Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
874340bcd209d6278fa09c9324c3c791_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
874340bcd209d6278fa09c9324c3c791_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
874340bcd209d6278fa09c9324c3c791_JaffaCakes118.html
-
Size
3KB
-
MD5
874340bcd209d6278fa09c9324c3c791
-
SHA1
514331adfa789338a76f91663633a59a76d87c41
-
SHA256
b37d2e0cfcfca4d4408dfa8ac646228bdbb2d689c77c804a00f1fac6137c0842
-
SHA512
6a2cb780812a782434b83885ea2e8897ac64b3149b60bbbba16c48a635700f546b6953587e1aa49978d102a7499f9f2de829c12cadf458cb9e926857d6380279
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423326276" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500fc4d963b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0497A6B1-1F57-11EF-B2DC-EA263619F6CB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058ec26378d9b60448a08dc939957da6b000000000200000000001066000000010000200000009588c15d60495097abe752d85d0a048c8f9fd77dda150fa0107e7dcec50a80c9000000000e80000000020000200000004843ffdb38a1a8b8e75a6d23e8faa4455fcc203db2e0783f9e82eaa9d227e16320000000217daafc166bcf45e2b373aec6c3fe70aab3cb860739b75b0d06059c679ff5c5400000004cbef8e8e1637434555a94797dec60e89560f89a4351551c8cf390c36be35e687e247e7b8438c3c3a01c5093d0aa4c65cd40a25b6ee5c97c0f6f1ea7c3f391f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058ec26378d9b60448a08dc939957da6b000000000200000000001066000000010000200000005cbb07e8a2401f1fd4a45316ff59401d33fa0a85c23155cd7af0b387438fd824000000000e8000000002000020000000dcc2f54663cfb07a658960177ac9b2bcaa9ad0f623593c984479c9d478c6f7b49000000070f7b130f81d28ecf038d3fdd1cdcab98bcf492651b4736f6cdb9505bda9c570be398545dc73b2d85d3763957ea9684e32f35567b407ef1183572a5e01dd7b7c4d5c311b40a0f4dd1a5822b06a469112f071cf5a4a9693c0e5a9d21bca4dfc38963750e77de62c56f70d1425a115d66178c0b77b177535882c13b54de0f77a4e8bd1112d113430139adf6a81d4737c6440000000bb99c566507548c611878786358d223193b9ddbba35019d74daa4735fc7cf3211174f7e24b30bf69f40e97a46f1c84b7b7348090d27744469a72b21663842008 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2944 2904 iexplore.exe 28 PID 2904 wrote to memory of 2944 2904 iexplore.exe 28 PID 2904 wrote to memory of 2944 2904 iexplore.exe 28 PID 2904 wrote to memory of 2944 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\874340bcd209d6278fa09c9324c3c791_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5011cef728f247d854a0b5ba074fbf888
SHA113e98c64f085c356bf6fb97e5dbe9f3fd277f5bb
SHA2569d6c035e6a728abd44e395ce8e3910862fd38af63739693408362b9501947158
SHA512938d139d33f08afdaba57c0a86b9357bb9bb33189da041217c084d21d2a8a2d97647bb5fcad95573d1a19ede3b9f6b60a327b65e77a172a3db886015f81845c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c731d65be2ef193a18e0220cb98d45a2
SHA1f2115bf0890cde49f9fec2807392559e59ecccb9
SHA256dc4524d176c96a6a937628f60d4daba1f11a6d7d30e145cf1f96385cb1fdfc0f
SHA5122a0ec437016110a93d54404be19d1fb63e50ec5fa87666a3fd946084bb72c516584526400cfead40b02610a46f738facfc8487df68e0b6237c9c2c6a0c0cc304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea369640b2cdf87cc626c8ce957c1775
SHA11cf7e5e0cf01f9e03f7b026caa41b79ad9bbc848
SHA256efc01150a6bf8351de5327940614fefddf62ac52615d4da172e99f21b7df7644
SHA512b15502f0709f64a9ed0ad985e7520c0ebd371e5c9036d7327ff0c49a92afc652f630df8ba4ecd946066ae26d6d3e56836f7ab4402415826cac4a7a45ec4e7423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58069a3f4d250765306397bbb05411879
SHA18d0377ed7477669ae9257084c107794f1025bb7a
SHA25643add8e4f0bfa2478725aaad2078d35d25d8a29586671cb999f847a61f1828bd
SHA512ea8cb34547b2ad746cade0008307471ee13e987126b9d80f8be29c60597bb9c0d74d9718d4f09ff7595ecdb45715353fde24f6c3c9eed1db26a07bd951e1e2ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56acdb0d31415c7550c33d98ef0cd0bb4
SHA189afcc13f761632e45acf632d7bfa9615584e840
SHA256af678b62be50093771bfb987f0dbabebb095ac557978b76745a684a64c81abdd
SHA51249c4c6ed94cb498bac2964ebd62d37366294933f543651060037bc2e9038c227e9a5799e7fc34982645cfc013cebe6678eb795922c6ac85ced6d1b1e1733242d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa713661e4bac1ec4868754a52a55ffe
SHA1c2ec6fb1fd8fe8e4683042f85fa9a6c6260c8bf4
SHA2562c96e70aa6d635f35866a87ca51472cc9f1d6a183328905e95f951ff3f0cb185
SHA5123039acd482aba966c2ed4d89c0f33f4290b4ff3e1af341a37b8c0b81d1dd6e5090aaa631f86a4731f65a3b6323c52af3faa72e04fea07e3723f32072180d82c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573d154467ff3570959e277d596fe3019
