Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 08:20
Static task
static1
Behavioral task
behavioral1
Sample
89dc98cea85391f62e9e94d543e41c55_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89dc98cea85391f62e9e94d543e41c55_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
89dc98cea85391f62e9e94d543e41c55_JaffaCakes118.html
-
Size
742B
-
MD5
89dc98cea85391f62e9e94d543e41c55
-
SHA1
bad70021785bc11cd91052807eadf2d483551570
-
SHA256
75898191c178aeddea96466e05d330064011e9ee34e91a61af8d9cc6f6af00f7
-
SHA512
5deb61c89646fb55e635487fd14ebccc9d22d8a40092d41b3e17d816d87fcf6ba3852ea240376547bcc71224c0b5a44d38092ac424fd4db8be6fb3bac523e8c8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423391888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9AD7681-1FEF-11EF-A965-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003685261bb8274f4b9c5aeb22743538c700000000020000000000106600000001000020000000154f28ea6e15600da737e0615b2c697cb7b8141baccdbfaefe9b5de25bdaeb38000000000e8000000002000020000000eb8884564c19e95bfd0821928b40b07ef3414ac045b5a24e30a8bb9a4d4304f990000000ea31f8e369b32a2e36e489869dc0014c91ae01fd9e24375d11c5a237b938337b45277c41bd5b6bca4614727af9a90d297517541968fc30d147f3eca045bb782870a29f95ef3dae00a2dcca592a974e90a5613dc493a6cfaed0c1bb3fad77c4e8314a2726ce296b027d11ce54b73cc9b52e1f5bf9d6c055ff6079678a9a1388b487466bc15f0a5778216de4a7f6d5d09540000000e4e04113bf1079eb1e4af17641f7b26ac9024807534b3094f560cd7fbd880f129d62b9f5bf94f80fea55488df57eb5769e29234699d366f4beeeb8b1ed3f182d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02c128dfcb3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003685261bb8274f4b9c5aeb22743538c700000000020000000000106600000001000020000000bdcf26e1774d7dc18ee24cc142bfd3a12b519bb7ae57abeaef45be20187c624c000000000e8000000002000020000000641ee15068669bac21e4ffc3388e049a8654f838803e206490a1af8962c23e0220000000aa994304729ec679bc074f7020f6891758f6cc5058c6c82baff2418e31803df24000000005f3d67f068a40391f34e2515851d98c487e7e319067f98132702d2ac685aa76d82b338f132341c5a7714107c9c8ce6902124ffda63fb2a5de7484a8d2bf1ba7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28 PID 2868 wrote to memory of 2208 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89dc98cea85391f62e9e94d543e41c55_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bbf4f294fac988e034ad14ab0e4424b
SHA1206b58e169d15a4f08b81228ba0d8210705c03b6
SHA256dd847191d4555f85d660cb9032181c5edf2b219740efb93e80046fa72b8778d8
SHA51207cd5a5a865d2172fc498c61640e8e02a3734f925f65d6f7e8a58419d7cc52f521977869ac969d724ed7aac0fc41729610e24e560ca9afec706e5399603e07fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5552724a423185a0bb63a216589c9f0e9
SHA1e1a610c80718b4fa6c7c4dbaa6d7be530e40bd86
SHA256b3697677c8ddd28268a82b45ee066a28e5c4303711cdfd0158fd765e6c4127bb
SHA5122f922520393bca149d493c26493e16acec601db6d727646d728c2a7cfbb6a13e64b9ea156c5208af05a99f3d2d11a9522a31f87340aaa5458462ce0d2752a1a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3bc409b8e950883fdd2934cc7e39b2e
SHA16a8959168ca504bb2b35a247121f06aa42018066
SHA256503d0c6d03412cac41ce3802cb2bf1d11bb43a7fa6e414b920b0e60f2d746470
SHA512b1955d80ac569b69c4d2f63e0b1766adc3c9d8b646cb3adcd06b8a37c83516776428503b6bb8bfd901cfd1c09eb0ead09a7ae17ac3cc8f5bf65a2a7722655993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3d8d37e29152013beb72ca161d0cd25
SHA15d71f3722b314f17f915d45e2de52fbedcfb761d
SHA2567d1c58394b6a731955b9eccd0455f0af3521ce65a61d9ed34cab7c257dff8b47
SHA512acb285a4fbf8f641378bc99753163255741e95efd95c2ea0614ca7fd5589f86d776fea3fa00b1ea1a6b9b37d7576bb6b3e1770cc418abaa168e97fb089eeff12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a5018f02fd3fd03df5bb725da3a5447
SHA1781c3e3470d5db5e220cd721bbeb9e0d7ccdee6d
SHA25677a9d98957a9c70fa6ab67a83db57acd81289bbc7b811ab84a1e4033e9aa3602
SHA512a89608eddb5d49efe907a6d32c247b079491cbf4cdd92bd2329803eda9a963a2396af38afeeb13d3d16c95eeaba23eb66d74de5896d1404fd4643ed08de45cf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514fda68150e7755d5878e3c319fd0a72
SHA1efff237a4885325b8bcd5c1a1160ec3df736c93f
SHA2568ea66d8df75a67cb1c9e88fa689eca9e5d17309a19653a3d7d1822283c836abe
