Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2e98202991ff614760e96ddbff03ad97_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e98202991ff614760e96ddbff03ad97_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2e98202991ff614760e96ddbff03ad97_JaffaCakes118.html
-
Size
2KB
-
MD5
2e98202991ff614760e96ddbff03ad97
-
SHA1
ebee21e0150a0af7e1f649156aa8a29bbd188231
-
SHA256
4b5e8838ed196c2201ef60bba587a7e0523302ee8cafa579641426e8766a2619
-
SHA512
07c00c1056060e3371b2bb68b1c5c2af3f269273647fb7a94e19a9a00d3e98ed840407c7c91fefad49627964402b350c4abebc6a25da63047e67c7fa8a685488
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426671676" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000006cdb9bc9860dea23351550c93545b4e3f9c0a6f9c1224ee9fb7536854484a57000000000e8000000002000020000000116e25be17645fbdf35deea4ed8d7cbeb4849dbc8b27c3663260d6ce16e233b290000000bc73fb42fb0a4523e92f22c109071d0a15e8ae081038c99bf03616551b3f128177f6fb545376d54087e8fc1a6e7aa56f5d45c91a27f66a8b7a257f84f4d55e605a830e4cffbcefa896b24d83bb1512c710508bd5ac8714be9ab1ed53fdaf3f39f4e3231e25f5ac7c97a3b05dbca67841d9b4b2cafa2877bc34b072f68c01b1deb3f9b0fdc6ba5bf074d18b97d57131c74000000060e56b262c6db8272062f4c811725cd5d3310a1637afa633d9f3aa4f6f98d4d0526b95b9270380fd23bf6485f6aeafc46f3834d57122ae0c586b385e9745cc35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f897f9d0d1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000003313770786907a1e1a793f66e58a0c7b9dc344135aef76fe6a6d8bebbb36035000000000e800000000200002000000052ba02ace42b9599b6f95ea0db95ef406f6fc7d26f2f87bf254707f06bfe3fb1200000000b312589d2003d3ba1aeb197b48088c2b0317dcd1538a492e24c082c4f15abdb4000000050ce722636f13ac4892e60bfbd0a4c04b559b42f80d6c3ef716a6544f20a6a5c088450ed42c4738417bfebcd4aa3104d8ec6493b940e21c031f7bb385e22d6ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22C7B361-3DC4-11EF-B836-E21FB89EE600} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE 1140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1140 2960 iexplore.exe 30 PID 2960 wrote to memory of 1140 2960 iexplore.exe 30 PID 2960 wrote to memory of 1140 2960 iexplore.exe 30 PID 2960 wrote to memory of 1140 2960 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e98202991ff614760e96ddbff03ad97_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536223238ea32916f54d8b20abadfd38a
SHA1b7cabf21e40cf11eb90f49fa2ead9c3899136b62
SHA256e1dc5d42032e3dfc2481fa59b41cd7f6521816aeddb0244f7627e8b213f30ee4
SHA512d354f13571525fe1c6c03b2287266d943cea8641b2547d2642cf10e2116dbc8ca8a08633ce473eeef03e335f67fbeac5d56345b58e2664c7e370d64fc8e79333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574afaf10a25ac99fdeea66c394b14f74
SHA15bc1f5bf9777cb3fef43362eb417583185f71078
SHA256181138dc0c4f01889ed15895b437b1679b24c10852edcaed89cadd025eec4441
