Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
2c11f8a4d536f68f038402ea0dd6d51f_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2c11f8a4d536f68f038402ea0dd6d51f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2c11f8a4d536f68f038402ea0dd6d51f_JaffaCakes118.html
-
Size
23KB
-
MD5
2c11f8a4d536f68f038402ea0dd6d51f
-
SHA1
db6fd8b3ed50551830b33e1f12da47cacc95e910
-
SHA256
8fba23910a266fa5459d5ee44789bd9abb4da8f79eb0405ae24add7690c5332e
-
SHA512
53988eaf7fbd8355a0c09f8a106340836204bf91cbcfac9c99d18aac7cb6504bc20c46414d085d76080845908e551c343a75c2ce30957777c7146062c633a214
-
SSDEEP
384:LaExhu5TUQ4ekw46x5kYgAQ/ETtmvoh768JSQdSuDqvx4qVQnpiF:hD
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7034532762a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000059f1658a42a3e62cfd74eab0669a4f331c9b5972d85397b1820d21f1b2e466be000000000e8000000002000020000000de295112f927a3484a09ff810a8959f7cd7c37ec9c2f0d14121fa4bc43b65c9920000000e0436f4f13b12575b8650196312c6b78509f4c3f251a196e069e5f6be33074124000000003cddaa491bdcae61598d5a4f8632ed1d2cefd016c67f47558b9f1b5fdda58629a0e7c9673929fa3465de51f41b63c11f3b840109fca44dbdeb65309d9ccbec2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000370dc7c074a7d66d29b92106951b45116a63dc75ce5e2e532bb9283d3e4798b7000000000e8000000002000020000000495e39a775ba9b32435bd30e2af23ea76231d966c3831012714949c440e0c936900000009c1c862a63032003a5a93f91b80d18a39eda447fa51d3fdfdde1ddc7df3c70b85cfe607095295c22a07262d98df66953a816f3ae0ab3be4188c0eac43e9035c0debb7ee92773c9f89dbac5a69dfe791c0d520ab7abe83194892c374ec9b1c01a22107e16d71e3fdfedd1a1ca05ef86beb51b02576ad3ff0937bdee810071a934b1ea7d233e8fab5ce057ae3a529fa6c9400000008e3d31c2e97f214b43e3bc9378c322c4c87eba3aba0faa5416ab9d964ae2ddf72c6eae02add94da6684bce9c7fb23a90810a64843380ec7e961b5835cd81b41a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421456376" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52A4C5D1-0E55-11EF-88D8-5E50367223A7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2976 2400 iexplore.exe 28 PID 2400 wrote to memory of 2976 2400 iexplore.exe 28 PID 2400 wrote to memory of 2976 2400 iexplore.exe 28 PID 2400 wrote to memory of 2976 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c11f8a4d536f68f038402ea0dd6d51f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5639194668cf509065b1f7ec27446a6cb
SHA1b4184e804a95e79178aefc0e5ab3caafc8e38a1d
SHA2561a04ff76964e84ed5a06abc88e15f7437db08dda976c25248686cbd49e092f70
SHA5121fc811be367e111611e736c686b0fc310bb78ccc62311bc9f8a8e25836cfc9f0b2d82a9808987d63a083c1c4f62d89fb113e7fa0d1b9890ba67d705586ef3d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdc2485cb3fadd1483d7e1bf9ed97d7a
SHA18e38041738ed24efe376e27e6864323cc2cad37a
SHA25618acfa15684ee898b6ec8dfa186021f543d42482e429dc1ad643b2b7e2b2c4ad
SHA512908cc73eb84df9903506c6adbd59e221c73de223cf0d6b9f43dbf5688f10682ec88ae042c08e6bd9583b8582437c0949f151ffd7f0cc11a0a3e1a65caec09257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515d328f74a22d38753f3af25d4a5a29c
SHA1ff82c0229b58ff3d98b30cee2a4536ab742b1348
SHA256416c9388432b6647f5f2dd989c9230cd3c52be7fba76eefe8120cd831db56980
SHA5128f45eb6a9b387e4580c5e01d6a2f61567d178d23f5c06bfae1aaf09c884f00c64b7e343be03ac4d2d1756abd0e48c51c2bf77dd6f6e235c41beb2fabe88b4e2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1e8db0069e4f8159f10f61cb418ab0
SHA1bc23d8188f0690bdcf30c86430a07947e5246daf
SHA256d12694d1834070e35bdad258c215c254adc9f3a31192879a20c38b995a2767dd
SHA512b17e405b1b98607d73775d25937e2a887caef117c6704858f228690514d3e5206405ae794aa01e1e803a56eb1d601a21d7a870f9ce2dda2655e1b1cb02497ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac341cd0afe95cff0b818b891933070c
SHA193cf6611d5ab6b8939e958822389e3f03cd109ea
SHA25685d1169b92d4cfb0cb60f5620303fe77277de4e8114235eda36e8304e34ed732
SHA51224d4bde19be12b2df7667377a0c3e02c3e2abfc8812be0862c03fe3e04a9ab8f173121d381adfb263667a89b1b779b562bc096ae5d25d576cf04caf752ecbd4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587147524b91a3944b63730a34037f73a