SHA512ce5dc56dff46ea3c7f7089b6f6146da40bd09304624bc28035c1e9332e592ca39b6ac87bd41eda317a804b0f889a00046fc7ec53dffa61189ecf961068e0f874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a32a2d07d7430d7d91e252b3b66872e
SHA1c23e0b3c78def0f3f482b1dbb5a58314d353eefc
SHA2563edb9a24a70aea9b200ebd0738ddd2e3d38d8db1ce6222692150b6386bf99f60
SHA51209e178bfb8b623d6b405e69ec3ca16d60663f18809114217112b2dcd7be0d4778104ed3ab2f86389cb9857b0a59214fe44112857ecd2a9bd8de5f8975b65fb4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5904c93026d978084317277fdafb194fa
SHA195cab6c055fddde9fb7a81df5a3d02007503f976
SHA25653d3f8e96cc62fc7b3ca6d37d75f91058da64c598964571030273ed68adf0a41
SHA51218f9c4bd8c5e64cc9f19eb81ca98a5e87adc2f368dabac2994b1e2d146ee854ea3822bcf4b0a48f0c9305b6d5089256692db1618e7cf78f1f287213943420010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b49f31bf345e60ff6e02d74fa14babe
SHA12032dc5ce6c3fe879194a5d8af733853779e36e7
SHA256752491a957a1832370e0f1cbcbf2556c21e947846cb5360745f9475e809415fc
SHA512e989ef30354c6cf93018d5152536032c01a272a3be57b671ba669f6989843aaccb4e1f55d2c8cc1ad94d8c0491052cf4d4006bd5afbe73d7b2ddd967218cc1fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f609042f1044990ebbd08fa6631aaca
SHA16286bdc5d381671aa3e3be861a00f8363f9a8593
SHA256f9cba179c0d8eeb34b1d7214d2f225d4b0a759e55d764ce640e18032864f2b53
SHA5127523f50e585463b0d70d1da56b788ad322fae026e583e72cf7a426fbb7968bc66d56019f25395e85ea8422c833e11d9852843cd97ec643c480720faa9f9bbdc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56740e09ae12da4621a524632a6ee767a
SHA103042ed52961d7da39943e5bbb7dfb76c6b1a230
SHA2562beae7562b946b610c3ce198677ed67e9bd3314143b2ac60b9664a1571ba2fa4
SHA512a250a7193e0340f028ff31217a1ef5f1ba042efc495f4cbec08b0aff50b56668b6f6f0b428b0aa92a3acac736639793ced1c06f2ec7f59668bd0a5d7a434996d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5348882027bcbc6a1dcb129fd5a546bdb
SHA1010b4e5fc3f57734427068b6c0d343fc16722e02
SHA25679c2da36c1a006e608ad652ed19dae79e0ba4ef962938d064ed936b4c80e22b8
SHA512f00b40ba0ecd55bcf0ceb88389132e567e35e621fcc53837cd613a86be2f2d4162f33160e470378cdae3641d5e43d3518ecc5a5c20337b8490631ee574d61c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8c383545b526928e04c0d36def5e902
SHA13c505e654059f564ae3164e780951243b93a7d50
SHA25624c28c23cb7138e6dc42549e01aa5d83f42ade92decb64958b8f0c961fa983d0
SHA512822a76c45809014476797b2cbd3ab81f0eee925a4844ba03ba130d6d4f17837a657a2f3ef6d47e819e2cdecdfb12ed4d4183752f9b2bb46bfd4e97bdf6a5b09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58835eae8537dcc9d49a86c2f6183ec68
SHA1d409858d91ce715736b22495b16f286885eca64a
SHA25667bbad367c561cb68f157c0ade1f02e4eecd2bd7acdfff3135d524ead4f3fac7
SHA512ee79d82a46c540606211bc4fff16417e1e6620671d597ceeafa6b27cec105c82afbd565272af9444bfff0e17325fd260ec135e5e970346e90e3ff93500c3786f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592d293f31f1dab38d635412b1a4b8783
SHA149d8963011120ec97f1d3482a5cee0ba924ec510
SHA256da6efd20c349c4725ec121bb69fe48ebc0b759792514aca3a70a8180d679050f
SHA5124de01d6afb6c0f9d601a3e5451d1c2dfeccb4c94ad1148a19d999d029e734f449d61f9b01250b6f59325592ea7c0e39148e3e2cae2aa7eaf7097ab7dfc1a4d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff8604c1e0c14fe4521b0b887dc1be53
SHA108dd88c7309e8aefd6477ec5c6ea40c43a569b37
SHA2562f6b34b0b3a68daadec4397bc274b11097195c43687957ffbd290733f1b3b23f
SHA512b2e981321abb28429a74271590fca37abb88c88c68ff39b9170d2615ad8481bb71595e345cf6b975a2e319c2c597ff863f8f5cd10d7acb4151e9d0e36f8a5a7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b43bab9d5df26c20c324527ff297147
SHA1a4043dccaa393825177d9089ffc04de3fcd927c0
SHA25602afadf5c6938fb777255ffee225983fff7b5c7f99e88bcdd7efda53b336bca4
SHA512dbffb099b26cfc0c34f4964e0d2b18fcb74556df9329bbf24a432da1412b3509f109419f1b8ffe9385e02d7c9849263acad9d4ba7a8fb14aea68f878f65f1dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad2ee45eaa78ac4fe750563bf59795cc
SHA101ceb755fbe21500a624e1651b79b0cf78bffdf7
SHA2565cdfcf9b590277934cb758caae894b21f8356cde7e24fbfd3056bde31a0d6c64
SHA51211b8b074995c98fcf8ea516a6d876ec7ac556be2808ab5dff015be942f995ac6378a4819d76d9d11e31bf803262328be1d1a4dfc71abf73ce1b2b81ef9ae6d9c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b