Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
198ee8363ace3e2c00b9eacd0f145f49_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
198ee8363ace3e2c00b9eacd0f145f49_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
198ee8363ace3e2c00b9eacd0f145f49_JaffaCakes118.html
-
Size
2KB
-
MD5
198ee8363ace3e2c00b9eacd0f145f49
-
SHA1
7c7415b1340e00e65c739ebd9d850e759ef4ca00
-
SHA256
044d686137ea9626c3bae2110d49e7db65b0126acd3dcd53fcb4b034262abc26
-
SHA512
09661a625487416e67bd2af675f9904f4fa3b5a42a5bccb8854901b7157e7d702e6662c72dc338ee9c1efc798f04035cbf98b2636c7aeeb9be6d12bba3949662
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004f0850a17a5e6cff72cf9a9b608f072f19d43a112b09ebae8dbb0d3eb7792cd1000000000e800000000200002000000095a1453b7e7bb1f29ac9da928db763d1c82578a4f0ec4713ed4a7c2f818ed4a42000000097b20f3dfd21e9c28ce063be3c46f0d536aa6b827d657342d919d008f2a8d6b540000000ef8dda6653dbafba327783c1522318215283e45ee7cf33c484338c662048f7e8a419830d5fe9de9eff19ff08d4bdcce69abb0dd7fe2753371ab2127c3fe35818 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425727380" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86CCBDA1-352D-11EF-964E-D2952450F783} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000a3c967060126d6f8785f72f69e42e1d8f065ec39814408594e18c8c288743d50000000000e8000000002000020000000a8db8eb97a20119b08a6ba602c37dbb96b05effccd164fe4e4f7f2b6f642db3990000000e7b2a5d468050e1b381693c556a415c998a463a6c579f95b68091f5e26490d56318b43846ecc22164b95106684ca4c99eb38600c310d7d9b1f9b423edb003caa2944d9975296de4b764be70ad0c16d422d0faaaa428b12257394c573adce4a7bd4bd0ce6c8516f5a84e1d4503c411c5a3840e357fd0101986ad4a69fa931d71dc6a7ac1273d78694e645f5651232e9d040000000c3e8ff16b44461d08f759679ee885f15f63d501f2c239560c9f9526c611e0c0e3ca2da1c224740ee1df43c1caefdf5566bdd9ebf5fb989b32e891d49cbfb851c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e1485b3ac9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2064 2088 iexplore.exe 28 PID 2088 wrote to memory of 2064 2088 iexplore.exe 28 PID 2088 wrote to memory of 2064 2088 iexplore.exe 28 PID 2088 wrote to memory of 2064 2088 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\198ee8363ace3e2c00b9eacd0f145f49_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eb6ea9076db366f62d6de70eafa6f39
SHA10f7121304b1c22c8116eb997043dcebdde345a1f
SHA2569a5f5052f27b153a18962daef63a5003bace4294be0f559331463d4b1fcc4c77
SHA5129fa3dd194c93e1bd53fea709ecf950c7d265e5c7d626352aed43b16e800d189a2bc2e47d73529e52174036a9f3ee3dccfd090edf277ffd387535b0e7183d32d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b60b57f4eb22145e2ceff9c805d03662
SHA18e7f5b47246685b0b95323df07f4234d957111ae
SHA256e27d7347e56db29fb9aa394b3d02dbe611822edf859a4f7046128e9841773d0f
SHA51279daf82e28191f45cca415ad18c0fdccf9a7e044780f1d3c9f6aa0d60c22d9a6715781f2ca4d828c9cbb7850547d874be3dd5fbdc35775429e0b5dc9d8e27a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560f1ded77998a15aaa47499d47a4d85b
SHA14cd0c4126c0c24fc3732898116d214584c60aa93
SHA256d871dd6cdcf33a7688cf7bbdbe85da9ad861cf3bef0062a64c7ff0b5b5446a71
SHA512dad70e7d2f25ed4523ac73d9e72f380bd35459e33a737d5d885d57d9e107f6ceb77a8021f72715805a2ab119e822c8680a1d4023d5b56b53dd4aa8dbbc9a7009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c05ec5de84bc9e4cb3727da8654b1286
SHA1be1fba353adf3a6d1d1a1b8f36d1a04e5d3a03a7
SHA256ae0c2c1761d8971b16b702f63698fd135dacdc64d3b996e26ffebbbed6b294ca
SHA51269ce6f7f88f6babb42e506f441f52a664fc43067ca0db8109f5fd78db986b0c06a94a3d2cc1ab22e483b23989705fe190cbfed1fc2cb00239e49259434d3a3fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5878d1d867b8a400b57264bdf68bf38f4
SHA1000efe5b73824e4b96210c872bf8a870a19070ef
SHA2562739d56af9faf9385c778922dba0afcf6f2589592a400de815dae5590aba8ed5
SHA51208bda9c4244fcfce8e5d82ed7f068d556bbd549f3752fdb1db327396cca8b595406255cec68ec35abc251f793c6ceff3036cd3807867518b4e926d510b40c924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d7bb2383c5b9a6c8d96716cb445845f
SHA134b23f0d54fc5497a69c664a6997d983ba2f6a40
SHA256115d5b93dd7f8acc400526d190704b2e87ae74341457a41a58be9897578b05b7
