Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 09:33
Static task
static1
Behavioral task
behavioral1
Sample
914b93080834b4dad40c9c3d031d4130_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
914b93080834b4dad40c9c3d031d4130_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
914b93080834b4dad40c9c3d031d4130_JaffaCakes118.html
-
Size
3KB
-
MD5
914b93080834b4dad40c9c3d031d4130
-
SHA1
9db5071f9f2f8dab84f5646001d25e4d843f4ff6
-
SHA256
3ec1bc03ff716d9b6dd003970f8d9fc6591b0687be7e5d44df6e5daa8c41c72b
-
SHA512
68521b13c8a378fb02c3ed6496bd3fc480ba7f1d4e4a6baed37f924631d3c2bee137b43e4582f5b844bf13abc4c649b9ccacbd838a7980eb0c97377aee2174d9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b588f36b7b7f620ead5e70f81558c2c4f0a1078df2bbf5d761b5f347edca2d9d000000000e800000000200002000000061d357a5c7ddaa30617dbab7929d81e7702dd4a59cc0b9ac5493627622165bab90000000df5975bc388ebbb1feafaf2a2d93292e17d3be508b5da98681dd981c663a87e944058cc677f2b03ef31aff32653c67f9dab838c72987f3c253f98e7abc521d2605f0fb67e68c13155d101bfc559c3f383e7ed482352f4da133254499aee116603c2578f38605dc73f1fdff06f0c6ce8637773e73e563c84ff3641b827db9debce312db5ad6f0cf1917ca97474fe6eff64000000048f0d78e1f07b3a257f55d41f21174205661b1765849178cedf23aae2ecc65043e417c2c567bc0f266642e4390a807efec545f7d3a31e4f292c9bbd74f8f04cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005695449c7dfa3f970b14e66fb0ec7887b31f96da57f6b929e8e0b7fdc2ff7b85000000000e80000000020000200000006196c4043d3a80eaab0f7501aaa6bc7ccf0a1af12b9c8c7f00ac5c87f8dd1a4820000000badee3ed88b958475ff06b1178b466de862000d9fae9b882ff6ab6bc998236fb400000009bfec6364f175179045dff54150d80281664b6251e793b52ac7c68b2bdff91546ee6db9e6bb7ebdea2a09e5122f87364ed7609e7c2198e3d483f73c4a6e32562 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{686F5ED1-218C-11EF-91AC-F2A35BA0AE8D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0341f3d99b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423569107" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2748 iexplore.exe 2748 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2620 2748 iexplore.exe 28 PID 2748 wrote to memory of 2620 2748 iexplore.exe 28 PID 2748 wrote to memory of 2620 2748 iexplore.exe 28 PID 2748 wrote to memory of 2620 2748 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\914b93080834b4dad40c9c3d031d4130_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4238b629ffb80ec2f3c67286d649cd6
SHA164a773af7288290eda09aea4d80720ee961c358b
SHA256b43ef723c82da2511cc0adc34890e378f1c2d57d6d9f34e75ae995d0a011554b
SHA512c1118a941724bd8e913c7f3ba711cdd170a0178070aedaddb48f3105e93082b344af22885e21a4bade9e78c5582391dde17517f34b68b5a571bde75bd0daaba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f387ae3d7756bcb73d14c84b9bfde65f
SHA10db7e9c238ba21bad275b15064e632e49ca4cca3
SHA256f34aa892c698b8dffbd434d5cc0720a25e7580f92a885739f50de970415e66dd
SHA512672197beec361a27bc3435407ea6228abf1fbdea1cb0d5683b3cc3fd47429c8157444683aaaf01d04382e448246fb9030e781c923a85de08fcd6fef88d74d483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532643c163bd67ecbaf74c135c247048c
SHA137295bbfadbb67d3da01b4e2823275db2d3710b9
SHA256e929c8fe3d3c71c1b92287f91b50442d96fa257b3725951a1e8de8a75fc0e3de
SHA512554de628303567a80a4f8758b2f1774f4a3f79af9a6999bdf18af7dcc7cc9948c5b6a5c79536dd760305c0ea70bc0008963cbb528f25934039fad4bb67735d82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5750662ef88105904e089490a6d4f61ae
SHA1bb81d0b233210f3e47a80c4a6ac9852d37a9d0c0
SHA256a7b7942053eaf6c577ef60b87f7f29a4de8970b0e8f921c90fedd41e7af81f89
SHA51258bb399fa15df17b277928fece77f2383f48ede121b54bf50c671fe24ed5d812fcc8a48e58e7aee0312ef877a0d0b568f6e4d1be59e51d78361ae59ea7433e4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a00456300f7a7d07b58be4bf3447426
SHA126f017366d89cc60f8a1121e89222e9b1ee177a4
SHA256193b0c48eb305fa310e42fd003ee3ad190414e700d1360f34c94a490ae18052f
SHA5124a932844295bda506e2fc2abc73ae4837c8a43d3dec4ed7888a862f004760b5f676050b0282201df8b196d40755262a554b339768d11e9aef84c93375ec5a8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd61023979c35206ecfaafbcce1ea616
SHA15d4d8420bac6d1fa84b1fd7f539a8072434230ef
SHA256b54b0a282b971ec03f6b67666f8a551f8bf42acc92f687ec693dd5cfa810fd36
