Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
a492671d6cbccd68b211bf6948b62fd3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a492671d6cbccd68b211bf6948b62fd3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a492671d6cbccd68b211bf6948b62fd3_JaffaCakes118.html
-
Size
924B
-
MD5
a492671d6cbccd68b211bf6948b62fd3
-
SHA1
d458b45656b66ab03f51e4113a26295fd012f978
-
SHA256
da920209c4390d1c50107c263c37a2c992d08ecbc9fd24014ae45d36402b8bf6
-
SHA512
62f92a071578f4183e580f2572775f878cf37c2f2e0fc0a7b53217c9970eb2a05031e32a782ea635cb151b3f2512e86e5eaecd3ea444753fb5d4d792eaf5e9f8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF3636D1-295C-11EF-8A46-EA263619F6CB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424428247" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000767e61ef9879684292b5fea24c8cf2e700000000020000000000106600000001000020000000d3188c07f9ec5af8d35269456648c5b4be87ad55c2b9a6e8d3955dbef954cb4e000000000e80000000020000200000003f3cc280a025c55821a8f577b5954b2a0047fb5bce65221d89d75fb9e3ea64af20000000c032b86099ebcd52f7471e3301d58aba72bfe9ba60df4eb1a426e6f1b061082f4000000082a7dcade20fec40ac958830575a1b1b27cfbbf5064356a1bb9666faf7a5b8715780711fb1df5b783761f8e79d1e573316541b171d1b811de66a532b2be4a3bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000767e61ef9879684292b5fea24c8cf2e7000000000200000000001066000000010000200000004b859edefc90f5954d8d11f80f7cff9b601b68476073ff0b5e0e0bcc48391c21000000000e80000000020000200000002f5582968a7e7ed1766ba2192632bc741266b6ea90ce9d06f7b8fab2a99e240d900000002825f48ca9bb836d91814cbf09d81ef2954fdd2ff39f6755ea38cc278ce42fde1c5564489624bbefebbb969e2c81f8dc7f8528e744adadc3bad965b4e7988ac54ef280eddf2f72b4419ff30a3883ed732e046c3cd301fef72632b5e802ebcd7bbb142f13fa6ff63823c95275ff62eaf3d54ce7b9b8d4a99ba9139d9685028ff0007228f21d89dcab4340e3de59778de4400000000cb94b67c85220a4dcd7a58a012c16419f6661a1dda4d6a97f7f89dc662e5ea4e299c0851e6968debfedb49df265cb60e1a355ed9b4f54ad2d1d6cd0539c9561 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08fd89369bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2164 2356 iexplore.exe 28 PID 2356 wrote to memory of 2164 2356 iexplore.exe 28 PID 2356 wrote to memory of 2164 2356 iexplore.exe 28 PID 2356 wrote to memory of 2164 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a492671d6cbccd68b211bf6948b62fd3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d51597cda8c21662fca115a2d5c7c7e
SHA149da022fe43a3d2820273d1ee7f8f251a2503f97
SHA2562d7953f0fb5466e4f29e454cd427c3f1efe98aa874fa5e4d772038d5809490b2
SHA512770c75e34c33b4a956a66ea71f6459ce27fd83bc94c044708edaf8cd70100dc6c4af8cd13f4ea244b2ae61f971b68eb96aa4ee11f576912c53d5e2e9e413c365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599fe033ed09dc692beabb00bcc39f73d
SHA1790651d55476378a4a640d421b31b2d7081bf3d2
SHA256e398809404d44ee3079cdac09bbe7853865c567f49dabf6fcee3c0aeec7ec5df
