Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
2806df00ce5ad3171c5ef1d0fefdfded_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2806df00ce5ad3171c5ef1d0fefdfded_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2806df00ce5ad3171c5ef1d0fefdfded_JaffaCakes118.html
-
Size
1015KB
-
MD5
2806df00ce5ad3171c5ef1d0fefdfded
-
SHA1
76cc6ce1bf94bbd5651f1b335b9525e7d9163db7
-
SHA256
b7d1ae57cdf1356831b585b0049603223fcd9a3a31ad131fd06b6a4dda870be1
-
SHA512
cdd9096d38a08585bd87a39342dd85c253e767d1becb35d87ba2bfd6757ebef05929b11034386a386d7cbff472c55be5f920b4fbea67451c6b923b5894024f49
-
SSDEEP
6144:JljgtD9koia3618kygtAtcKIWBCx0SFbH5jg:JmtQf6iMcznpi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008bcb2a69e92cf0ca45657f30177bf7cdcf00fd5f53eb95a0ead218e61678cb0d000000000e8000000002000020000000ebb978b5ab280e5dfc530dd1d1e214a1b4bcd468dcf7ec0f8a18355976dc891a20000000d70f0dfabd82f763049a7a81513497a807437493191f12ae160c8ff2b11487494000000075ca1818eb4b5cc265c9fd1e4a982a5a76f13ef889e451d4b094ac944e3bce7948d7614c1924dc6dfa7121089bbc112dcda102a1658c5486d3241423a1794dc3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FE01C21-0DB2-11EF-A8CB-6EAD7206CC74} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421386257" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004fb2e4bea1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000004b65ae868f11a36fa7b1a591d3e089c09d6712faa725c4ca88b0813fe1ca78e8000000000e800000000200002000000032b7533eaef7b885b641bb9699f6dfddbd96ea56b60e130909a34969a0156b7790000000c47d026be6d7a331d1d7f5215688adc91df5e0c81e78519f81cd43954f0a07f01dd6f0d799d9594aed2e49b123c1ae6bb7447f45cdd083cb4df578570dab646e25a8af8c3c826b0fc69f6781c64c1206fbfb5fa3f8dac7a552690a0eb333073f77c040f66e4fde9b89ed5b4cbd3871866964271bd80abc7597db524803cd9e84bd401cc19b6b205001e5b9dadc0a788f40000000ddc6cba802aeefdfd422b2ef033e4113a8ca6e857020b69cf1a697a6b4a0bc78a6e8ab931615cc953d4eeca5c480ce1b0f02b5b68d58b90b49e0902320f2bda8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE 1280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1280 2336 iexplore.exe 28 PID 2336 wrote to memory of 1280 2336 iexplore.exe 28 PID 2336 wrote to memory of 1280 2336 iexplore.exe 28 PID 2336 wrote to memory of 1280 2336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2806df00ce5ad3171c5ef1d0fefdfded_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58310807a1959deb3f23cad1ba7b7d93b
SHA1a4a7f19c0d742184817efbf047ec1557302e2cbb
SHA25681f03d22de11a7950d532f748102681d22a35229647c397ab82435ed7e52d996
SHA51281af1263766a43a23635d01b9f9c6cd6ac573fa23eb365b357e7b3aed2349a36bfbc5cc0b361934f868ceacaa6f1a9431cf40e5c9eb0775012acf78c8b5c6903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7c56e2c86548223738155860abc84b6
SHA16b3609cdc63412e687b150a5963668a9caa0ca8a
SHA2560f2a263f60bd46e958425f6d38d4ff776b898a6868876c52f373a7850be47264
SHA51245d374efda895076b380a3bc9e25d4a3079d9fd6b48c672d5128b5d87cb4a4b4b583351ba95686744614691970b5c7b1d5a03ddf7a972366753df6a8ca7d30cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549e7957a698e59d1960ec1c763693e23
SHA17f9f9059f042d4bd5825f4a0801630cc3f5f189d
SHA2566f64a086ffa854e100387c21c8d179fe479e6bb409838f950a9270155054003c
SHA512cd145e1ae6a4fa1d27c2a1fea974500634914b6527648a623bdb9f3c5307b3fb90e03df0989142060914f5d081acd17e617fa843e355f7773b4e66b7513fd40f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c128b6bde8e90ae00a4236ef6dfa5b41
SHA18b919e41b26b73a11fae79df21dca060cb4a2e79
SHA256e9ed663fbe2b2af256e4432ee3ecbcafe79e3a0bb4d90bed5a2c64e3d6f084a0
SHA512039aa7b347b9683a082f39b06f4ca9a027ca7107361b07bfcef3d3ca5b3bf09a413ce94bb5dfe75ebaf587d0f510482f455c123b7a0063030a450b6cfb0b4388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe2b912bd7e446026bccf0873d59880
SHA1224e5068f6902e5a9082a85a2283623375f279c1
SHA256c008e6bce0349a66c5d1f8c1ad8aa5ed53691984fefb39032a789603997b7cf1
SHA51267d7f244d2c692c28f3d8d8f80e29b31d6f3515a95c04c6e112639af33732e5f22eaa249474ad3c63db8cd2a6ca5676faf937c819e390d896f178e9bfb1dc241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bae8569b2782896ca9405fd27e4fadf5
