Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
98a4eb7150b41aab8d2e28f9fa462c68_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
98a4eb7150b41aab8d2e28f9fa462c68_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
98a4eb7150b41aab8d2e28f9fa462c68_JaffaCakes118.html
-
Size
3KB
-
MD5
98a4eb7150b41aab8d2e28f9fa462c68
-
SHA1
5d3ee3fe293d8e1326c4b497bd00961719387c6c
-
SHA256
202c3f6d522eea1bec2d3928116fb3cc609d66e03e37eb91c889af612a46c3cd
-
SHA512
640f2ab2e61d5e928813c1ba97de2848972540282509a19d9fea4180b4cdb11dfe59021d8915de272a41acf2b984124b10c3cd749c84a19ed6ee694f759a5cd5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423767229" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2548DD1-2359-11EF-A2CF-6EE901CCE9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001813372e6f87434987facf5ad3e6aaa0000000000200000000001066000000010000200000009aa2ee8e4697c1ae8b4d084b74a35d1076a9eb74e4e3eb853e6d9b7e967be8c5000000000e80000000020000200000006ff88384d261a73630fd5323f9935a99eaa8d441aa739b1a0e5e90204e3860fe900000003d53c6ef7ee8b373a014b148daa4b4c6fc612fd249661fb2f62d43d91b2370f23111db79dfb1fd6bfc0334dbc83a395c6c4d5d955a57dda0eedab56645736d49facbb1bec406b0b63cdc94bf2d101a976fbd5ab3d959544ac559d001076a356ebb6d8ae989d01edb9fd60fd9777d6942cef1d56557cd4fde570db3ac51363dd0b4742c82dc31185d09a197bdbac48e3c40000000d9f086a90aac3f477534dab05aa5697b985bc573e90f517d263e8e87c0b2a27e846786b765f40e538f9b06b64d629d28fa66a0a886f4f6da4870d0784536d10f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001813372e6f87434987facf5ad3e6aaa000000000020000000000106600000001000020000000b7e9082f28a198d5fb002e3e44fcc579dca732b5d50b5fb05901a9158b3812e0000000000e80000000020000200000002d8e073f896db2d7a49bc0b43a74ee58f91bdac6c57366626c30c29a17d5cdd620000000465875a48922a89fbe644c66677ce5ecb0dc7e8da988f154e4d0e915d8aa778d40000000c9d9efd36e36530ac278d29ccb98667edd5603a68acc6b8073e528081acd94c88fb8ffe21cae38d194d96cba59ec7b774233a1b3654be3a86f62cdd0bc5bfcc1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b1048766b7da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2328 iexplore.exe 2328 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2312 2328 iexplore.exe 28 PID 2328 wrote to memory of 2312 2328 iexplore.exe 28 PID 2328 wrote to memory of 2312 2328 iexplore.exe 28 PID 2328 wrote to memory of 2312 2328 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98a4eb7150b41aab8d2e28f9fa462c68_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD528e5eaa597c62c11e485c5b03df24b3a
SHA1ca3009413774534b69277e60c70ee13a5caa9998
SHA25649fd0b13b153f9fde53402451b4c8504de631c9695bf1debd18a56935034cc7e
SHA5125f14317846094558b2831336d7d3e3a39aeb370e791f5745312b0d85183ee7723f228baaf065c1e823e9bf1c1cddae86c4fd033d3f4e5520f91401a700416806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53dc4ae7f7d3761e7e217b43cf4840745
SHA1d48e600567cb9291b905fdd32781cf0e4e77115f
SHA2560c722cbfc0b588e862f97eb0fea03f9be170b5426e2188e3488409520f76e645
SHA51286786ce12a8f32d2180d3f5a93724a12bc5dfe39ac75d00d43a687625f6294e1954e3bc2cfdde778c05a0a4e1c43a52b10b86efd970fee1fa018d3dd8bc43182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52536ec38554f770548b66f9fcab66891
SHA1da12a1c84475424d363823363512798d5db969e9
SHA256d833f7db14ee259986b17c0c4ca44b8bc3e174d51c42efa6a3c20226520d3e13
SHA51297009d1727bfb29395319a983c29c83311638a8b8b893d795be8f9da61d3288e7449a61ed23bc765345542bdefee5724cc3ba174dc88b6ed6f6ac1b9787a7746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c5dd4b33c4ad375413e69b3d7296468a
SHA15a502f726484d17971f1e7b725e5b7a1612fb2b5
SHA256e02018588d60c008b623201fedb82e3d2442604926adc5c1dde457eae91688b8
SHA51270ca181a90235c5badc5594c1bf169889d38f6f29fe3762556b2322d304c9e2c99dade0c794276d851072b75162f983caf998a3bfebafde76d47615640526147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56f35f94acc4b2ced4313344b45477540
SHA1c4439364461886d8dc5c6943bcd5d4f9efbae352
SHA256c6941a63d42351c73b741c8c0ad8f44c3c7dd83b1f045e16eab34239ecd44bd6
SHA51235d2f8e876c790f54c695d2f4f4d6fc8574a240c501c3803bedb22bb9607c4be19ace660158e84d923f581d086a3c9e8dc418b05d62860516552fe52b68fed5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53082a4cb40d140a69d1d2192579dcbbb
SHA130d502a71137b58f5d2f7836c09f825b0a197367
SHA2560c00ccd2e8db8b53092fb9fa818d6766637351a02a166555718f210fa1867f64
