Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 08:18
Static task
static1
Behavioral task
behavioral1
Sample
2915ed1d9553c71be2c3a64d85b4a24b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2915ed1d9553c71be2c3a64d85b4a24b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2915ed1d9553c71be2c3a64d85b4a24b_JaffaCakes118.html
-
Size
23KB
-
MD5
2915ed1d9553c71be2c3a64d85b4a24b
-
SHA1
8bb7b6832be13ab931af85a8017cde083bb5d812
-
SHA256
98a63af863206614a6dbfc88f474ac7045572c056d464ae5ac949af66e4b6961
-
SHA512
af92d31bac055b801ad5de309a780bb79b7d60d61c3f773069d4c95fd34871de8bb3f2a5a15442263a28334a0071d8b4acb45097aa107a1e4c6440e9767fca6d
-
SSDEEP
384:0RbwbvQBD1VDATjA2E3zcbM72uTmvbqvtV7Zf8PGeZBa2HUJSdgPcYIfSTVqfQUj:0R8bvQR1VDWiIm288bqb98PGeZBaQVfD
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001a0f96c7df273faed0d66b47c22d3172a29991d1161f86038bb4ed5631b3c6d5000000000e8000000002000020000000448e38a9efe67ef04f24a164558084b30018f734351361898e918bd030c78328200000006869d678937daa0f53f4740a256cb49521593d5ced426ac925efc817e17799a94000000080595a7e9a189a115bf6b9c66283cd54774e0ed112ed1a0307be21fd45bf65fa21162c1bffcf1646108dbda4e530702270097074ac3019047e2a5305b3002a6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40952395e9a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0376221-0DDC-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421404594" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016f31d3ee1d378bd71f65ef440c0e384d1ce77a475aecf2f6d281c44d6ae83fd000000000e80000000020000200000008ac0745b10e0b1f83f896725834d31ceee0822eac902a5ea8d96fbcf2e2b2d4d90000000cede1edbefd381024e53800f07c127aaf1bf50d08f1bfa577f1cce3944be9c4c381acfc8049181e501c5a39e16e9a9cbfd2321bdbb4feee81598c47526df3dc194b7e5fcf1555c11dd7593c7294ae67edfc7b7e2a8a3d70b4ada0d5126e272e4398a288a903e200498779cf0480449f96bd049b94ce5fd29047f4b9bbffb31c47559f0758cfd1506d3301ff72dc4b8a2400000009a125a6c36483a2722ba711c6910ed247ff4e2c173ef1274bcc573e39d8f4ea38b42dfc15776b86b1f5c8b6fefd82174596d972e4c39da139a16bbb7db240efa iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1500 iexplore.exe 1500 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2915ed1d9553c71be2c3a64d85b4a24b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e535d0fb7a91b6f7260476c72b04b894
SHA127013f04c77fdd4b7bd635ec2038cf55bf0777c4
SHA256c9d7acd25fb06dc1dd76d9b7744b20403e62194b86e6a7eae272e0a6eda0a7e4
SHA512c8e962ef955e06411cf313240d862b2fdd1d90171436a8407a0f3e62a8a9e411600cf8bc4991a61ac9dadd768b75b9da90e31b9b23dfc0c521ee2b3761d061fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53f73af8897a2a573fe3dcca19fe57ae4
SHA1192e83b583a3f6784edd724902339f9e6431e624
SHA2569e633af482b550151f03b0c24e7998838c40af05d25b68b0071bd0f4c776942d
SHA512b92c2403255ca11a5ed8a935ee2723318ce648f739fc41419869c8f6847f722b14d2792e49137bdbd3232ff474c27835cf60dde69a060948f8c6ac30799a26b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54b30d0b521bd0a574bcec7d01bae5dbb
SHA1781bc8d14aeaffbfb88a8861a424de332b38515e
SHA25665f86f0e03bdfbf32d8d28bf4f7b369a8e609c3ce0f393f4a9d458736d3fcd68
SHA512f2041c47ed150426f392f1a87b223740dcc5c2987e7dfac7303bbb787199aee1ac165117a7a74adcdf294dd2da4d26db2074d2e5aa550f73ac81a4582c923c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5598512079d8da28639ec3d563c7a7658
SHA1ebdfb0a763a6d9efe4af56dcf4bafc28559720f0
SHA25685d18de971375c2c9e376c85ab3d62b5d99d1626d8fa92fccc373064d7c99755
SHA512776ce04a29e63a511e8baa4d4498b5616b3ec40dec97a0db35bb0fcee6e1867931a3b0698791b5a7af765d903140abee7c74971343f064f3dc9573eb1b770f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d44f1c1a2948a9d50f7d3387205876a4
SHA1c585a9fb732b222f6f048b749e13b94fcd159975
SHA256bbc7814483d36a1d09b9729461f534b9d5bac96f777ebac02eab27765ed59fb8
SHA512c869ee09d87e7df387a841436c9dd177429cf607c61c886c5c8002e40d452673706ad69f5fc611ea0a5b913aeb0ccea0a8258176e60e82a202ad83894da2c093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a81ae36d9f2ea11762fb45b9f5aa44b0
SHA1529a064496cf995de93840553cefad25f8a8a6c9
