Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
293b9fd67f50f8b06cafbffaa9889760_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
293b9fd67f50f8b06cafbffaa9889760_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
293b9fd67f50f8b06cafbffaa9889760_JaffaCakes118.html
-
Size
2KB
-
MD5
293b9fd67f50f8b06cafbffaa9889760
-
SHA1
d9639169aadac1254c5b9372365181d837c66aab
-
SHA256
3ed0ad213127d9f9bd68922b2e35441eb8a2d26d0775fa67e97ebc530713126c
-
SHA512
12c12c8579bef9233c45539c661e14a1834fec1b25df4c159ffd9f730017909403f341449ed9bd1af8badc2e3217705305d0e69c019fa7156e6e2a4a465f8428
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426456191" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000e5418a4914c2d1f6a2a01ac3703e4dd6b97242f3b1395a76097e622826a6b456000000000e80000000020000200000008faf6d3db13846dde12da5d1d5604aa68f9efc3019489e3b0badde355bfb55bd90000000bede761e99d0f6e372a50578342fcfd404ee562d1653461356e78f26d0d2b6f1e37a382ace2f2ad9d8d4f72721d8d43f8e4de075d814a11c2e1d9ae34ad8fe036b534409606031d45e03d1701e8a0ca0ef8b165e543b87332bf8c24c2d4dfdf6458b504b9d20e496d505831d915dcddd6e4bce3dc9f9a2a9efbe8bcb6340c4dc9c577573d71e160a707a30b5c26d70b24000000077870cd9a6f773a708a562b3249ead97204bf5436d9d6e3ae27d452ac8e3a522588f5cd41f2b72999cca77919668f67596902ec7fb2cefaef9d3b72295b9b2e7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000030ed212dc877006d15f396ca3d1a8bd9acea022b20f86e294081916e240bb414000000000e8000000002000020000000fa334ba572f37fda0594e8b808532d2e018f8c1a983992b97516bb8d618e760d20000000dde6a848188f3f7c9ba7c78bb486adf68b7ec43a30355e4983bfa79a087d159440000000e385f9ef90a16cb19964b2c77b3a45678080340d137b86e8dba9ac2d2dfd915206c582008c637036d7dc90cba0479c3a066b1777d83aae6f1dd7dc06d6c3de24 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7000bb42dbcfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C93E421-3BCE-11EF-93D0-F6C828CC4EA3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 iexplore.exe 2560 iexplore.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2920 2560 iexplore.exe 30 PID 2560 wrote to memory of 2920 2560 iexplore.exe 30 PID 2560 wrote to memory of 2920 2560 iexplore.exe 30 PID 2560 wrote to memory of 2920 2560 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\293b9fd67f50f8b06cafbffaa9889760_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab46ab4859dbd191b2948fac78b77a32
SHA16078240b47821597662906ad7713400c0c7dd8cd
SHA256b26e949bb781e0cdcec1454967a6f89fe1ed4cb3159ce5bb39627d1a684a3760
SHA512559bc2c373112ec79be8d74912e8577954dbeadad2894628792fc19d15c8cb66d50ed62305254c8f57db5304173b67db7ca24fc6a0ca2b2379dd509386406977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a8b92244e5bba97b82f7a16de67b735
SHA18774f48d36a63b664ce05d539e096bdd192b4b76
SHA256c67a14ab7448fb8508380385c047b0e4d80ff7e6773522ff75b89602772f57dc
SHA512ea39d6acc3e2c8bd1b904e66622b824fe4b0b3c5528d1d64ed38965b3a2fe67813aa2be551894a81ff0f3bc803014b47aa58d777963566cdfc834c10de42dd3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56661c410562bb7b0933256cc7ec74c54
SHA18f3d8be5747153d379c81c1116b086eabb7862b9
SHA256f91b94e6361e73a5753905e2a31df7d9d0e4708a633d4e5a9fc0f162cb0a0d9a
SHA5127f92faf24cc624b8b83139788726bd79318689d80703e93eb6e20600f64b6fdea569d66c10172f112bc3b085f9489bee262a8183692732f975b28f97e4a72642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592371767671be07c556890f081c5e30d
SHA158a403a081912548951d4338545f8f5bae9ade2e
SHA2564f12cc444198a51bc5a75daa72a9bebb13d654acae1e1027bd016e7f26f58dbc
SHA5124628b6c8efdc9728281766e2af92695482d22e885dc1fd7302d7d3fddec88755aadf8793bd428dde2e9a0333211239355537cea867f07e08492245a8525e10db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55827279b07c6d84ee9910abfbd9cd090
SHA1e1c92c5c687023103f9181da66704b2bbec5067e
SHA25660764f6162e3dde1b38613555a782e3c78e3193bb442f4c3b84c00f4cac5c79a
SHA512917c26e8b3cdea0c9e8c15a08f5f07c0432b7c2919eda30852064af99632f92ae9e060b2f557c21f03a02fbc438ea42d2deec3b257cfce4089374ef8b71552b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a076cbae58205c17658280aa1b758c0
SHA18001a9a83b3793a7d466103b39e68be4562035ef
SHA2565acb553eaa0055c2df207526773ff666331cd79b74ed48b0c182cfd23592d98e
SHA512a2d0a6ba935c58e475656bf518d1dc06d30c35f3574deacae7fac1ef97be5938eb068c99b31e659c35b36f866500ab04e2388a1422342f7eafe15191f6577a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4441dcdcc96c2e0f90f92b7831c967a
