Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 08:14
Static task
static1
Behavioral task
behavioral1
Sample
b2855e0ee149cf68f86c9202c3b99fae_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b2855e0ee149cf68f86c9202c3b99fae_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b2855e0ee149cf68f86c9202c3b99fae_JaffaCakes118.html
-
Size
2KB
-
MD5
b2855e0ee149cf68f86c9202c3b99fae
-
SHA1
93b6efcd76fd2a967dff1dd7ad8b3ac13d015fe5
-
SHA256
a79cc188da72a49495c7bb8b44e7d90ee47574b22a010a41200175a437a3a1c8
-
SHA512
95297307c4e1ef5aa26cab9ee86d5b73049e6ade44d8f383e65d352fd61fdbe896f27d7f30274c0b438e34460af16618739cd1913768fe58e1a30f81c23a17a0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005103743398c1b84dafee74afbaf875b400000000020000000000106600000001000020000000b7f6f2e6dfce618c4e9cdfa501503b153b4c753fdc629804a417ed41ec2bb0d7000000000e8000000002000020000000c5c25729f379270debcbc82b8872bed67dce5d212380a4b167ec684c99d2fc9c200000008f3dfc0e027ff4a1b11269250201749b4868c516cc645eb975941522ed3390bd40000000f27bf4f7e428e25d396f24d5b4cfaa11c33faacb98959986ffaa3f52538aca2da06953b6b9261d4f77a336851ca9342307a672613159d110da56b4bab325a71d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b60a51c5bfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424687551" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C676371-2BB8-11EF-8A04-E6AC171B5DA5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005103743398c1b84dafee74afbaf875b400000000020000000000106600000001000020000000531d6db64c8fa0d559248672c1ee5fd039b905c4b0162ceb1abdb5862285d263000000000e80000000020000200000006302572595a4ad9df1101cb85db509fc26214d37f02976ba5f93ae45dbc8b3cb90000000e070d8e579df89c3a740a3e9923ecbd14823f46cf35ea80173d26c3ba104684b6c2a9f3dc0a83717c588ed30a8a2a39e4ca4e1e79e04e188aabf6772d4ee7aec92d85a4621973e1d69c5668bfcb5f11f73aee2042ac80a2e69d83a86edc249bf52953a5358336eefb49dd1b468d24804e368dce416ecaddd026eae67c75e4fcf261d171f22691c179e429f432f9610d4400000009fc2981e2757cf30617bb7b6335bfce3972514f09d44f22673504186bf178f9fba60580f3ebca03e92e2d5c551e70e5e71a8398b160398cd3daaea72b923be48 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2984 2008 iexplore.exe 28 PID 2008 wrote to memory of 2984 2008 iexplore.exe 28 PID 2008 wrote to memory of 2984 2008 iexplore.exe 28 PID 2008 wrote to memory of 2984 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2855e0ee149cf68f86c9202c3b99fae_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559ede4cf7e05c694bda970d0be94310c
SHA110f54a89d4abc277d18c9a8b2dc59d228c650cb3
SHA256c34f9f13ac5112e2a2e757a6f3d9c03202aa2f7db2d074bdc951f74d908a3388
SHA512c6f28b1d8090e3de1d20d1b250a9807217559261887ce0df9df1affc4792daccd3217fa6435c16761028c347fea79946a852a0a91a9a326aadc87ff0d7c3cd55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563bff6099369cac6ee0cec95e872ce24
SHA1880751be58e5cb0c477b17598bb8941b9f4cf713
SHA2567cd5b5f716277bd8565c83801484dc19dc17852a7986685f82c252ab6be87a99
