Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
b813368b781f52dee99ffd9b40f3d8ec_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b813368b781f52dee99ffd9b40f3d8ec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b813368b781f52dee99ffd9b40f3d8ec_JaffaCakes118.html
-
Size
807B
-
MD5
b813368b781f52dee99ffd9b40f3d8ec
-
SHA1
4abbc3e06364c59e077f6c504372baf6d622866c
-
SHA256
0597b07c608730d774bb192bf7610cdbc380ffe38fca0d8a24acc780259200ff
-
SHA512
c84b26ac61e19d5f1b2350134d891094bff0922b6dba6e6faab68fcd1452d828a6d09d944f5de5b38c0e456d4ef033291c70ac4d782373c7371e5bbabc6f64cd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05519ec9ec0da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424781011" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e27780c68d1c6044a9d32d964ccd2b9a00000000020000000000106600000001000020000000535dc1e1b326e78922b17f6eb8ba8508997661b0e007c327a203d02448a3c2c8000000000e800000000200002000000055993cf8cdaef953e5a43002a2d60783e276c34d77c46f981623f66dad7a8be590000000c0d3a06149086d23f439e4f27758283d7471aa45c6739693749463893cc479aecddca3bbb36d050a189c5c71bacedbe5da3a77547ab0338e8c7d1ffceff6e1eb1e21832cb08508f8901f9b90867b2365fbc7449861c15546c56b79440bd6e9e2b0ead463250ae2a8333b89e9620654e1bb6c7ddec34cf3fa10190920cbad80f7e9b07ce075d4c1326c0a2d3528cc27df400000002d3e09d577ff9a078d391ec3ff44ad1ec8b383160da27f4c44cb6a0514ac4724b119a956b8519f9ac75cbb194ff6b03463094f5b1f00b68ed92349bf4c276303 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e27780c68d1c6044a9d32d964ccd2b9a00000000020000000000106600000001000020000000977911ff6438e2b2f559e55eca22c0df35e715129876df7d03cfe15ca73c5d98000000000e80000000020000200000006c1d3893591bdd35980436a784fd9f4534b4d8b8977834f7b867384e4aff6f7d200000004f7032b4e80321cea181e8e35cc2c11d5f8e435d66273e15354f5cc4adbcbf23400000008d3ce8eb67ee019491138a584e3d0ba5a59889bf8d5c48e99b856f6f3df35591d8fe8113ab290a8181450d2d3df03b13649497693f3c3ce1d5d59a2f1d5fa8e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1786AC61-2C92-11EF-B73D-E693E3B3207D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2500 iexplore.exe 2500 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2508 2500 iexplore.exe 28 PID 2500 wrote to memory of 2508 2500 iexplore.exe 28 PID 2500 wrote to memory of 2508 2500 iexplore.exe 28 PID 2500 wrote to memory of 2508 2500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b813368b781f52dee99ffd9b40f3d8ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5783151d1167b433156d328ee0a7ad793
SHA13ea1edc26927019162d0cd45ee886ce8eeb64576
SHA256b5d1fa3de5a57201d88091659c5411fe5df165f2adf5becd205ba206c96a1129
SHA5121e39e742d2ce1036aba486fa6878ec382ce38b181f12051a04d5e44d45d8fcb48088d400008c105b226d817a221a5e956b9cbb0b93fb12da1436688b3aac71dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5287376523171a5037919c93e0d4d0f12
SHA1f091621e8f1720fa41b7ff60f9200ca2a2385246
SHA256e1619e12bd9acf259cd052c8aab114d2ee90fd0369bf482321b27152e24a661d