SHA512d4d3bb24ce904f80349564902652620788eb9c578335c6c65d42f462baca60c56f5dce615c518493ec1e8c9241f8f25dda874edc0270f711226b71ceeb94fad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57936145f23160b3328f18a60acec4423
SHA19172d0e04c8614cf26938a06e87e84ce79051fa8
SHA256d59d7af83d4284c4a7ef9c32a7990b6c92f7f9632df04b07fa1a3fa8bf237728
SHA5125b6883be79d7c55a74052bedf9667e262fc3faf375e972d960c1c74f9f8ecc5534ce99f79f4e955aa784ba0caaa6864385d78e890d9a158a2c558324ce4a5b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3a3908f43a4827c861beaf8a1baf3af
SHA19f85ed227c39e8b65be7077b100f9f458e0423d0
SHA2567361c87d758df2ff05fe474d862d5c9b595b8894a7bb00e7220b596bedced776
SHA512ae410e2424b2e7bd7f83d350dce29519bf64feddcdf2f4d4f99d7d7d3f6dc952493349aea53baa658aaf5333aeb7b07d4fbfbfcab3377ed4960d2d44581b9afe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d58b91e86f0ff9a8c4f1c5ce1544d2d
SHA196bb8128eb8582df9abb719f61fe68ac04b3ec0f
SHA25652ea972acc6c885ad9f6f9f7db1c394f23030ff62ade50a64b1ee5f075661f2c
SHA512bbc860c6a19e61a44a3f993396fda3412c957fe34792a2dc16e939f8cb64813c3503669baf11c4fa59d0058bf59c9e3c605012d3f6ed871a474814c01af35d41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597ab2dcb7b726e35c46b8838aba7260a
SHA16b175a54ab464d890f493c59c6140c8f5e9da435
SHA2567efb3c0fe493e0fdc6a42a283a61e8096982e92ce57a98c47d82e87a9dc32b73
SHA512697fa92fb4619fbfc000e540a68c63212f111db1b37ef1b2a32cc84dbc602ce9bb50781fce836fc4a4f6d1e76e0c225b9b8d401cbf193b03ebc183fbe1b9967c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fbbdd8036af23e7da14f0fdae4b24d3
SHA1747749096d09f734e572f47e41912fb269d8b0ed
SHA256a4f6ee9b0dfd78cb63ab212183bd522ebe436a0faa851ce24362a660b5e38fef
SHA5120c9562e00b11f163e91f835d6dc4a01994a30ec3df8c31da2506d60e346d3689a9df3ae397d03d87b743b4e0ecd0b41a8f7d91a111a637de50d19a5d0a6762d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d44ed5a8494a423880778ef1304ebf2c
SHA1505206cc06d16c34e250d3ad1797ea01a089bec7
SHA25617ee9df36ffc3459bef1d0ea0027240a21f69278291637e0fd95a00298084fa0
SHA512caf297a3673ed53e04d189129e3d3fc31a502f2484cbab04ec8d51eb9fd8a0827f0649d4a4146d30264e92bf1499585a8d791aab5d4f2b7fa83d8bfe23132136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ca980f3330c6e8eb488b8dadb49745f
SHA187e0c001ead97178af0fa6e87d53955c8c803203
SHA25600dd5e3834eb33668523b8d5d81412da1a20cbf19ea5edfd67555c4df995bcb6
SHA51200bc728c77012343117b963c34d34c56d2567229426e7e17f68941b2d498c6ab2e7c08841788eb73096f520587ebab374271f582bfda98239a000e213b165535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f6f7ed3343caf02f259173515fb8579
SHA19d995aa193d111b6a5840e89b38265efd0e3ec40
SHA2566dcdf9a05a7e97afda227ac7dff44b9f93dc7f05e78719960f082a993210512a
SHA512f562afeff8dc59f11e0efc432d51d462cadfe83e96cba4190a62df0189ed83c3a350cc5898694263cd3fa5923f179c96ad57e0baada1789ca8c0be627d755d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c70ee72de7d611404d0b133d33d47ed2
SHA1cc085bc4d4e845ac81acc36942e4a2e8e2c0161f
SHA256ae3824ea89cf83fdae07f6ac7dce0055215da0d00776a0913ca4181a6de8c945
