Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
92680ffd19233b01207fbe4f723adad7_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
92680ffd19233b01207fbe4f723adad7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
92680ffd19233b01207fbe4f723adad7_JaffaCakes118.html
-
Size
985B
-
MD5
92680ffd19233b01207fbe4f723adad7
-
SHA1
8abcffc2a32f42d59f2f73ab31ff595961580da9
-
SHA256
a3bf572f7b3f2846407cfa247c14f1d98a36e4479080bec824814193d58554fa
-
SHA512
0e84aa3c1382d09cb59f7fe0fc05cb6d1274e63ae316637ca791c4c4ca07decfd72ac927049d6d1b90e655ed85b7b7a236f20447ced2e7d96cc699c8aec7cf5b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63310BC1-21C4-11EF-ACEB-F6A72C301AFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d9ead00964db94a8830f9b542a12daa00000000020000000000106600000001000020000000fc9bd09c6f771ade1f8fd293d57dac8318de72153bdc8ce8475d31c4ec2d1ed3000000000e80000000020000200000008cb247271e829cded2af4e876957ad91289f360e4b52132ae8e2aba26d327c1d90000000b6ca6d97ee4415b050eb72e3ca1edb2b08719b6535424a8b53d158b3426ddaf7704516e54f4557dee577c3ef669a9249b1fa1449faf45dc2ec0d5e0a81ff56f132e035a4e68221e2f96b8239d773d823b3354fbffa5bc6556004dfa27b0f9125448456920fb8d893062fd8f9c345e13cc30ebe2c425183a2526985ac60ba3dbe0263c29503c41418b8c70e9d6a164b1140000000ffadbbc97c77401a19d7c4f083fc5c0fe829df6606a392c8aba28240b24ef19034ddfbc065013dddc56828ca6937ed9313d52ea2c21166d8dc2c1c184e9d0525 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423593151" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d9ead00964db94a8830f9b542a12daa0000000002000000000010660000000100002000000017f150577dcffc907b44514ea0666abccec3de421f3645d0695bcf902176d061000000000e8000000002000020000000f92c9d003ff8f3702f581ecb4c4524e4e67f8b259d5bf39da927f5f770fceaba200000007e56374bd4e1c9b49e2ba39f2c318b2a046f03724dfc9c7c567dfce225acaa114000000007e8774ed95fab073d8e239c3a0c146897e2d4677e6c3f0484a2fcd3453906bb4133443d1be8df0adcbafe154bef73708263e2efb91592b6593b3d613c694a0c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cdb126d1b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2760 iexplore.exe 2760 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2248 2760 iexplore.exe 28 PID 2760 wrote to memory of 2248 2760 iexplore.exe 28 PID 2760 wrote to memory of 2248 2760 iexplore.exe 28 PID 2760 wrote to memory of 2248 2760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92680ffd19233b01207fbe4f723adad7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56607f5f79735369298428daae8432e9a
SHA14bc7e0a387b92a1619ebb6ec9bf955b2c7edabe1
SHA256bd21526c0fc5c73e519915c5d539578ba3f7a686faf6112ae39942d654e17f96
SHA512ca5f0a22b70d274153c4c3ac3ef24f187ff54928057b9d05f6d23a636184a350564890767dff0ee8962de8922d00acfd4095bd9f9089b491c9600f864d763cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51835c36d25dfdf1659932a1db1f8ffad
SHA162820944b34fcea05678353a2710ac6895976985
SHA25644ae2d633ab5c6d003e9340bb46411e777cdadd505389fcb45d3e7abcf49b5a0
SHA51274a5ba85c837d5f3a5c1e7b3631be1f6c46233c3a4fe6901bc5abdac095d9a49c60693c17ae9e6fa6db6435d278e1667a8ff463716621ae10a549d6ad8da7be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57446ad7d7d9ea2e870c63b95b15f9f36
SHA164e94cbb71c0d4343e938be5ecc82bc6e7d62eda
SHA256ef061854e01b5208f57e50daaf4521b015fca656fc638a76a0afbac98fe7af45
SHA512c60f7b6301afa9722cfa61b0f19144bf22cb8fa3a1d8f0c050c3c0035261abfe2124ce46cab9082c578e76c61ee9213713c4e781a82a638d38e9e1bbeccef871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584096e12d6d5805351103d2c7168522a
SHA1e3babcab47b69f7a5fd3259cc65f447add6a6429
SHA25665aa00c41d3f38d11b64e7f13ba64ad18d145edcb2cce3abd0b3a6327a81c314
SHA512445d7644d506a73a6e18ba2a52ef560c2746dc0072e4b473943e68079a94b62b75354c40678862063214ddc3c640a936a8a10518a032ff5bece2b8062f3b41f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcf0b5cc1eb9d8aa807a3bb88b55b948
SHA104390364d8e57e1d7a12f8d40f86509e284c1a88
SHA2568815136b752a6d03244964d18be680c09214e3be18b7e9e0c9abac0afd52a9ea
SHA51284648a4ce3fbe33410521419c30558bf1afcf906fb7ccce1cdd76dbe4d490827b9e54ca1e53781e6fa58051b7deab0741cd8dcebe908fc953717ecfb9d60070f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555d9ce773408e4e8132135c46e4a4db8
SHA1a6b0bc9eabc73ffe3a39f35a777b5d3e41cb8d94
