Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
ae63c211d4c042686f12f1ce0f3179f0_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ae63c211d4c042686f12f1ce0f3179f0_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ae63c211d4c042686f12f1ce0f3179f0_JaffaCakes118.html
-
Size
3KB
-
MD5
ae63c211d4c042686f12f1ce0f3179f0
-
SHA1
309f5e0963be222d6221f47ea99bf3b0c2f08342
-
SHA256
bf4f267efc9894359450f44e188b341c3c037e23b64956c1643c83000bd4d6ab
-
SHA512
f8265386bcb888deedbe64b0d0c2091ad52c8c19bed55a65fca02e1ee094d44cc32d80af9aa5e9b273c8b545b9a17c46b8cf7dfaf2ae732a42a04e82b8800494
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000baba6fbde99d90933705b55c94fa1fe6924821faa9f5fcd5a423fc544e018eca000000000e8000000002000020000000cfe9dbd5b1a8b1b3669a4755c1589872ccf718c9b9c7e8736c26acdd08c1937190000000c98956dd43f410f39fba27e6ecb538722838c8125390ddf8efbd510fc32cb0b25fa4d169580c8bd16c1128b7df10fd51187014d89d0aacf4c8d9b85a13855cd0dce77414f112e1a3c4dd1ca9f5bfe6ed35f5ed0989738cfbe7afdbadcb284ae1bff1bfecb624413cb70e901875e3dc60d4710d8ad7e9d1aaedf0bd78372a35d4ac6968516ddce85a3a4b4cacb60edc984000000084d5bcb4b1382e89bba4bef8f34c45e9357ffdf9e7bcfc3d90b416cdd40d2100f027855b48bd38d19c3e27c2650c054d371342589442c4a108aa8d98f6c07d06 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b9222f1ebfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000615a2cb81114dfedbfec7b0d8761353133163ce3aafb42f683c477f76b019aa8000000000e800000000200002000000053429f97ca8029eec6355f337cee05b0f9bf5543a7e018bb28c112f68080bb9c2000000057fd99911100a9af298fa90c9f254c38f1d470b8e9bb69deef9106eb700f2dbb40000000aaae95ec5ad5103028ea089ed2181c08a1956d3908c64bfe41a7aa6b9fd2ae28433c158d032f2ccc38c6569764d700bb2da0cab755d66be302bd9199314e3c25 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424615768" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A69FAA1-2B11-11EF-A13C-DEB4B2C1951C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1208 iexplore.exe 1208 iexplore.exe 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE 1808 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1808 1208 iexplore.exe 28 PID 1208 wrote to memory of 1808 1208 iexplore.exe 28 PID 1208 wrote to memory of 1808 1208 iexplore.exe 28 PID 1208 wrote to memory of 1808 1208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae63c211d4c042686f12f1ce0f3179f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea9cfc68f1b9dccee144853fc7bc5ef
SHA137c777cd083ce682f81bddf96338f46449246c16
SHA256b01ddf22a8a0e74fcf796895ff7c9be5005fd29f7ebd95787a51d3971379efff
SHA5121068816f4d7d207ffc13959dff6ec3ff10911f4f510bb78bceed94af2edecc56049d01c5ebf0c137c0636c63b0d17008d8c39cee782133cb8742220519613618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b8cee71c9c71bec65a1d93ae23c050
SHA18ea84e37300e4e6ba9b795b0631ee099d11a54d4
SHA256a7f2ac3a31164c425f81136fda633bc7cd1dfde9f40e15e41a327e3d9e79578d
