Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
a88ad7d8af23fe333a1bdd3f8031c373_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a88ad7d8af23fe333a1bdd3f8031c373_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a88ad7d8af23fe333a1bdd3f8031c373_JaffaCakes118.html
-
Size
2KB
-
MD5
a88ad7d8af23fe333a1bdd3f8031c373
-
SHA1
e7e8b28e2b9deef01dc40d3fe794ec8611661c42
-
SHA256
f940a64b9153eb6b824e1a2cd4e273afa41507f7bb9bd7213f446e0f1db6263b
-
SHA512
510a31c97040ca359112c85a61d5f45d493e12ef11aa6a9a561088c45d68701c3e05ea5698029fa414a7cb73d1f17418cd08d3167696938b2e000636990f9cad
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09276352dbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424512270" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000e5c03a751ed854bd43770f2dc4084bddc9c637660f7130d8f6658ec75f814ccd000000000e80000000020000200000003e2ce6ce1a9da3f7c34b97f475113cc43be6a9da2a12fc60b5253a4d8d35f4392000000062dea3356ff37a849a29373e890957832144756b27828d4518a64ca4e626c91e40000000bff511bc1942930b0e99d81c9e49779ac4f2c107232114832fd132d62a2989a531bc20415c0e39af090b1358710e2ddf4bb3c4e4cca43bd2e06dc86f02e120eb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000002ee77beccd1db303d208a6e3ac87249799443cb179709f319fcfefdf805f6660000000000e800000000200002000000003f8b21790f5a4d591f9ce600fa0a4a42e723aa3e4b60cad47f65a56112576b790000000e4c76940ad538c3832edca5ffe08ff4b5a89b3c25f07c87b14915f783196b4cfb63e86f376432d9d85ede52eee40a3561279177297907366dc307a182ec1ad5e8aa0d4861d7940b8e48dcbab0e96ac571d882b1847e51ff79a2d6068ad798ec280b3e86b9e86ba4a54eaa868bb43d7218bd00d5abbb930de809dc5d82f4f15687b5739544f2bcefba786584686237f0240000000d02cb5a29263a961bf749c84b6aec1f2c68c6636355f920e30080152d7a5d896dad7c6f7784b99b122a3ebf7a490cb6369e079685a89763499715ab1b3119adf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60D3EBE1-2A20-11EF-B6C6-7E1039193522} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2524 2368 iexplore.exe 28 PID 2368 wrote to memory of 2524 2368 iexplore.exe 28 PID 2368 wrote to memory of 2524 2368 iexplore.exe 28 PID 2368 wrote to memory of 2524 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a88ad7d8af23fe333a1bdd3f8031c373_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9fb6289cf5540fc70982f1fa076070e
SHA1433d4631681262533e33f4486bc294076611c3d8
SHA256c88e14513d9a433628e8375798e29d044396d82f1015146b4556624216df1e12
SHA512e3b7b73ac0e5caa7b2e6e6980d05e67d4b6bf44dc409f73c4cc4090d068e5720f128f851647fabd7a3d204f08f6b1d856a12b79be87df6da3eb7781a81887db1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5113b138879c1f594f1c8be86c8aea9
SHA1ba1754965f87a64a32f4fda9db9ba7548e9a1b9c
SHA256b6a907db8bb90e52796a1aaab20a5fb6600887a82521b08400df881131a5d81f
SHA5126dfe2972ac88529d6c30a370896c128e45cca1e1f240613b73280839281b46783c50b353fbbbce321c75d25ca4f674145d249837ba39fa07e87155047b803a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d4d4eed689b39ca5b2e6a34a5f3eb42
SHA104fd55158ba6d1dc7d8367b90d7c772668995be9
SHA25609782e36ba5c9865220c3071dab89d87377378c27d1a4ce52c170f1bf2751b4b
SHA512b5b3089262a86b9602ab69a7e803c48947f55149fa978a1e0dc592e06e81a6758c5a40b6375a586db10b2f62b8313bbcf1a66c4f97d39f7e68326df9df7204a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1ccac987c8c95b909e7391514f9fb5e
SHA1d713ea48571c66fdb3041ed11624845a6c49eafd
SHA256303e1fa04f93d6f8ee65dea90e4cd2aa746010fce19cb806d641f48cb89df55e
SHA51236e24a60248ddfd2177bbe86adf8844d7a71e418ec6cbe60007b3d5866d615e6e7b3e2d2d8cf65f2d6df7e08d3084479539c84372da45809578ef2a9cfe5af6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f70ffebb3a0b9a0ff623344d89634ff0
SHA182f7a8207530a60542b6c46220332ea61567ce51
SHA256d815e93cd5e8b9960d778a68d071fb9a3b928da1d788bada441cffcdffdd4fc3
SHA51256167a5d9f4175ac7e4dac05272db45677e16edc68ed9e25f1a5500189c54e1cb83777f57d1b3101598553e696f685ae783dcaaef00ae3bfdf8dc8641f8ec43c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5651a36be2199900d91884e1fc474bfe8
SHA1ac5ccf9322fadd60085426f46091493f1d49f0e9
SHA2565948dbdc4c376889c6db807b34d2da2adabab16efd9294d1164ca95c2e776bea
SHA512e8ab179b9a7a34aa1b32b304b2c3fe163bdeb18f7f21539c4cc52423b58dd90cc8e8e1cd629813dc1d9416effb479c5ed39413ecad4339144ccc0d3bf47cda29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507d9936c376c8152344633ce548ed57a
SHA1cdb5e06aa3378e71d644dbd231905aaa2b079b5a
