Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
9c09f3d56d5e234c852569820267f951_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c09f3d56d5e234c852569820267f951_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9c09f3d56d5e234c852569820267f951_JaffaCakes118.html
-
Size
922B
-
MD5
9c09f3d56d5e234c852569820267f951
-
SHA1
1f4a0dd3c499ad4e228d5910ad2120fe51628216
-
SHA256
bcb80f4eff07c087ecb77c5668fd2e2e3aa6e325088e9200a9dce5bf268802af
-
SHA512
98acc1f3d1a0513fafdb0eca28390a4bf39af8610616f91aacb7f0c54576f869fe1aaf4f7140228a7a2c902429b4f5f3bcd13b52e1fc004f084dd194f8a5c1d3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cef66f26e1a7d346b982dd975bd8df6600000000020000000000106600000001000020000000452378b5ee43d1d246b1eeef5e2f0fdae1ca98b1def9a874530a0928cdf080bd000000000e80000000020000200000000e9917be1029f2840fd4777f8b83de0e889d184ff5b1e21fed056018efb0f7b42000000064b1c813b6af2293118242aa14fef7dae24465bedfb7bc54bb7f906872cc308740000000679c849ddd25079f06a0dc4084c04a0927ef04d80f32b967844129bb809ee23fbd9743e3d460e9cfc83bd5dfbebca42ad67c660160e675706ba8e338b09d6b8b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cef66f26e1a7d346b982dd975bd8df6600000000020000000000106600000001000020000000a339c5710cd5269abeb26609eb92a4cf6e17852173e74ad70adeda1d47158ee0000000000e80000000020000200000001b42894e6a160eb89f4bbfee80e3d87fb2e694cf40f3fad75ee5541ab36808d09000000019323db8ec24ddf9dce4d9b7b604a45eb1f37947320825069f50d14e9d281c0a1f48142224c50115558508f6b4f3789b9f651c58a356f43b3e240be2819d3fe929c7b223e7fa4849872b599c4df65203cb0f9618c289b84e91fc371af403afff422244b75f0b94ad72ce8e3b5c410d2a373e6b222f8fa27bc90d3bee2643ee187d58fb88761c9d6a581feb0dfcc4e45d40000000de95334c94a30708dc59477e6a2054905e0106f5ffecd7e4ed913dfe1108c3681b93d32621872c9bf4cff5cef075df7a3e93d8c3a683f553646de43405590498 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209438c97fbbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424217912" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05C41EA1-2773-11EF-9988-CEEE273A2359} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 996 iexplore.exe 996 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 996 wrote to memory of 3060 996 iexplore.exe 28 PID 996 wrote to memory of 3060 996 iexplore.exe 28 PID 996 wrote to memory of 3060 996 iexplore.exe 28 PID 996 wrote to memory of 3060 996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c09f3d56d5e234c852569820267f951_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5084329787342bb3c6d5f642eb5e1c508
SHA16f6e043a09408a1b16d1cee2dd58b236d3d36a56
SHA256192571babcf45a22b391834f3fc9f89e7cc1f5ef470cff9195adf65a15f86a73
SHA512ef3fb0382afac9724e81c93990cb1b877fb2fe471d8842b87ba64397040bcf1863adf58f6b667790dd1aa5b4c6e4a4e689952ac5d89c19df5ea097e833cf310c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5742614883165bca39f2ff0dd38e137ff
SHA15f289924221e8bd5d8d027ba484f14d0a9d65306
SHA2566b4026a4fd6c4fd57273212119284cffb7a06f35777e19c5afc50e2a3b9d9f05
SHA512e2d5e1414cf0a7f68e971b4404aba1749e8edd502769c21c89f173664473a6a9ad6fedb93b50769b4db3e70ecba2b5b13857ba6415128ecb9798e87d29629617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e064c313e73a4089cedee1edde5d94a8
SHA1436010c17a85468f914a6c11e489ea66a6b55ff5
SHA256aa77005c33ab0fb38109bac4fffa4de919195deba3b7eaac7252abee30bf1dd4
SHA512dc9de85955d88838f37cae98188a8c7c0ff613c070845fbc72e8dc7c11767bea3d05943a9b86dc941f570d50da28a67173d45e53c5315f5a42d87c620d56a8cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d6a4473e84cea956aec84d8e0d03ecd
SHA102670706392bce05231fdc35e39dc2772fd06460
SHA2561f88ced310153e637d898da5bbeeb066c386d6ea4a0e0c59c92cabbe2622e529
SHA512a95e92116d4ed4189f336fd9358d9de9c5f8a6ef5281d8b6f7477f8f748d66af2188b51534908f90f353eebb1e1563e590b2fb110ba9e852d71c7bee8fa63da3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573e24f862839f80faeff8d711847aa1f
SHA10fd873b32dbe71907e69ad963c44f1d23724b15f
SHA25640121c0142760d9b7f0f228e2dd40df362b0af42c7818e5ed860de12c81a4bcd
SHA512c9f8e0f1c20f7b9c322de3210017223461c5ea30bef157ffff246e7928a92b95a62c6fb05254e3be4a52f977fb41c74282d96dcd939f8d3a23ed0028c6436ec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d22a38a2515a0b30cab89ef9d695427
SHA1526b910d17ea68d8000e0650fb14539ac1e3e371
