Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
9c8a928052f6d315e93cf2f116750ad3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9c8a928052f6d315e93cf2f116750ad3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9c8a928052f6d315e93cf2f116750ad3_JaffaCakes118.html
-
Size
549B
-
MD5
9c8a928052f6d315e93cf2f116750ad3
-
SHA1
303e25f6d0980efc522c68da48d61c028a27cf6a
-
SHA256
1e5c7cf449d6b01a84f8f4e7e37dd4be5a62acca6c83ca840258a7d744057666
-
SHA512
f8f1537bb3617bf7da60acc8700ff5be7e9850e86c0dad1ea5e3c5d4fed5da885332fc54b696af47a032b8be2b409cb57aee2b4a27cf45fc1b9a846ab56e5eb9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424230354" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE596221-278F-11EF-92B8-52226696DE45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4a62d114e441b409780e41f77706c7d00000000020000000000106600000001000020000000797ed5c9a9cca1c0199c0c728bce959acdbbc0ad565c14193b6ff8e1487a8317000000000e8000000002000020000000c13b6bd3c12a26e41ffe6109c616b5d8b13ad5edf203a4d225ea50b2641f131c20000000f188689c55dedd930bec778f6b19052eb1e262eda66753cba75ff244fe05f15f40000000ef5321f09ab8bbbe544ce303b5bae57cf486456498a043a7d28612bebe3cf12a81f3f22b62b7f9c46566e4ad2eecf54afdec113b0bdb18501493b5f698e83416 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ccded29cbbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4a62d114e441b409780e41f77706c7d00000000020000000000106600000001000020000000b137315d199e039a668fe3aedcc0ccb618896cc60603abefc7a036a59f33356d000000000e800000000200002000000006f8073df7335a50f8a7b6790b004068b0203c5b0d3b4f5b53f8aa7e24ff127690000000d3fa045fa463dcd5061506063b58ec4b283087218c52b011cae18d29fb27909f03d07f1c69f9cc1d4b226b03467aea343ef79d9e1e185440217e67d6ef231dd0cdc03332a1afbbff1a5cfb32ed42711b629ed6be1e39d882558416775e6c193d106c1722c6b4a8cb7aa432a034c6e94bf91dd2480b4005d4499e798745ce444b6ec0dc64da1bd774058679a1bb8b7b7340000000cead77cb6c6eb501fdf37cbed773dade4e8b556ffcfc5e58f6f0d39e774b62b1e77160b7b8c2be5513b1cb2d9bc867faa4cdd0e701df1be2defb365d5c60873d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2216 1740 iexplore.exe 28 PID 1740 wrote to memory of 2216 1740 iexplore.exe 28 PID 1740 wrote to memory of 2216 1740 iexplore.exe 28 PID 1740 wrote to memory of 2216 1740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c8a928052f6d315e93cf2f116750ad3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bc30fd483926186decf7d1aea535c45
SHA16ba422891b5c57a31b44785ee0bbecbf2ad041f3
SHA2560233a816f47e0683994d3ac84dd0eee29e2731e40a9b37ea58c1a1243d4207db
SHA512afed2e0ec0bec4584b446bad9b145f45a727502a1189a367cc2601f0e4687ed6daac4c684fdfd989497afd99eb5b89742f8bb544c6157d2db0c70ab61f7b1c05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5d6028e4ab975ab2aed943dd2cd5fc0
SHA1f6a3961a4246a27306ad31a324d128db0efc620e
SHA256c9956aaa9acb924c84161db4a1c98f845c9f35a77fa8d131b66a580d6459033d