SHA2562650382351344659b872c32bcb3eeae9865d42edaf6f98b949e939c3758e4dfa
SHA5127b6a74f0f1d04744551f861c616af7083dfa3c9d12c6b25e603a8f5f5b256df89b51b74535dcee30d53db699832fada5d20278e4ae220d367d556894fe2820a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0398bced34e58560d0e75a5587ff7d9
SHA1471d3a05e6061d7f2872371007b9fac69a1444f2
SHA256e90811d20c58f9cc27a4732847874215c2a39dee79482bcb3aa75dcadca194ae
SHA51205616dc068ace74643759045170c60088124765b3f674e8a5d6851d557f05c803754abaadf607f42b307908fbdc894a28d2a16780269f5ea0790d33fd7fae936
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e61212406125f203122351cd15e50f2e
SHA1d04addc24e80ee8b7a2be448e90ec79fb35f46a6
SHA256f11d2aa4b0ebeaf147cca6865e9d360f554d1d92838948745ad336745802b6f4
SHA512c604feb28779cc31a1a724a987998c707b1f3367b80db6d3323ee2b55f6e0efcf52afab04158d12cc871c1627db1072e5ada0e715412840b3b91225b53e6b1f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5796f5e18558d00dd48f9344321ab24e3
SHA173281d19c57b924649fced3a605636c3e5e823d8
SHA256d080d19c42e7c2ee015f8f4da452857e23cd025bfd688d3c710ec918cf842f25
SHA5128f3f20c51fa224e393089a3f35bfefe61f0e0a492d26598396f60b3513cbfce65b440504dd1d20b4a5089416d13628d6a92901020f37535a662d30eefc040d33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f90c5afe0b3cdce76b5d643c7a073c85
SHA10fe6949d9dace9a0321947a736c4af04d359473a
SHA256f9e43b64bec325f1d95f336587040d1a723212506d07cde6c538b75ffcacfda7
SHA512c64328d8ca6a666c3ebc87e54d6f439f180325dc8beede269d50d7d0013e668459774add3fd88db068df6eeaae4768e736826bd38bc0339e3e885d3d651e0e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58229020a6cad029cbf63d500e95c7225
SHA1bc659d63608052099df2f3b17af461de382534a5
SHA256ce2c503c97561a538bf84a4561447757ab44041297fe1654e5083894323b095e
SHA5122c7275bb0f9087adea30d2f64e99bd1df27148484bddf873a0b143967798356af521dcf736ad0f85f79e326fa1d82864decfc9589ae28cd0a7986aa1f1c0c894
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505ff0b5ceb0f707976cf6fac5003ac2e
SHA10076824a3aaf42a70492ce3279e1bd5ba4c95dbe
SHA256cd4da5e8e57b9764ae9d1b3f5466eca826df7aab8313ae96487c20fd6fdcf036
SHA5123cc78ceab65e77f63e8ef4a485d779c3ef85e78295eaa19ca330d322b034f0283f2d10b3e31a54a6dd7a01c927c8fa52ef2a3cba4d31f8603993b51348d62a68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51be93965afae0e680674e79011859c19
SHA1ee35c957cbe3476ee21b8050a430bbfc24e38512
SHA256049f61ff794aae1d5521a2509a8ef3b3405072a226c498e33ce50988ecee4b49
SHA5121d5aa3abf325f9b598e00f634cfb3b723f8f0d22517702fa6824424a9bf2efdfa1f50e1ee8cdb7a735fd53a6c0bffbfe628ddfa0c3b65f73c34c68cf1caf7a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591fc1145119aef926d85e0d3d50418ef
SHA1eeb0935dffeab4c84298cae0f03f61bc70cfd925
SHA256c284eeca8c1bf0a5c17dacc4f978046939d3e7a93c4ef3202b0573d259a1f365
SHA512e6546a278080fb1187a1c8107a4c963f4e6b94bd7d3a20ab95cd85baf244c0b5ff218411f574250b89dff4bb2509ec7dfce7aa9633f499563f0fd8bc69929d37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56253387289019e4992b535f13507eb3f
SHA1cd06858b9a862abb354577b416b3c62de6ba7fec
SHA256f71e35eb19669ae6c7a1e6527dcfbf82b276c27506748c3e0bda6a2d892348d8
SHA512c4bc614bba252460d4953f6b7676c3b2d6d9e68b1545d9614c2956a838ab1681407a21e9ab43178585c90878bc9a692c2f2c91f69c7f6b892d5ebf74a9069e88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc0a23f7627943bc871984ed29883e3f
SHA1fbed4c6bfeb76b3f6cb868f0e10401abb1017312
SHA2567de3cebb4a6558e8afa87b4cd7194caf6169ee3afec23c79d0b9025649332e2d
SHA512623a288d6b52a8e23c72b05d09bb7aaff97af79425fc9894c37d7d404367c44837f46fca08509e64e19dba7631581cc9081cf2b06f6223270006bea348abace9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b981902ffa014a2b83d7ae711f8f31d9
SHA138f97f3903c1bdc94818873cb1f0f49025d07285
SHA25603677669a847b2785616ddedcdc7d047e168f972b42bd8cb0ba7e819021bd22f
SHA512f6f04f73671d3d861cbe0037f6ae075b5aa8d288f326b0bcc483f916e889e1b89ff8ea66f10736bd49b41d77621c5623dd29901bad365c3dee262364da66e9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822162acfd0174616fa8165cb0f6ff92
SHA1b95d5f2d53ab9307acb74268b58c2053874e7ca0
SHA25690e425c05e75af5eba9df2922f01b948aceaaa923bac0ed0b27410163aebc682
SHA512c864045f85e2d09971b50bcc9f7e427b49250f11db1c69cbee2092f09b97494820dc0ab6cbe05acea8c63a4eaf847ce8fc72ff92cb6e526f70423094b28e1436
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b