SHA1e1ffc0cead331984d3162820cae94f8b18cd5c87
SHA2566a717c04a70caf8eaa5a43e336d0dfcf84620e0ac1aa10a9fdd97c1da96517d8
SHA51204f96dee41ed72456afc4205578b0e534cd3163fb47d0adb3e6293dd46106b99676778f8ff791f9652b09897a273c6379915352167cbdac121cfcee56b9b6569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afe96b7de73bdf9fe564fe5e05743304
SHA13ad5ffb3d31faa575e80084e3e89161ebe290159
SHA2566c459ce0889a262b0896798bee9b23a3f43ab98698e69381d74c7cc8fac65cfe
SHA5127310aea77eb8a6f212f0ded5c70a06eef6c2eabf553707f56f13354e47457c7c3f6730dd3052aa72ed7c689f57fba473149161d812ff1fd009f416367caf724b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e683bfd51e4fc65ad46199ba883a567
SHA14975f7c3ca2a756fb0fd0aeca9c1441678975d7a
SHA256151c4cd3864f37838f4829871bc3a4a434db5fb82fb1dd9d97c970ee43064b10
SHA5128404c5db2ded608138f603b5df22013c832be518bfa918e913bc77379e27000fa0fec46f0c7f4b7203c2ea72089ce5a0a9526db1c1110734e03f01875b1f9f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfb4f51ea2193a54056d8af46e09a3e8
SHA1f3d4120103c25b54bd7a05ae9281ac048f73cace
SHA2562151dd95906059b65cb884abc97654ee12ca21f661de2a8f1c49edcdde48381c
SHA512e17aa35c58fd69104e70220442be39778ee52648483725733745351bcd9efea62a5d6cdcc20b11dfa91fa457303e65c6d7232257f34eda8c50444d0eae73e4bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5a312bec557cf78605abde51b3a4ae7
SHA1850ea3948a717c7856ab1de545ccc4b726447077
SHA256aedc3bb25c1f6598ee59c1fe95167e849b13a17e72030a00d24e6c8a121419ab
SHA512e4d3105ec878ffce4b6bbe7f2dc7e085c1337b71749cd9342017853dcddc7925fdc11706f9ea3747f6a5b6286cb596e533b4e509beca78d71ca4e2e07bcef0cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9a0592aac1815ddacf4a67097850580
SHA17b9efd33a153ff582f7d4111fe6212670a26478f
SHA2562aa3ae56e9d9e8e1babc29b339a5fb45c0922f322782996752493b0db1ab3e06
SHA512eaa12318c1792f881cec3f411fc0488c912ad1f7219b1b12fc6291e18675b644c640a78833c0673587a2e94ffa13f34d20a717356db3de155b7a7b917b66b39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b15bb19e5fe55625644f0373c86d75b2
SHA123b80fc567f943aa88cd0b388d61011a055e254b
SHA2560e126a391194accde96a14cad679a429ecd9f6265c29b6078703601d87536e9f
SHA5127bc85bf6c78517c7e1f662889363b4b8ecc61539bb989df9e8a325426a5fc58977b1f5ab4c918018b05348eb489799e8a773bd8867bbc1794ac478d840bc71be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598199978ff6495ff9a8d7ef8a967369e
SHA198bc8c155cf40ef395448bfbed253f1b6e87e26a
SHA256f34753e33464e915390431dffeccd17713c80e04b31584f3ccc0b407682db7db
SHA512228dd66c2626a79eaeaba3ce1b2664e0eba23f156f1f68ff3a3fd7d968b75a28dc2b907504eca58da70a37c446db6b233544d79961104530fc6c6ddee7b05c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d2cd5d5a414babeb6001bc145059985
SHA10f2140bd3fcc3a80fa940a070ae63ad082ab07d7
SHA25654f43ceafc3a0ece95d0593311c0d0206cf7cd2498cea52fbc08e089ab335a9f
SHA512a2b28818490eab716008d306d463c607f0995c97957a26132848fd7446061b5c0d7eb4fcae9991aca5e58dc45fd535649baf1a99ad49b80b9bf9278971019318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567b070333f4253fc61926f3e85e6ab53
SHA1e09b07a46db7d46bf50ac342c50cd33bfba65177
SHA256756d5d3ce551c8951e41248bde5e2fbbe2f69ecd6423b08f69b177a900e60f3e
SHA5127a282d23c203bb8b643fe4a6f6a851d400ff86917570b8701859e7eb11c6b1ed114a8b09c48d8ea6908d86be52368f5ed176923109027c031b4cb384663ef4f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56393b1e54da31a3bf3d3fb220c895342
SHA1245b07b39c5059652e26d8a44f51eea1023361c8
SHA2562f81891127304048b97f6ec6a37703063bf3ecfd939b16110c124c57a4ba4418
SHA512158460e3cd04e6ea151b2f6499c4245357dd745eeaafe4979f271166858f03b36d906fdbce829b0780972bd13a8c9886c3d868ef66bf535f8e0278804b1f1776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59976dc6c1b7e224efaa587696a6c3633
SHA1af9fe2657e8f066ac85846b3070062888f39c0e0
SHA2569f27a8e4d24fed9cf3d11573325292f9aca7341829efc0201988f4f334c78dc2
SHA5122e7334290f2c92c8ec4681a6059a0ac9a8ce2a85587a02636363739ccad736872e6f6e5220bc4182650f42a05f3af8960f41dd4761465889825f1edad3bf3951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514d1896b284bbd4b250d5486f8c9937d
SHA188a9c7a1eca935162e666e6ccbe63fd6107afc70
SHA256941afaea0868fec846512487cc6e5e53fecf28b71d959fc1e124d49c18c86fa5
SHA512e1b71833409e532a0e56db82d924af2d5fa29a4dd0fbd5825f7c7fe560da7d00322e45b4bbbc9a8a6e32377c3568854019f98f849b6e812d5d88f3405b362dd9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b