Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
2c179d47e3b921d5807f02ad4e3974c5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c179d47e3b921d5807f02ad4e3974c5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2c179d47e3b921d5807f02ad4e3974c5_JaffaCakes118.html
-
Size
4KB
-
MD5
2c179d47e3b921d5807f02ad4e3974c5
-
SHA1
5f1447f673c1310733606a40290d3db32b8e5d38
-
SHA256
9e5e0445cc0b4895a9eae8ba418b6bfa9d4ec3000319a4c736e2345e903b0d2a
-
SHA512
8db2a941df441ed1b07a6bb3c372061708273e24ffba829c1b409346724ec3f7c74cd5e5ed54193405a6bf8bb592dbe8bc364d414baf9145bcd1b1b629b7c08c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ol8yeeba:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000287b60b20c670aaaab60f9d0b5079c7883f85860fab213a3ec80cbe9ec97d31000000000e800000000200002000000033506e61724abcd56f481c71c59428819a1df64e98171ffb30cb90db5ff9db6190000000b11b6b5cc854e57f2337908e7320e96f59923dbd78109ea07fe62931a503e65b25f75b849aea8e70e1c8a3920a1d368edf0a7f0c406930c7f72b9fe6000d635065111501ff08aad0845c4676b1bb6d4217b9519e9d1744b43726822d69e4d5bdac162f1d164afcb549d0399977fdc89301f3d1782d279e24e8192e1f6439aed95ad8b75025cf17984d1811168bd2657b40000000bd0c3fab65f99a3f7cd06ce60c6de231b28ad99ac3f418509f02e6818198e1d88c5ec34748f7081a800e780d02302bbd98d720a0f07a75db0fe8096168ab3958 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02ca50a63a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421456758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35984291-0E56-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c947d13c0b205a847795b495be203631416b67ce0cd852eff3c94319626be558000000000e8000000002000020000000ded8ba48ea7290d820057df9077f040bdda3d088667aa4be3d5be68d4f6d08fa20000000d0d8f6f63ac8c78fec0c861aac914ed2d1f587c7a47500c0cd5e5d6677a2d0af40000000f6212860fa59a4a86f6e95a2e4ca346ce21cb9f4647f9afb2487db5fa6ee129232f7e779eac4c715ecc46d10425993d6fc41ad49584e0e1b9b6f96d4c0c4557b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 856 iexplore.exe 856 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 856 wrote to memory of 3012 856 iexplore.exe 28 PID 856 wrote to memory of 3012 856 iexplore.exe 28 PID 856 wrote to memory of 3012 856 iexplore.exe 28 PID 856 wrote to memory of 3012 856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c179d47e3b921d5807f02ad4e3974c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504ef799ee78319ff1dd37ff894c5573e
SHA180cc66914f7b6666a791f4a882adfed4ae4ac813
SHA256abfe9abd0cbce7159d7f7f8fcd0d2271994f01149107285fc0ee05d7a7d418b3
SHA512ef69d5b19cc43ac87089affa5ecc79c680aaa9b5a74eb53645a9d039417272356a7eb88a395108ed567b12b6151bb42c30a6e9e13dbe5c796f4fc0352b24a49b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d5a934080c491a760c43b0994502ad6
SHA126b032974f0372cd12a442392fee9ed79a3bb612
SHA256be4a9277e335320710279cb473a9c971177b0e5bf821dee0f26cfe94fab36a73
SHA5120418cc477dcfea7c920767f00741ac4ceb52b10a228eb435be5d06aee22ececcd7139c4df95ddd89919f56838f9f58486bea203245f613ffe590420a9901fd39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1e8a0b4bd15cb826773e44bfd348b0a
SHA1288c3e5b654f7bcbefc952557411788aa49405d4
SHA2568941bdc8e1a6e9d7283532c1e29ee65692b6f30debd5cafc6f3b72d775d38aa3
SHA512672d1dd2d19dfda4400e14271fe6cc950e51a0d420207c0fd09c4578fa6a1e44b9a105f76df940ffbb5e09e3d49cfb9fc46eaa9bef3ad7efbdedbde3a69e3280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a5db92c24857ac21a58eff785c574cf
SHA115be7f4388099d6e50f789631cfe252d3daacf33
SHA256f358b3b57596eec4879911af9fa834402599513071bb9b8b0cd3181b77f13f50
SHA5124b9b944b0b7bdbec056a1af21a4cdc43cfa116ef7c53068718a2293fa9262abe41fbe666c99dadc07e2ed3188911318a7042f26e694c485d5258267ae30028f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535c72c85f4a61de2feca226e478ef133
SHA1ef9b95b71e04aac4e3f64b0a03711a2663394f43
SHA256e6070d859a4add14c6db938bbccf9f92b75d6a073fb5174bdc672dbcf1b66a4b
SHA512716795fe1ac5cc8830129ad17fc1a8db90280ccc50d7d47ed8eac722e72cf4316486c5dfc8685b3b116113628268921a216e6032354fe399d19d17768dc782c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b23c679a1504160a144c729a7bcff5ea
SHA1305cc5ce03655e154f4f4b157601b14b9aa591a8
SHA2562632b3607ee2ef528d7312cc2dd9a84960d642b9aabb54adb6303a536c4fe086
