Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 18:51
Static task
static1
Behavioral task
behavioral1
Sample
afdd24ca3ebd3561a367ad2908d1f1e8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
afdd24ca3ebd3561a367ad2908d1f1e8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
afdd24ca3ebd3561a367ad2908d1f1e8_JaffaCakes118.html
-
Size
746B
-
MD5
afdd24ca3ebd3561a367ad2908d1f1e8
-
SHA1
4868ef447b498bfd6009ccf80389a78da6ada833
-
SHA256
ff3caf56fa1e3bf9b3e1c6e8459ffedb7966883408838a077ebc5aa8783b933d
-
SHA512
9db249f9507f14b0c1a3b8ae8f74d1001199adeffd7c0dcb3823e84df0f97614698069c6780157b4a22e667b2809e23ef1e25cc1ec49ed72d9419dc7c4097da7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000537c1c4d6399ac6f78e1433225dca633a8ed7587166755b6c9122a9b5444ad58000000000e8000000002000020000000dd4a73bc3a3e0b283f1c391bed586ddc812e68c6081675a494266bf5301dbd2e20000000b7c6e37f22d302d386595e1d27ef963df38636ebce4f15ddc3e6c972175684e04000000041b45be51f2a161ffee63ff41ea2db0d9b980d36844e1d7b034b7036c50323be621760a9eeef72e33611ccd24527b478598b8da874afe418ef6cdc490f3e3c11 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f9f1fe54bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424639340" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000004c25ebd99b1b4f5b3b2ad9c4f8899fcdc20183a5da3efbcda948b6a1ff36a658000000000e800000000200002000000047497cb5488c87ecfbf40948f06d21760a9990f05daf9f2171a5683f145a9f199000000050cb1c372139b482a265a1fc773c49cbc7f4ebe84fc0bafb24df2d9b2a3eee1ffaecede5ee2da91f4a830b2c69e3c2164abefef02df2c9a3f11eae9cd367889597d56940c59a405cead3c38cd0f49fb411c0c223a1930102b2a0a6489baede7d394f244db10ce66c12543a813aac4a69c61f6745d6d2c147a59f54512f245779134055064eb2f5803120b625cbd2ae0440000000bcfb4510cb3fbd64d18506353f0d1f71af7b86414fd47feb83616619de147cc31e086c88ee1a93bcdcf1d742f4d3386893062a6b9d6de330b661dbb9c1cfbb61 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B153CF1-2B48-11EF-8B35-D2952450F783} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1696 iexplore.exe 1696 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1696 wrote to memory of 1936 1696 iexplore.exe 28 PID 1696 wrote to memory of 1936 1696 iexplore.exe 28 PID 1696 wrote to memory of 1936 1696 iexplore.exe 28 PID 1696 wrote to memory of 1936 1696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afdd24ca3ebd3561a367ad2908d1f1e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5341f571511665781f68faf43b741bfaf
SHA13065087c1f3c4629e776f2f6af7cb798bad80d21
SHA2566fef684badbdef2fb783107bb74ed0d584db7d7b79bbac293136181e02ad5d77
SHA5124b33f3a4ff85c0afa965f6192ef77c3229ea55aec89a187db28a1cb70f9c4a0e3d9ccf6f5c989a65199953f307b4db22c50df02244c43d385d85fcce600dfa99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5970bfab19a88e8ab0df6745937b4dd20
SHA16737bd61e92e04009a20f7de4cfdc6d5bb131b2a
SHA256f565e890100712c02dcab4ca2f35241835965e0522bfadf4cdeadbcee0cf07f5
