Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 22:25
Static task
static1
Behavioral task
behavioral1
Sample
a2af83488d02761c9b4890ffea277548_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a2af83488d02761c9b4890ffea277548_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a2af83488d02761c9b4890ffea277548_JaffaCakes118.html
-
Size
4KB
-
MD5
a2af83488d02761c9b4890ffea277548
-
SHA1
eed3b3b1de1df458982975ff080f2bf0400b8ef6
-
SHA256
a0eb9b2dd0568050d2886d6f2c827fb68a9906ded6a12f8857db8fa4894d73d6
-
SHA512
ea713af54c6bf38bdbbb02cb897a0c0ade84ebff2be8f684c4189e467f1ee38a294195b33886102e0cc6be420b21da208c895da8e95da6ea3fbce333e0d5c81b
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oiEIB7d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f2bb7517bdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424392978" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A13D36D1-290A-11EF-A3F8-62949D229D16} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035e0d3e067df904e9cffcf6f5d87e63d000000000200000000001066000000010000200000005eb19c5b36e584f385df93170d382b080ea64988af55fe386e424c021b45f687000000000e80000000020000200000009ce86c1617dd76d81cef0114493b9e6f0e7fad172242d93976ee2e77b1c322ee90000000c1bf0f8d2f35461cc2991521d57ff3648220ec4ab51c463017f281bab15b5b4f8970a5066fb5d8b43f154b3b5dfaf59da5c3850e85d6c5b915a2c634deeae7f6c85392a34c6deff4f8fa24d05c6576a8272c40e7f07f784b78d07501227536d43d3624a49e0a7708bb7d81108955305d05ffb8544c273bb091d4463a6ea37f01bc500ec9a286bc0ed7a9192bb4164edf40000000915a0e9842a427bfdb64834eb170af74383ecd12481d4355dc206113db5551ed28538faa0b8253d93daa909038ed18943c154a63e9bdfba21d9dedec80b0f435 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035e0d3e067df904e9cffcf6f5d87e63d0000000002000000000010660000000100002000000089c0ecaac0d96779871dbf36e37e01b7fcd150651bf1ff0dac2767f1ae23f1d3000000000e800000000200002000000049433f1d23879de8d4a85a25e428987c6dc7a978809101dea254c2b1f02cf36f20000000626e2e5a4c6277cad03523a8eb261ec9c7996829ca1565d46ed000d6cbb507d240000000b8f7b13f705946ef3a573f65b197048d2c75618ea710af2ebffe52fc916517aac5cc03ca05726b2be7fe327f5315f6dcb390838d6e2f9755922f611a3e47d1c7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2af83488d02761c9b4890ffea277548_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571f06cac2ad3ad93a8a4898eb904804f
SHA17c0d62193b51241f2eaa128a2f79f34727d89abe
SHA256038468e6c7d6fcdbcae32db8115f5c6ad49224c5bc967569f6a0daca28d131be
SHA512a3d491421dc92086b71b6ade30d937cc61aced457bb502b2ef8f1057a301fe24570b01bfcb38ad5ba7439b7179c78540c5e40ebf1082a6cedaaf2c8336b2fa8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5101f7d4f10f18404d7eb6282ef96850c
SHA111cd96756d0be4a11b0a8f0ab4addaa238fcedb3
SHA256a418d42f00932cd3be6221b753d6c12cf8db2dee2f7deef241948296e820e1d2
SHA512969700ecd257805a2e78b3f3461d943f7ec30d82cd6049ca0fb510f3554af674e2d064c601198d578197e5cede8ea3bcb25a24d697e18206753808893b2c8c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cef010132ef1ca4585d2249080e52806
SHA1960aec37a4af95c33739ac22e37f2546964762d4
SHA2565d37e41b61173a98349a8530bdd3ee91faa65c377e298b6b492b5ae00658c362
SHA512b3fd826dcbad28d11f16646364676a5069cf7304e22a3738f10962e3a1769a1ab30664e07796c2a6af20d26a9646cfee6c1840617d1685abd932dbc7f15c0454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5894d2e5eaf8634df7017860ea36758e0
SHA10d685ef6f29b5d60dc7fe8b08bbc62e512e8f04d
SHA2560fe79111e1b3963f5894122b0703ee4dfbdbb8fff4aa34d82a2a87478486584a
SHA5128e757dd2528acc57648b22da1ae11b27e1c7dda2a41ffd06bf27325d8a4259d9f84b2c1e9ebeda3106ba4a02c7ea5398d1bbcff20217391942fe1c900bdaf5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f81cbce123dc8433d33af7b7fe94629
SHA11d96b4c3eec495c7b655a5f3230a6ae3ffa0e247
SHA25624bf6bb308a7c79786b6fe0295afc58309d2519cea2a79062524be259633c23d
SHA512588391ac9f42659c6ea6caedcef4ea74587439f5c983ee8a12d5f20496bc67a6deb8fa6fb4c02a26d39571a51843164a48d1e687a4f2c30e58e5e2ed5ec99f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5570bd4eaa122f20491342d85af93ba53
SHA1952f244c77c00c4c88f0d5b1d35925ff208ff20b
SHA25630b88531903f55208102e84a953eec4d9319f4fba06098607945baea9bc57706
