Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 18:03
Static task
static1
Behavioral task
behavioral1
Sample
291aefe8538e4be3be5f9b1fdce57922_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
291aefe8538e4be3be5f9b1fdce57922_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
291aefe8538e4be3be5f9b1fdce57922_JaffaCakes118.html
-
Size
1KB
-
MD5
291aefe8538e4be3be5f9b1fdce57922
-
SHA1
4ac6090934e3d2604e69368a8b85f9749d077867
-
SHA256
63cc43ecee3f308a94b7e86307fefb50e094bfb87251c8fbbf7779c6e95f0a02
-
SHA512
b6447e3d5cdab56c9b0a3137c27e1cbe30efd47e87adbf856d61c8f647c582f97fb11eb46d133aceafb9ad279451bdddc6d1e9a45ba552670ed9401a2711325e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102d3dc5d7cfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e9c315920a3830b340ccfcd308bba5fe0a2ef47e950dc5da14ddd1f989e00220000000000e8000000002000020000000734d3cfd62cfe44865b3acb19770640b45d28a71af8fa6c5cd5b1690afd0743720000000bc85916594da16c027acdec971ac5e4bb68eba7e1b44af5d88f612907e4c49bd40000000638db03df6e0d5799db147f8bfa33050e3c7d2d39882230b78d54988860a99a73d48d3ed3f9fa186abd249e4c923a3a4df05a84065640d1fff182b272e98bd12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001aa3cfbfb8980d0011c64b7068c8851ab0272a1e5883286d9b39dcf8ab23784f000000000e800000000200002000000006b7e47f1bb32537ed757c666f96a359bbc05a934b871ab02e0d1833d88bf2b690000000f3e026cb6afa099c42e21d1411974a635569d1d181e78f1927c16a88b2a474ab51a74a63e6da281ff656b6b2b964ed8f5a4adb26c8e70714b00eb558463ce09cfef763143bf6c96f8052f1257d0c28102e8fb3df2c09f575b3aabfdd4aa6e53d6083f965c486bf8af57fa0e40c4b30fc15f9919d617794c084f13804b613128e606e0fcd07ed74640c8760dca21aafaf400000006ba4911e7c724d5b78d9e3e85422b7648949a94bc88764c350a482a8e7fb0f47923161f0a122f5b677babbcfba15dbe0e4b172e3cc59e1ee5e75525732abd17d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDB89BD1-3BCA-11EF-AF97-4E18907FF899} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426454692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2816 2272 iexplore.exe 30 PID 2272 wrote to memory of 2816 2272 iexplore.exe 30 PID 2272 wrote to memory of 2816 2272 iexplore.exe 30 PID 2272 wrote to memory of 2816 2272 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\291aefe8538e4be3be5f9b1fdce57922_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56401b72c50c8fdfd3f482632d4b69a70
SHA11fdb5ac90a970ee19875c1b009bdb51b5c45ca60
SHA2569453fc58246a776b9a82d2b5f9a4f6efc756f5bbbc50a3362d7af3eac2359fad
SHA512835bd0a9f2f2e95ee477c1dd8bb0c90987e569c7e7c960d5ab7ea5512d0b29fa06e22874f3ae5926b04f246154043800c02047b94233caf77379064ba01c0376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f6d8b2994c6a1a814da2819aab36cdd
SHA106f8ecf628fea674cd78fe734fd145660fd2b006
SHA256aa4c5e08c2e595e584ff547ca682f5dff6eb8b1cdd389116c14b3528d3a80d22