SHA5122d3a852a94e42cfa149976740b84d7b516d3f6228c9e9bcb34ee0dc62a780f596814c93b270dea0403f3ceeb07b56b0b62cdc1646916d514c1b8949ef037ba21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b148349bcd92a8ade0e32ac550ce6c02
SHA108d21b6f794b9210fcb168d9b5a2c64160b1c9e7
SHA256c3cc8f74fd3e9c3186e4a1a758a8a5354ccdb376650be89ed6b0d92f0f82a4dd
SHA512ff34b2e3fdeee592594fa891fe484e551259cdd8f832dc434dd4cd39fc4a52cad447b0a7c14a5ffc4fd90fdb9649f1ddfeea7b388a6774515ae23d771b2df5f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce4a368fae1e7961117ef4bd24262304
SHA14b0265a3f9a19f8d7ebefe0fb370f7984725c405
SHA2562111b346a2c0abcdc1038afbd3b8dffeac4cb6737e231ba36a4938fdcacf1a6d
SHA512f9fae6c3800148a9e5de14f16def49334a2e8112cae887b68c46c00adcf06491e99bb2a871cfd882c6560fa8dbe26f0670db01f2ab665c694deea3dcd3377096
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a022d48d253440da04841a07932f680e
SHA1c8088549bb4cd965f411ece1befe90dc7627b977
SHA25601294b8780336ddd1999e725e0b38843dd8815e5a7050514f1d52e9f3822b677
SHA5124cb26ceddba9e3aff1cbcdc14d3f89cfd1e34315010379afece47feba907171851139fd10c8333216344711742e806564bc035ca7e495c2cf533545e467b6520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afee1392606a1c468599171fd1f7f9d5
SHA110a3bc2b4a7559041da81b14f89e1276c8bec5a4
SHA2565be1125b1a48b08bc3a9e80077c700afc7f3c3444903dd90039388c2f6f681ae
SHA51204b26ac89978091656dc58b0111b089e5312bc56b74c04554eb290b2a5adc689ad272017489faf2a53f7acf266b26c11f4917911095d82623c094ef2351b24c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da56957b39164812e4d5d042de66a9a1
SHA1e46992f2aaece4778c5cd0be70f7eb8850eaccfa
SHA2560bbaf57747e7d6ed8fb69c03cafee6d6be8823753f5cfb8b28c6e32d87c9692b
SHA512fde2f8d3c3a23fc46ed8d1e84ed5a1d4bbd5dbc5cc6241c0f92c533c3351851315f1f1a61fb940939714086ce6cfbe7c358c18d8cbe9e97b19280288fa984984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514fb753bad706207e865bb432be5675c
SHA1db4a7d8f0ce193866a0f613c1bc9eaee4c918825
SHA256e0995e4f26b28c7a77460d06d87b070c11586b172dab2516cc5dc4b7644e160a
SHA512f5c8e079ddd15380c1943595afe6c5b22a30f9946965b50e625cd1d72b98d5aa99853b6ad14b4370d318875713335e819de181607869bb47be63e90d97f0c342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5858e86ef1e333d1869c8b967285a9027
SHA168c0b1df76ba03fe5a264de6090a100e968f8ada
SHA2565b180a98e766b4cbdf1237c7a96d167f92b5fd3e894a1ec59d175ad474d2fe66
SHA512bdcc9c8447231751d2208674a4a9dbe462ecc74685c7ef2b44eddc94d9cb2939fadaf17883430859facf9e1352c2fce3020213b9b72ba73df75316922184a0f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe940fea3520bb30580d5f16771989bc
SHA1011952be2bd19f8359d677d9184e77353eea0768
SHA25604cdc52ec40edac4e3ce8727a99e116e9f51220c52d571d67301c13066126cec
SHA512fe340e0b78e2806244cfe5a382a9379652719d1f869dc5f9e71c346f4710f204af5669cbd6891dd7238b1316f74473c4e7ec2d83d6fe6295cac62d840c267f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4dbcddf461a3feefcddbca5a49acce6
SHA172ae5bde586e82261cecb96fef020a9fbede80a7