SHA5120cf617a1332d29ef420697c9d7457908da7de00e850d2147a397b96cf52a447cf24417d70bae12c47c33c0a8535f280e349b31c67718d4a7a28d5fd6fe032fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59780674a71a1556bcbc6e78d99728af1
SHA149574190f34490a47648b4f21910d1e34b0be18c
SHA2560f1fac342dbe0901fffa8dd97e83381c8a2cf091958e043e8e74228ebf7824dc
SHA512f345a96afb86682b21e4cffb5cdb7e6aa4ee817127e64a90fd1b6384ae156f902c9ea155bf309e05ce03b76919a4d73cd69418f6cb9eeed66816fd51075f021b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a7c8af00a898e15ac38144caacdf90f
SHA141066f41ad678e6e09878d36046e366b16e35639
SHA256c0e393ab4f34641ee5aa617977fcd4ced738a9265465b9136849c04f4bc29cf9
SHA51224cfe5158ae1850931e055ba42242cf0e8ce865de3be71a52782ec6eb3d5377dc0957ae83028d2a214f3d176fa3f26d9102e8520454df5d264387be0532c8a12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531dc315a8e2782720548da3e29a090ad
SHA101a0756b5cbd713d60b9975e8eb690edad19c9ab
SHA256378a5732b1792a98629b18097d70f7f43d4e81bdb975905ecb93ada0b60913dd
SHA51287c27f7c2909dd0da89d8e4bb9d9c236afe58a53769887363d7b4b4d3a449a01c9ae29352da81e4fc9398e756c4c3b1c5b68957889114843e0702fa3f6439f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdb2dc8116f266fa77cc8c9043231545
SHA19c4831fde23ea2eda0ce4e89ec7b7ded247ede14
SHA2561546e3e188d09f1783ab45519f855b80d59317fb847ec7e92dcbcf8a96cc4205
SHA512c8d253b9a086779f1263b4189172b960f10965401bf022eb94664fba2d39c094149181e39691defeb9f983f9b7ecdbf6ab09c0a8b0604b5281d6a934a7fa8376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a315c41ca3c55a95bb7ed3e224cd1e5
SHA17c2cbfa83e3e885ac6ab24fc112c7d6f4569646a
SHA25657e8529ab867f7590a19f05a81014b2f49fdcf4ee3919ed58bf24303c8bd7949
SHA512b358c3f8bb182f064e45bdca2a477905ea126de932f637b4653f830430bcc4be283beff0e5078809a95e546ff531e6d888a7e1fd6a39a667274c60bc46c224c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecf83316b7a4a3e9e034f48cfcd8b805
SHA11b71ede134774c929539d1c2173733e2ca90771e
SHA256214a176da90fab14a6fef786d2075427967366d47af98d8de9f339e9a2fa40f8
SHA5123bdaac2f5cb5d42e5d3a415e804fab4b79139cd93e62380ba8bf5faa7450d45ced6d13f01cfda0d6c0ce4e8b7a9afa67b2e4864368735e48bfa4fa970901a50a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4f665a6e8e4513427cda04a99eb6879
SHA161e1915f9889623921099cfcc9c95ef05198fac9
SHA2562ce399b218ee6dd3d2fbbd7029355d516607747b6ed945d4111b25f23b2f1a99
SHA51209a3f0f6c4ba66fe9cbf3f4cb4f82b418a8c046bc82ecf9c8c3f44484f65686dcaf8acd94a022d8498418a0bccb410c6314222658723cdf147417aa57323860e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598e8b907d7bcda2dec11b165871eb20e
SHA13bf8eac1760120da66381cc2a6ee55a0ee7cafe3
SHA256f4058bb87bba588d4325a54623890046ee073554acabd041791f3b96c89e8747
SHA5123a6ef08c4d311ce9f0fcc00542ee6b528b72a801083b61d8e7e7f5176deb89c01828de4f8917e17433cfe8f60b21e0a68fb2d2e50999d0a01b250571463a12d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4ded7a8dc391aa83eecc842d7839a9a
SHA1c40687ba0756269d50d3f5322cf5f99e016aaff2
SHA2567cb5ac87a6a725a95d1ec3f25bd692fa7e679a3fb59062e8a0ff893fcfd67e6f
SHA512dfec7bad4ecaa47edd4ff2eb0991c10c9dc0bb2024254f4649c466839c6062861bb74ff51aad89f71673ea6bc2f56a3738ed746016f7e3a1bf335ccad3cab4ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5863c89cc11a7facc6424b99cdda54c77
SHA1d8376f23819ad785ea1ccbe197a3bb2c06b72fcc
SHA25662d150492a55439074376b10b407395865743bc30851a163197c60f6a7a57c3d
SHA512d4fb3d869ce9f760eaac0b4799004d3b542b42f805feaeb29fafa101113411ad1ae492b543275c720d0d50803ef129808c7dd4c03707c1df36b5de7cb58d1413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57070e3b894e864fcf2df8e0dc9d765ca
SHA1f5508caeab49051ad12089bd6a9269c1bc381d5d
SHA2565e10ec0bcfa5f599736672eadde7bee0bd9026516359b64e8c6101474528e207
SHA51255e9016ae5317e26aa9f8cfe10dadffad053496f1407001d74fabf477360fd2e687f102149983b2e0cc94fb48b54105b0036823674a62eeb68a6b80e9d10dc62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558a48e5af5fd93d7fe30c8205028a2d3
SHA1c213594c2222f507830a341a307fff67ebc2995c
SHA256f9415d06015316bef8175d32e6ecfe85356cd32988b84db6e21a751a3eabe431
SHA5129211a4bea242af308de1297d7cb9df51288ea3f193d11c9e36ebfffbba43f1fa768cc650e99f9aba29efaeee64733adbe606e234565a6dbfe691f2a53aca337a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a