SHA51206350a85f90bf7782a74e7a34499d2762a0f62eca2bc085b5f77e5e840a4a8da3b617625da6f7780e23b044b7399fd6e82d74817724e02af20680013b46e693b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dc41aa24f71522bd9a343612abb273a
SHA1cb9be74868b6428e47ed0f0279aa859aa3750d34
SHA256c47f54fe29f823f79dd474af0c9bfba5faa9b6ed16cf61b8ff6d181448568486
SHA512675eeebb0278da736d63fa843ab41268b9d917c85e1c0680fa308563e42f1527625fbd70157627f397967104e1987a1cf3204f60c30029297e422b42d8db124c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dac67a5ad9c88b354e3dff49d8cb9ba6
SHA1583dcd6430bb91106f38baa0151f9f01eb136e4f
SHA256452d038671377e70933eaef0fb7ec886354c2014f3a5c3cd42a6f00cf9db579a
SHA5122e1a932cc6047998225ef04fe2698540d8b0b90c0df4211fe98d35afe35fb995d5d36022329bbf0b048e6c13518347a0867575de44b981b6c44bcd932f5cee45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b4fb39bb7b994fbdd211b36d92d80bb
SHA1c23ad877b0057d169deb267fb10cda3f8dcce173
SHA2566105ab7576769e306cafa7a5315b52c1b6aa71f1c5405c5aac1382772875eee3
SHA51257e0bc307db83b4d4c245c0021735ecbcb21507e0a89492b12064a5537ed60b22e228f09033424ad0eef93b3aafeec9b96125fce0d5c1c6168d6cb76d0227732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c759ff65a137f01a5faa5abaeb6ddc73
SHA170e46eb9b25948de806e4dcf23d00fd8b469a305
SHA25650259c2a7330da0c9854624f34d55ed185264acc14bc2cb6634997a09ab21304
SHA5124d74930628ca254fc5f0c6cc22cefa200a911e52a3677fa8a7682b31a950dc76c130e990ce682c7a0b70ae6725052c7c02036e9a362d37d1c9be22cfd87c3511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc14e8338e41a6081a5dec2f2b13a973
SHA1f1cee32e9381ebfa568eb146dee8b223061a2db6
SHA256a377c03c8993e16ea4356c1978376b1a1360f39d84b8e0e13a63ca50ca15105d
SHA51250409c2324f604e56bf55eaaef76b0b880c4a024fc533824a882781318e5144ff72876bb37da87d83ef9498840f98e2ed15af8bfb104b3346870155fcbb4b3d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5440eeeb638363a20fabcf862c23ee712
SHA1682970a5df937f0de21d3612652d305582bcbaf3
SHA25617899dfaebd0304dd44cd3fa11e212d19746acbfd3b63161db46484b1abce8e7
SHA5120b3738e721abb66eb9f167019a3de486b5b8449ec7037eca85b76ad5d6b2168a75b1191dced4c0199c72134b57a07729f74ae5ded51c619130bf913070558695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0add92be9e797a07836e585cf8a7140
SHA19b8cde0835abec3be0026cfce54479a2ce03b5f1
SHA256afa9c29858343f4081c2253bc2c0d870d93583dbaeffe3129a9509efa20cca3f
SHA51274720a6e36d697e509966342ff33a6ab0cdd2d2e04d8474a30ba0110bb4823327a663ea385e55189bd547cb86b9a5374def99f3b95d38da1b0b542415e7566d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ea93bcfa9e3353846d4aa6c3f76f9c3
SHA1e269c62ba2e2ddf3a552650ec3aa85e50145d9cc
SHA2566e87f2626a16887ef58dfd2328d8b29dbbe0e89209b9327ad765a95a67898155
SHA51225172428bda535539305d76d71f3db84d4b97fbb05194079c6eeaec01ab6108f3864e15db32ecf8477daecc6af20e26a1b9f2fe5659c6333b5a510b53a2d4e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575ff60f4008ea1943a8ac25d3aecc146
SHA12634de0b7b7838f0edb18565f3f973d6982bf293
SHA2563e21c0dc6ec14c03c1eaeeee54c3aec9aea4d7d547e618f479f3705273134b8a