SHA2566c5dfaec1fe7729a79f19e73417d0031b610001f3a083df79b991c0e141f52ec
SHA512ef208f18238acc13a380b8c2229ee01c14ee03bc18fa490545f664dc8c4d207ce67029e6f6bd6c841471fa8d9f8e8617bbeeed58d7debc4626e09606a5670825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0d1a8851abe101d8508eb82fbe80d1a
SHA1a3792e9c00bc9565b28b39693c6e2cce09c255d7
SHA2567bc42a63b44736baad3ae22570f086eec1442300192c6fa65ba2cae2e57cf588
SHA51259868b7cb3111159a77052d2f9dffdb3381bb0855f1a3a618c3be62f650412438377303e5c06dff1d9a3aed5ce871d57e7a1f8f13dda0a59635127f472fc6c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ce8a9366a28f65f6e596e9828f04945
SHA139a1b913db98cc38dac201d9f474d6df5f6090b7
SHA25669cd9f242a3c550c4b9fd3155554eb10c38db6c57ee15d06c9d25d5ed12ed02e
SHA512006e12de22079be53bcb35e157129c11321c56a944d855b229b1ecd4352d6e4463b888831e8fdbed7ff8889cda902d733c18d0a628d5e2d87b9f54dd7567b4eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c30af2d20459aa160d5db56d1c5cf89
SHA107faa9ee092dfe8cca0a20dde7c9eaf47688bb22
SHA25664fadfb112d7e9ca7b29cb4383bce2cf085a11750d47c1c88f7e7968adbf2c78
SHA51247c9bd5d8ed8fd9aead7b41bb9d87fa18c25469d7c3d38d7bcaf2116aace9d5ae952e61ba9ee103610ca68fe43b49bbea9a3fad7ad4a7a79f6c1870c770aae12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff85afa651e0e645881b63b9c583f08c
SHA1617e56156199817a448b4cef5637fbfccab3c52f
SHA2567b294b1b90e0955a97b98d4d7b7e0fe8b900de4c4ef11a70bde710b22f0126a9
SHA512a564cb0cf2d5c7e9c45d3c5712866ea5045c6006f4d620b88bd121132ea60d7c2a476591e5f9394dc9b5dde0fccf394a046fd35232648037997df121ce3ac6d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578ab17cf2b1deb85aa3c6194ae103acc
SHA1f05789819ae3259111572e4b0442cd744e3dacee
SHA2564233139b161226cfbc8d1ab1d79e495bc8803e4394bae712a798158550d800d3
SHA51202ee893fe5e91044ca5a563da9b613d54406a438331c8b56b6fba022fb86c44c623e6c533769e45bf5f95c65cde5faf97bc60af19d29558ccf8e9b8b5bf9e71f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afc63e0263e92467082f34eaa743e0a5
SHA1bbe01cc1dd1917a04616221d4fe3141a5249b034
SHA256d1e377f044d99c3c77932061ad8451fa486d56670936ac1d2682acfdcb9a091d
SHA512c7ab48a443480c0cf21b80945bdb4abc2c1521884888f3ae66d6e1b84c62fab9aed4b5c709ffa1552963d1c64e30d4fbdfaa80321dc4938ae2b0ea7853f791a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5097346e5f0000332ed09e6615c0f8211
SHA1aa87eadc11a8a2012de8a15072a6917f99a15278
SHA256dd4816dcc7c6248b1085a14049da0579139a19e0c4513f68d5f9b7a12e8e55c5
SHA5128cd39c312621c4f266b69a4111e6852ae58aa08f9c459a283b3552b6f8c2897eaf0a5fa13ff785184a890a3f2e7746890fdf3d42f8a113e15b9641ffc2301286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5826151b30df7e288128e88c3d8f3ae4f
SHA1b765666274b1019f3137f26e19bd6b6ca6a37758
SHA2566c39959da85df395bcacb74acf2657a736c9de816ecf5191e57b0be0d0e96009
SHA512e49c464ec71cf9bec03cc9cb2722dc49627447cfd3d82a748a6cc88b7dcd2806f5aa7253e9c49a4f7338d31697657f5678f325d3af7fc1a22e0e3cd347dedf43
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b