Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
ab2f4bb3192070f4791fa9f740a7c529_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ab2f4bb3192070f4791fa9f740a7c529_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
ab2f4bb3192070f4791fa9f740a7c529_JaffaCakes118.html
-
Size
254B
-
MD5
ab2f4bb3192070f4791fa9f740a7c529
-
SHA1
6977214db0c2377c50c7db533160b33aee5fa1b4
-
SHA256
6d8eb44e5c0744295cfe148928eebfc0cac9e3f768c5ca3297a01600bae167e6
-
SHA512
f32a5b76eaea4c80d9a3dba3489ab643db5c533ba8db738c1ac11c87d140c3f9199f60d2ff7b504975d631ef42d1e615274a5c51e7018b22b9f7c10c5c650c1b
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000005e45553681991fb9ff64859b47d9bfcfc335e402fb2209ee262fec963eaf79e8000000000e8000000002000020000000f9a2b834416f08131615ba0298ea1722420e2b87e5f5f7cb2f907713b7cb742c900000002c9f72ea0b21925aa3121571c994f071459b77786b86ad203905660cc7a410391396bff0d04be8810c5387653cfd0168f94220724e6294ba428742118c21cdf830a90881a25776d9b10dc2d9dfae4dd3a9d8a79193650dc3a980945af32c1116a4c223fc970d4bc339d5d219bbef441c93db3fcf13f1203d25312c8be97d42ad4891a0409fc31de447a980f586827c444000000079cf899f15cfcd3005e0507bf0451f83997827b7ff316b017c1f2c2a82306d7248c3782949c2f840fd3e150e0c49f6ebb74148dac78d998933d6a33e6675d9d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a9175d94beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88A0BDD1-2A87-11EF-8875-5E4DB530A215} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424556575" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000886ab836fb0fcc26ca6cbac8b63350298e1339699530f79202aa8f1a5dbfdb33000000000e8000000002000020000000374010386f264ecb1a9d6eeaa3b380da69d3eff0c1deb02eb62e6d1d912ff706200000008644fc950f788fe413372da575edf853cbb1a458c267a00464c2e4b153968aaa40000000275f983000f0aff3539bd6ca88c27002dd857637163370ae2cc0d5cf00cb68362e7dd16cfa0d48d5f4360d2e647e12a74047ef1379ebae8df32b4532484079be iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2944 1844 iexplore.exe 28 PID 1844 wrote to memory of 2944 1844 iexplore.exe 28 PID 1844 wrote to memory of 2944 1844 iexplore.exe 28 PID 1844 wrote to memory of 2944 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab2f4bb3192070f4791fa9f740a7c529_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa12a40180448346d746a14878150d4a
SHA12417cd4bf3839992d59f54198c7f307db332ed75
SHA25693865c088e020217794b991b314802928092dcd3f47bedaede72adfdcd0a4dd4
SHA51296358d5adcadc71aee692b8013604cc8f36c76d03813a1bcc5f883de41311a4cf3aa62c8134228b839844fd5fc98be16a1f9e892485ed70f9bf3e9f0b5da12a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5012760696e89b5f66845c4d6de094ce1
SHA1fd50d545d52166b03dbf759d320a78b11e1f0f65
SHA2564ca98efeed2be82301767a0d806c3f6b041abc9ea7744c77a9b7013e142091c5
SHA51203657dfa21946960b50afde3a2017cd8f614e3f45b5c20abcd6ed1cdc197b8273132f58990b19b6619ed7f96afe6926271f3f3f6fcac44e126076261dedf92ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574031bf207cc786d0b97d131d889e214
SHA1c7b499ed07ec5a2d79bb1629f186a670decacb63
SHA2561342fa6d884c199c203c389f729020aad8c6664f4b12aa03770f9a8c7933f234
SHA5121d9480cce96e852a461dd0670af584bd44294a19413dfd2664892bab0e251de1bfddb95c8ed8c92a8505e4773e526930dc60a1000b26af315bc524e7a737969f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546412ef69d7f989da00914ba9cfa1412
SHA1d86ddcba8c2548bb98b9fd9a83a0e41148b1f208
SHA256b77286a8429aa34191782d144808774e4d993f48c964f24e3e04878f5bc7d5a5
SHA51286751a2b3c5b101a784a4bdeca5c4cf0bd841e301ee1db34c2b2871402742e43ad326bd2bf2223872ff72c69ed53e3b1b080276f4e67d289b01aada915b4459d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4a5129f7b7a74f1b04525badc27d33a
SHA1cec4416411a15986338e12d36ef64d9a9ea7d51c
SHA256c360ead27d50ab83b8f199686ec9d5c8f17415fb7515abd1ea041dfcd8ffaa31
SHA5122214f0ed65a496f02131221e18d353ee7cdbe8c29e045720a73746c08f6fbd7e886e3d6d946471d913ff3d740bc57e23ab3b186d5e27a80bb239b347bdd672c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d1429ca3cc58b7a303195b5d144c8b3
SHA19fe837f29f051a16f42b0aac21edee821a2c2720
SHA2561dda1f40862828b11c4724d355111f7339d29befe8907a7feec72d8671cbd013
SHA512c1eb8ab41ea4080d09a6606d6f7bc83dd7ce592fec040b816d152cf5936a9e97355f89d4ce557170e64c493b7e583b2253294ad17bdaa6875c647ad2a2c75a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e6d9f16baf65d6792d45cfd4ac7117e
SHA1c8611af1e60647571adbf2cb8d6717112d5599f7