SHA512712049eee640bd8d2a34b19aeda2bb1920670a354bc0fab8826d16358030d8367325e9c7557d46291f7c9445def8e71ceba3851de2ff22d6d85e8c2c6cc1448b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b71c820eecc99020a69225f97b283c86
SHA130aab14864fa78116fc33edf74ffbae2ee930e92
SHA2565b9e625b368cda70c55ab00551abe2371bf2a16e3aa8a7fcef194acbc81545bb
SHA512fe066adf4a6c0db3e6cc901876423ddbfdb9e584022dbd1d6cb47fc9986e78683ce48f6d2190c13a723c6e3eaeae28b8160c207ec0a78cd7f466a9e9029ac0ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b13572591e042f3af3a22008fb8a4901
SHA12741fc4b0a99b0e59da523d3e7e4738c11af9854
SHA2567192a6f1ef59ed81b11d09d64d245260f4709a3ad6d2e0b2b67ceb1c72615d0c
SHA512f0af0406e68bd3286bb39979bbf5a1554fc0ec13c17f8f51a4cda596319cb692784eac040f96e4250a4e827211d8fe48164666f66a578f65ddff04a032cf5f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55719d96bd68aae817ff5799df4b713ae
SHA17d90dc48300a897a496d306b9ce56d76dfd1f1d3
SHA256fd13e62837f2a84d56ef3205292c0873d52287b9732632cbe6a8ad365c270d90
SHA5125421e2f4932d97270976fae72030798afbcf02b4ca89eba422fef7da5e406337e5dae19d4cde6741b2c0ebe291a964ffb38ad1c004a049ff3c9da90a28b8a848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176fec209d7802d2bfe357e3f932618c
SHA16da95213251feb2781191b451f0137b233ca5ce0
SHA256d9cfa7cf2fa1e3e952bd1df939e7d0e26d54ff58ad87880dbe5e0be4eaee9202
SHA51278540afeae861f48648967c890411503ffb71082cecba34b718f4f38286db7dec3a24c09f7e5cbf21f7308c33eaf62915e6b316eda54e3c6b702a5b5603a0f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e8e5f98ae4c7c1e198bc6fc01580055
SHA14f3f1a3dc9d440b74cb27d6bfa89bd44ee1bdba0
SHA2566b91d596d1c72b5b4ddd4940704da0e8929dbe9fb48cecc5cf2e154fad3ea1e7
SHA512468704c1a9ad7e85d1eed444448bbed7030c7c46872eac4bba94b3e11953e3cecde5c2872351d5d496e321078e1c415af88ee6519b9a91cc2fd4b7bfaf725f63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c6a188481659c9df6966282d656c3e6
SHA1e636d1458c71446a116bd2e18390f824554a9d85
SHA25644fade7cc6cf73ae9ad9f83990ae23e7840fca366100891b55d104527c7b6d69
SHA51245e123d0e880d03e51dc1287d25706d650026c5edc6dd75cee9c3d6288e8c05d7cff1765ed32112105cd64ae1b549008a13bc2378a0a12e404026ac7a9d2ba4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506695a84c0b593fc7a92804dd9cb85dc
SHA1acb5c062c747a87328aaa2be39d33ab10ecbf820
SHA256520aa3bba27576a7e088c4a3d88d5e3e8ce042e0dd046e65ef109075cf79b8a2
SHA512f5771791030835386e8540620e165bfbea9cd41bb1e49207792fa7eb5e5a63832d5e0fe20b3a6b604bf99a75f56b9ff2c5f907a99764824302cc23253186ef69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d707ed3365d1df0cc7bc8f154961fbf
SHA18bc80e975a0c703d9baba2ae68e563219dff9a4d
SHA256837a51210262def4234f64520f7fa3a2a826bd3b5be8754d1e41178c91d7e236
SHA512f26e86fe01c5f5ec3da871dc965c6acd20c477f00d1679da9e40d0d419571392d7a591abbf0f225276d34d25e36f30370dcf6832806a6c287f5a720fcc3ce5f3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b