SHA5123255b264b49a31283dd72f191b7c7263cd2f896d821aa852fa23a5353ff9c4582010e9c2dce6364bf55e6fb84ce69e879e8c439ba033d0d663e21d918e635fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5398e89fa0c12d7239869604a292d000b
SHA132c00b4b7f06e1dd93b8d4c494104530defa277d
SHA2569d73606add15ea03b3bde801d847ac6e995c1d98b17b68d41fa736195b5b7d6b
SHA512514e75b7670b63562dc848fb72690eb878f22523b667d44d1a1ecef7c8bb38fa7750e005ac4affa2d354b72c7205a800b319c6374dc99b42fd98bc5a23b9c8fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54145e5c8b28c943c68ebb54bec2a7b52
SHA1122c56302658091c62d15c5c09d805f975df294b
SHA2569daf8759f094520ff113af7446994117daa7ed52eda138ead96c900321a26fb6
SHA512f9797556a668d367403c7054d4ae82522f250b007dcf80f1842e28a5fbe71a49777deedc9db8ec4aa6162fdef5c9c400a72ed94b5573b07df0abc86fa45fe07a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c7780873ddc207dabe8c4520196f46c
SHA177285917497bc662cd66fe234beca8f2a36b9555
SHA2565eafd06d106ccbf76da5f3a6d2b565dd9340d2fd490ec82024221363b7165308
SHA512199ab2a762645697311c61fe5b14239a02a894d66bd8ca1619c01aa0dbda18fffe0dc3429ca3c9736773565fe664d3e5d5b9c5172f31adaa7d9dc26ac5a6db70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6032ac46011b3854a5841bfa6714aad
SHA1feaeadc4afeaa34920d5730c83491c7544662387
SHA256ee4e626f9adfb5706640c1b03e77f490e4e8b41df00919e89343ec31cac16d76
SHA512ed2944a5e03b6336b26d7a10a592c98aea90621f2e419bb89877e89153c35ce5a2017e4ee809988b2938095f71e26f988448992c4b2e1a3d5b6fca77566d0fea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ccf878c20c275808c81ab3f56361b66
SHA1437b2fadc956ca80460a99e3e901991607eac6d0
SHA256e233de784a30fa98b905f014ba3571ee12dbe8b2d8e65c8b66aaaa5352567979
SHA51289a76520fe19ac3cbd5b3f7e9539cfccae22aeac343ac292adb862b4e9ab38bdf250736ce0146ab32ee2759c5f8492ce99c70f8d4b348673983ee0711f388792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb2cb130905bdafd410a31f0d9637afd
SHA149b7112503077e7a84c1af8a6fc69b28b7496179
SHA256e86f161bc2da715ac86dfc0fadf21bf1ed451348d12ce180251498789803a9d2
SHA512d1022665f5cd90539af5505c8436df5e800f3c86b7607782859dfefdd5553aff26eb6dad77dd5bf221d36a2ac4a92db844a59586b2982c95ce25de0ad06f091a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ae7532a67c681b2f6f0a69354d00b36
SHA11b527b7fc2d7ca548526007e113ba003e72bce9f
SHA256699b02e7be6e95a4ddd97b42b34f8cf3c225f2b0f4afe93b532d813b92449044
SHA512188e45026615fb786c4e9e4938ca289e16a27c872df89e31284b3e4f43a19f6f839d8e555fcd8a9f1e97f97a26cdb2f942566a3d012935e1d3039901e5bcb29d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a622661c56d74fee93f0063bfa68e145
SHA1787ab7189b56e4a794b66e237311174bd0edbb00
SHA25662c8b0863b3549154729476f58e9a6ebab8e3052ff78ba95127b62191f136cec
SHA5124647726674b88035d9fa621645ee0beea38b6ed632a117f0556883682a01553c5cfd8712f8575343ef0dacd6cf82638e4a465d8b391f7c90b2cf7b7a91a831a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59046e777865d60a6655bcd8e4903706c
SHA16f07aec56b585b67f0c33e1da36d22ba77043418