SHA5122d4b9cc1eb3a1afeb69652e256dc271a9532e851a5093a2163a5cc3cd7fb93303eb26952651e4dd2c4e425b1d6e52d71f837f87e4bf627bf4a8e05cae08cd254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD560e2e3c1cbf66eddc1dfc9e610564463
SHA1f09ec8c8f984637418a8553603ec0779b13155ba
SHA256646ee8b43ef588c7b29de0bfd8c551c2eb7b0440c72c7707b07e2cd2b6e0dcf0
SHA512d2ae5ee378674bc100d94472d9ebda61edf477c918da3159d05e7cc4c886956e7a36d7ada44ea4cdcd20e2a4b2055fe84ed6f01ef6093aca6cbf96a57bd6cb16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58daa3b3daf81e8da2411c63f1ed54cca
SHA1cc7339d4286c4e7ecd4374b45118f9ed9073ed94
SHA256d43f30ca79c59b48f5e2f998e0e4e55f566220c3e9feedd201a80e8639a7e626
SHA512db911bcccf806f56b7ca6cb9c25e7ec22041782f97dae704c1b56f3b5aa3ce4b75a36a6988c81b7a1feb512c3d735d0c13e64eafee1437b9431f11d924affaa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD503588bcadad7c93233ae1c2b01566ca1
SHA16c70adc0ad6b1be2a6caceb67dd471704af9f9f4
SHA2562dba13735594f14ead49b2ebc759edbddaf5838265df0775c83ff7b7d887105f
SHA512e57a7710a8ba22fed2d786c2a3b1beeb6cd9af4d772e7443a47d79f6951e7716dabeee5c98c42d49a6fcb6968b1d4608c130aab1ec2151000742ccf9ea869ea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD513c8f9d117bf46680344f7e6765e1d01
SHA1cebeb92ebd9fd43c158ae3e8d47961cfa1cc6963
SHA2568f8a842775dfd0f0cda0844db9dd0ff67580aac2fcb9cb8813e49ff7220bfe04
SHA512fedc507808b94e4b21f0c242893b19c95afeef1da912ba03c2e67e5522c436b5de481959b6c116885724d288b00c40bd81afbbc61bd6e45da77775b01db4f1d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5116b74e5e3dbc0ee42b7fd353185ea10
SHA1a0de28951770475a6d0ec8f8ff241aeace8c38de
SHA256d20c9be79fd2884d7210a634a6de13723b63493b5ec5ee499893e42c6cf0ba6a
SHA51253dbf1854595aa43d741ee40c6ccad70c31f7a11bc739bb7c98c9239ff7466d315ce999f8cfc096d0b4a5cd0f9df3ee22db09499f72e999e23757b253b548409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a3a9caabc1bc4940229eec5817da49e4
SHA18eb26900f120245d12aff7f3ba7b0b96b1615112
SHA2568785bb751ded114a0d02d592838aa540dc68e7cb50df4231f504b078b769a11e
SHA512721568107a7ebe7018076cd7a8f5f11f18d2a1d41b201d21bc98cad13dee0cbedd00b21e02251463154efaea7f6997df2e9f5e3ec58c47fa3bf208d6d3c9a885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD553ddd3c827cf604947b3aeb80e822815
SHA16d3eff6153add9d5aed8bc3d72dbcb9fbf50ece8
SHA256a7fdc253f8087f4e2877752ba01bf36b8887b79a62b344d5f5062edc1eeffa82
SHA51263d3b9290ad6d4cf06dca17b263819df06a8111e50d52777e44e355f390835e1092c2fb32645fc2e4970ede5fbe471d2a80631af6b89f1b383e1f30d059ea262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59f4829c60aa87d3eeb999cb987568a87
SHA172849c44af1bec3f8dcdf6d20cc61319c845f106
SHA256d5b1aeb53fd7952ac9579bda14b1ec023523f6793c02bc7ea4be3dde8a74c1bd
SHA5122b2c03fb2d4df956bd11d9992ff9e65072efe54dbb00760986e5dbb426708db7e2e928051eae2a183bc8a4d623ae1e001bcbe2f1c27e32004f53efe9de89c143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50475f4e38629e78f4bcf2357cba99961
SHA1af7c69e2b9b27a559bceb1b6e38f62b77feac81d
SHA2563e7f5462e8500a7cb5956ffbc97a17ba0747c5178e4750d65e82bed46967cc38
SHA5121ef88a2b5bd1750a5c668904eef27ccaab45a65fca87a247e30d85778cec13eff155c9362bf723146b7c6a340fd8c28f7ad8f33de02fff4f9122fee256d818f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e2f9e00a02f93872416d59aa5e2a375e
SHA1205f939236ddacd3754cbcbd03fc6afd3cbce947
SHA256f65bc2add6fe8d673f98413f3722508ed2bf43801acc9769d3c742dd79b7c2ea
SHA512ca11685373498e17acdea43c48afc25f60d0456f42df89fd044ac607317d5f9f158f9299f948f6116b6cc540d54f93a64a3b61e6832211e1c3d262727aa0bd23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c72ffc58e5920b90abe76eb76d005ce4
SHA171d0e280385d5d24a4d5276d4844fd14dfc864b4
SHA25636de9a1ed9bc967fb68f84317fad25ae5395ad75171b4cc66165a8ae9d668006
SHA512244ba5734797087bb10ca5de8bec8488813b123cb7851e60bcf34fb4583326116e0528267b62740f64c51d5cb36af56c39d88e54cba77642b974052b9579ceed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b4a5e40ab1583025771cf88b8967c964
SHA1dc8436256ca4bcd3e0d544bc03a2ee38a3be9283
SHA256a3e8f7714211371806fcb742cd299a40809950ac4a4b45dd96bfc231d24193b3
SHA51289da7399831b2e0709b65e211d4b9c6b66ca46c6f70577f117d15f5b47d9240a06030d1695c490034fa1cf5d823adbaf57801675343d4225e07a12780d930024
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b