SHA256098e725807dc021b2a4777a5d6c3de93040312ded6c921eb167aaa86f73f2c47
SHA5124658218b4adbd53677defb8f8f93e35f12678b417cc2b023ca7d3d1be2b95edb980202b7bc104cbf97df3792c1c3b7d4e376c3c4a021d20dd69ea19b43c8374e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7d75e6801d389645cee27bf6daaed53
SHA1da4d83b616a1084cd07e3683fe7c2a2770db99ae
SHA256ddea9889f9a5dc4bc19655576e666b11d8c521c0befbd4201ed93a6cf6f80742
SHA512625a8a83b30c6c5ccf56199e0ec9a3d8e655a7c0b774c32a67fb30a7a58e1c0e4c4e91cb5fa48cc588743b4f359a922540c9d54d643f7a27e4991864c44af185
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52be248c9b5fd8b64f2e4f652696661bf
SHA14fb5fc3e356052288163e585a43098cb13185fce
SHA25642b511ffa1c248ea65af722ad13ee2ba1286bfe044cacdb26eb8e09a7757840c
SHA512483a05722b764bb3a8e2240efbfed5af91f15574eec7837e97c26a9416547a52096885f20cef5d4c718b77b626651689d628235b289bf33bcba1df6183d964aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58901f1eed02800da16fbfcc0c2d83598
SHA1336dd9b0a55c45cc4dcc238a7528c504890a41bc
SHA2566ffe50f59c439463dad6f25f5684a1220692989e0dbcfcd50704acda0f5bfe2c
SHA51237c24179b5a0669ad9bd6e091fb3b62e822e220245b93ff978cd384c9580e7048a900f4d81a250c6040ef685a604c9d30c0bdac0c182189a6c1c658550228221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1984f457ade0451ebaca79d5b57eec9
SHA12805e322e6ca8ca7a6373612f7a4edcdbe8ed1eb
SHA2560ef6e3a15af544018bbf8e06331c56485e70da895efe7640f1075f990179246a
SHA512566be6d201c3683319cb8644125371088d4c13a9d3369cb60dc9ee2ce40ec29f0af1a75d3b43a4f6db984283b009a146a8a23dc705073d0f24a5aea84186ad24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dbcd9bc5378a88145c93b23cc9ebeeb
SHA1b7b6ed350da58532d71508fb0879eee8de1da83b
SHA256b74d468dfc45b007a6a5f5cb346ebc196cda9e016009c51dab370de923338ccf
SHA512c09d4c1d0eea0f469f92b1083becd3fabd2f37bee54dda60accf3d18474086de121423449171cb83cc9445055ca04c4ac4fe51a53b387d2a3a4c458738e977bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ec5ac0985184f390d695bc6ef7e6664
SHA18ab4ef7eb110445d848c6e925b32e5035b51aa58
SHA256e0db269172bae2ff7e7be9589a45f805b5e9be1c0f1defe3ab9e73b0c207cf2e
SHA512e54eefa6087862029415aaf8cc728c18f523ddc86d8ac44496166335c37f11f888f21e94cf3411de44b29680e4f8c25c56076ce0c3e2191c84c22e6fe4a84428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a0b17e9ea45474b660d0a75718bf92d
SHA180b85099891774b20e5a742686a4040a3730c045
SHA256d115fea3d7cc6366ab15f9bb584a3d0c7b156a5512992e8ddc3becd393b66ed2
SHA5126edbdf33aef1005c9715aabc658c944e0afb69b50864d5212effc0ce163c4c3b56d4266e23322d212e303860534555a27b0af8517f81ee0fe057dd58f831a773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c004801b245a77ab8bdd8545779e632
SHA15e39aa6a7eed3f5a2ffaabbff6e697b18e62d3e5
SHA256e650ee07aec6d6a3dc88d1fef53b1aac81d7a2b0aa2e838f5705af51ee3871d7
SHA5129e1b5af82491790bf1fa3969bcee7645f22c082b87d8068a7e683e9322bf3734e7eb1508b2cd9b09a7bae26412ce6cf880da91f4aee1f4edcb1843636bf5128a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9ae0eafac34336f96816a61695b7267
SHA1ad9afbb51d8cd79d1f1e73ff76250836b2f9704e
SHA2561fde026b2ee1b63340229d1246b68a2344da14c53a18c43814ff283078b8c447
SHA5126f2937d25f91f9adc027a0770c61e1648f9f0c7611cb330504fe9562f1dafa871fb195302635f19e4322eef2534ed50c99b04356be6bcc6ef76c19951a3decd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc9d53a0a3ade86bf09f096b838b0019
SHA122e59cd3f68895ef0244b91a5616c709151a9de9
SHA256e2ce8103827779ba1ed8e5333d69da294c147d1e86d0deb39e359ca50fa54681
SHA512412a9ba24079ab40a55c55a26d685ac0cef08416b4f884827b1cfff668c95c64ba284f025914e3289d7b917cf4a79bec983a1e4c9ef0a37a5e997882be78d562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58385e05a57434db09013d694bca015e6
SHA1052b77a9b10d176b30e85c7e27e02078c1eb4310
SHA2563c00e2e2871243c3aeb4e96f7dbb15618e6594320e30bd76c9e8f5afbea16cc2
SHA5123a11dd008dafcc78bf5f39e52f3ddb0ab46700647f8a1313076a7e088810b803391ad5af4d70661dbe8d6080cb51bab80beb876d1cebf44e294a9e51623b2f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f1c091ae25142714142586852ccd0ad
SHA120a3a3682167ca0c9302d78be2d986163dcbd732
SHA256ad1555d4735ee0dd9c5afae20ae27696eda11a79abdae72ec1cb9cc3e5791f3f
SHA512571770d3750d21d46603d0581aab71ec80ce895d9a1ae56a728110bda3fabf8c6dc1aacec24a47876ba2200463e7b640fb40aa3bdc088ddb2311b56a5f700cec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b