SHA25694c416a6d08737f231710c2db26e2c4284c1c4f0cbd7d9fb3ae6f48e38caf968
SHA512a66098f6b01a052f818d223a4952147040e4b830b72f811f601dc1872f1135569d9dcda856d8b7dc4321a4544553d4119cc0a80f67cc5e6048c3c73739e2e512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e34f7058da41821a07255294c8ab4e1a
SHA1db86fb8e8d02c7a60bfcc575b7f4498992c3f7b4
SHA2565f2fef57d6169208efbae5b650076e3cf6f4c5185e27295791ddda74cc39bc48
SHA5123cf1cd8af14bc594f044066b3f633e8da4bb3282adaebf3fa46ca8c3c10c8ce9e97aaa07730d2931123afb2d1dbdc8d11f636c9f6c673b64f873a34399e544e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed52a8a0b8404c0819e456453871d8fb
SHA12c722f43333ad70ec6b77120c43bd77676211c42
SHA256c7425372eca9a010ba9b207b616f9b48e6c2437bfd86068d256f25d7c88de61e
SHA5126c85b071b4e196278f80f376622e1c7d9834d984e200df85980d41edf06346b84a448ed665242fdfee9f6204ce8532362873f81e9093c1652795328b900ac3af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f5d28ce809a722a486fd91ebc6a263d
SHA1a4be5f6e24de91c1dab95a259338a7f96f364315
SHA2563193747d3b2698cfdc3c64192d57a74bcb9dc60aac7932093065360509eb7452
SHA5120532eeb4fca2036381ba20850482aa9d1ec2d84c7e854ba9863d54625f4c6240317a45a9b1c5d47e2ad3abdb370490fbb250db976a2c5e40b5fb422637547d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb27d93e058764e5cc9be1550aa5a876
SHA1590e72c2132050c23d6deab3d643f894fa84ed4e
SHA2561b6c3531783eb268de9aa0bd5fa5f90c0ee489fadb8a57c3ff59dd9f646cbfe5
SHA5120c851c4e6b19f844cf3abda91515357dc141bb5fda3650913bc625c72abb7543142eb1b8dddb6c76a52c156e900caec9415905c17e426e02c1a419e4b0cadf30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aee5c0a94e880cc7b098121a418251cd
SHA1b5e1d73663d6c9ee88cd2555a3e6ac6bbad9b838
SHA256906f03659d7c38fd8ca2f6bc54560c3411bae96718b1ca2a6eeedc7281ad9a07
SHA512e68645cdfb1042e589d9ad9a9fa37ce5a5bad6756b578dca7a25ac78e55ccfa94bec7fd944fee95492c9af8a9f3d8d46e3f71c2111e82d92e0c96ef61df5befb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e53642c7da59b72977926686b3e4b550
SHA17b29dd7bf6b03d7587487b0fb3205eccbdace71c
SHA256c7d99603df461880782e31b46142e3339162d27730f8c3cfce03be02f6833cbf
SHA512043d7f8f7575b14262fc6ddbeae1199a22518ccb907bf455071e788e3777cf7d8b1b6b8ef941bc9ae3dc79283770ebf5bdd6efeb7c3b98d047c4e7e26f1d49d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57af6998f44fe8cdef62e0dd90fda104d
SHA1d9b83dda5614e6d7d82a3dad17c482344c7ce38f
SHA256fb3f7595471bce143cd3bce6eaeb78c101c0fbe3ff17b48240f407952671b6e6
SHA5126694a569e8d7502bebe9ea791b8a42e76d875c332a7db0f2162861b1451302ba69cfe868541df9f8ece480dda89e99e147f19466612e7402079dc02000c12a9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b3506ecf769a5153d941af7fd09040b
SHA1ffef74282c26fb4022827b79a1e2726cc2274b03
SHA2569b70328efff37dc79b8355d888f85a926105f480bb59b9dcac34df9944e93060
SHA5122447c2acf99ddd8d9bd4869197794e982df60b875f7d5d4c711a68cfd4eaaa4ff1e609d66d9932011b4a48ada94cd451dc7bf8538f98c2f77c83cf3cc494abe9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b