Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
ad2539005e5438f0eba76ae087211664_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ad2539005e5438f0eba76ae087211664_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ad2539005e5438f0eba76ae087211664_JaffaCakes118.html
-
Size
3KB
-
MD5
ad2539005e5438f0eba76ae087211664
-
SHA1
64d58bc880ecc406fd595dd8c3fb39db52c25e67
-
SHA256
f702fae7e4d79204edb8193ccd3cee14d8c92163bbd7c6fea2851a571dbc8bb9
-
SHA512
ebbd53ad514be7afbfd56612fc980167b40a87d3cf058573ddf741a191fb81a129fca4df400dd12242f3450a443949c2a917afbee10d0c728a01cb96b1a07c0d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1488071e721354097efd7c03ec6805500000000020000000000106600000001000020000000a3c48c53de3a0a32b6ab2be7e99a94b453f400f4d5528dd6bf31076964415faa000000000e80000000020000200000003d24a1770c0c1d5103eb0aaa60635fb3ea90e3ccd3494e580d22c16c5d9ef9e120000000caaee0f196f83e936e97009fdca5d05f948e035db4ecda46801dd3a41503354440000000fad2df1645ca5b7b1fb4c91cdbd588b63726b3dfececd0776a6e2bb33b3bd819d7d0b6817935faeba459ff40c09e40d53b546da22053427ff8aff09f7596ffb6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424594290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0843a2decbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58820BB1-2ADF-11EF-8547-E6D98B7EB028} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1488071e721354097efd7c03ec6805500000000020000000000106600000001000020000000cdb06fe015958a16a42839718ec12d0baa185bfe652ce6536bcea08eab97b8af000000000e8000000002000020000000933f9ce76ae101e099251cb8397b469ca7c014275e1590693819302a80f3e9ce900000006539bcf8736a0e7470778d6791d98084fbfb4f484f52c68de1832f1cf219f74c70a72c15f9fee6a94deddb509002ef66465132229f5f18d6a3657808379c29517d4679ae4c4532fbed38f019cddee3a0dc21fda822ad6dd76afdbbff3c3e875f575626a8e78b4775c33e15fe30838ee6d157b3638d887e311b3793cef41c0fbaae3013126cde419f346c1c418c86be4540000000fcf9ee0bddcf0bf5830335abb21d8d1c7f20e0764afde00b8ecfe09dc6fce37c994924f3a59f07755368eb1f15cbd4d633ecdb4f5f9cd06ecd3778c407f5cca2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2880 2088 iexplore.exe 28 PID 2088 wrote to memory of 2880 2088 iexplore.exe 28 PID 2088 wrote to memory of 2880 2088 iexplore.exe 28 PID 2088 wrote to memory of 2880 2088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad2539005e5438f0eba76ae087211664_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eadc681311df15ff9cc6e00d5c458d59
SHA16329de4a57ca7df0cce172aed9c854eedefc3e11
SHA25674b5efda10870c179aa77ae530dd51066ba540039114ee8de4e8115a6aea1b11
SHA5129a81e5645d2e8ac7c2efd9668cacec11396011375a679cd4b5b7fd068a483d685ec7f483f808beefc53d3bf9685711662991d7440323913b0c2be61f33d3fd4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5033fdaef5de6b269a3f3870a98ded9f2
SHA1a3f093d19fcd9f070cdccf5262e7bafb9b63232c
SHA256ce5c4f3fcbd5c5ad8bf1e3f2ec71f7dac8df17cb2bf612bc32bd38afab4ffa57
SHA512919be1edeb70a0b318dc5c09ab84120b0b78c44cbf92f9ac0fad64536219636d501aaf4d69514fcc521826f5e3df6f0696dc0b93a3e7a023750d72c3c4b26d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566564297c64ba2187154eb7b8e726086
SHA1c37443a4ed7bce266e2aec92344ab5a619b670a8
SHA256114a79f25174cbe273451a6688dc392e31043cb029cb989e3640d8e58a49a435
SHA512fc2baf707ca985708f60e4b562a4270945f787b2902cb1f1eb2314d8dd6c34063a15900f007b9d40228d9a9a43dcc50f1b8cdc0025fcc0f9f6b8797e415e7a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2de2eb0acb822251c2a9de8c0bb50eb
SHA17669ea5657d64da9b63c5f7ed79f0385603da185
SHA2567455fd9597531e605467ba6253f4e133859995ca28f3c131f302c1350296dcd3
SHA512fe9454781640afd8a4039e18c7ecfd27de3199f5b86fa20eab31782158acfa62ece7eb35e027da5d36e3d976f55221e0d592b21183e0008e9708e12628747d28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57812c74c97d4d4d12ac95b25fc3ea079
SHA1a51721afb85e30f88aa7cff84c4cb8000cbad144
SHA256d28e19f222af959f34215e45a0b60ada45d1ff1fbda121e811ec67ed1d6ecdac
SHA512a46c5f7ed0fed1e22c439310f720bb717286907893626952a38cc0b8d97343ee294ab9169a95ea4f609655c4b769b4c080c6ea1f2265874888b271625d34c343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55db43a74ead54c90a484e150e6f117e6
SHA121e4c37881834d2702be71ac10c63559b2270136
SHA25627369f88601aec33c456b73bd0a8bd9e001738e142e6c1ec679f7b3403f41c2b