SHA1a756b7f90ae0fb81dd6d053a2efe8073102d9002
SHA256b93af6527c6f54e0c0e0ed5dade039e866578f8672d886a91213bf134ad2ff33
SHA5127dde49949120b5ca57dca245766d8306f5c946856adb52ccc2dd81593da1265661459e9f0fb1ded98cf2177ae576c58c2b67a2971e983ad86200d5da5d3f7f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50115f87bbd3ffd0a03a27117e884cf7d
SHA1906ad3984f89b7d048703bdd48dd35944bdb2d1a
SHA2565a46954adb2428c8d1a718a1292692537bb0f666d084bace79971d9650b79c2d
SHA512f72748622f533beb554c7d42b0bfb7b45331dc42bacb4e072596c887154acfe10819400906fcfe96cbb1d296c9d4cd28b78e78c60ad1aee81496f4aea5642c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521fe693d2cbfd17076322e038f18e170
SHA116f4ffc0c7752339edcc37c59c178af632ad24b7
SHA25660790952b1c8f556d45cdccad57f78a40deafdf75f9206e04e716d833b6049a5
SHA512ba6bd0e3342d4eb062bd9f17bf5b7d320448a963c76c667579c2bd90c93ce4f8ad18e97ae17d0f8f0b20b592b7ffedf25cca642cf168187588f0697930eb20a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5460199be10d3ad70a7bff5e5dfc97895
SHA1d259d4c66c101a0e78cf85240fa0d1f70e428d9f
SHA256c15e3dc20ca443620b0bc83f3914ac15ffc54249ae82049a1f94eaf3ff9141d0
SHA5126cc07c4947aaaa32b5388313067d8446255fe0e26cd2381eaf5aadf4f9fde1d16d4b4f93b3afe3201f521fd4d5afe962d05aa8783e03cdde86c5d34a95802c09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e07ef3aeef4c7a511c60f14ceb6dd7d
SHA1fa72499f332376b3272fc914aa74a74008434c89
SHA25605400e20b7bca5d4c21d14b851b26d29ba049a91cf9512739264d19e6e99332f
SHA51242a44b10222049f7782024ff52aeb1bf13e16e53e75c5ad544da0022e9e9a4a48b6713853e0e5eea9c70a865e97d8f842820c83921d3cffc733f9a1e214b016e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f38bc58139533046a61bbbf80e2246ec
SHA146984f65030a46c0954d20497064ab59d12f25ee
SHA25670842e839647823dfb6d820a4e3ab6ede4e46ed34370fc1c45a961b577f92a10
SHA51226830eb4e23b0e1f323f6d132fc4f6114fbccad6d0d3706731458b91009577f8ab2a8e3e7a43650027a18214ca0ab00254b238f9cb68b1aa4f58ddc83d07cec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5741b0baff60c085e55dfeb4438081e96
SHA140b956da9f7d233cce56705c41c2329cf8b50e55
SHA2569779b1a27e842208279977186f6a7b5ef6298ceb0737317f0cf4be4a6cf91711
SHA5128dc89c6f017590c4d463072500891a75360d91b4b3e0a6bf720dd9db9698979e1348909e48c29b4af8c0809a94e53d335e3de41efd43265671452bafc82a81ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5411a9ade99855f8770241eadd561bcf2
SHA12446e6faf0a91490909b4f7c34599faf4d1853b9
SHA256d065ed6953e7ed2c7c80497c153b63afea2d93e112955c1b1fce545140e94602
SHA512f4aac444aff31f14ae6f17262c9dd8ae17d0bb57fb97717e219d5a01e2aa2e20aef689d9629c1cb21a9f4cf0abe0edd80dc30467816df03b437538f36048694b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f2deeade2fe9ee3820ec269adc5337c
SHA1d1ec6e5d0a16481e1a4e29e0d10d2adee313b08b
SHA256285a1c3a703305c084deb3db6216d6b60ee326afda320a879c00a91bc1b0c492
SHA512c0db8ec0d75138a1573ba85b3b8625d319e22b3d3e89119637d64299f94c1bb5ce5fec1e9d4cd5d22329ce64d0448504553e46e5a7f7a9e89420f4df0932df73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd52f90ec484e06103bb1ac747295b6e
SHA17a515103158875c916441f62c1e05612ebf869c2
SHA2563dfd360a29f89542c0749b6cf6882d0bf0cd51150c2a850bde1d2b6584017e2c
SHA51203b54cc4c439b6ee1b8fd67b977ee5dd4b9ed2d7e8a1680111762af4443e7087e11b296ea770db6481175867d60779f4512316e326b450cc8d00141f6d430e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6b1d91dff0aeb17a219a3be46b44a24
SHA1dcd72aff7a1a331f4c6516d3ec199536c84c385b
SHA256479c1d2ce4af4fe20cbed8a679c6e90e92b0a1012c387fe53cca52fef24daddf
SHA51266b7637d934673e60ff042abc524dda71241bdbbb4c5924330e999bb1010b56627986f94af71d28b27d8f3872fe3ccd237f4e71e7c688b3b5187147f9f373e2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e7da6ba3790ec7e753ae6f466d757ab
SHA1bcdf96a36ef8a6ac1eafd8a3d0d60d7598e25aef
SHA256bba898403ac34864cf47fee05d88d4492a3aed7e689fb04335f787fda5c381f0
SHA512ce695c8aafdb914db3e2d5c8b21d90ed54bc5dce15c202a20ee1f5bcc6ad0771d033f1f8c47d42b56da7f44a5c8b5302ee6a561f9ef3b5e6cc7ae9946c0bf9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce8573a3d34a355f48d0a30a21ad230e
SHA14c08c79f03ca9a0ada7a60731c9ef15d80b53781
SHA256786d0e38810dee0199f4030d9d3bb2f94e957f807a6eb36c0f941ca29ef0693b
SHA51287a6cb3cbfea9370a0f2a3397e21eb347a40d8d2c240013f4d5d6f7a1b4eda2aa53fd755394285511416fbde792860b78ad526476a66a354f172f1905c1aac3b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b