb1dab124bc1171a5
SHA19a5d1e8e7fc9f967533363e843fa925a3bc4444c
SHA2569d2e411cda01094c0c9ccedd0d05d58ec1a1d3c03876ea3a52e20826aa469742
SHA51289c425a4adf02090db1264885d3d839afcd412623a3f38fb9bfd4396133a16943ef9aac04219c7ff7bc8236bb094421404e3780fa692d7d0c12dbf618f339c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56553990b2df48837b186b0f1248cfe01
SHA15b19aedba132602f5326749895a223385d5e4248
SHA256cb1ec4cd7239c8fc9a3f46215587c47a277620bbe96d1fde10dd7c131f2f18db
SHA512b9d6026870499a2d84edef46d47eb4ae4eebac7939d82240f332a842742bc0cb5d0482bb95b69e7da7deb533771f77aa6569551bfa19b7f625f45b7a867e54ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5753f7f72432ea1b618622ee5cd8b23e4
SHA1254678e73a9022cee1b863969fc67b71e5e5cadc
SHA256fadc7e1073f9a44153949188ea175f2bd55a80eba2ae6dccdd9f9c5746e30101
SHA5129eb05cf3265bb8818b48306a2c43ba72f5e9d6587af4c50ef131a55edad2cbc5015511be53b7ec5e805c0e95fff22ac917d9da1fc3ccfa6f80cdc2f191a09e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e0443e87333a8c2fbdc6da4e667b2bd
SHA142e4e70528c90fcc1064f03762a74d3721ac0491
SHA25649b65b7c25923ce9d6d064f24df63bd314ed72872acd85c344f20decec431225
SHA512de1717388fe0a473a1e58f5cdc2089a4e36aa957924132679de2471cdb662a193498ed6b00144b22aaa9803bd76841bf3a624b20cab44a335414be26921f4273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524bb50e00fc5dca9cf342781458cb603
SHA14a51c6b70d4250ebc7498e6bbca03e66afce0816
SHA2567b24d5b4ca62132acda0277913184bd287e9bfec318620c3369b6a61682d84da
SHA5120a0811428a5b43e67d9e250b62b2238e2077b67aa7fc5eeb04a52f641a9dba535f3ce570e84e4a693cb0bce9a3f2066cc8e0aa4ca503823189a3cd8998c91f2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548167cba38ce6096e0b984ecb52dc4c0
SHA1cff9f2af68014a0c2556d16b65a94210f1e22807
SHA256a81fe34060e6c9839c22bc29ac5ae8b5c1abb96d03619246e825b692a7a9cb71
SHA512b98d4945a49855c81c2b422086d3b5dcc85ca997ddaf88638a7271d05cc4532c4cab2b3041d8715b036c3fd338272a8f945a968926503eeab0101f3c3ab7be8e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b