SHA2560ffdb9857f9297eb84be1ad9a07436a8a57d28db99641a90c8587f82543b3a88
SHA512df36b279ffecd04593a7b9749a13aa0e67967f825fb8d4a4f07f4bb4e14977b2485398162626ef72f42bfd5ab154ba523b49345176d4465aefb4d2bbb184c672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ff281482be8cf44380309e5ed7ef4785
SHA11d4d58169fb7d370daa80cd2eb631dc3e6771d5f
SHA2562500f78612a2c10c867da7232f9bf890a866527bba3bda9f5639131e57b577a2
SHA512a3190a156a1d2e4ce5d294fb5875d825159e348596fa435cb2b9bb49a45606b9078ce7525e4e10f017a1290bede4200207fab2803c264da95feb039adc75f0fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59548976cde8f1227aa452fad4e632d83
SHA117ae82473f8bf25b5262645bebb11af9dfda7240
SHA256664b52bf5b5ef3bf64d7cab3ccce2da29768d7b380a1d6fec07cbe8e0e2ee019
SHA512732678f31516dfa8c26f1cccbec875aa90ed48f72f08473deaeb674466c6918693cae754fe5f1892e27e4393a0d8c417c9dc9e5b28f7c3695619ca94d80a04ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5400806f9d0b18921db717d126cbe736e
SHA17dd7078238a4855d5ef2122797cdabddee5811e4
SHA256bdc1eb496a83402a9d12e70da5f2cb4c1be60eb7d94aa6c83d3b8c0ae6b5137b
SHA51283e1c62a5510d6f58250c2e9da17cf3eb9730e4e9d9351d2430f12f72c4d6c02be51c82d8ad8a5f977da475a4f14c55a699f9482c18c4f1418e700262f0fb2ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d53a5ff0981947c3fb0305cf320ccbfe
SHA1d240f010e528e2d984d3b3aa8b6ba4b935acf6c1
SHA2569e2614d98710f7cd32ff13e678b96eda828ae178859f9d47061284270826647d
SHA512bfcc627a5c84163210870a3831355093ac8855249916c27530e013e36f5098b495572194ba8254caef570efccd5cc1e986e14e6a5adf79d9eabef331b135e122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53767d9c00a60e1b6784d3be3fd7eeaad
SHA1d396cb0e52aac060c3bba99cf1a0c0708e2a6713
SHA256f7ade9e00a16904f57b8d0841c3c6af9d78ee329048a3b447c9644d136aa3fde
SHA512376ecbeb2e91ecfd2bc2b73caf000565395d1c0100edbeac83912adee2df55fe57685e5554fbfc086921e2ceb7d20a741432c870a3521ca8e892b13114fb5106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD567ce0eba78995b8f97ece5edcbca8c93
SHA13f7f77720a5a56ce57d5a658f06c8c238ab0584c
SHA2561a1109b7ae3fd62fbd9e89ca2439402daf11a40c8819a3486b3c5874e19166c6
SHA51264507db3f0fa880163ff69d385e099109eb7d2d907b7653480fda74e794b4a31e6fad299ad378a464cdeeedcc62efa2b3f5d7582aca91e8bc7556a8e02e41a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD547b9db6853b05f6cad80ad18c97415ff
SHA181d8411023f0fff889a9d050b5a457cdf48892e2
SHA256de31a9c19b7f8841c97c086b7a89c254e959e8f8a47fd72f11fe3cc859080b98
SHA512eb9a5d3e337bd9421df49b703ce06cb928ed09c51b1a89dd839820e8185089ecbc8b0d8ccceead534a04d75841162aa885977d6cab3f398d5906bbbcdc7de6e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bed0c0532ca1f189bfc65daffc385532
SHA140ef7d6b9b13ea773a4eb31ff03442902089ea80
SHA25690dec4cc508ef5c6b569883bbefed982000f18252089d85af1dc2e6337a5dc63
SHA512ca8b11e8084be07dc45699c055c6f3ab67aefc066bdc6c917132c73ccc63ea5067a7bb2ac746c6c6786b94469071638bb5c99e91c86451f904cac3c5b24b5aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf26f8e12bd9b19d28c4d2de0f42e2f5
SHA16bb76500bbf53447ec174cfaeebea87a9652dabf
SHA256b97f834efa43e1d1050a647d7a278c2fc9958993574497eec5160e5afca9fbe5
SHA5121d679b9e426e7846df725654becb26f0b87560ebdd9dcd790e0a3317d0b39f36d23dedded40340fd1d45db3646aff2eaab611e9c0f5c445154ed72b5652af1be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5858af975cb731d862edf5a1a90d54ce6
SHA16017f92fc24306e606db1a6cc8d8ce3a1ed424ae
SHA256c6b687c04061c8eb75d14dc88aba7c553ad9085911bf8930c7396cdb34f113fd
SHA5123f46b0fca7aa9047bce11df82bf66f5ecfaf187e4e76f2e888932ce51b6b1b96130738f77f578f91439364e15dbe45f2c068ce87adf2380bfb9a6e8eba22ac86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5daa42d053598dce9145eda2d802676b0
SHA17a955c9bb5e87f460f1b504cb40559f72adff126
SHA25658d03012c60e73d800ceca9f68b0b4a2e7c95a0bfa5c7eec3a075f90bb5211cb
SHA5128a5ab3705d4f988ac57e59d69d74089d7b9c0376dbac09b00d9b0eabe78d9ff92a1f5b5df15c6177d70427f3389871f1fbcc354c84fc4fe8a0558a70948e1f89
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a