Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
80fabce53b9f27ecf8d13e3b42290146_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80fabce53b9f27ecf8d13e3b42290146_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
80fabce53b9f27ecf8d13e3b42290146_JaffaCakes118.html
-
Size
2KB
-
MD5
80fabce53b9f27ecf8d13e3b42290146
-
SHA1
d6fb1bb199cfb88a38edb336d82ea98a8f66ddf4
-
SHA256
1aa915d4bcf2c89b1952bad3b997d31ac95515499312b73936f0a9a4e58cd59d
-
SHA512
fed29fe5e6a1e61cf4852ee9595116c3bccd3641fb9b212d7a6d602cb36563ca365e50c511fb2ac2baab38619857f57ba543d84fc69fb1a594a63ba8975cf780
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423153103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c0dca6d0b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001c2d14c6b7685e4ba01ec27be9f7be8900000000020000000000106600000001000020000000ab788daf509dafc99034e9b02a33f7166db847f5486334b13b1df8b60f8711f4000000000e800000000200002000000048c631678b9cef20d678d7a8fe367c82d7941e3a95782674ff33a77b2061499b2000000064ab3f791d8bc6ad7e41f3393939bd2f438acc698e18afd78c87b7d770f6e45b4000000059f9fa12d18df530400989d03a4697dd0196d5f51effccc74bcfb000f76026cfb3e6abee76d976d62aa82f54722b156fd91abea312563d5614d9bc1911894693 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001c2d14c6b7685e4ba01ec27be9f7be8900000000020000000000106600000001000020000000babb95d0e500eedf8e115d69b94060ff1ec29d64b515e797b1c0ff66bd65645f000000000e80000000020000200000007917f0eb1589903cf1ce90605b53f54d1bb45f8eea27ed0fa51fd05b51a543fe90000000c1ea0f92fbd72a173d0513e3a0e9bfb1a8ceaea7402eee70c50168025870decd09fcb11d4ee5215cd65559d395a6763f2b7a92a7b89ea1f35142b0a84e366d14d55cf9fb887d12cd0399f41f94bab516a43e90340281c7d2d072815bd3d7d67ecc61c80a0a40e65a52d7a2410245cc81d65aa7de2d32e6ad0a8f2d7efcf6f1e46cf3c4323790fa0f6934ec80ce2c76904000000018695a2962a25b4cc40ce95bec408cf20398cf8e8ad824ce86dc232f02b93c5ba04e695d7706c949a41f9b0262e17c1ef75f55b0475d5ae856673557de7712b3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D223A3D1-1DC3-11EF-BC3A-56D57A935C49} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2972 2004 iexplore.exe 28 PID 2004 wrote to memory of 2972 2004 iexplore.exe 28 PID 2004 wrote to memory of 2972 2004 iexplore.exe 28 PID 2004 wrote to memory of 2972 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80fabce53b9f27ecf8d13e3b42290146_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fa93bb58f4b4a995c8efa55e047d318
SHA1587c6edd541026c386c9a304981ce061840e5be0
SHA256c8f53c50ae440a313161d347a7c36d4f03eae34a9976f4c159dbef6ea39fa528
SHA51217381f97fed342c23d4bae35c24925214cb63964b8a909c60ffd4e797443679c0afa72dcb70cbc9d1465b50a7c3569628c92f070f7d535c172e09db0cfe58055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538c90327cb6fb798100768fcaa78d821
SHA1f6dedd69d88c47c0373aaef7c6332df81bca97fa
SHA256a2d6d022d381e703c02739cdf7c2a35d2080791b25b93203d7bcd674e4d234e8
SHA512ab448d78826709a9a05359e00992e1aec5e30bee060366128c0e75a20e9e15639e0ed155c1b42a44c7501252556996dc632a9e111ed15ce7c7d9876de6250340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d001b613c2ddd36ba242797e5b96fd2
SHA10c12eb2f90b4b1984e3d7498b590134259647f2c
SHA25645cce1bdb9f325b190a9ba2cc85c49f994e95f8103fe341ed2e21f8b65d18054
SHA512aea63b2ca1f37af9dd8352c9bbf0897d29bcacfba89cc5392e344d905435e144668c756639557585dbf90501de0272f685d2d8a47b1241bdd5381198fbc2a130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50692f944f782462ac5b3c587a1c0f260
SHA16b36d47723126111c3935dc2080935aae7c4ba75
SHA25618ea80d4af38c2e64f0788cd52b012761406a7267539dcabf920de307c0b8364
SHA512fb3e5434af581a74b3870667725856d97919bf909bfd8e4a327afe3161863c1de536b23d766231215a221c609b5bbfb2127e4b90bfd97ccca7b613af386f3b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b89b967c03de64ad37074b6938831e3
SHA136e62233f3b2de8876430c177d72ec609c388e7f
SHA256e2344b6da5fda691e60102674a405b7a43f41dd3b0a153595ec39eab6777ac3d
SHA512db32384996eb156b3515439a828176d21da72da6d93c9abc29d22da6ca16c75ec2ab0d57e30b53e2d0ee98e2662ea2f42552ffd80b7502eeefca9d80d7b72804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5720b9c0ca66fd2dbd8319b4ab76c3c3e
SHA14c693d217a44fce8b9abdc7542381e8b48bf8763
SHA256b28ee18440d3def2a8a969478c5ac07d5efc06fedb6d3d183f10d84cf3a1e0e8