SHA256ca4494cecc8e0f78cb93fdd497bee045f2ce747711b2e9be47865f3416ab2845
SHA512eec7a5af93a1c2fcdd6471153b17064287010ad7d869faa9f7d2d56c7463ca470de50318a0936c7fb94a4bdd9ef22c906c47527a6ad61836c913179e8b6205a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a34193dcb898c3ad340859b5e8bf5172
SHA14769dca7a63148c5d4e9ff022052d5d4c0c8a6ca
SHA256c75efab8c624b8782c196fa463f4d62696f004dafdfbb2418bd4d83f9144aaf4
SHA512a5df6f86de7d1c5c667ffe265ff43a6987f2ee079e1b07bdb64d5796d527c7468f0375e27d1d0771b38ef6f1b4960497afacfec3617688d2c63861a87b55a986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b76a0149aca7cf26ac79aa684036367
SHA1245d2b3f5c9966565c8f8b38442b96db555d2d2d
SHA256be95b64d613525431d47cfd9c10a71099478db8167f5e2b056176cddbc868e8b
SHA5129d9e00dc793c76d31403203b27278bdefdb127a9ffd9ad13713b54cabd290e8a39e6a79cd97c6144c1ea6f2a117c51f36260e0b49e02f41877558fbaa5a2cc57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cf7716c120c6e1baca64693e91e1147
SHA1eb73270fc125b2a093e37c69f8b2e599fd10705f
SHA2566f9a57a2bd78799ebab43256607477f3bd44a7a2cc0e9b3a9afaf5dee8b79dda
SHA5120ed56b50bc581f7c134c48f05b6aedcb610468935ae5ebbb4f24ef8e5b4a3743b0acb7cae10aa7ed389033b5e4d206cf0f947a456772523e3e6bcc6e8426199b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fc6e6773606a0b5d8b21233e1dce3e3
SHA1a5a056cbb8260e30eb0dc89a94092d5ac17e696e
SHA256eec04cd10ea9ac81dace5af710e0f410060d76e2f05ba3ef7a224c419985bbda
SHA512c45481aa17254818280f5d95e7204255dd6e1f27de820dcf95d671fb50d8680ac42fb50ff85d16d330f64992fb9461e938ba49916aded980f06636d369990e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59698a7ae93c58add6a9d83007f40a0ec
SHA19db679449221fe384b3fd08569a9b460cdfb076a
SHA2565fdad3076dd4cc93605b99c7286e279400f7ebef0edff3bb82ce12fd42ca7388
SHA5120b714dc411ebce491f27c8f975285b6bbfa2d51ec9d03fbbb08ad82d49b6d2cfd52718bad4f97a2cf43de0ed1bc7c1534f264bf719c3a72df56a04a2d03abe31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f705f2f603c9375d436aa82576dd9d1
SHA1983066652327776b46046c5d6f9305d9346fa1dc
SHA25612eb3d02e0396e9dd6a75b25965509e515b2c3cdf9d3b974da819358b20c4331
SHA512d58cfd2d8c2a2e836eb0cb797e62f0470bda7ab869c9de8f08eaa493f763ba22396f095600b8db4b15cfa3a22de178fecab63fca607a979d2c630e28d56ed5f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5056f48eef835b7b666ee3ac2f2b39721
SHA1f17cc590dc4bbbac183e6cef875b7abca6a036ba
SHA256be7a5554794f957e5a3fce7b3601f86013fafe03d7649e815458d093a66d17df
SHA512ca11ce2f924364b7960eed848de6e9afe1b7b22cc1b97faf2e2764df44051c634aee5914a80aea1505451ca38e2f1708febff21698de5a98e2fb48ed69d1a451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5369f2f1a3b8afd02ed8f4c09f7923340
SHA1fda777498042c0acd7ac0a30a4fa3febf58e061a
SHA25665fc22c098c5e50491af42e1f9390643aea8cb7e110fb0e30309a8d722f7a087
SHA5128012a83e7207c647a9b77ebd910034302586dc057eda60e6093bfda4945273a3f0267b252b166035ac4786a47144a6292fbc2d77f41bea61e22c4176e1f2e699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5355e921e8b88e08da90fd696267eba2d
SHA1029dd487297a5fddac4202f463d1b65da1a61b09
SHA256e6779ca34e2172f50eccd4a0e7e29aee5aef5c7e4a49497e4c916f2b0b67cc25
SHA512b71f697f9e8c3b94c20a9a932c6c745eb973cc7ca92ba53d2400a70b0e98ee6af275b667ae8c469eb000d837dddd7a71dc8df337242fb8e31ac770abbf79fe98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6fdca52e7db9813067ff54a78777912
SHA191e0af968647378f2d6a259fd7659ee162dacda7
SHA256fc5b88e2adca1842388aabcdbdad74bc2900b5bec341d2764310193595bd71f2
SHA5123326e7c76f9eb19e83f7eaae7ae4cd2cfb064c26fdf2514611ea20d5acb2fe14b0aa13b72531c88b5a77122a79ff23ce59c7fd37e59cd63182e1a90ab20888fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5069f28df4acb3a61b1998332e6b59b88
SHA1c526ff887ec4b73b226b92017d93165c8c1e5463
SHA2564c623d1cce6f66b9961305dfd33c2b8daef71e53bb5bb57b58cf55275498e944
SHA51280abb7cc22562694c56dcd2a23b3c47936d06a9d22f51d3f3474c1f440a9a2ab45ef9566ce0b819e8c32e6dfe2c192d997bf9e30f520b1b3de38355ce8de39b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0ffc20198ec1ebe8fe9ef3f39b843d1
SHA1309ffbf302ce39abd2dde2a57a1f6e3a49ce5029
SHA25663feda709bbd622a21da7174442bbe17893d44b988aa44ce95e3ca4adf77eb1d
SHA5127c0d93e38fa32b741d44730ddf3597da403c45068ee1bdc1f15a3a5c3a256845a8cda25879e9204b832e373c65aae3fab6521d5469536f6debae3ef6d7fb033e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b