SHA512271d1238798008defa4cff3faed9b1011db8659c04002e3cfa6016becdd6516443827f7d4d9425bc5903b362348587056741d4c7dff5f497a4d0718d8635fb58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b098df6212833431c8fead140c6ca1c
SHA17dbff1374bbff7fc5a1301e542fb963237d5d014
SHA25658c07d3bf98ecd08a8bd1bad8adfeda04d03420c5b8dfca4b957a05da96327aa
SHA512bfd64e7c85f9a67670d6bf24774dc1d2d535d81c02d6ed2104efef0d916a652428b155654ce2f6c9e4e5b2ed242b748243ab4479fee3d0a76a5aaa6175984374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be19b793854d156e93b5660a3bb8afe4
SHA149794ef321bacb120a368ac444d777d4c4260b39
SHA2566f236059f0827f23bbfca1108844773a69a7d2abb05cd365e3b9d5ead76cce32
SHA5125d0e1d38a1dca7954a99430f475e1c206fd6a9481fdc7e01112679edda01747c76dabde1aab1f653ea0ec26cc7e04581af293790817f66c9a7c62c06bc7d5e2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5800d8a043151936df5048094d26bac98
SHA1ca9e880b22689ca9efe63eeaf75ca42a15c344ec
SHA2569ff73b4f585549dd5f3922a9d050b194557d2395b4e5eb35b1ce9ad09ce3fc12
SHA512051483e75ae3226d18d3ad9c7365cc24ff983847e6b680e87e91b332c9257f35ff3267bc04c8c839e35f99f9aed5069cbe9a1c0202be77897d7c86bd4a367b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f642008c1bd1d1dc5acaafbedcbd693
SHA1bc27f2c666d1a9e3081da29333f9463ab84a5399
SHA2567363ec27157fdb68f9e4b3d738615859838e41677e2cc1f0830dbc4bec555da9
SHA512544fe8a0de5dd6e4459ca69fcd44c42db15391fe85be133b7085059a2be0dbac8e5763e93c2129fa5f424c838fd0d3815a7cc030394458b060f923bf8c86bbe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb4c5914f92729be673243398a1646b7
SHA191da5bad6ebb2203fcbb3510b86b30fdd87ca997
SHA256b7ea4df4aca4e0a9b1fcafbedf2495e621a39d29e5a39027921e26380ad04d5c
SHA512c7af6e14abfcbe913f377d613bed8e66e1f84704ca062ae6a37b28f0d131af466478e8d744c90bb47525830927d9c27a1008e03c9870b9126b6888fe6f044b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe697ad4b0a8aaa005f8a4a38b2a127e
SHA16a0ba81faa6124bee7c57a25a27f7ba8607b9c6e
SHA2563147959506b6ac934f80a17c6c0d76c254b0449c09424fe873094afdab95fcbe
SHA512d92cb5221940dc3d15259213a6529297b028021bee881b93f7c9b276769d4b246660a783acf06ba488ddcac6e63bf968f59caec24c023746a40f4e88a6284df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7cbe9cd4a0288e76fdc80f477c7f272
SHA19b8775f40bb48ea4735f09d6dd2a5446d85721c0
SHA256f70595edf364d602c1883bb05a366d101608f5e986a201cf1ba9a82dd2606ec4
SHA51260ce4c1795d3fc4e7a0c6bf2e3bd744fb7b52951ca2375e357c2a94fb7b5e3e227f129376e3b0118a8fc7a4eca35baa73613719be990d9c118b1a4ba480380fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2cc4e80f4a3ecc57346100f6920f51a
SHA1a5d84e11fe60d555de1cf1eefe51448c653562b6
SHA256d83b00af127acd727b2e85af9c35e810a3d458d1b4135a28e5f1b17f6e5129d0
SHA512bfc8fcc1b9fadc9797d7807fc3b4871bfeae1a3a1d39934bf1259c4f73af76dbe86b9f3afb14c0cd786d7d036b8a1e41e6040749210f821181cd1bd5b5cbcd8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575c0b6f1b979d045ee79ddfdaa3be39d
SHA1e1a5465b164e0cce60e5402c93d2465013ff218b