SHA5124d3bac8fdfd6a5543427e85ee1be794d9c50a5931d5adadb22fa9ff6db3040a22df13d497ccfe63be777b1947a22c4fcdf54dbc9fc16fc042f2eff6fd1b8bd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597c03e7e4d5ea466f4eebebfba4a0da1
SHA14f013af0f75b4db82f179c39b0a7f0b8a23819ba
SHA256453fcabf825d4ab749cb76d8c57a08e0bf37a2ae17571646eaddecfaf834337c
SHA512f6c4201e6c0522f2f2dd40a7cc9f94c68ceeb434970d6d257d0f145d44ccfa86d26eb66eab49b335616780b00b10abc7c68e36a3b201055e7f7782b398a49f10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d277afe9d940e784516c4ec1060a30e
SHA1c04314c9d526fc4e5d7306fc3841cdd341317f0c
SHA256f5a127820901350f65c355526bd2e2e55a78212c9e05e7f36315cb059d02fdb4
SHA512bb31cced662816f9442ecad88ebde97ec5cd7281560e13d9e9c4df927744313a374befa4c2b63de4883dbba5a598428d8d52b22cfa10b376fa69927f9eeba864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8abd55fa03a94b1dddfe10e71660874
SHA119316576f22977b141443d3baafd1f89c033d26a
SHA2567272abe56362e9d0b397e0bd5a8752a0448a425cdc5e7e29d1157aed37bd61d8
SHA512c972a98ebd87e0377597d17926f9bcf4c13737a080f0cc7a48c70ade2815a2631d8880d270eecaeb88c956e2e09e42a6f445adaaacc9a29c34d44bdee188d8ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9b93cd5954e80d44939c042d9c75578
SHA1e5ba6b8e3f2f71966908648a56a0e06b5e5c3760
SHA256209e1da32d8606406a037624b4d6029b3bde934d315fcff7870c6750fc44f8bf
SHA512fe9989cd3ef444e3f8ebbd26b1e517f5927d562c571c0812c997c51f5a4f1b968eb30dedb64d5450b57692402f4a714020901674435b66e3cd04dcb13acd44e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8b0a9a9b1a3b79f1335ebd62ce86af2
SHA1f95a03feafff2611f8b2684f24a812afb640e1d5
SHA2565a8bdef04398d14ad60d5ab7c81d5f4e9d51aac1f331b4cc1133530e08ac962d
SHA512c01d1c28b6c37a2d0f843f073ae7ac79d190527b2b25ce3cb8126248957865cb4f8482d89292a28d212c43e691f5edad9151079eeebbc8c7e4ae8cdd48c8a699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561c093717ebab5938b0c992d6ef6fa5f
SHA1df17eda9965a598e46914a2c2a71483421ff06c1
SHA256c272a498ace18c531a0302d919ef57b16f5deafe0345af5108983bfedb459219
SHA512843185b2374e8381def476f188158630e3a3823e0a54be4826668ca407e8724f988ef6f815f15c45712149f805cfcc7c30210fdfef6898cc23a8b495fb7a853f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5969554053df3e8b274803bcb5df465e3
SHA119d01b12b1cf5e56a0b7cc8341daed8e1e718474
SHA256bfb26931695918c186b81c02c245a88511994a1f5829656c5f4f74c33f14f1e2
SHA512e3370dd1fe7edb487108fd40d3a1fe5995bbd993a13158bda3cba3f057100951de76f564f13fbf98b13f8310e01fa6645023e83ab307a34f1194fed188119291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecb38e5a64b87eebf7c600c0079f3b79
SHA1c76f52dcc23891c499c6a9eda88bccabc8de9bc9
SHA256bd5f69c2ea95b13e84a4eb6cbe3c9955f5e6ea7c1dc4571b355cb6fe071b5051
SHA512829321a64b58ef1417ca766220dcc6dd08269db6b7d025a9fa24840bad30001241feb8bd0e5dffe8491f8d97dbcb5df256c4c4f1f9b0e692a56ce4e348a34d27
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b