SHA512731052eaee77ebebb4abea31fec6983e00ddb0308a42e48c9519f5b35cf7b8090fcc76eb96bddde6fa7eea13b3d7f4ac43556f0ca66525fa13c4c5920243e7e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e7a2cbe812d40327f55c39ff0617e00
SHA1aa540d681b41264b1d74675dd8a02c1f41df0a9e
SHA256df0d674aa2f1d9942826a4c1f296a43a98b080a876c22b9654ff718b815d8218
SHA5120db31e2cd460c6f1e99e03c9142512c9c8f44d3df0aa05be3c3d50380551b721a80c8ee2a0fda05e24c92eca25d5d482784c0ee05fdf759782aabab51eca1b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b9f94a003b2a4c1a54cddb3f9ae4958
SHA17f5c7de71c152a46fdf3cbe55b94c9388941c576
SHA256bbe98dcd108c2f6f9eec299be63bfb9d15e2356c994147eabe7d01995c0e39ed
SHA5122fb10414f363a546ec0a40db4daef77889ca029eae2aeb6b9a5e3e267e6f3b832c46f9690e862d2556b2b24fc6c2c62a48d46d6063602d68d1869aa8e5229af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e07260974f4c383b203b6e4fad721c5c
SHA122133fdcd814e9b5a5c6cfc8c17e7097390e9431
SHA256e4235f6102f7b43cc4a547ca04010f80cbd004bc40baf3ad561dce02209ee9a5
SHA5126e0231f12792b3bde7226d8afc05830b369bb337366f8f48bc72774062b141c1e76282f3c628fe70e1608aded061d873ed946fe16ac0c7ed3064b24e003866b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a72221844c1c15078e2bb2f7bbf3bf65
SHA1a4e27a94dbdfb0bb7b009420af3a6b45bf2993ee
SHA2565e7aed10abf5bf5ee5cd1be99df288396ac1fea63e252187598dafd7e9b6a3d9
SHA512628be17dee4d0db6a67b7e748ba5c599e8cf6d7c9b2a2f956eb2f67413781edc00d1a87cdec3a131d83a6743803895053e5aa4f5b4023407b7ed33c9078881d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6a2dc18342624706c1ae856c34ae35b
SHA1fdbf112985f91fbeaa300531871cb4faefa89422
SHA25622da7ab8b8c0d542c3f4dd771580ded1d05c7a5c7d70e72a3c4805d346bef01b
SHA512e6bfcb3faf88b73546f4d6eb1f39a7174c608a2af5c179ac3c9fc355167092853ffc341ad14aba6ee5e810f4234ba561f2f59b1bc29a815306490531910dc052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faf342a9e4dc7cc15d936747a3cd8ce6
SHA1a4d6e402966efa4b2db9784abe5799b672a2e514
SHA256afb4c1313968dd7ebd0ac34e9ed78ad8553171134d1d0b1bf04e75353d91f766
SHA5124fa5d878adef9e641841529f6bef12b76c3944c40fd140d55eceecd158a896da645ebe5a9fde302e3e0c8061b809f30938768c8ebfff7b4de96c9ae056ed3e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac00a650c2ef03b2de21f512a0e22560
SHA15f7b0c2d2af9405a42f30fa94270995e90ca6ab8
SHA2567298cdc6ed54bba59cd5cccb1922eaef464ccae0e5ba0fc209b3df6a6d479b6c
SHA512e715cb7171cbacc7855bdb4370634304ec74db02e544787e8eb8c41b757f883257a350c38aef31de76428afa17e91f26469b9fce9bd572c81f5bd6397c21387f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f14daa93e3da89ab865fdd14169dc13a
SHA1e36e6bbcbc3700b24deffe12afe19f1e4a596799
SHA2562dc1a1c479e816cfc7924c04707d5d0326f39d61e589eb3b33c11e155ee0d6b4
SHA5127ec32b4ab034562de488fb3b07e63fa8d80454aa2ada28eeb765c59fe6bc8d8e91a4348f3716179c9cfbf9fb4121a41028de2eb47da53ae22eca0de29879a438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f52802a84ca8ab6358314a084a72f74
SHA1df98e08235d5a9171ec56d7c08fe1d2ea81473ed
SHA2569b9b5d755dc3933bbf724d68584a220eb4f5c847157e30544c8212f15d670f79
SHA5125e1c9295283e0dd2252f55188ea6ee322108127526a68c3cc385d53e57b2b3567682015f180c126edaf7a61295e2173094869a04eeed673a1209fc660cddf7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cd127776597d2080fc504e68d959ae0
SHA19ba5c5051f8fbd34795478def4bfaf790c0eb2d4
SHA256223cc2508815cd025f18f654842ebbfe8b6acac5515f55f40d83c218eb8da61f
SHA512dab9395ac338c4c47be726620f196ab43ce434d56da16444c660f16234ded14bde7c58be4c10040c7a8460ed036f96d9d37cea191d96b80e61d5855568654020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddbf5cf39f6f164098cd0fe29a963339
SHA1cddf8f3050d00914c0c072f9e73fa2db9295a203
SHA2566c819c6555fcf35e6a2622e721637f3e5f8779b2fec112fd8f71a8c4a51da96e
SHA5122601ed360a9f067f3b1f88c6d3becc0daf3bcc062d3cac68574952eb3cbea2fb89049833eef804600bb13dc26267fe8b336515bf05dd1e1d168ffd37cf3f31dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a8f7a6b26b05c4aed7cb55dba94fd9b
SHA1a86ad69bda30f02cbc9d9c6404d4d32e8c9e87dd
SHA2565d6526d0d8ea11e006427ffbdce39a7ccdee909af51ac8f8f68bea7d5e55da07
SHA51221e4295f8739fcdb6fd7ccb5e823b0cc12aea8b200277fc884a0886f2d8f6508a36ce99ec9cfb3ed81c41e11e4f4167bd3215f0d3e482fee5b626475371e7322
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b