SHA17f287535a22c6176bf537e1618edc3d38e23028c
SHA256d3503e7e6cc4a239e3bf6eb3a0253de672405112d1301114edbf0ef498c23966
SHA512af6e097be6913bff18ad91e9c9871417438f71c1815702a699f8fc2f6b309d60e7971546efbe42ad191425c730a1cf650b1b3f6dc493fe3cb6b6bfcc41ee3c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcdbdcc5ef46f84d3ac875e71c88ad96
SHA15899913476e2ee3c6a4dfaa91ea9a026a7f2ff52
SHA25684fb38471916dd1dc9a53701a44b8e316723b77157a52601ee47cc1ef1528d23
SHA5125167a222a5272136193d4d515a272a330ef7f4ab3a6670a1089d04bad3513de3e3b895fc346345e09f9aba7b288af1914f90afa6ddbc0214e10554ae0dfa13b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515a818d725e80e7775c2a966458dac7a
SHA12b718015a02e016c2eca7946455272369358dcdf
SHA2563897d14aebe53b0d99a3fabc6a8f06e16a16f8bf1b7cf20aa297b21dacce6fc5
SHA512d011ef0a2124484830210d9c8dde39bd6f6b75fbbf3fef77c17aebc572cf6dadeb81060848419bdade8bf2957bc7f6767ccf81fbd5c38c55f97d21b528649ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfc69558cd756a0ca874508496fcc69d
SHA1f8e76b0595f97ea4609abf88729d3537bf032634
SHA256fc7bf3ef7eef64d970df3b6054d431606b6ceb8bbe896f7e1b9664dd385f3645
SHA512c4ac0964ebf82032217f7032aa580b9773d8af46987c524867b24b9061babf65d4067f9a264094ce30f950e2a567764102a6ec51a7836242ba0dc867988331cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aa8f122142693be2e2eea04de7ee6c1
SHA136228b025cf3028c3d361b4c7ce69d1a13f1586c
SHA256c8a34e07c8843b582509505fa1e748ac8eb8b7afe9aa05e80d8be40805e6b21c
SHA512eb07aa7f5f7d8c3c73cc87a149abb896497a908c44f8a1aaa3ed1f60e37717dd903106c8d76caa0309051fd03cf41cdefb918a43cce06800b0b28b9056a535f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a0496eb5193337e29c8d49f0d09785e
SHA1797effd30926cb533511c8594ef70dec52f77820
SHA256fba2485d5a1fe0ea3d049c745163b99feab59c853a3a61572437d862f4762f32
SHA512e96cf50a007df02853393735b68d8c01b00572692d2061992c79967480d447a57ef821cd35f662291f39dd68c0568b9c64670d8fc3255636f76656ac9de5b3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c15a41dabc41a6530f1c3251c509f2a9
SHA1b47810c6fa1a74845f0cf368132cb6b5c8fb1eca
SHA256e711f28b2a437cb277faa1f545d9e92d7597ececdcd31c4f3c84112ab44a9c58
SHA51287bf4135b4c5c32a160cef7276006dd9898f1cbb78697390316af1f1273bbddde32a88111ead2484740f587ea67070c60e91566d8e61d38fe3f91a5e21735b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abd0b5a92d1c518790b104b7e3d3dc44
SHA17043eba80e8e10e1d496c480c72776b5b074b079
SHA25680f02d19df251a771ac2eafd71faab4d646a15f0e89dd1e5891895e41bfd9a03
SHA512aa7d64aef0b14817bc546c342800a456ed48b0104799ef462162fe48c6b28bc51b428ce3a484b6fbe99e4317758d0d501e7e9dbfad58bdc5a303eb2f28b2f6f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a3f3b1c434b1a06641a2d3a8dfe2bf
SHA1d36ed9f22eed715422035d57432f3edac8008f31
SHA25677e67142cd5769a6e4a6fb12079be8ad0a60b7e0a68e3b2c24c476352b9ed339
SHA512793f2ca3b52950f9135cd284ff70a2a62febd813130d2f4cfee23dfc0a0715ec570ac60c53032815eef84cd909129309e0b68213563b3b01d86844eec1e7dc1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af94a6e4ceeafc038bb6f86619a0f39c
SHA1c8a07f748a6f3aa378447cc8023ef57f036c7ce2
SHA2566c060da9c9aae37afc5f63792974ffcb8221f7a02f882c4b99cf7ce38e283a51
SHA5124c5febab3e60629ad4c883fca5dc16d58b8d29a661b14954c4b323121df3b7e3e9122ac51a28df74230ff720684e0a8d8159a9dd68f85ddcb299fb9126c7c6f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ef8b97ae68be6919bb99467614d3f5e
SHA149e78577cf6f6344b5a940b8c6d301434feadd48
SHA2566e5d876b558f3d148637a360166765c38306847d960e8e84bd984200e9eddc76
SHA51220db59930c4e1c8e41ff64f5cd17859496ae0c18ee1a2e11dc3d23a86310cdeb736b5cd828ea81b608c5280a58a935f8b90d4abb9495bb4fefdd58cdf40635c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7da7a9a6d59e307391a3c8411ee0757
SHA1ca7313007598e385ec052b821522aae96638e667
SHA256e57526467b727d705f6a5e73c39eed1907aba3a6d22a37edaed098db22910924
SHA512d4cd570cf1dfdf6fac3f5230b149cbf830ba6006ac4b4074c94e7e825263344455c7d3f01728a26ccb405f275df474197a39ffb82fd2e322eee4452abd535b2c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a