Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
2b05c7e42e0ae47fccb71983eecf2291_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b05c7e42e0ae47fccb71983eecf2291_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2b05c7e42e0ae47fccb71983eecf2291_JaffaCakes118.html
-
Size
2KB
-
MD5
2b05c7e42e0ae47fccb71983eecf2291
-
SHA1
da8686787a234960fe4e32aebf1735443a3031a0
-
SHA256
c6c15c4aba6d39ac610963817cf35f1cf14b3df8d97d2339d3ccba4c03bde5fe
-
SHA512
b1f6e6b06a47f241d7e506f042286a39a5e2ffac232296d3e68a2bf9227841ef329fb2eafb821f3a9af3928f157bb6d451761222b43f19e88a8acd3e34529eca
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000019ff994e62a00fc150d7dc807ef3722cf55ffed564b3b16fcf6e89aa982d8603000000000e80000000020000200000007a1dd8f06caec8639121c54f81ccdfe57aa8e7fa182b3a31bfa17216fc5e36d920000000b73a599b792c882571779971b904d90b2b84ce4e42700b5f8154261acfbd6164400000004e787a4ad0b680a7df981cb1b0fb7fd78b154fe9c4e1b382868eb161520a5859a970a702ec580a97c439171353c16ef6c038410a2b634f24f8105a667952ffb8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00eae8724d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426597611" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000092431d59459f93d24d57f415d59e5254f4602e99265185f4708cf3fad0cc522c000000000e80000000020000200000007107627886db4d3a362b8caec25bf95b3536810fa5aa7ec2be9ccc19111445c790000000cb257b16ee6ea802149ebb76c08f0701aad1c2c674366fb69366d81be13b17cbad83ca7ee342a12c49103e0d0350eef321fa2b8652fa29a0179be8bbedeaa1fa298fcc21a27544412384a157f77cebc90e315f782bb02fce969c1569bdb7a3cd92b5e3e73d78c24f3162972608fe4bef03517b3440d37b14b0fc792c7103a969e7dc20058550cabd8e38a0412667abae40000000b83b4f79edda987ba5fb770c986325bb35dc7b199498a83485933729cd89ae0339f848ec4c235402bc4adfc779796ac495d1b23969b456781cebaf4d2cba8bfa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0E41331-3D17-11EF-9E0F-4E18907FF899} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1864 iexplore.exe 1864 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30 PID 1864 wrote to memory of 2300 1864 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b05c7e42e0ae47fccb71983eecf2291_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571dc53e98306eab2216e6b2bc24734dd
SHA159f1969f91823a5cec556b5c218ef23ca8d2a850
SHA256958bf0f52535526b7ef0254390b6e7a91328105f19117b9f668d3c2a12e993bf
SHA5124db7d771e8ec295bc37ef1259f0e357ef1a6c6e2b43eb8459cdf007dffa44a59ac86f0dca718f9dc95f32b37e9fefee1acbdfffb6137624cf599191b08f92ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53871e49d2254362fb126ee44451970
SHA1d26d5d828aa2765d65c6fa5e4d9dbe83200202d3
SHA256b3567954d74ef5ecc13850f1fd1834496f360aca6f54c0bd8bd4fc0e3d577664
SHA51207f65021b24e82aac2d8503651bd314e118646410aeadfa171ad3d079b891353d2c74f65a5c436aae85d6d8a5c8fce746dd20aac7027af921f4408710f6cdcbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5130d20f416b99a890f01ed1d844bb5d0
SHA1b1841bf961e7e8401c0de5995bcd8475eb5ae69e
SHA256625908f98b53ce41fc2d97029e2185010588d2e1f61e2b125a1e6c00d9d8dc6a
SHA5124a189c24f62a406503cefb41fba85b419797f951e6843516012e50c4d2fd4d1f5ec8a42f987d06bc6c9ba59ee634847a99cd66c5b542f92db4797338f6fc8be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5045fa4d9283c48e762d2223d59dcfcab
SHA158ce9d50c46e1478f8f86469c251c60ce7908dbb
SHA25676587bb596a54a19ca9fa2616068c0176cf81651bedc953ddae4646bc72fecd7
SHA512969184381a27117d984d2b19018fcc24bf428c0a69ea0d69e38413c8c367ec921b9f9a9f6527c0e95766f31bedf70d7b3b83f0fdef2065120f4d72a2ea5eb28c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd1b45ee1e0359af0e097939bcc33e04
SHA1eb30896742be7c17ec5dbdc3fce77dd467a544f7
SHA256cce42d3d30cfe311f905a17da5090d43e60aa1fe3315537b49f2ad0ab649fe25
SHA512f083bbacee1dc08d67fdccab0294e5a2b14f60b13d7c7a84fc1677a0c0c744c838902685d65bf2065bc328f395222ba8e3dd42cb888fdc7c973bda9148258b10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597da20536a975046fb6eb6e7d1786773
SHA1728b5045847f9bad75a27137fb2884bef525d034
SHA2567e54a32274e28dddab6ae94ccc3251d630d337375f608ef16b4143c024a2f834
SHA5129526d78d52bbf5861bc78f98981c9e0674b2e84bbf9e54fcfc86fa9f3fc52e71b1ddd734ceb7b855b8169885d46f9cde19a9c37cee44f34de8eb433dc20b21c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da231994524ed6e0b7335ebb4d5cbf2c
SHA1ad86b68389d62a8317727a24c2daf9692ace5fa0