SHA5127f662c82b4fbd2f5e435f7874c2c72bb1cb70e21e557d81bbd8d1e446eac16cfe55cb84a9befe33e1f5e17904445fb9d6bc3618c3bc032b810eca8134397296e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56eb8686be1c00d824c2a74bacb8508a3
SHA14a2687bd6d4120dab095bb21c0af21c6ee559d3c
SHA256e53d18e2d4a85ff601d495fef3ad1d20dc8645a89752a58af87ac1d73a0f5a2d
SHA51277e225409579b9bd9802ba678b0a392510f0aebaef73c855f14c49cbe79060a0221ce35821643f50f40be588d781a5f58b1d43ee5c7b2348d4e6adf6f290433a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565ea30b4d651bbd4f71af9249f8f4e48
SHA16138f2e5c9b519df047759df8ae5559c342626d1
SHA2569f70daa1d1d4d9c7b016f119174affe98b11205fa9b8b4aa767a180d8acd5c86
SHA512050bc7fe6f5e665048660f2438f7c8bf406017f59cf133104148d959bb7834156fa6fe0284f76d8913c7fb79f4d2a6f846fc7e974a88f3995bd613d2104f7f34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065a66936607d2c9d80384d2fbde1e50
SHA1aa8e2535b3f60ae1ec682d4820a281c1317e842a
SHA256f9b0ca109fce732ffbd7caa0d9651de09a2878ea376e2bf9dac4333c5d436ae2
SHA51259ce5cc03ae8653801412c7b0a76c455b870704fbcec8ee3aa731e1be5d3d02c3335774f6895147ebc222084ed3bc3b2a29317bb1190011fa05285e276aa9623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a5dc5997d70a5fe43a2f4dacc668b8c
SHA19da6944eaf2d63c9347f45caf6c7e4cdc890dd7e
SHA256c7cd6a3076f3db7de0ee9df7fa0fdc1358a5f25224734be4cd161fdc5b510905
SHA512b2e64bd4c27d1ff23be5ebbe6dc2a3d825b31abf1075d097ad3fd64bd997ddc73d1d76a12802ddfc999ad597208c358cf29ddfc2478ac83d18236eed1845fecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57979cf0bdf4cd3049ccf54b4f26d7961
SHA17e72053ed5d1601b52f79d55bc41407fc158f021
SHA25613a4028b438d632718bf93907c7a6361e1a34ace163ca0ff5efecdc3208f31b7
SHA512b1c0507707e55ad77313da901476e803a500923c44590361a06c7783aacafe036121a41401aa1cca5cccec282eeb3ce84624f6fd5889bca30d28392b816d63ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fe55e856d6e052c6f30d7ab7b3dba41
SHA1db793290580f9ce800aaf39edaa89b6b2650d60f
SHA256ff4d44065b63af1e126648b75c56e833c65a4c37fa92705a3830e80f25f1caa8
SHA51226980aedec323ddc1e26046289c192ff52d966317e8bacce0e413cbe8aa450b03e1a32d25d29a249dfcc4193c7299a7d587845988a6aa7b91c0ca517c4eb0104
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dd3d667ca2a261a5e494036d31383ad
SHA178a9363986855dc9cbbb6ac090148bbc497d559d
SHA256e25dbc37ae1432cd5be62988da1d3be7ec6caf68e23234bae2b555ac8f77ca09
SHA512002bf44d3e7215b18b51a094cd6c5577db54a2b2c4c58ba5e5c09548b11860b31c54c5709a9218d29ef13b35312c306acab20973868f004a9d5bf62f7d3b785f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55637175a30368a0442c431f9b5c431d5
SHA1f6f3c651cce5b8df1c36936aece93b592bee31f0
SHA25629bd8370886648dd1993f2dbb529e02fcd2b894b21eeff8f83cd7fadae21a560
SHA51297cc1741bdbdf0807178459d97dc715bc559279dd9f686dabefafbc36fd89e95fe91df0cb4875253df1748241d52ba206de4e2a936336ca9f3dbb04dca1132a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5164975ea981a99416ad398ef3ca1c535
SHA1af778932ce8d67f4f347eed882b43dea945c9907
