Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
236c7253728abca04540b219f071539c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
236c7253728abca04540b219f071539c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
236c7253728abca04540b219f071539c_JaffaCakes118.html
-
Size
20KB
-
MD5
236c7253728abca04540b219f071539c
-
SHA1
5d6f122665f046d273318b9318593d26221d3b60
-
SHA256
45aea9c6f01dda8c73898acc420e31c2da8a4681b7c83f3f11e31606851c550c
-
SHA512
9e1fd30ee3b256171724764428b5183b0137f63e54b5447b7643f82dc0771559386a468065e920ad227aba964afbe7be041dda3c55c3bb1d104baeedb71ab802
-
SSDEEP
384:OGJ0HlIc4tv4cuGTHjGJQBBUKiGJyrTHn6Z8i/gb5LOXguLZ:OGzDGvGok8AglExLZ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006c746e53277ff79b9aca5d6aa1b96cd15a3925fc2bbfef72d405ba258af80b29000000000e800000000200002000000011ddf0d1f73f85faf29d713d4de01002806523035e53063c22f81a1d5cb5111e20000000ab12ef5d34500591c1eee60f45bfd55a6c37c5b573211c3bcf622cff74be33fc40000000f07ea25ffa10e20a155c59efb7baba4247bdde945874342d9f3a979524d47106093787267359ca08d1d0acd2952ab97a6927524f0cad8b16c074dd93cda93784 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001df8f748d5becd4a30af4d26516f303132cb00bf91cf6074b2d67eaa937935a6000000000e80000000020000200000006d1c500d4067014678179bb369d57a666368c26e2472295c6c631f2bbb740f7c900000006181e1ea9c85846fec28f32864d145c1ea735c1f75c8469e48380f91abb44eb984bbd81e8ad971b5e2e5e7d084eb295813b20b9b9e964d927b3712604d4a7834b1522b472d125f965b184c3b7123ea9384a21094ff2fd3d8616a9e7f5ca54271c01694c3e724334170bc5e562860ad917237981dba98da712153a9a96ddce34177c4c60e2f0e298f247b76439be2e5d14000000058c1b19a2f9376fec57edd99316b672b0e45079a852a59b982d5a0f36a8db857155f78a8920a707057e3eb50dc6ebbc42f9a86ba93cfb57b7080815c1d574389 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b1b0b87bcdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA19A7A1-396E-11EF-A5B4-4205ACB4EED4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426195188" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 iexplore.exe 2040 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2108 2040 iexplore.exe 28 PID 2040 wrote to memory of 2108 2040 iexplore.exe 28 PID 2040 wrote to memory of 2108 2040 iexplore.exe 28 PID 2040 wrote to memory of 2108 2040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\236c7253728abca04540b219f071539c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baae28025437f2df56fe47cbd88f8498
SHA1784b2ae048b5131efdeff9bc00864e1be28e7c6b
SHA2569ef42f921687920c13a27d734fbb1a0452f45446248fb2131f00164d381856e6
SHA512e6b05a34497bfb9abe7cc2d49ca0f589f951b194e82d927a8cd21a91f3e2d5cf585294e41b4a3d167def4a3dbf8da85167b091dcb7f095df28cf1557847008d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5390b3d514d7140f7b9a29ec15a1987e6
SHA189ce6d6cb42b2f8c9fbb93bd89ca3f237c35a529
SHA256cbb0fb29ecc650099441d1867ea3552f352d7ededf64c3f83eff02e4102150e1
SHA51257468103d8b5e10ed29f31fd4b7520d0efd462025e57941d85258accc4b4defbd0786f33e3526f4ae777dce83f6dafdb43cd10f95fb5de5639e4dc4c8b129e29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0bae85619d36805002dcfb11576cee9
SHA15cce1bf153ff15e7dcc05c1a45db352776840a77
SHA256c5aaa2c6a6868be3b1ba479de2b0355f4990671a9ba272ac362ad04f8523fca1
SHA512ee77dec16bf2b6f234d136b385c211d2ce9560a8123a6236f77ffce1a401668198f9c5d555290cb6e8fbf5bb938f7a19dc7a0d684bf2b6f1eb6d0904b89cc5fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc7c7aabd0daf396fb9d2ea38c36dcaa
SHA1b1ddb0d82e14a2a48ad99cb31ccc894c55cd22b1
SHA2565172658fa85c0692a33180a04f9a8a1ee1600e6a9f8fc262b5ef17fe6f81efb6
SHA512a2d7bbf42859bdeccea35e39f9a68e1e84608aa3362e9b060b59bbe3dfb012e3d4c6e208436395d94ae85a2ebfed2648325ef0cf44236650f18a0fea82845963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea3db50cd67160ae200dab0a25225991
SHA1a5909b7b2a224fd9637a9228c23de86355c81e83
SHA256a9d765ff6f7b6da25b1cfb6b89e325fcc214e4e20ff226b97c3d3fc0284158dc
SHA512da43f3210894bbc02a03fdc0970edef6e0d336299770b858322bd54fc6852fff2b6d9733db0687396706462e815e6433f05285e4102a8c666e8d42843aa285e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a4960c03acda14b41680a57efd20800
SHA1a8e5ef323669d574d152aa72bccbc5e8a1637dbd
SHA256c2fcd5fc55ba912b247d737eec1d6400198183c9eff9df78f730123e0418d6fe