SHA512cc478fd761f666de3c993947ce9f0de3fbec3c99f7ed13ac8cc2953b3b19fa7485f0afc0353b07aa839d4f5a4459ca03e01ff73fd3e370e7f480978c75eddc5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557dd01641d279baa5f8c9915f94d1b50
SHA1e6cf585daf6c5036791d962cfdfae8f5ef06f00d
SHA256cfcc2380041a0f428b86d265d23662b2cb3ba9c397ec304bc0828188f60a17a1
SHA5127e753433983db218473a48ae4c3a321fb138a156f50b93ffcea605f3b1b166e487896abc1c236b64c30c0b33fbb8c69c25d23911a5c2946827f1303d514dd0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539b31c22c87de0181efb0909d3057cba
SHA1f6647dcafa6d475241854b28cb7a4ca26cc5c136
SHA2562d998ee19be333eb9dc397b2e95a711a19a8bda98162e87cbaa5e8db28973b25
SHA5120e56e3db9dd6ac32f1d858bd5af0c3d6028cfc7a4d2f1a156c7598db499c196f7d0b7687671b3741585ad2e90318ce71f3e992d887e46f618636d588e53e292d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f92c40f82124bb77d0b634b5599bb90
SHA143b728074464e51b60b2a875ced49f88b5a0205b
SHA256dbe8a8d6b3d0ae981bc24e5681c34a584d994d5481e4878294f758a74fd25e1d
SHA512e9ab13bac2d0aeb545a246fc3c9193a1092461d603a10ff5da334b46ac9a00c246a2043832c5e97a2b8ef5da144704a31ab044bf0aa74e2a19a3fe9d79945935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3456d2c469857998b3a43dbded5caca
SHA1497ede05cbc713fdef1d56789427f66c4e802eb9
SHA2565fc47feaa0334983999e2a3258474ee3bb9ff97ad8afe3ac0b5affed3a3ee3d3
SHA51278dc5a1a3852fe892a6d96726c6ce9ed366396b04893b696d5226bc9e1d813d4e3d3e29575be0043c2e41b44cea44eaf7b72f88174dbbc8a9a667ee0ea663f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552b9b1bffdf883911a60a97cec889cb1
SHA1b1f441b7c537881d274d4600d70bc9ab05482c54
SHA256b9ef42c4d280483cd1dac588aaaf7207d138fdf8ecf650039d62c0074b24ced3
SHA5129defa7b3e2dd06f35b467fafeb23cdf6e9f2825c4e5aa5370a31940b9e05236fb23745268a0a217a5f4c28fa131185542c744bb980607e65e73d1982abab7d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e860aaade44db64728aaf485c22fc0e2
SHA13def40e320e0e535eed1437ace1bd5e738b2ae6b
SHA256a6c4a250666b6fbb2a5748f7f168546301cb3b033199797f77738bd370a4e5b5
SHA51279f1a0b5d033084c80cf5da246cf2b92e97b9ec92f7f562df696ee6f405ba18bbbce209b931bcfc682aafb87b4ff8e81ad1d177d269115f941f8143735ade2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594f6d1624a7c9362353a8f20f32f87b8
SHA1a3a83df78e704240fe7e197fc88e9c51e7a30824
SHA25616badab18da210b85500f11537c8faa1d0362444d08798921b34ca789630b7d9
SHA512fdb3e53196a0a2d2cf5a421f90bcda5cffb1d3779578143792fc599efef153bfb0d0a64fe74c19883b14bdfe5640476ca67107365807626e37bfe40adc755118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8b6944374d04d223738fa7a22a29f5
SHA1d4bbec3cfe3bad4a90c95717bc6df823f43274b3
SHA25648b32210f01a95e1a492a775b61e823243539d2a8cda05bb497e16fd4d38c760
SHA51224f632022b13d87443993217c3a83324c2907ea227f4bb437de0dd912b823d832726224b2fc0b1d086aa2a3e8e0df1e23dc6faef0b3c89ed54b43ed69af09de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d12812beeeaa0acfafb06ad80963c89a
SHA11fb256c67c1f1bb3e726ed4365cd13c15f7832b1