SHA1344109e3fa33690593f67be1acf7736f7bdcd551
SHA2568b220318d4c379ac80131c6782d486850a23123a4df67a168165ff4f30f760fa
SHA51208b9e11fac00e1938ef96d057c9b80547b153e5356be2090afd3220950886dcd78c148f749ca63a64af94e849a421b4a843670753acee6374096294cf56c6479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519a7f7217446bf9e65557fa7056ef9fe
SHA144531ed5cdbf12044761ea81e80a09bc43dddcc4
SHA2565219015177d56070dc3556da58802316bde187ebebade032b951079236594dac
SHA51258dc65eb17de5246d4597a88cf412fc3d537273f3f75949b5fb74e457364961b0310f68c580b0dd100b20b4c864b91e42b299a05cf498007344a73d7cd82533a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5635dce54fff037637eb0ee0e513e1f21
SHA1c98b85af480e7e652d04313c86601a9533b35bca
SHA256ef18b4a80ceff6a6c4cedfa0efa3e7558d7182c4de2aab67f57cdd89e47ca834
SHA512f03144911097855c271f5efd0cd3efe929fc031e44ac1a25191eb2a91c3b370f5e2473f9905b9d0d09fce7735ac4835cd8efb43c2b96b01aedb5b26bebef104a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547ba39601793d757af9434749fc17ee2
SHA11e930a9528b579e6b289260867ef79092f5a1770
SHA256d115a43ce31496f1c4d57c85ad8581e67206cba3f109b9299300fdf670241e6e
SHA5125f9d7c087b24d912dd4240a0e91479902107bf5173bbbb8c94a53a3ffd06a625a51681ca45db3e88c84566cee96f2e7e44b113fcfb407590ff20cbb37e5484a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cbd20011a0e49b39fe0d5883ee0ce44
SHA1098813bd94092ef4be7b4708aaf632fe73c7353e
SHA25614ed61af51d507581bdf8b7a1784b4df923a7afdeb7b97c6a857e8190e1669da
SHA5127fde758d6cedd8439d4c62abcf1005acb9c973e79b6373800570d22632fd31724d629cb7d57f4b17dc9424e754d839188b59edf8d068b421bf3f2e25eefa54f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6e5781f5e76ca357eddaef944c67068
SHA12f833894895e9cf7cf8cb5550de86dede7beb4d0
SHA2562de19c4079a0013a473ee2f84bd2862a42317097791cfe023f68f0485a7c4536
SHA512d841f35cd199cf7f4d547c888e673ead8da28ba64c13e3ef0dfbb043fb23a0f4f821c63119fd0a96c893584b5778a489bcc7eb4fec0df3023de7c8e97e9e8006
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dff24a9a1922c5a1d29e43af48ffb4b5
SHA180b14abf1f401e06a7e1fb68fcc92ce3e732ba82
SHA25690facb4d19b027f040a1404047acbb9a239f4f77dd44b113f784da745d6bc0ef
SHA5127992a3e295f075cea34e2bb90b71c1670e54fef68b564a8117ca157feb58e4564b41bef169b9532e5e25862fe31cd7f5acc55394819269ee2551463fda57d281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55efde6b4b6ba8404e3c7e6e3b156b4c6
SHA1a00ccbd1c914de2d12c2fb5f8684ec03922b5b01
SHA2564db34d5adf83ec1af304b9f10e7db3edb619eeed130c63e35e4ba4265b4a5439
SHA512201804bd0fecd5a8e6d8cc6316e24398ce4090cbe267e5743d3a20674af052e216f403eadf73dfe77a17a1968123c7348a231b9bf0e53fb7d7363738e1403c74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58969b605e17b8135549f9f7283f216a0
SHA11d85acb5d855d4d3ab622520a26622207b1490ae
SHA25688f1bddbd7ea1d787dd4a7d3264553097ccf53e5911bdd7a8137be6d5134210d
SHA5120b2f9af051874c254d7ca3484d3c032b16ce39d810d33348320beba836e8770bd073004eeb5d7e807b5970aa6ece69ec74b7eee0766578cb9e0ef70d21aa4699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee4870a64ca48bba4c8495021da01b7f
SHA1ed959176e288ae844f3d5bfefc547c2e30cb4378
SHA2565751dd5d0cae69d18eccb650474c98925e767201b878b2918685f41d509eb8d6
SHA512fc082f0bbc02fbda19ef0460f867cd957028f7692b7ae3acc852f818cf148dbee1f80ecff16d07e0c5c7e0361ad69939ec312de040191e587e3c0b347fa10ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5160e04e842c6230a5cf85097e3177f93
SHA1d7d793fcc513343e5e540c7024b53b4718610740
SHA25646144d2457cb178b72f68afe105528094758e860ef5fd890e6137121cdc19a2b
SHA512f7ab5603bc68b38b0bbafde25ce191e1ce0b0167f934e68df7d0e8d0437ba42813bf071d7a0d9a3cfccf5d9233286793da9cc155bf842b5bac7b5309a6999e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f19cbf46338f5c23b1edcb3cb0f99d
SHA1b03cfc651e1c36632a8835e71aa1ea7c7ce11996
SHA2564543d93fbb3da4e0e7038968f78e43be1175560d117b814c07ba026a765bf944
SHA512b618b18889615a77afff0ced80e8fddcc73522467dce7aae9498d47e9f59df5153348b8524882c992a5da969c1ecf856756b7c9c0131389b08141c8142135a25
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a