SHA512111211e6f0c98a96052a7c6fc370bd18120abb66219e7740ff42e47255a5ae3713088a868e4858b357cd7e0eef0d1aaf9048e12f64d5c5bfeb07b344422a2dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a723d7e6d6df85d48e1a6aef8668ffe0
SHA1a832ce3e5d91b95b0a505c5084321fb8a920a9de
SHA25650396e6e9c621df1280d9291130a6ca22f3b800912eab9be9d2c0e27a7e7e3c9
SHA5123579555721e543e89b4f673edac00da3296a67006820a52b4f6b8fed8a042537e320114a969c81a0f57c4faee86d5420f193377bb54ffb8a293e20052426d1ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508ccf6d3b2a2b7fa1a8e45c99e561cb9
SHA1c9899ede6e2ca54c700cc731543a92b4729451f8
SHA25652b41b7330bd632fb89b314e5f0f7c61eca294fdad9f86dc3b3d3b4d17fa5579
SHA51202b0ebf3e801bb6d29d47609ae9d9574cec2721841474d99a91ac5accb910902da2f15ff2f86cfd3eebf17d95f94180d41786a65c7201f998dedb2d6734d0662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fea2ee8d3c5e6698ecbb25093d6ba32
SHA135601b163531b3e3dce73e8464b058c5a82cda0e
SHA256cc0425ac111ff28980c95c7b1195b55ba23d1ac2a01cd052af5d7f564123b36f
SHA5127da2f10c414d273d9b98205844440c051260a9ccf37964107d33455aaf6d7254e8cbe81046681728efbc7a5fc99c962c8908dfae1b9dd61e935ae7b499c36a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bd7b298bafa01d7566c1a96dac07129
SHA18afdfece34dfa1e396cb33a1c3c11846af905128
SHA256079ae300628d9065053d7450d15c91f5cb425bb2a3714421fbcd1dbf2e4e74de
SHA512665c56eeee1815c05455110c502af553f192d5c1f50211a25d95a54faa3aec825d0c9348dd61bd6c05b5bd8d73c0e52c093751e1f96dc94baf85993ed099a095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aab753659a4adf3b8e8125edf3308e5c
SHA10001f1e53a6eb03e605923a869f59d99d8d4e01e
SHA256b632ee1a2f35a521636e24725374a050a920f0c84b4c52b96480d8dda5d7e882
SHA512887a4bbe7eb82534187f6de6e6802c054e4f67c524e91e931fdd87957439285646e57afec695cf96a567fcc3dda80ec047c5e58eee76f0137e4af54e702b9802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531ce0ec01880d61a42e03e6ec563379d
SHA1b4d29f2e2844db96ccbd709ca02b6217a6cccaf1
SHA2565d960ac9776220eaac54be6dbdaddd8d964e867c4765c0dacfc63695770ba353
SHA512c5ed1786f13fb4fe9f578b2dfeedcbaf83e7c0ac3c239e1d11db22e108d74ef6afb678b54bb1c15f56452dafdbe310bd3b58cab32c0d148fea11406cbc1f3c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d376c4f1fcccba137cd69f88d2d9a21
SHA18fb9c8d494ee2a5fdf67e7bfcad85e2598018db2
SHA2565693718d81799f39d8eb311c5c742bbe557ec12d0db4cd01036f4141a6c75f8d
SHA5125ea163d2d068c7f5471a5c327dd1ebb26d434b555a0aa7dec9a9e85c7488e0465687d9c4445e54e6945dd8ae3141bc2729a96b9ab71ad294155017ae3d79f46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e20342d292874befb6dc4a9142104f11
SHA168f4847168a3c6dcf6caef25baf36a66b0cf8f75
SHA256656e0aa859342e0f04e28e5558d1d31f582a1ed308271eb36ffcfcd1a9dc42a7
SHA512d3d2ace32d692ca560d10598f48e75c4dff22990f688bcf2435cf464db218fbb1dc317889e8e82b5a8ee7fa3ab491e1941cccea4619fbd59ea9b49b759cb0d8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e0b73e0e13cd62231c6a44ec339d9d6
SHA11ccae78fbc9935723f3fd158638087c1c2c27a36