SHA2560b1568445132418077d35d07975a97f33da8514ce5973612c3b7ba4a92c8ce46
SHA5123206f6aea58629a8d1f311a1cd660c448955ca939dcaa2012852a4b9d0bd162a989c67fc750e8df539b70cc95cb0f0cf53cd6b643ba86870e703f4fe6f3e0489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c3b16b705a505fdcf29bbc7169a411f
SHA1e41b0471f8317f6fa10c3745d1db60f0d52f5a61
SHA256da2ce867bf51e05e09a72cd1e36ad26027f7aceaf483531a72dd84f576629634
SHA5126ad9d47518c7bfa4a7d87a2afed3a17411952a940bc212c853b58482c7741d7ae2991f456c23d2765d28f2285b70f63426786138fcab4702091eba8fda1df69f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596a22e665a6e6656c9d8cd91baaf7a83
SHA15679ffdede38c638646dd337440725210d63d80b
SHA256eaa9a8b82d4e76729245050b31596b6f77010f1820c2292ceb95272123739e2b
SHA51293834f76017ce31158195f327e3719d1b265d35a7430c34d0c2f23417143c8a008195fffdd7666780274a192bdb57743600c0197d2ddcdfb0a09db4cdc4982fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5611ce87ae512fd7d21f485a056903765
SHA1d251f5910234c85ff6383c20a72baecaa9bfd5f4
SHA256ef1666bed4d5205825a2dbdbab607a1876d117c036c48be6eea2f84f10ed9266
SHA512e520d9db7c94857b8a33078f79e5892a4a887fcda8b6f307e491b5f635b28ee18b4cbf828f20e1b641650e1758be958b66e3d5fc5b3dae67649c792733cabbb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d06b6ae6af4c2bf36b0fa25a98f7e61
SHA1266b2f021df6b9736fa64d799f706f387d1c5491
SHA256a11dc4e1e2e743e9e3a912082faf7806c712acb289bb915e15aa5b09692d18ed
SHA512c3e3c66ddff119c2f22b7de780e5b8a8cbfc0b4033991ed41d455384b7d7c3136ffed1263c16c2d1553c2206db6487949d26b3f35c658d508cc930b9378eda52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2bc97a4d97de0a59eee433fcef662fe
SHA11afd38ae8bb186baef6dfa26a47cc2c2369d8f8e
SHA2564501a2bf0dbe6a0d9009e94b79c87bb200dab5b405a888f31b2263461f0b3b97
SHA512d63800f7a1f9b17b7e383279d0b200cb323d90a297a6f07317c05a61aea8f48dff0b9729c98d3588a309a684a3987ee6723b6070f1c6c0262866d2fdf6fd3926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e4964276aba5b59f12738c5265165f9
SHA12d22bd00e3520df462c7e7618432f454318b7a29
SHA2567511ca553d78a66474632f449fd305c5401e7d2f5b5670f06888f3433ad78a13
SHA512fe7d2e49b50b7c68507a2434eb26db8d9dc08adc9004fcc8a0bc6c5aa459da8de94d09598ff6abd7bdec0f73f8226e0d9b911dcd4a61faf40e2695955752f7df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d10a2cbe18578d0ea7821e6010e6a56
SHA155809cccee9d276a5d9f9e5e8d988b711b844cf7
SHA256b78229ad5ab6f14a7795a1919256721cfd7aec5758094b6b2af826e7f49ce23f
SHA5127cdb4277663ccb821c31039db8b4a1900edc78e91781477360b618aaceac41db98f959347917d04139301eed597e8eb4a325a44da4e183b6afb0b47fe41ad367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abbd69a4cb9e3081d03e0552cc04c228
SHA1d9bab8a2cb327d9632a025f516a000d33d082c30
SHA256d87c5d8839fbc4531ce8ad98522123b8dc0c51cb51b80ea70cea9efbeb19acf4
SHA5123dd6508d482d3303aa4562c7ab071862be909b4b72f1132aef01608a495ec5587441ba98121af528f899dd289ddfdf4778c8ce57168e7e72717e887fb66c2db9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b