SHA5125d87123292848f3a5d03d9dc6635447ca2f3daf1ceba9583174ca0803734c0866a172a08555cc63b7b2a429b06eed3917dbdc6465cef4f993ddf5e20ba1532d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2a70400fa270353b645a750268eeffa
SHA1ef040c500b94a72237c9e9c49778833df5824cde
SHA256a2be59d1d50b422e7d2558c39290196d821825000464062d8a18defd2d94c157
SHA51247bf4acb8cdb6c23de948d1a290bf80be85ec8a7b40a00d76d26d2f33835451bbb6e84317f859906f9ac25dc46e52d8c6566686de5ce2c71753de44ccbab8193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fac0da01edb2069a9e00588a695129b
SHA103c3921e7902595d0cf83c3d293075bbfa94e089
SHA256cdd6c099e2f8578c5da2641c87b2da157bacf17c0cfa6a1d3a47a3337e3eae99
SHA512282310339389bd69e53d866c7794d5f4fc3010f2a65e88c45d7c8d3627b49aa43e0a432b740519f325e4a103b4da19c1eb1b89415c549d9c347c406c27867c2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b49c618c539f633ced77ccd27a26d986
SHA15c06edd13d122313d44e4e338154f6a71b0427af
SHA25663d035dbf03dde8cfd0be1361b2f2d3c607ac6a100f9cda4157e8fb366b5c00f
SHA512634995fb5785fd11830684656993e68d1a0cf2aef7ef6f32c72bdb69a9b46521c59df2f76d6c88c86de7bc4f40e411949bde1e06ff1c526ca8faca7beff7d9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ccb84d8b370b46acab4655f16b5410b
SHA1fb0ae6e0d6f981c4f8b3a5788a4da5dd1f52a11f
SHA2565fb0953467186f5f136493dbf52b16b25242492a5ea7c35a2f681d9f13209a6b
SHA512229991a5798884937cf3adef4167dc14dce71543eba59e1be7689e5216e2708653f91f0594037383b2d5195bd47187b191ac2ea19d8a6ad308ac6a10f7733fe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550e469fb5beacd10dcab0ec99ae7455a
SHA1cfef610ec43b2877af5987a8b88ee4cc2f62ba48
SHA256856642c2f153ff9f9fcd6d294cb4ae3c1fa52f711d6554be1d0613dc50d38680
SHA51250a880cafd2018a9e10a286d3c833423e241ca62399b9e2c7ac9cc46d921661a3767d2f878f74de8fad63b41cd3b99292937bd6a00685ae2a4191b314879ece2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf1ddd0956509912433e99c851e0785
SHA109672b055079d1ae3e10b03f4b111eac4206fd74
SHA25691b82fd27d61b7734b6ee5c47dff16e6653499d98fa5f9ac3b53fea39fec825e
SHA5121e3ffac809896e96f95f29c0b0edd6efb9daf196e6f5984e971bbc1162a459623fd59078117d3349cc8fc686fe4fb1c9d31574909f5e7e1491e5998bd541add9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b237c2f8dd41e8f2c00fdc6afa8befb4
SHA1d7755f63490b68f499e6b5ca411856f2ede74818
SHA25696f3e5cd3a3724251e9136ceaf44290e54c85d444dfec1dd0775e18656322e4c
SHA512293c79df1cbf326e25ba59b6cc207a3dc7bd29c8b2b70bafcc89d4e07fe85611f4e4b3e4a81ca2bc8dbe81869a7827cea12ba857cbb4e524257aee35fc00da26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f81d5a0a308a75885ad31b9ffb9c025d
SHA14d28a9dcc005dbd151b9868e44c0acb2252b7890
SHA256233133c060e80413694d45ad1e4c8516d1d088c220ff70787b5fd00674f10e55
SHA512622806b9de32c9d07d63a4b42e0854bea6024ac71cff69588a1141b7f63873a532f1fec6a508b71f19ed77d2cdd366d6d6243f58f6f683f9d41787b0ec57d246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cf62b78f9aeee864b40a6a8b93cb912
SHA1a7cc92846ab9a10dbe250860a680f12a570c2362
SHA25683cd0a1e90c7e19aec9ddc5c45f50f08b1a85dbee863d185f8db2615fe0fd666
SHA5123e125c5527d02daa3c53544c514e0162d636385e69c30b3d11b554762df9e2be96f52164d43db852ed513960448d363117f37fd643429363d2b70d967ae9357a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c2a9be27821f77cdd6a2f61467b615
SHA1fc2649690ddf5253da73653696a799c56718e5c2
SHA256e6a4f0770e13cef137a4c5560a491ab8d9698351b31a4e1fdce4c472e0e32c27
SHA5125940ada6bb160eec7e1128f097d9307c3b9c4b0e4d5e215c043e06958379522afdaa6c72c8089b033b3e69d4daa6d815e6b1b320d6ce17a71e3316ed8a2da35b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2c4fa429b520f8f6d6f1cd719d25c5b
SHA13d70c2d57e75874a83e46bcf9715f475793081a2
SHA256d0f1463b4f8a0dcf8c9f1813951d1645bf18dd2846856caad3d8bda61652b38d
SHA512b4ecb41674d049b08ff4d39095c150095b563a3f9bc2d6c51425fb926507c600467cc91eb46513e72bab2408718c93e97509fe3abd50f4cfb41c7ad92b800108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8c37f1d2d4e068ee6cfdfefdd4d3e04
SHA148806edafaaeaf7d6b67bd28a4fa825a8bf25fba
SHA25627942f39e4b79a0e5281b8ef990868d5a9b2ddb380d03d3c5549a4f0b692a8d2
SHA5121674131265612f6f91e71f9a04a32cc09f8c49c2117be96d13445e804511957306fb2b6925c1fd96f7954342acf0e8b93bfaf0f43a3e673399e66510ab59c496
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b