Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
8fa592229827886720cdf3a14c75844c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8fa592229827886720cdf3a14c75844c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8fa592229827886720cdf3a14c75844c_JaffaCakes118.html
-
Size
2KB
-
MD5
8fa592229827886720cdf3a14c75844c
-
SHA1
fc6b43ef37ff2098d48af4ecf58e45cd7923bb01
-
SHA256
5de4ca05d0f35977a53edcb89e6578acf3adf26ff39af2fc1c64d0a27dafea2e
-
SHA512
3d1deed79c816e90630cb76ac19e5c8382be5d45f0a394d219c01f5e2de97b512b9aad54ed0098441690c26bae88f577a5910e3b7778812f9c4ea2bfd1d51345
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cf7de21bec093a4897c4fe82a130882b00000000020000000000106600000001000020000000ecd11bbb398d340cb623624b07fe58baf8358e7b5a461a637917352b7ee03ea6000000000e800000000200002000000096c1460d767dc9c71b7a24488b0236b8d6b5b8bc09114db5a6eff6c67ce1e75c2000000097e0ac060740e572b9140ebf6036958f780124325c9552aa8bae313887fd1d7040000000a75940c08f48d7023b7aa195fdf2d03f03e5355957bad21a689a70cff9ad1a009016ea21d63a2fc7c5d2f3d6319296a49d3981655322e105c6c12e2676005438 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cf7de21bec093a4897c4fe82a130882b00000000020000000000106600000001000020000000bf95d8d897aa1899ad2efc728e664e2c4fdbdbabce8681631fe5112141db7150000000000e8000000002000020000000a64ddf2c98d65417924561b28984d5a5285e9c270baa341201f9a7af783ef1c7900000004aa01c7af19bfe76e487ee015f3a1b8e7d0a9779e75d8d6f2249336aa46728cc77bbb529d7a093276464272d326dd341dc89366f046921c40c726542fb5b5ad5175faaa0c3d761eac627906b14660d62b909e2014a34819bbdcf12fa545682298c7a44efe6aa115e95274ed3e167d759c5ca0c35f32130fdf5702ab8c2f32d58ec129bbd1d2d541188ffbb753e9529d94000000099d63a2c05905c41cd334d98da280dfab84c7dae3f0b726e1e02c254e5819aa183bfccdd7e34e57f54e5210317ae4da508c9f4b00489fc13771bb8d702774e12 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{324A7A41-212F-11EF-AB41-FA5112F1BCBF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ef04073cb5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423529074" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2472 2240 iexplore.exe 28 PID 2240 wrote to memory of 2472 2240 iexplore.exe 28 PID 2240 wrote to memory of 2472 2240 iexplore.exe 28 PID 2240 wrote to memory of 2472 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fa592229827886720cdf3a14c75844c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f34596baf19e7c39d28cd44147268b7
SHA146eaac89c008b7fffee8637f8a34be9c21633628
SHA256b54260177e96a3b8b2acc39d7f4a94e8174769d372449dae6828f96390ddae75
SHA512ccd104250ba0940eb7f7655daabf58e40217aa4d8ca31d7932ab24aa28492a9dba5a5c2ef383c872d6468d6b3a757e3a6579a145449f8945676431214eaf4375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b07c6031dc4e7583b375b93f2a122fad
SHA1f1a6a4c02cf5aab7917d4d2cf01ae3a215839e9d
SHA256ebf5f5d2b48d887d03c20de8c2e4bd97a10a2b8f63fc99a7631f1f02d40a4358
SHA5122a6ad938a93a502db84aeef58b8991953c4dff8dff23ed282a2bb175f2f59df1ce3cc2e7fefc24a5cb6d4790bcb33151befe45da7528fa002295acaad31c5088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f46afd95a3a00852885821627b9c8f
SHA1277086828eb4b548a8d98bbdbaf3593306833ee5
SHA256f137f489be7a58fb46215079f524fa7231b8796fd8b91bcf8583bde91791b4ff
SHA5120d6fe775802bb7e1ac33e4fceb43c856a31bfc161bb00417341263c2134870a6accb341b8a7125dd7ee1c0daa0bb5cfce1c8b1a6da1a54ffea46485460c24d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab2bbbfca66bc6c2bc1689c84b490b8a
SHA1efb80744cfa499c3d4c13893e442865919112b36
SHA256eec103fc407553e092445db4bc373c7a72934df8e5ba740849d74b5f02f9a3ce
SHA5129e9b4e1b1aafd1d3e490b44e5350fe0be6f2791a98abab460302eaeb69592b75cbf7b79222f260c5dd902590f8de30e09ff2d75171f46575377aecd7bfdfebb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5477816eddb8eebf4380bb367ecba587d
SHA145be0ad792ae0b3288936437f8a466a800582302
SHA25644e5e35d641eff8ee2e720766d36fc4275c77e883d0f44b6c35d4be051bd29da
SHA5121aad02bf249dc7438ba6d06015dabee25840f793b039fe5e5a19b50a7b3cf9691abd24f533dd5fb1c16567a423a8ae5f86dbda2e3dd65b5fb64c8af1f886ee6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a962209eb13707d388cf39ad02462aa2
SHA1d7b508f547cb5e3fe9b153f89398ed07b117fa07
SHA256668b33bdd9ab91745236dcf88aa32624288983b254f0fac05f0fd6a54c9857ed
