Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 00:42
Static task
static1
Behavioral task
behavioral1
Sample
932b12c5416febee1560e831774b6989_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
932b12c5416febee1560e831774b6989_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
932b12c5416febee1560e831774b6989_JaffaCakes118.html
-
Size
2KB
-
MD5
932b12c5416febee1560e831774b6989
-
SHA1
a9157f48fc85fcf189a274064b470cc1e5d35191
-
SHA256
3b186ff3d05ce117e4149410729ad2da0f0a259e42380aacf4e036b6918418fa
-
SHA512
f8dfa96fbaa3bc57c5dd5ca75d937a5186f84866e4a98bc75654b163c11bd608766e05b9c0cee8d541aee249a9ca0de39c2af98b75180241e9b3d90ec0489fc3
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ea5034bcd21a8439426f1df62d6a70100000000020000000000106600000001000020000000a2d35110dbe9f18146aa52f7c2c6c39d96df671e5a7b256f9df7e45c98adc407000000000e8000000002000020000000a480cd3c259a2c06e0d31d6b3c60bd3a2f7fa0211e55ac169f31f9088ac068c090000000ca21d4e13250cac57d35d2069a5e07030a320daab9149ec10212b91bbf06af0a1248499424f7c3a93fe8e5e9ea7b0b742300b544dffb3ad17d7e8d865193933abb6a6dcd8922f23a3e7aa78470783d641561c1c31c3ea92cc65a4084907a81b9716de47c7bf7428a4661e7a2ac8292093c6b306491324f71cf21effc5869fcafc2906a70ca3a308108fcbec4f89e313e400000003f31524074d523e1d559ce5366bf6350709155a903ce9506297e882fa72f2605d0dc71a0155f3cacaa17e6f1064f6be1d0882bd8f848d19d1d82f9dc26386196 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC958B1-220B-11EF-972F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40485c2018b6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423623606" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ea5034bcd21a8439426f1df62d6a701000000000200000000001066000000010000200000002eb4c6c78ad945d9bdf4ed3681e624310ea35408d0531653790a037afd5bbb17000000000e800000000200002000000032960b0729601f9e66ba081be59eee642c87abc91dcb07737b2833d9f8272b62200000009bd8daacca96dd414657029cf8efb7ab7206eb587686f8cd9822e4ebf4d6a96e4000000090e177ed780884194dfb8f625a5a647a32751802e42e8adc0240326baa52b1cbca487906709349634e96e18d6f4ab6907962f743bed28e3bb9989c9b40c5155c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28 PID 1940 wrote to memory of 2368 1940 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\932b12c5416febee1560e831774b6989_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aa344c03214c4fd0a6f659077497543
SHA10126de2ce75a28d4e555a83d5be12c20fd5cdc6d
SHA256c96b672eff95967e4dac4f11c1fe74f2cb39675d8655e14847d50403f625b4f2
SHA51209208dacacac7df457fa9d406e51350c02aad9cb4e693df25b4012b1d8771ceaeecbd6a831322748bcef448c5bcff216df4191e2305f04c41027179fe7799f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567ffc6489609ad25bc21a9771e5c901b
SHA10f1846b4e3037368a00da65f609e78fc98b8d7c4
SHA2564f8ef6c3849f1dcec16fead07bc7041b1f962b4e714abb63ba6f052fd3f13929
SHA512e39aab7ab3186f942c7da2b07bb956d50f45c072b721fa2f78d7d6c4cd6c456e8fb38419977c40ec70b01ac9927b550f510a6534341bf959039c14563a7ac343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a893c04c7c288aa90ff263cc9dff8782
SHA19fa29a24df0c54d495997a3601ed6a2044aaabcb
SHA256c1a5c625b4b5a947a5c8a6a56cff34b59c01aa68b21448d947c076c27363399c
SHA512862e7da23ca409e2fe26c8a75a9cdfd309ef7e5b658ff097a8405d2c4dc33678997a0a0b19be35c63167cd4244a798184e67623f7dfc5539eab3ef7df9ad74e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc6449b648a57c801d6177867f1f30a8
SHA15eb36da2e85df393f878ac65a7f79247cbb194f0
SHA2568cff4f298527f42a9c3022c0287b25a0f143f1cd3be73d9f40930f208f0e1620
SHA51236c10b8aa9dc6882e375ebc7066fedc8baacba121475658910f2341057a73991550dfe1f8d37bd66fa8d911dd01f6dd0c3fbc3db84197eebfee65d130134046b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5100f4afb4647ef14c4552e42bb4a1acb
SHA1b29bc9bb339d8f76e70c581f1051d463373729dc
SHA2561a05d5b8d98e0d8d02c265d5a08777b4e933da71e0f8eb059ef20933b3ee334e
SHA5128952a3bf85fb7b047e3f3e0c5e287ec56498640cc97a2a3d3fc2c04137e22b4e54f81bedf49adbb20b4f218285620d22a8c92f7d6c8efa0c8edf0ed4c630d78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56969f98b08d84c7a4be0232febcb825b
SHA1050fc07112aa4bf19f6b36cb2172e83098ed24bd
SHA2567f8ef4614b327b96e4722b8f110fc053f7814e32a8cd484b30fb5327e1db8319