SHA51290118c97a62e6713be75abf7a630ea95d32f4bf2ee0352542bc7b1ab57e9b9dbdb3e60c81b4cc79a4d5a18780cd23da2bafdb8988c0c6e82ac30660d8004fe5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578b2b104682b443fffc2a26778040cae
SHA15536be3c095254d866f0e310dd741965197dc84f
SHA256c655a7f74e0ae83520e2e69173a32a07d105a3902356cb8410f258cc02caa724
SHA512a1e8ea708567c1a93b23b774f278a6198111fb006ddfa32467dbeb0eecede3682154dc75384d9315f642a1f845fe1d9b077b97cd87b09c1c8c701150e2434080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57df8c9f2265730147d46577e9166e1f0
SHA1972e879a1fe3c9a14147881c542148531b2d7aee
SHA256aa0dcc0adfff0a444c7df1f4b348bfbbc4eed6cae04440529535b33566df0cb3
SHA512b29e4e4039fcb3f0ebd93e6799647ae2c6b1cc67b5a47e6a266d1afb17e8f3abd9c2aef0a6c43dd22859f403c063ed58a8358fe4e85ae24da353c56393c8d97b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5818d1a2c451842d890533a1d7b9574d4
SHA1aa7bae57e83b41faef505131b82d076e95f4d897
SHA2566085b35469148b62a97812d19e42fbd52168b52a7efcd66c815054a302183f59
SHA512866372628c9c50d581097c33a9aad346e13e4dccafd3eeba9306df2d3016e1c0ca1af54857abbf29d55ebfa97fe26215c822637e2ca34dcd4815118da9e9a8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e7ff4fdb273be4143b0df2f51849330
SHA17c16fc7b427cdcaedc9d54fd9673ecb0740eb019
SHA2562b98e77e1bf0f122f8c9240bf458d3c30655896a25540e3e928529a73e4f1455
SHA512a50ba7141a41f6772c1f021c19163670d50207df9d07d5598e1fe81854fa1a0d4462f580bda325dd7c60cef35b6395a4256ac50ea549ad245efe6f0647de0fd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595e350ba5ddb1d2400f004d6722a94d0
SHA185a74d1eb5af59180ed9432d44d0fbbd61fdbad2
SHA256c513fcb6b975bdebaa8c37689888921705d75024291a4fe625a0e6b4f01a03f5
SHA512b6495ef3f01813e4fb3fe7772d74e58d4ac228980a5fcba728963f373ad63d9d5a9d58125e52ce7933610209c21e486d1e1ddaa3d01a4bd5cab2464d57ccf076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee6b24a0d5ebb0091f7eb1c79e4259e2
SHA1ddefb2a41c27cea4097ff2f9e1525489a2689815
SHA2560417fbb0e00e748163e127c7e2647951e968c19da8176a970b3a554dc6ce1955
SHA51227fc53d778d7776cbea1e8f8f5628c7ad3de2065cecb3043776f40e29a3d6ef62590db794cd16a163616e79a77083ad2eb743443d5d5a26f31a080dfd2d7c399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591274e33a7e0f7cfdbf1b52cf77a5aee
SHA15943ca6ead0116d0111181f12efc963ab8abd50c
SHA2569afb6980e248f440ae562090248bc381aed0f6dc22ab2280e91ece10a0e609e6
SHA512d63654c12f9040c4cd91f48a6c06a37588c106ca9a3cf10588387d8b4c47beaaa5e99d6fec735ae4c4a00d071611ed7b52cbf6b3b31ca2d296d95b81139da837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b9c3b013b9f069b6fd4a06f321c8487
SHA1d0d8758cfe25d869d4b99899599b0c3bd8a348c3
SHA25668f21f48b60a4260b18585366c3642b90d4c5131ddab3519540c681df758ba89
SHA5124c91e6fe589f1c0ffdb81c0c7d633f28bce7945b9af1bdcb1ad3e1395601c7e0fd17ba2c76b6da2d71dafac49e5d6e4260d1c46598d96a978d7e0aae60851f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5880526f43869ac337290a165577f2bdc
SHA19986f2989715914b746c9caae80299e494cf02e3
SHA256989e342b11dda010e72da22b8f9e32f321a1b0c9c213d6f859fa2df80e118382
SHA5124987e5227cc2cb4c88a58f59524581cb7b0d2ced01c5e5ff3c65b56757a681b546a47804624d028228ba6e3aa58653e2f884a28920420d8ce24b47f405d04d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511d9aa63e26adc8d57bb7cb65086d8ae
SHA1dc8c30fdc719ab97c748df7472d73baba12b797e
SHA25626ff75ee4f3a5400dfd114cedaf0a9b77eebe1a6d3bb51db6a4162b5c721ff12
SHA512472824e3432df36894007bfe184174fde5cb1522c29e2fc817612e0c08957135221c3ecfc0a4f96f43635da3188d4f05b4d3cdadcc23ac614857119e7610995f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3be6e824999c54d4025596729bd95e1
SHA175ec4f2d6549a0623acd885b52dc5a4c6ea46be6
SHA2565fd8c0c9e85477815dfa79fa220e62ebb1c6f7926d9497ba9197d50e28536c01
SHA512a4b07cb976f9013fd7a49f15e1f924950ca30395e3a833d5c193bb5e87ad0119794f0a0255669882452c208aef6f3ae260da1716d560447da07933d42362c722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c83d29b5b7df896ba14d05b7f5e127c
SHA1839b23f14a2f68e30dfa4baae8dc8fe2393ec061
SHA2564de881f467bfd805f24d0b7027e217987e639ac0f7c93c239e08981b0e676b9b
SHA512a57241e18edb67bef656930c944cc8afabfecbc7ab550b09fb09cb6da9cad3c409a653fc44c9061b24d597c42b78ea4ea631702fbf2b6ce756fd267dc687efe7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b