SHA5128254ac6dc99ec8b8431c05949735ec7364963fce7a7731cc427e9967fac5b93b881bacab2dc9d00739f6164dda185fd5d267bdc37013085e695bf42d5b74fae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc4ad3ee675eac7484f6d070693e6cac
SHA19b2d80f0d55ec22e834d1747ad985d66cf36b206
SHA2565d7585692cb86e79f3f2449d3dc8f1307a78da4f0395c8cd66f3d3e2afd0edde
SHA5127c9f87396b1b85cb43e1cb9b34f78023e1ca8bd3f1d7a70aea2b26895d379e9f9c1f522e499a323227c6e50e51d1769bd167efc24eda4f116d18eac5bcd6f187
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c888e47f2ea2104cbcd53ac418c1077c
SHA1bcc065e133fb163da5f765bc7f6fe18f2b24411d
SHA256ee047934422d0b450742eb4e7be336eeab7d5e502b3d148cf129c5a78190e02e
SHA5122e2ae68c32c3da4cc47fcf71008c90edfd8636c72067125e03cd17a6da67faa88e83cb8276c1166ec4785b308571c5cbea238bcfe20c3e286a5b6383833c50af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c145e5a97377c295cff2d6e2fb11ebe
SHA19b02f7a376613ab56a6c8468e310ad124bfa3c22
SHA256421771e12c70e623527edbba8f802f40a1d29949bf15c87a825270fd5bce7ca4
SHA512459ec39bcfc6a6d38eaec8c0482d04cd21433d278ac188e543d8d03f79955686638eb8f43af4af6c5c187fb47998e89090dfff40dea00ca82d6113cd3c647956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd92eb38ae6d3af60a37ab540edc5eb5
SHA121987f19c9106591376196035dfc44984aa65e95
SHA2569bfae44df5e76e62dfe13d9a315a83812a49399be327d9d9c4a98e5d2622e454
SHA512aafb58696a5934997bd1d18fb35beba9828149fb02971e3a51f73aeb6296037d29122bb5adfaca3cac64b02191b76bb169dc837c20b12029d4bbae13eb731bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd8792086af52246602ab16388a4b2b
SHA1051c8927b71acde7a06849c15cebaeabdb026476
SHA2560c950d0b06b7ab4d6d4de5cc18ee1ed00c3ad87e2f777314bd418affcb8ec24a
SHA51292f3a5e20f680da71e401665649441df4826ff525922c435d38509bd36c6bee11f6952ed9aedc818ee93a70c79eb06e12062ddd035a1ad1266c28d085d2bfe7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b31688a4920a77e96cc0b014269db200
SHA1bbf975e5d333169789267446e1d51879f780a668
SHA2560a3aaf3156db6bf09d258fd4fe31e882b414df16f655ef663f49c7de0264939c
SHA5122bf214f0abea95c2ffb516589c1886ce8e404b1467a0a1b959e64599c8f67b5b17ffbe913f3aa7730cec8038a7b984a56c0120b8366ffb947a928304eefacdfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3dcdb1648abfc0dd6e42891be21fc31
SHA11062225a0b7b2d0b1ddbdca6e7ec8907b96b64a8
SHA256131ad36de4ea2ce766c7c18e69f568443080bd403e8c873eec78fed077fe805b
SHA5122d64639085c616f7a04c6abcd006eaae0f0375e554632eb2369ad771b5938a33bfe4bafb842b8d086ce0cb91f41739aa19bfaa11af8a162c929c76085398e80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d24436aec9661f49ae806e8647bd2032
SHA19734ad064981e905bee01ccb9c63ecc44888a7d0
SHA2566068911722a6e9504fabf43a122a38133554525642d762111a93572f08d9d264
SHA51249134cd80659795bf0a35ae779cb5b418a2eccd7b5da1ea6a83c9122646c9ed77d4fa0b56045f94ae044ba93bc99424f7b127809dc1343e3be3cb1936e8a6dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5103e87da98b545f67dec22285db2b34d
SHA197a7caee1ff6d0b0e1703bb30a43eaa59aca7b2b
SHA256c3df961845e09062a629148087bbb908c334ecdbe3672fa23333629d6e907153
SHA512f59ce36fdb642277d4d4024bac7b597adc3e186fb088c63f8416c2831f16a486586b61a225830a925d8b4172288c73ad59e6adfef9396ca08b4920e94bf3b93f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc50997c42359aa1381c5e7e4a324bda
SHA1458e438467d4983c36f6fc1560a9130d17cea40f
SHA2562c3815dd07ec569aae4c0188b7554cf1d6b4dbfa731c72812428abf9f0dc095f
SHA512be33fc314bb081ae027bb4450ea0767eee5b324221e111389e0f0dbe1f2c9376246dc482e17bc0f804ea3a95a01ec7f92e42668f6ee9ea4a17bfb02f149ca424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb749e8df14eb2272ef1e4fba4872439
SHA1d1e67be8448aea4f9b23be12cb9b24336ebf9ffa
SHA25643bc865669223d0bb72ab16d7feafaf8773d73550a375fd98d597e0f1d5da932
SHA512c734c923b8567315d3593e32d26f8d3732b7fd0d86b16146f666aa8f1b5108b1afc33552e1c1a0ac37c988f95e45b020b476587da1dc0950aef486b811eccd9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef178285f28e36253dc81928d320ed73
SHA18204ff9fc9f66a8c95acf8c24fcf50a293fe5b9e
SHA256277712e6c69ca592102a830b9943adf9332bfea448e728b66b5f45ad98584b27
SHA512531d2fd7f80c35a5bc3985dcfbdfb16d674cc6a0f962344d75facc63f73ec8ad1bfa340bb8519cd752633e78ed52c8b69b4dc95fa9fa26f7cdd9e8a0d1086eae
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b