SHA2563eddbaa4dd4eb0239542a6c8fbfe30ebf5deb1d4729d6e3ee35496ce4e2dafd7
SHA512b330e56493fa4839f20d4f851238c7c842df895f91f1f9afc0d28ed5e5e38021e2fa6671bd671bdaad118e2f0718c4a89a173ee7ed2ce3ff776df610d86acb99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541235b5ba86588c1829e5c51638dc35b
SHA18001bc51a4dd345e481a7eac4c1d754c0debb360
SHA256423861d89b69e861e5908d337d11d4e1344249efb3db49e291f7c1bf0877029b
SHA512d3dfdbfd862a2f4509c36e95be926d0ca06636c203fb20835c0f13c656d6a8a88d1c64d102aca2b5a3a089dda0df8f7e55c838d995e4713fdfd8cc03652bae3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0e11d52e923638b94d498bd77717e86
SHA1029b3eda3e3353a136c0c8f4cfee2578d94a20e9
SHA25654864d096e2ddaaee01213f928e0fd9653e4489d63f264a06ee2d158c9a44fe6
SHA5125ae4f6fe5820b09006d10c22ddd2ade5196bc065075201574db6dc1a970a080fe80c7ef5a18a8de49eedc3c4c5ab7cff5a6d9d9c9154a87c5cef2cb282d31d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f51991b2da664a7b69f46cd5fc899213
SHA1cf1afc389de55863937ec223e19005d7682dde5b
SHA256148f58821fe64c33a9548027e1f2b3db2a6fa8585da5d3ba204443f4eefeddab
SHA512343ad853dd0517299958d01d51f371599eb55b71e7388b5f89e170cc6b59306a074eddd4081c19ce7e38edf390908dcef0dfcf9e3502e820e7303907c110ed6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e98a7caffe23fc8c6b0171f183e5690
SHA1882ee954cdce09c7ea898b6521b11e47314402dd
SHA256ab958bb7d921bc8ab5fd2ca0e0edc0068f91ad9b963d914b2ce63bc9105b33f3
SHA512a07737ed06461da856e954c9aac4c3b20e874174ac73e714996f43baaa386416ed4b009c03cf167e173059c00b73eb469948338ab573a23aa20ae0563c586ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530cf51c588781bc22b2881be4fbab599
SHA1be9da2c8808472edcfba96ee0df7b9cfdf7b09f8
SHA2564fad3732bb67bc437b8c690cd1a8edfbba9e4a68abff6bde62b56638933ccf42
SHA512c042eba37bb4366ae0a7d53c4df12f1161c27960affc97c03b1e5434424d3f497b3c14b7e84d7ede72e10e74fe2c9d6fca5a0fd99bad82d31f90330c5e82040a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541e820c82af07c5e98cf3fe0746b3c68
SHA16a59d27267d8c5e07e72beb40fc56b257ec83993
SHA2569726fd915ce04ab026c354ce518e8252c481e18625a04b283c244071f79089e8
SHA51204da82510bf11abe29b9b48586ff414d76083ec8fa3c5874d7e858ebddab4adad191e6353701156d6b9d9e61773aba35188d696332042737b29194e63a4602f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a652da5b724f9b69277fd5f51b2d243f
SHA1cd496c58b93eeb32247e124a79bda6d06be28225
SHA256263877be381b01eb4d482cac27ca7c05aac711f6830901704b963cabc2e41904
SHA5121acc6eb3c25fd11fe696dadfb75040a5c66d9a0e00962f98b3cd33a41b8e50615beb8f63e5a4b7bb2ea474e5bf9e701de19c972ec274b523ad1ecd01fc4a6147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6da482161a65bb335a56ecb0641b18a
SHA185b9ce4bdb7479a7c46048fde3d5fe7ac26461f7
SHA2560f38fe6c44b35bcca9c58f45f5284ac0f1fae33a7d346c3942876982041b79cf
SHA512b330f3437eed07899b8f20eff909529321cacc694eaf31fd5d9cf1579314ee6dc5cfc01a087aa47f04fd4daf467be08ae5bbf04a097b9be5f51fefad1035bcf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181f4ac0fd24a8f7b5146c8a5518a9a0
SHA107fe1dab600b0d11de6ecf64841b645a7ade7e10
SHA256dcc3af508c741d6a8e5ab1ced2ed40c11d7fcf628af4208a64fd4a93b47d08d5
SHA512e9d25a8472dc73a411bc063fdd98032fcdd0b849afd6ffa371d60149569989f225ae9a67d0784845abceaf142ec1445677d296ae67931df19fc797f5eda0dda9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c2feb58e3d90359e710c33a82285672
SHA1f6ddb145b261d7adab1cdd324933d47b1c72ead2
SHA256baca734d5d6875fbf6a5837dffbc74183a291345e11df6322e469e3912e1b549
SHA5126c90546de51b54004086fc8ac07a380d1fe4bfcaa21bca2c9167a6a5018f31c9c547bd37011862a5c4bc88ec954ae893b993a53aa641906c7b56a37dfaee3693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef5ba7dbe8b08f1818076fccc338235b
SHA1f881700d5fd7914c15f2696028c39fcdbadd789a
SHA2561fae135463972bd36ae8ab2cf3ac06bd8e2a34e0c6ca0d92da0017f90c8f8b81
SHA51212caefb056c847b8693fae1b5b23e749b5b22c5c2eeb872000d96c455ff39543873e2a4fe03b5224cd92b6d9d3655d085161cd99f6e4d3fde269ee3ee1125495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b505524fde4e95d4be45c0bbbe6e0e25
SHA16f84ad0c2014819c9a122988f5d3442a8e92a696
SHA2567a1d3b7329b8b24d004101a07313042373d0424eabeefc786e4f7b6132f5f745
SHA51268bd86c936c7acb348788743d3cd52f69b36dddbed7f345c9b276f26b8ed63118e550962165d0cbca2011dd22b1df2ab8b260f0a2fac8cc85eeb4609bffb777e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b