SHA256c2f38cc50ceb83b01bd63ace74d3d71295b10073ae1157b2ad06b5619bcc6d59
SHA5129afd28293b13f414c1763000a06b0627a8bfd79c929c69505b2e94d2441a67552e841cc6b3cee394d5a1984c5503d2114e43fa6b4a66bc8f2ae65a73aa72e7c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db73144c56cd3705d32b9fd49e4d8ff
SHA17ac8de91c7ec869a4a1e3c50adebed59161911b4
SHA2568827e6c929c692260ebb21814decd02d02540f1276f15907e1066859aaea2344
SHA512b45e758b16be0831b2d2f320a97d237d1b38d04813edc87c070e0853d3a0c3ea0cdee447474e1c88c2b9fe7c517501d971a94c55c8e760f077f134f13ca3fcc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db4c1098b1c70020bb0651de9d0afab1
SHA17cdf54f89099b35423a8463827e4ee3b68479e48
SHA256d4c30eee8c01200b40ae5bc57605b464f63d39ef080b2364b10a597aea069e64
SHA512d0ac47ddc0ea9d4afe59b975e4a334e487591d6d7436a9496e6afeb82fa44d64c5e3fe7b97e6bfc935f7460ddfe8e62c0a17fa89dcf64823cfade6aaf2c98a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548226c0b3200ed485dfb89af727726ba
SHA1e37015755be7a7e2c5fc7a115d34cce80df7e869
SHA2565184f1f461f86ae0a30523a1036ca91a68476d3e5da69bac3a09af0d70c995bd
SHA5123680769c39b6472741ee6ee28874dce3a9e0169d618a4604a25afd42dac648bb39204b6a9f3028804a2b57137607534a30c00f03c8147ddd1a05ba2e08dcb559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5988511676732a5b47891b9b227732459
SHA16d650f27813519c58aed2165fb080ed658ebe0fd
SHA2563b38f9c9b8352f9285013b7bfc75b5796e0c52128c620599966e37068e4cde17
SHA512c7fb3a5b2325ea1785ff9a7bb22395269884c4e7c101af590895a293247922dfcdc217947ed4d735612a29e4363bb56f8bd47da892056f7366837a5da582d3bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500039d87fc9810d356948b452877a5a9
SHA14ce9f0218373a05ef74f5bf65ced7418fba032bd
SHA256c86da5cc880c796e15c3a10673bdf471e27be51342931cf210d10c72db89ebd8
SHA512254de4a332ea154d8c22fcabd73fe651eb0d380448136901dfdb5ceef99e2e5f8b125032c5f46a820b73b1083fb58c7f58f9c7a7a506923a9cc0720c78b79a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554188146a6737dce89ad41407ed9bbe4
SHA129561fc0fbc59eb0974c1b3cf57009a9654e845c
SHA2564c8f27b8e80d4bb84121a19832f86f53fccf49a86e5302176d619772113b50c0
SHA51210a9e550dad48a4e27b52333fccf607b566827bfedf2b6f99c76bcd64c4f175cb628c5d5d35775b9b3d6e2df6e892b702d48490891302f9ced449fed0e7400a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519be5fa2439f64911be94456581309ad
SHA1a3dd15a719059cb992ae5b097a10c5f792e0b212
SHA256f394c94834b49df9a4245bb03adb75ae4534a7d3705809f6abde248e74dd103b
SHA5126e53a06e9c3200b36f5880351d44fb5ba20e938b7a489a070deea7e9b24f83dd1effe202d997dcdc769647fdba82c0f5c725acabc7b00792d165cf3597b02905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edaba77d5bd52fccacf4e03d65ee039e
SHA1c694d21d202b0c2654b5ec1ac649ba08c822eddc
SHA256dbcb7a02d1a00a42d5e709e87451a26f669a4bca244a60df43e26f209903da07
SHA5122dc62d26d484b225d16255c6a653170cd072719aacccc50f621674b4bd1ead7feee5f48132b9ee8daf67bfb376300482caec6e895760e4a8eddbf86918afef52
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b