SHA256d6cc42b80e60c4eac9eb5ff48d3f78de3f47be9893175bb1554d2e4db40a6380
SHA512f071e007e67e35a0122dbb23e5c942888619658a6236a5574dfa1661970c7cc78c34f045521f800fda3eff5f69dd3c24d285ec3193cdd243e6f8350557e50135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c53b81690aa21f981c139d270c392726
SHA1e2dbeba5b216354a0777ee28bd67fb75083b02a0
SHA256b021b4aa7a5f78065ca4fb66de1258c97aa9c0dbc0e09d2ded40a7a523f79f5c
SHA51266b854db8fe22b33e042256251ea98ddda7b322b4929de1184fd07d4475fde1eb0f933f3263dd03041374595a69a83765aafb41727da939351fbab3e50aa1f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567a8521ca9528b9565bf376fbd44c0b6
SHA16c7f2a1cbf5e1c2ec8c7c799b7ac89cc20b6a35a
SHA256afed9925f230aa29a099863f00e3074d4a65596ca2a82247bdf107fc115994fc
SHA51225fcdea62b946e490218719c6bcb0f98cd2708a2b3265a684d7060cb772145d2c43f7cd68b59d73918e80a32b96afaacb773f42faec97b05982b8e768de00922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593295be043c8a78f21c05ec08127fd3e
SHA1a3930cdcf8978107c83b23e6c1c4bc198e7e4718
SHA256a0c90ae6eb9d01c33d96011f59f75586d2d1986bddc2b81c9e14ce9b6e81d992
SHA512e4cbbf8f05a207255489e363d5185fb901910090fae484cd2cf29ca53987e4416e1dbd864bea718be2160486cfdcfd57c0a1dd97e4edb6cc58d9c65ddbbee162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f567cf64c1abfaf8178a8d1a1855caef
SHA11db4f15da46344098193f8a81bbe19f6a3637d9f
SHA256f90799520249a7174ea1f05424b57c7a78d80b7a0263a46049789c41a11bd243
SHA5122587ce755790040ea634107c1353061c8691504d47bbcdcaf0f4a564676a9614a2dd5f5fc1c949ba331828d9301d18f50dfb8f517261775ff3eb587b6ed82ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebacb3096059ba15e3503baea5698d77
SHA11e562c7f8ed166abec346d9d6a7e61fc25ef49c8
SHA2563621aa20e1271eab5c987b6991b6b78aea73d23139074cc69d88f815a9e6ead3
SHA5129c2b0a62451960bbb2ddd5538d294ea613d8d429c5b3cc1764c5aedb26ca054379177f3f146eed252801932dc792e8e7efb1ec0f5739e131bb3ae46b4647b963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3923bca59a9c9c4895893120927bdfd
SHA1f03c6fc4d5e0973644e2ac44952481da3ce8cd5f
SHA256d524be98bf8ef3e6f04f273952e930e6c22a17ab6f58e3a97f7b5d82fc337947
SHA512217536dc5d9d36f479e46043467c7ad74d9b3cc0acb42d193bb6e051c3a19bb119477f5903e9836b379c7f67e2fd6cb137d0e95ea92714cf57f189eec56f7391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c26e1132762b46032ef2be0e1e442992
SHA1ccfd1156419855462e108560b876c4763747652c
SHA256c1929a0ae8787093796887690c44bf31fd902c88148c88c3332ff7d88f95fcbd
SHA51295254c1807d9b7e87082ea82fdac1d4e1adce95c8992eaae300ff01aba135d315f87bd2733155b8d3a85834153ad9f444ec991126a96ae8d97293dc4915a97f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50845e224e3263bae00fe63c832e24c91
SHA18578742aa1dcd1b9994f317049ef6b18247c1f62
SHA256845dac2de79ccab1f99be6eb727b41d74ec389000040e241a113f4da8a79012c
SHA512700f84aad554049ef911371f190db5c085b01302101f4342779df0f83beb00ede5e3c0a44091d020dedd4b48b765564311e18b153586eec001f986b56e817988
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b