SHA256f55897a84f175b99df6f4ed66de2a4b01b04f2b2afd36fccda53b65a9e7798c5
SHA51277b855b0a832e8d1a2da1a4decf4ceb34d2df659fb42abefb5bbb19c62223d830b063148f3eab00510a53b7a78b31c8550b7b383594d8ff5912fce5ff15dbc38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a6d3590165c59411c563183c39f7dbf
SHA1941efadc05575e5606e47427182deba5f695d784
SHA2564e06fe1191554d4458cbc8f52b0c776429cba1fa6191e7c221eb61cff480d190
SHA51293130ccdd07535cfab711bab46faa078548d7b53869b26ad985d974a21662b6994f2cdf4346a8222d72fbeaa1dc6fdaf8d281d28776990dfef9c90e718cd037d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bc69d03ef9b67b45cf6ec03c0fc0f3e
SHA101b97a0702114a07d5f448d072ef1bcdd76fc2ce
SHA2566465db79abb52fba2bca6150bb9dec329fc4d41647d12a1506d74f5ed17934e4
SHA512bba4cce28b0b684e734d69841c6a5087ae9a190614d903ebeff3d7909b4e94eb649e2a1132c480bed88fdcdaec41041756eacfe5e190b089b47b3fec2b3bde03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554c94d4a64f11044d504b9f8fea3682a
SHA192e1e770bacf63ebc5fe8d71700969fcc5631fe8
SHA256e2a53f573e09dfefc40eb6e10e8ddc79c9a94bcfb85450b9becf84dc6723110e
SHA512a3e08878c0a158e1d24df27302fc0960e2f935aa8e1b22e8e695a4b896f179a6cdcb001afcb75a4aada72a460ae6e9aa53fe7ff641ce21cebb814abf4c947ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d90e55333cfe874c6ba806ee107238b1
SHA1bb5c6a8001fe7f7a5bdccf6d5faa816bce022d9f
SHA2562866e650eeccbab0e5af2ab8d988c21e644d6a260c889ccd4c483f895dca7548
SHA5122ed48d76af545a018a655259fced2e1c0b50d82d450fedb91c80d6666b9b4e06aa03818aae401bfd540f30b4360e376c6e902f0448af8b1caa82f4e83a6b8e11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a93fb852cfc408cf975801ce4521e02
SHA159d50acbf630e28ec8942eba706a46ed405e1be0
SHA256c13b857de28562fead6b0309d26b7d12f4822760006bc797a61bdf92722576b1
SHA51200630c27263f902a4e9dfb3998a510ad57279a7e5269dabc9cf84786fc1a896f84d76e85272a89e7f28be84650b306117bfafebffa17e4776828aafdc5300597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca88f150c6b886e4edaee1777b73f242
SHA161d94d14694af05657d2fd353af4822a5eb503cf
SHA256faa103405e490729f3492b4690b448ad45890812db0c035f6be96a0c168cd49e
SHA51213337eec6f612324eb15fdabd36867a0e672c12b4bc113fe3683f9f88fa4b44fc6f2a145c79ea161ed61d09cbc35a0f48cb48af4a7f5c2ac051d020eb54e4061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575e7dbbbfa3dde29441379773314014f
SHA1eab436f40e21b06172a479a9612610ffe134b407
SHA2565e8a4419bfef58de883d59f0e951a3d69432d19d3cf7a07cb7c82c498132d181
SHA51296f09431ac8f47ee0c2a0497c07e3ba4db75d0a13c2d513194a43ef4d958ff79c5c0c0e617d589c792abadadad955ced192adefed545ee6d16060903985bf518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57507fb1c9eef1929c6cbbe2eef770eb5
SHA1d7599d8ca44c963cc4a4f0d1d035cf5ab3c53423
SHA25643ce23f5438e45aa427a4b7df9ebb5a10f8882b97c8732b5f375d25111f6d8bf
SHA5126ad282fe0138af209c123c27db48c5ef38448dcf8e0732df6d1e4d5f06660025c272fff90b675f61cf49e31cb65ac654015de2838ff675e3366ff27a34e8beb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f45c75641149982ddd15fbcd62414f65
SHA1618161887b9b431b8e08324d2bbbd43c3649fe4a
SHA256efc92c8926acd714010531c6b5e768e6d9b1dacff2b40cd28c94ebae45ec5057
SHA512eaeab961b8a732048e7234ac885b66bad2781b475a189fdd11d3253740b9d6bd4f1599815b187ad6f848230e11fce900cdeb13f71fdd18f23db9f0768745ae24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8a0585e842a431210525290429afb71
SHA1ee66782cd2d9d6c8dba31c5e580c5ad0fef6e093
SHA256d8230bc52653409d0d197b8fea3dbdd3b58f59d469c13f64b6843aaad042a988
SHA5127b0384906d35f2c85ed83f506badb525943b0314cc11be2793e39669704d6583f6bfaa70471b8b1f1e9eb45b3daa257dc22fa28adc96067baf909d88480f3fcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f269c8d8d655e561d7332c94f6e017b3
SHA125296c69e3e1eb3256b69ba1739ef8c1628b0598
SHA25679a2b7dc76e7ec1916204047caa485f050c8e825625ef6e8dbaa6d928e5f6ea7
SHA5121a262cbbb9d843b0a20cb8b3ff36a80df7d4062eb1710c6e92c6b209b3b3a229094940a0e51bfbba594d09af9ba577c712cce618d7e4ec564f239c507a83217e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1395345cf916c7691d3332cbfba140f
SHA1d7f4904d387c337d189e81f3b5ad3a152b37f0f2
SHA25647431dea94a038822fe6b628843d1ca2f5229e9c550ba0743809f397e04287f6
SHA512342a106c21997bb3eb46e96dae8356c187305be2feef7367c23197f8ec3022b1217263bd06b6b72aefc923c1886d3f33c9855e189aa3e0a50d1a49efab70d78b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b