SHA51221c20a62eccd6a1d7b9772b914ced9da218667fe636892b8086ef12cad50773b652a30c953985de5574f107150933d7b5e47192862abbf3d252d15811c0fab59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b09f7712a7c0f81881491fefa477a2e0
SHA14aa642a2befe8a84f44c98bf5887f3743b66e065
SHA256a4404cec1f440763c6e87192eb9128daad6f39940a7a71f7fc0bf93f07c8d021
SHA512801d9069a999a977252f20eba243ad5aa9314661c42e0831b82a264845cd1f2fdf63d74bf7c932e22e765813c70b86b4d6d789ee758ecf892fb7c2dcae2c09e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593a7db84326714793ba93fca6eb21cbd
SHA12ef043699f5ed4112958faf3c581c2ae0e888697
SHA256d668ec49b12f3388f51b162cd59b694a5c53dfff7d042b9f18a877b00e10c45d
SHA51289b1b2a23cafd2af2d5d2220ca3a66ca9f0168f5fb87283955c0bdabeacd5612fee6ecf16a78557aa1d48fe5c2fb384879aa440ae2e86218b2e6f8b8664eeca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56133a7c22f013076f097f961f5705b38
SHA1135f6f2b007d922c2406300fe84907d6600c2e1c
SHA2563bb18094c706f8b5158bca687067d1a35a7cea701c458b058b29173bfddffd68
SHA5123da3e6d5cefde7dead555a9b852c78d3419d251e1c8fbbd884b7bbfa9b519f34a7552c43c6a44ec19abfe3e4c8925a324a10aab51af24b86c2b983785591e9f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566e83bb4fce3330120a4e0d9ec360034
SHA1b7f760a994c7e8badb1d020341d1e9019c38d746
SHA256516206da011bfa28370fd6516c66dd015e603b228d782baa6bde5b94ea5dba57
SHA5126c63a6232b5cb7affb8a6e5842aefa2b19d7f8f6b7c7c2dbb608a9673fbe62cded4f283c11e9430f28d90a13ca6894f728367be04b8afea07b5353b926f5af44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b0afcc6f08a31a96036bffea1f3b009
SHA199d8a9638dbccbc07dfabb6bfb42c387330eaaa3
SHA256bd7baf8ebe6e6823162a1f5c73fd903e8ff2c58c67058b334a0e5888c1dddeb0
SHA512da7a5ab40c523ce95207f5114b772e9e2d369b96065e30a927df55baf61ae9524b133692238ad5966e9889dd62673950dde5adb1b893e32e11afe6ab50aa0f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57695a2024a7ba498c2f23b5a2915b4e5
SHA12c8d11b61e1a3e96f9b0aafb7114b14840db3213
SHA2564166561dcdd07d395fb77a240c455ac7b58df0e464debf16ef8bfd5c9f6528a1
SHA51228c53e775251eb2b8adc208282cdda42b3dcf97d9972635e654c0a5103a622617912e0ab89b8a576cef22559d6ed0aa6e56148f3a2390d257b5c1cc490ff7f06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577dc62df34e0bf81f18e07728cbc45fa
SHA154070807426768ad3dcc7f9dc737cf0e3381e300
SHA256cbe4976392aa3adb6f94ca1cab7d200daee9c0a6a70b77c0d9b6a2cffded21ef
SHA512dd2d57f2eb5cdcdf8c21572c16831c3186d7a6e24f475c5df7a77c0344f664dccfd5a174c2f43202df59378db924b2842c579bc44b391ea1a085360e4d88e7ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e8b8efc4ff2bc66cd00bf43c21a1161
SHA1e897cad81337a30687b5b9bca110b3d3a0d93c68
SHA25641c620e4bba3a58e76fe63ab72a3b40fd328f7549da754832eef9093e13e7e2e
SHA5125a8ba2f88cbdfc2d4d7973abfcbb2df2c7cf38708ab9cd25b980be49f4253201cfcaa854844e1dc8995b78001b46f4526089981eee9aac38f1bea34ba014f7c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50282a997e238bc608574696ac7395423
SHA1e623f45109d9b07e20b46af57115a4c1cc2ed5c9
SHA256bf7b9a682812175b297b1e699d2ae92c12deae535d815b4cf76eb769b1a7a705
SHA512da8f7b515d8921fcc2a0e9705dd3a721f3df0d4c8601dbb800e2f1def45a01e4a17a67fd50cf80d4a18761447625e9df26b8e3dc7e8fe3e3be82bd197f2785aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d354b2405b82fa40e5abe4b7e4d54f1e
SHA1fefde2d7f32aff0654fd4f5228bb98f6567c0787
SHA256d0b5d6b262d66654bfbbc071fece9bb93ba92266af9046d79823d7573b0119b6
SHA5127a97734f4164a5cc5e3d7d2b00621229ed16dcd280e7efefff485791157dace9acbb569903641d1f25bcdb1e2fb3288e2a0dfbe929e3b914569968abbfff41ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581223675439c427954e2e0ab48d729dd
SHA1cfdce4d3b6a6b775c970be3afd3e9a6a6b27f899
SHA256009d3e8657279256f66f690d812f7999a0195ceb627f7641564565a69c2de4b1
SHA5129cd446e05fd45c22d32e86f22d3854906706cab38a08796e7913350462ed7bfc476a428386d928a0dbe295bbe8f932a13d1cc383e14e9c79c26c3b53da9833d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa4303638159eeb248cbdd18f7acc128
SHA12339abb38fd8ddfb0cb28cffcc2c12f5f28f0898
SHA25604305bc13f67c57705b0443073e03ca9522bef27a0f85055947913a8cb5ecb30
SHA5127fa2881a48809f269072091c0fde2dd328aeaa52e31d8dc8cff7096b6b50b4b3d7d882985e81e92bd3ac3012c2f4972c3f41f2cb7ffee3bd37f29e9f6e500ed1
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b