Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
9102579464dc79b83a4293a5912043df_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9102579464dc79b83a4293a5912043df_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9102579464dc79b83a4293a5912043df_JaffaCakes118.html
-
Size
3KB
-
MD5
9102579464dc79b83a4293a5912043df
-
SHA1
7ca411543745ac411b279611807a537dff3a8a8a
-
SHA256
3c253851b905388c28e4daabc405bdfc9f962c2a3c1ec6b28ec6f3c0591fadba
-
SHA512
f2cf150a853fa25ff39fb986295d16da81dc51c6170a0305e4a4ed784ad5a61133041d7fb7734d1bc241501f7e5fff4d0c5426f4d9b72ccfa70fa49b3c13902f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4f1cd375b67eb4a922e96c5e86e311c0000000002000000000010660000000100002000000016e6a42a161e815ee977a4bea3d4c32ae94111dca2f7cabfc0e54672b61efe84000000000e80000000020000200000002dc2b071f9be74b5ef4a9531a074c720920ac60971e1241359453dea606ea6ef20000000691636ee620ed11606879ea304cee3770299e86b3402e8a4cbcd4784fefbf1d14000000067ab566768da228b64f54bd0790a6fac9ffa671c04720db9c3ffccec030ea409e1718ce6f8e7ca0da20b794eaaedf113ebe92421103a140af3554d066ed0603c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E37F2561-217D-11EF-B2C4-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423562871" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4f1cd375b67eb4a922e96c5e86e311c000000000200000000001066000000010000200000004a99a510a26549f1386ae5d0a115d4386d6d2e2e0c7388e8ff388a6c6f243f67000000000e80000000020000200000002d80d80759ed0091e243eec3d4fe2e1eb33c382dca530baf6df45e4635f3d6eb90000000b69dce5767939140144d6407145dc4a95a6fda42bff015e6b9b314c522aa127f6454fc33f1af88b4ae9a554df7c76c2482f753f7ce1afa19f193b6cfd19bd8fddb40b16b5b8042bcd8f2d6e2c599376d29330d9083a935e07f1f7eab9ff944e387ecf34f8b409a010eb1d319671e84ca4887dd557dda83aa67693372f565891e25db5d2af17ff401eb28232e31562ca8400000007f940e0c16939da0cbed6e1f07733fa8873b6f9bc95af4af315f76e5f6bc58196538aa65b7b9d55612d1eb6adafdecc8a8dfaaded5a262c34186f92421494413 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201050b88ab5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2116 2368 iexplore.exe 28 PID 2368 wrote to memory of 2116 2368 iexplore.exe 28 PID 2368 wrote to memory of 2116 2368 iexplore.exe 28 PID 2368 wrote to memory of 2116 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9102579464dc79b83a4293a5912043df_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5140d9caedf4ce359b79cecc7e3c0f82a
SHA1a21daf73d7a3c6023bf8b5c56775e8123ee2ea1c
SHA256eec63b63df7ac93e16c6e0201ea7700b6c1ae8ad5a5d196954f363b698663a26
SHA5121011d199a0465b1ff6cd679a590d8ee1cc6e1dd02883a00732f306c780a888687ec060c3ce7f44b130b63f7630e96e8da001bb1b5328df3b540561c3aa348e83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e9e5645a0285c6c3dc1a784e14ff509
SHA10f784b16a759656e012c9f3ec1c1820d61ff7c6d
SHA256e668b4702bca18b7cc44be72d4e78de3b0c2997b0d2fc08dfb2fecf6b430188b
SHA512c04d24ec27e1f8a4b7bd4059b7e46e036d064787dcab71f9be0af39042f6f80d341c9f7e92e24297a5e36e3a5ec46e3897c96405decf738720ae7cd416ef8eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edcc28fc221c0ab794db95554860b5e8
SHA16d195d74f6b3f6b33091b89f6b8c5e0cdfc65ed6
SHA25660bba602ac8996e03a9c0919eb2573abc6f1aa887ed98decfa1acc2caf061adf
SHA512fde83148affbe475397b2558c788fc5c155d17ce5561eed7da4d68d015e29b32858db438b74b56d4d49594a903b7e4014084de7455994fe93df1373f11e98cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce2b12d0710ef2b52f4d53fe7a1c6bff
SHA144e38bc74065992230633356fe3afe52b384626b
SHA256ea83cd60731b5a8ecb629f3854619c62400b5f4da981f224d7fe53cac0aa0f07
SHA512e6c3009225bf0efb7d10f9e8904e7d1a01afe64b383c177660c325372eec8a374f98132982e823170b89382789109beb743de2084a2ecc00b36677096f770435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bb2999f48a74373fbdcc1732d52ca7e
SHA1b41c45614defe949701c0f962858b9c3fa2fd031
SHA2569a8c8a0e32f6cc0b57ca14bac9f5f7342311b364800f039baac290254bc9bc43
SHA512d689d8a8bf6dc7d21fd593752ee085d2255a940b00f4d62a932d9633b6fa14856dcc0dc186ff69a621bc807a11b8ee4995f8bd46359303f82b42c9cb7d56973d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fb11e66ed98aae74abdbe2404240ed3
SHA193a90ad811fe341f523a314f7d4b6216104a3237
SHA256341d2bcbe153cc9f42641830e27b2f0c22eedec9e6ccc2b96d142125456e34fc