SHA51228ba9041773d55ff43cf8896731ab4c0369b0b69e3cb18f660f5191aacc4d837c45f50827e450df62ba33162289c07dbe6d524fda67b26f49908cc62c1879d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509905107f8c6dcd36b842a3160a82018
SHA1f3638eebc920699799c1644d87c5fe5f2c94611a
SHA256c48699bcb45feb8726da3e51b914e6e4cf059c0e35c9a4666a66bb6bd5c51f58
SHA512324099f660a422580b76d91dc66c2e9c47e9a63fb3b936e3c44e0548a79b877ecc2f25913fb7c013e7ad6b31b13ff094e5ee68013908d165f33c95ffa1eaceab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a054a83013d959ee4f3444921e55c1
SHA1e4d2a5cab9c8276f291d049b6fe1637020bbff64
SHA2567f0ec53f8568975349a7427ccceb7b833f2011eb95271b45d21404c356ade112
SHA5128d4556d212368ce3b042b3bced38ac4a6a3cd2e8bb548b195c5fddda6b7f036aedbf4a2a7f6e5435de99482ad385a5ed1b9a9dd7843adfbb61582e9d1a76d13d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d10b59e28cced89e57a4d4188c6fbb
SHA1f3dc0ae47891242742ee4315eeb0cf172f080623
SHA2562b5c7544c1b4b083da0a358c1e49a5b327ba0d2151a6bb96afb410c507251528
SHA512cf6eef2d6391d7e66760a365dda74493f891e379c8921bdde36cb309697f8702d0a49ac32c4dc39a899b65365c9b1cffa424100eb9c91bee4ba44ab138c9a06d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f473a6cd8a0ecc77c6d4bc466377936
SHA1d4001e8c30f1e5a2897ee3801ab65e172b497dcc
SHA256144b80b657fc72c9eff55f9229e6a764fab12857f945276a6e6fce584c0eb836
SHA512d854cb72202d3760690c00fc14ea734be3cea2a5e112f0770f65edc3f2192f9e939d7a62b64fdae66b6297201d8796711b8545a7e5266d239defd0bc4e18dfdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541998581c66c3988fb2d7062127f51ae
SHA15c03af36eb197727a3bba22f08348f18546dc2b5
SHA25621f03cabeb66d7dfae66be0bad957cbfa815566703c05d4be88397622e49059b
SHA512fe3013914c5848a8a322e22f23e5cdda879cebd9ef0a3a50b7a324d1d3f7fdd6d6423e12b93072eee58d6e143dd797d6b223634c9f0f780c808eb429559294b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec2a05e70c580e6f2149e24ee4529ddb
SHA1bad1553e2ac5ecdb269c82e063af32924d9e265b
SHA256e5e8cc0e25867302d1a89db892d6b92f9c65ec01db2b56c031d00b8950ead794
SHA5123d8675d56a747bf78a426a2988b18be4a812f55671eb3412c42e7f13d9d9038c6e7906128842c9fcbffffcd8b93b355eec3b4d0380cc242838cb4f7c32caab7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f00f56a7dd9a5c08000446f684fca16a
SHA136e993fb45a1ac843edcb107977828cd6d01599c
SHA256c94a56c6cbe5c51850d924fbb872b525a9b9452f696ad80d8b1d41130d8688e0
SHA512e463d0b32a190c2d7ede57a676c48bfecd61dcb7ed518b5d888dd20dc25d7d9ec5f836ddcc29704ac44b4192d9a0d2168af42b3712f1f3e5749fa5c4dd905a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5883a8bda56c41016b426a5670b703303
SHA1e13b9480351a004ffb78c07f11d9d8efd7f6101b
SHA256159dba33ff58038ea41476b8eb406352d17f65921dfd6f19d006a73a79de7318
SHA51279ea7fde195a7ab8650d5f1c56800cd4fb3a0262c8873550a89481e5ef317293b42e8ba6f4da40185b68995f38025aa569707e996da2fc3fe7bb55e8852cbf9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc4d2005f3fd1a327b3dd08a0d4d1eea
SHA1a0f209b8b62995463d69ccc660b8428dd62b2571
SHA2560bcbc1cadfef857f28c06d27d0f131848bb98f9a8d070f3a5e5be63c96135076
SHA512b94d2dd83c75acb2c1fe17cc6549b6cd96b37961ce711a2c0d516d20f6e5ee35ba9f90db81b2146e5d8da5baebe2a55c95471b2664c801fcdb1e3017165176fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de9d4d59d9961411df534584fdf6c982
SHA15179fa03b689b7e1e1757caf9363723a0ba462a8
SHA25600e46c2cdba2d4017fc9767f0e8b87738378de1ecdb2dc3ad4182d288084bfd0
SHA512ad9eca18e12dac75e7f77b4f7a0f420d14d5f481008cff39be105e4d151a622595a7f99a6253ce71d4df229bb0a698a429ae85a1e0db438d14b674dae5ea0316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d42f4364d883eea04be694fc43c967ba
SHA1d2003b721d8c45b0f197052986744e479cd41ccd
SHA256279643baaca4065ca5f2af703a490a2567bff3a2e10a8e8766c7b71180c4c1cf
SHA5125caa5c4203a4c77f8e6cb3b78fe78fea2c53c96b5532831de8c1a66dfcb2686b9a9549633b15f7670b8ee8f868238ef89d5d0f6cfc2a3d3349b22bb10612d7aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5702c88ac0bf3cb48926ccf15e7a89395
SHA13d44baabe08cd572928c2dfd7ba23ac3b22525b0
SHA25679550cdaf0fcd75e8568fce9ea4d361cbc1301b482d7f5dd241f5723335e6f0f
SHA51273811c9170e93d92adc3f010315ab087581d034528b89e5aa99d7361565bc8122704efc71379d5f774878f2d040ad3bf6b812081dc0b37e5dde7be10c8666d69
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b