SHA51272fc3813a8f48d6d9edd0cb7c333e1c227ccaf0ba2380ab63ad4c8927e7c223938f24f3dbe18d8ded1e3bc0397742ea1982576fb0272a95148ecc120a5891537
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1b2aaf760db38f8c3b2a2f51c81a47d
SHA1d71a47dd2970b52cb965204225b4512825867ee3
SHA2561b9208e5fbf16e54628bc7cc034faaf2c8d452c983fbeb7793860911d5faa8b8
SHA512f842674c457c29d84afe1cb423f0c4ec5681f664b39d1b7b30cdf7b8f2363572814f0e7635b014fe0818f4662dbb0ddaba2922124ef8027681652d823d4f7f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52811436327d2ef81ad1c3247b8fcb93f
SHA1767aa2ea61c82b8635830320d3bd113b8cb2c0d2
SHA256b15a0d42c61155a784b3bf1670a4feeeee4f086f17d9144b58d76ebe6aba00c2
SHA5125af69851f8f1a1b1593a0d169d01ac8b4368c9007077b1e9f4b39ff69c0ce7f6a514eccbe58fbfe5a627073ce49fcc3ab379a20bab8a016e2ca733b893edd41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ea99d741edba050a7e2df6f1512325b
SHA1cf4d1a99ef4c428f0c587cb8fac810ae73a07f77
SHA256fbbd2eb11b883fcd3aa4f8c87d36a9472382eac64db4a82ea897071d2e904bbf
SHA51264230c4bd557ceea21cb8c4afa069552015676f074a29abe59e5c828534e0c8d741d09c2d6e4cdf354e91b0d21ce7b0e6bc942291247876b076ff5e78a58c06e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8ae5ec734d7aac6b2c5bd27369a9f33
SHA1069eef634fdc9807de9393eff07540bad07e69e7
SHA256c650aba3530c0045b51a10acaf1690ea4ff6da4cbbab6d7d6d0c2f2fd3453666
SHA512f72ab04b459b935850735d6e85efd6c0c4cc6605409cccfc0204dcf80d2a8f8b9a995f5990da7fbbeffeddeb8d80b6fcb1697d0afacddf918e47ceff65b8e498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d388a6aabfed19f2e32ef76852552bff
SHA19ce9f043dae7e8c67cde4a621dd7761b6f5325ae
SHA256f3cc03836e6b64788108c5032f090a4a0f3e9b4a681646883a8daa8e4a855aa9
SHA5126ee416f28cab59dff836f9a1551915d2118dffa171e2622afdacffeadf0fca13523b041df0afbf4169ca0bb0a4255a922c2b78c5227778390c371de1207155fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bd239af26cfb82d02a4a1cd6591ca98
SHA12fb5f554cf2fbe783e49f666a87b760bcc3a590b
SHA2560df0178116e30eafbdc92c948b90e2100abce80677d0083b3f4ddd2b45957769
SHA512727da62713fe493573c6ec83d9517025491232e3b15e77efe387f19f6ff9453631a05eed57432e05a1a86810b83a981ecf75d005b9d12082adc597f2776c7e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536fcaa43ba84882d11c8bbdc13ba7513
SHA1da4bc9220f280e5540b8c57c818728d1c0f48dc2
SHA25607f7731a43ce97c3ad805eed645f2bd82f129087257abc8117f0bfd5ba58ecb5
SHA5124c96c7f5d523ac5f33eb0c34a6a52f4846913b6ff1e9f1459eb3376a54d2587588be2f865b874619e50e66aef712bbe4f15f18e9dd07b6168d2dd167c2df481d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8095dd638903b504d6744c96cd3849
SHA1e4326f07ca081ba776c6ab667ca5f7599a9122d0
SHA2563b715953a926118deb8d694424abcee5762e83337b34de1118664d676723a8de
SHA5122eaebe809e54fe086fbb39c42cc20f17b332ac6d4855a238a1229362229290ecac18c288090773c5b30525dcfb0af7de4b410ae2aac4e9a2d687574722514dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a439a391ed95d1a46ffa215b00d659e
SHA1678b4a8716506c7414b171dfebe1568bd038bc26
SHA256999e0750aafe5da04b6cfee0272d0df80bb374803042e2cec2da1c45cbb9aa37
SHA5122c5a842b95fbcecb2f0babdceba75fe6cd417e957cb16647f727c0b0d515740fde5dfcd121dcecd2f63c94553181d65c81f174d517a2ba1e62aeccaf7d45c606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56afa7e80287bdb4ba708639502a93cd5
SHA1426cc55fe49df42d4ddc9e4a33b1ad0c20f4803b
SHA2562695082cb5f645ce5448c730f2c6dc8e5bb6312e901d9400e34a3f616f07c084
SHA51294ecc765c5885de270c2d7cb0a45d83318f3f0743989ed7c272cae1e76f6936045685e9605de64fb8c5227cbecd890d18c3166fbc64ed82e76625827e3883a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56829e71dbf5ef84299ff3e3d8e390642
SHA1a223886c240c958d8808911d6445ea3043420b6c
SHA2562dce3f1a8b2a114de0892f5e5ae5718efcf2cb87353d52cd1d26b7c6ee680c0d
SHA512e754efe11fba7cd750da5f2998d993a0948a96500f0df642606c45fd1995d7254aeb2728aae8aab52ddb3e5c39fde5049342fdbbebe2716cbcaf75b1f7065fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d7a7fff652485af543bedbcbe6aa292
SHA15c556fbacdc6b1a9d3f1411329e79ec545509b4c
SHA25681d7dc701ba09707698d5316ed1f2174a0a9b3b1a2eeea6ff884576f6cbf62c4
SHA5128097297f35905bde3405f9a2f56964de6a8d74f3d2115e46c422ecc0d9e6c6d64e817148b71270bf091c3109af200e59d5b112131be9fd9aebbb0952c5e899e4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b