SHA512f716188558d4bf16db19453095c4dcbc6ad350771874d4bbc91b4a913c7f3a4a9a653f227cfab85c90f9815ed2680fcef21b787c760bfcd0b1f62b4f8fab20da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54769ea8ee9e55151ab038c4850dc8c13
SHA166b119636f659b0d433e9d599d930d7315bbe37d
SHA256af05d8b3adb0150f643f3e0b060b10afde96b7a9a0742d601251e877ab14c3cb
SHA5124c6e870c2ed57ee7f3aafd311c288f4cc1ed3cadc88749170a0a86060778fee92077c00fc923114ea712b948f5d1272684fa31767962aa725ce834455fbfd4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5473c4e0c9a18b6a7620d300110c9ee5e
SHA10f269659c707cf84c195d6074e6c3cd0492a334b
SHA256bf85fdd9b49f78dcf247bf3741356f6eb4153d0ff063563b915ec8a01d982ca3
SHA512596762ad27364475cb992953d383ee5e0c952a5142495dcf28a4f99af5fd7dd7b9d9dcef8a6c2ca8db18b3d61e8432a8f0d5ef802763506d33c8521a25489cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d1a889bde50ea5863be321c2ced3d3b
SHA15d38c1061cbac0636e9c6f3091944aaf13cbaf60
SHA2566d6e362a7cd98acb614b87bd65988bd7dae1aec6a350c510a0084220af3fa605
SHA512d983d77397ad289d62c449bebe9d5fc11ccd3e19e4474ee416fb388304fba3871262f410f88570ede0eebf382fc46fe5b845105f7ef2cfa1fc24cd10ec635802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a8c141e2a4b0f2cbeec0388bc5fb283
SHA12f16200ca2d25e7a8905acc70062648d8b0a3350
SHA2566ddccd448f3960b2df824791d68916385243f0e7f17fe7ba12d443bb32746370
SHA512b8ef2adc9a81df88a7c47048e8032dc42a9adf759bdeb936e1a3886418029704817ee396e4ea3439406cbcc8f001ecaa6dc93cb82237c106f3f5b01d04325e8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b53a6b4e45634e5e616fc2f53e85c373
SHA15085e4d8a0b6a3efa3514757172e66025465608a
SHA256fe60f41b29e453d7f0ae636462b62f4a0d12e61f8eebe966e38f24279b83d564
SHA512f1d3cfdba0469de1d1f8e79d8de0a6d7146761f277815da8c0fa1c384e2c71bac7243c6fafce35d591504f6139a566ca5852b22572c92af290e2492b94bba6be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501fcb96ed57babdd4786b93252b0118d
SHA12807dfa4b1b2552925250a8abe9e64f0ab771fed
SHA256b2940870c76e99b189401d5e06b715004e48d02fdcc40f0e239397091e5f3947
SHA512638c6ab23c6ed7fb9e373a398cece644915bdaa36c378c29d082ef794ed1e7ebfb589f58b8bc5bd226a2787134061233f5252cf2a158a83a2c9980cf586a30fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5a7c5b77557e4a0a16308b5ae82a089
SHA111033b54cf6109407952a5d933d34524d0134db1
SHA256b8e133d0bc49f68b0c35a201ea66c3a610f6b88d915815db826f333a662424a4
SHA512ce6152c9b54d0adbc5e684bb99682d41eff77d9f84bfba3b913881b0bd111fba761d8ae9a54d4d1ac22dc90f7ac50ce7ed9b03357dec7e4ba07b99eae41c8086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b2606c8ffecbb0a95456bf0cd4fbbd6
SHA1626933fa00475eb1cd32e44f476c08818ac07e60
SHA25699014fae25b1331b26f19ea2cb9ac55e13d8710397e5e6bc22d2f1dc8642a590
SHA5125364daf679a4359e818be25536d4d044e624b48ab5e306b3d4795c4adc945b99967e2aed2b034f59f1fb5e89f3bea6bcd895745876a545d61298acc05cc0d582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5414816de06d12b523b0146829048421f
SHA11f32734f3b01c33476ebc486b197f080ae7212ad
SHA256186f04a0da42e838bc7e6e594f55af2196e9ddcc0ab72117486a0eae2cdd56ea
SHA512ce2b1301a789eac3ba1b0422351c19e5276e6a3138a8c1bcc71e3a5e449f466773326a97a223a4c66a30e10ac343f6e7492fe1b852ad194c54bf13076f0424de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ab31033c8473739786004b4ebd0d94d
SHA1f1f381327983ff3393c255311782599e5f65188c
SHA256f2bd4a1dda36106165cdddf8c2af8604169f69120790b459cf2f56698ee3b3c6
SHA5128d3008da4609f9df8296f1f723cf6b8793a0cdb4c2abb8a91a8661dad8d8c8a1f57ec4683a636e7d515811ef9cc24d78139e92aa685dc776fc6fb5e103f56caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c5b641f201c0d8d0c79b418168166e2
SHA128b9631ecaf6a37308df8c2b4962804ac03773e9
SHA256a614adb7f9ce86f4f39b9a95254001d0c73c4321ee29068f90633e916b3fb14e
SHA512730ddbaa6882eabd938c0fa2d7a1fa08f77fefd0398942d5667db89959c2824fbcb0581f0730955d434e751f5fd80ec4f019e2fe1adf806fc7b608f7630e8912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ceb3094963ef8f91902a504fb87e4734
SHA1678f045b78e77b0511d413ce1da13eab8659f4c3
SHA256b2d04e3086bc1eba450e25485d8b10c6538cb98632005200c295390cb7d88706
SHA512cb96a0bbeffe48a34ab98f5031f36256ddc4fcf95e2fc467d0839547684ef9d8d83699ceaddc123df522c8e42a120fbcb2382f654af1adf5ef523077fd53c6ae
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b