SHA256c5ea155862badf5fb6aa4188766caa596d7ba830bc9071f412763000381b98fc
SHA5120a4042da448d8f06eea15d3320972a1c925c51129558f833849b18ffcd8ee9a1b5a6e87c1cef610292cfa988069a06836f9423e625a6ac9db5bafc18ffa97e7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5648b86e0f5c1912ea67aa2a1177a468a
SHA19cbe4138bfeee64d8f902d224c57b355f7e78577
SHA2567e08cc57ddb832c6d9b608ab08d50b27ec9e293ee71a0295804ec11a8425637f
SHA512a46c574ad3c4f9c6c2475e2c95b767c26d48b80792b50b5a190d588c2aaa00b6150bf1dd44a3bc77e41d9ae12872b1e75ce49398225604bd783babea5d66a286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e74420f74c94c2b89050eaab168e1ce
SHA17c6b13562f2f9dd85fa24a7868894db67070b935
SHA256c3863e6ceb4f94ac589dcc2f83236c4a4fd50d7b364bd626ba968058bbca4548
SHA51232b6b8c90e1eb61e41ef37dcb79a2c5b3cbcbca5d66be6a104b73c7f971a17623e71b5fc35fffaa548de5030085a20005e078ca54fc7626cee7181e268ac1b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acd328efe63b8b79e2bf38532697fa47
SHA151e79b66e45c4902ae41585fc6656b8a165bc16b
SHA256ee7355eb8c54af333ce647781514f5e753560f64ed5a338a53e3570f1cc65f7e
SHA5124c37f4bd0f42ca3c489da8a77a18965eeded514a5a1c4237d24cc26ef8cc196eff6b605095d8948e5d1f23f782cef0730ced102532d4c0c69f0bacaeaa99ea63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fe1ffaa6d44dbde18058bb573c9a785
SHA1730cc5d133deb050bb0b59832f071164b62a461a
SHA25621ba307d25cec2cfd956885fe091f6f653529102918509891117dfc36960509b
SHA51293b2395591bffe2f966470e0706eacf0ec608cf17036e84fcaed527c09f7e895ddd12332668050107b8b5d880e80062d60b7c0b7338a2f4a38e73aaced89aedc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6951edaf8a999338b95ff5526219e05
SHA13e033f482e534838992a4bccf5e61ec72de9aa0b
SHA25687ec4854bd4e7bb2574aaf891c578078dd5ce847e624e21c29709b2b78648ee8
SHA512e50a06f32c5bd274680c9a060d562683afd10b75350a01096f796f562771e0795b1dd4aaf2735f23129d3ac24fa95287de5c47ddc11b612b5e9f691fee6bf773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a07f279f5c441ee5aae716a3ff9cf648
SHA1207a68caf073762b3d15708933cbbc209f7650ed
SHA2561bb9440898cacdb26b61018d322420dfb3e8a3b18586eb7b13acf3332fee84ba
SHA512b43cf74065099ef3ea02a8c1a51d33a69fe515e96ed30cd84e30cbe130fa784047f57419a1a6e16612962924bddb3fc5b7ffd3cb9baf843e00ed3b23dfc23b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562250f8524083ce37bcb756a13a60e34
SHA110ec146b276345dd934eb9e4a3eaeee457cf952e
SHA256802a89f7d3a976fa5b533ad3be3cf7c1ee126aac3f38f68db939008b035a8bf9
SHA512852a2f7015cc37b23ed4e1529e65fb629921c64c522b75b98c345d2d06e16a6a5ba9770a5702b1c4785790e5f20a201e1a7e42ecd6f04bef8296a983d07a027e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7ff53eeb1a64c6475d348a5807a7f23
SHA152721045aa71acd6f559c27f54d9b5a2a8d79038
SHA25663b77c9587e6c7cadfe6fe026044d13bd8d537d667fe7fcab7f5a280e3a1186d
SHA5129825b7aa8b07e019b4d2d2671e40c489baef12962bda37bde14acc3e105bb4a9ba49edec3022dc7b074675fa923e88974c811f2464e406becea982d4402a05da
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b