SHA512eb868912318e3687a5a59a30316077cc14001ad060acb3ac8252c3609444cd0225d956b70d84a6fd62bb932a431536fc16bf43ae809fd72704b758c1ca059f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d213373585d3dd2c8dd4a5c51d38d54
SHA1e723be6c364d54daca1d4299ae33d24d4b301006
SHA256906078be3d19d00dae52cad8b49dba48b66b863f9fada0364fb9ed09e84757ff
SHA512fab60d9e0442e693e605f826eb9b949710abf858f64b8ceb68c001c662bc72d6646565ad11b3032dd3eec58c6e99c17c0f5356a50a18da07d1f84031a9c77cb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f61b115314eeed396786590b300d73c
SHA135b033debc9b938f273eafff10aeb4699fddc4a6
SHA256ca575e9c83c143f25b01445e5b8337ceaf6fe2aa0aac1e4d573a43ed3958912f
SHA5125566638a42d39a94b7b08f6504b34626915a003fb83a366ddfd219219cca7e6ed84fc69c849489b781191e6a1574e510ea0bcaead555171d2dcba096fbb9f07a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5848aed90c26e2fbc42efcbfb3981251d
SHA178c3ad93fbdaceb2c80349cf3972eb27135f4de2
SHA2561c633185af9123738695338773726345c2e1b67fa1edb05852ef1a93edb69cff
SHA5122e35bc9300713bc3fa0a622afec90697a1e12883159d7e4f205941e4910d7a43e41faa8b299444e701f6dd45c42cf0f2a988cb901d1ed0e63ddcd75e8fdcf5df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5311f3fece9a62d815677daf5a9f62df9
SHA172e83c942c2bae2e672369f7f08400ee450dc9e3
SHA256af3a52dcb5b47d604b0a2b288d452f216a0e699be1052735e2277bd99920c7b3
SHA5121fce45ef7931ea1bd05163c18ac9a0206bc42e377a8b53b3165db8d2c2360de18a84ccd74be30422e354dc22f60d9a2b5071216051288a4e3a7c244b3fd3f5a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598444704318a0bbb1c3326858f039d30
SHA1fec407aed5fad294031487166e444429d8b93b78
SHA25646fff4fcfb51fbb1e3439a646c9c6d207bc66bcf87c24687b0595318a37b7704
SHA512a10712158d39f58ad69096044d5847ea393f32b152bd17f82cbf70588e471ce17a4679b4c84a1bf94c7438be722d228db68962b66ada440f7b694a240707fde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f65225cefb5cbd07d08c30d4910e448e
SHA1934f8a9b76060a1402b529a0de912456de7e3f56
SHA25642bce42686da01ef7a49bd914061f003d8ebedd2f7548a5f1f40b845443803c2
SHA512a5c8680361208abc034154b756944364e1ab565672f8dbb056d1419015732e0463f8b6c5cdffcf0d0dd5da7549ab0e2ad3741928853edf3e8679112c62667fdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55edf69c9501de0a1917cee2015dc70ce
SHA1c7f03a22f1f61a0d902264078c8724ea58007959
SHA25606d70cfe183b61801ce40da2984572d3aec9e2d5f7726054522e7c1ede1e44bc
SHA512a3ddaf9edb21a4f8bd1a69a8d801b44ab06eda9fd6f064f06f6d7425bf55da72c115ffe79b76b564df1f45a4599748c68d17314ee56e8e4098ec1404247afe92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1b101a8c314d0e664a6029bca64db90
SHA1f215bf2048fb63fd4cb9959153baa8b372684a9b
SHA256ed3a801883f0d27e013592fd491718c2c352f94abef009d95e16f7dd76448d98
SHA5128a6d459457bf9eff67a7cd1102358fc5f99b374efdfc624708b148ec284bb88ca86734323a3707c751b8df728fc59853bf4037e9ef36a40b9b4d8b8f02405bcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d6903521245400b8118b8c6c1119dea
SHA1a876d40dcda092236fc38595549a3e8fdeb65a4f
SHA256c928cf9c4c11ee4e5afa552279f902e1ab12d7c4c1e81829177be6ff542ecc21
SHA512587a30822ed060937fc893848907c0563ebfbfb09d5539b20f18b3c6b10ebb9fc584b6e7d0d96be43d8eb368c93d3f49d5bbb4a0d7f3ecbf0777cbb55398b43e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d3a68edbb97d2c01c6b83088bb9c4da
SHA1e5a4feb9b930b771cfad1e439617c0e83149615c
SHA256bc49f10abf4062a7dcfc9ff5ceaea2cdc382da232518094b9e30189a45a258f7
SHA5128fd6446f5a331cc51aa984894de08f36f1db520b7a7f7c54151c8ff1509bc18e0edb66eab14d1b1eedd0aa9f15a608a325d06c662cd6e961f68c4533f7639a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9b9d1eae36c0d17b58bcdb9fc5347e5
SHA1b88f58f3f8db08676095adce8df9c17226ae6a3e
SHA25686ac75676ec4521ebd03514c8a8ca73fbc542ce01ff8015e8eb23a514cd72f11
SHA5127f8f577628b5a5c32b885bdc4c788bb49c6cc234a2dcebc67f0981b396a15e6bd9a716c02787c76b0ba931c3d05557b5a28798563a79f344af02a0787c0fbf3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a02d6e62cdef94ab225fc75740e5263
SHA12d3641d976948cfb863e55e1a73cc45b4e34c2cc
SHA256fe51bab578d65d27fc96c5c7815396565a625bbe4ace36d6f742072efdca0be8
SHA512d6e221367ec1686510cfd652e47e92d85f0a61272ddcf1237aabc9dfc8c12147b3e160a88153dd5d172597715905fc5330f5334423b35f9cf3c1a00b319e51c3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b