Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 10:54
Static task
static1
Behavioral task
behavioral1
Sample
299e728c9e3b6c494c710164e8669d63_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
299e728c9e3b6c494c710164e8669d63_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
299e728c9e3b6c494c710164e8669d63_JaffaCakes118.html
-
Size
460KB
-
MD5
299e728c9e3b6c494c710164e8669d63
-
SHA1
065f19ce35e45c84111cd45f7651cdb3368c1b69
-
SHA256
7c6e792473daa3bcabe13235feec789443312a6322704ad14cfb4f87db7c9880
-
SHA512
4ec37c726c8fffa8aabcbebd48aee81d72354678f2cbd132f5da2cb62cce26130dbe999263d4a46b65d8ec9c52bcb26b72105278bdb5caa1ac50f071989bb429
-
SSDEEP
6144:S+sMYod+X3oI+Yd7sMYod+X3oI+Y+sMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3/5d+X3K5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000bdb523bac5108f0dd80b56d60e247cddf84d38543e117987bd67ca6caa8c450a000000000e80000000020000200000007d450b7f1ad07543b8d7a0eb8abbc985437b7faa19324bbcee69e6f97e105100200000005260809a4adde98cbd897af32eb80887aebaf28c9f64a3ea852d132137f9f08440000000ba5081d0d38315bf24697aed0ed33cf725ff58245294d33997788a661d2db771d41e5b5b5b7f80ccbd8183df2811aae9b988e97aa8ace3308c7a0c6943300b76 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421413964" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208d196bffa1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002f2e357badf1f8dd3ab640886bac7e0429a2871b531554e4ef127a419a73d591000000000e80000000020000200000000227533c20a0a4784d2e91fc9fcb5a2a13dcdb8bdc5963373ed20ad6d853dd8b900000000475fe0e021c8faadd41808128f3897cf66897075482484e1eb9e261edfb66fcd305e355bd008c13b4a0d62af59494d8ddd0d8ca048575aab29fc091863d520167c2fb844de8b17f81579bc00a19c5f28fa06ce8f9a7c4d1e6ba1f596ba8369427b0232c0232d478590a45d4295c1e2f22771cb4f7309e39a0fd395d14aa962fbb77a3f2a1c97c414765080208cbb9034000000041ed9c79b02d57efca96f449483c4a7e48d59df67e9cc977ba95997ab74c28d1903a73eb72b15a291ec6999c054031b712d26c80ab4e629fd9cb6f7696e12e49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{928C3E71-0DF2-11EF-A7A3-7A58A1FDD547} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1488 iexplore.exe 1488 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28 PID 1488 wrote to memory of 2068 1488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\299e728c9e3b6c494c710164e8669d63_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b93d200d47d1918e544d5d1b42835ae8
SHA1b6a7b41aac3a8e42b4d6764ba1ee3a812b99516f
SHA256e892547e834bfe72b89dad9a366a407a2d3e798661f7b6b5cccc87a5ada1bb79
SHA512deed2553b610e40352db49eca56a33acfcc800597c854be8d0c1456e1aa899c50e3be0a5da31cbdb14476ae5f2a9998061504c17b0f42964d12d86f7a9496128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52daf23cc2d3af9b263c821a4f1242439
SHA13263ab6dfe71e9f2f79c5ab283904cce6f1b4c2c
SHA2562d830641b6a99cc19f69e3d224fda1eef8b3e624de4451c7904c1b08808bf2df
SHA5127215121d043c8892a5d7e7415fb927c48ad1cdd9779323e358c445581933e84924e786fccde8707499261371acc2a74d4a11dd77c18b603afbb2d5934540ad4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5249be7f448b3e1e90860becffa0ff39b
SHA1bea735bcbac9fa0355f8247239692c68717d7824
SHA25663b232441c58a70b40a3d5de50ba1eb7c914c19487a5976ec1e743f836653280
SHA512b5a47d9f80728805c74b13e3d8715f8d370e5b1aad8ca5dfd1ff68802242e74ee8619befcc2bf364acc5d71ae5b03d6e64ed00990468950c6178c7ea267eed25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b909baa5be4689554dd0012ab047ddf4
SHA19d34c193618e53958dd3a6ec91459f0c8587b77f
SHA25658aa9eeacdd16318e75a43553fce3f71742b53cfc9741ab6d23ab59813841dbd
SHA51246cf5e356f4b582269d68425c2ca2dc2da463b9e06ee3cfaaeb7af1862ca455609d5aa8b6fa9e73faa06855fcc8fe428874337e5c49241d8659fdf5fa9fa111b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f364752e96f8eb8c7631b02a75b9910
SHA195e4bcd76d353bd9611e1fb0a0c3e705361e6ec5
SHA256255afc39b9338cfbe1e02e0e64f8ddf58da6eb18d3c02eb71f52d600d4314658
SHA5125a4f3599c23687e5575029b0caed16b1d759ac82beb7df1d797e65917f75aa484b76661bea53433c5d13791c9f3359fb643a3b95bf72ac5424ba757887b7dcf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bbc2a3fb93fb443419f5032ed45f9cd
SHA106e236311c82b483eeba5b9ed3d431533513735d
SHA256a2963f933012f59c8d33556679df8096fbbdaa5fa0e90535e34556c85f87510e
SHA5123c7018a65a47ed15f7c4493e5f6f953840a0c9cf5537495c9a9eaaa27722ac6cd06215ca46f2c5b3eacfa35c18e1a84caf013cb08ec2123e1fd3f2a3517ac83a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baa8f6d0b9a965d1dbaf75a6a72ae215
SHA1dc14c7cb83e6e5b76658de8462a711e77c69984e
SHA2566d439c40ad3803e63282990860e6fcb366da8d708fe777f16944c213bcb4f05d
SHA5125791bf370514ae0ebd02c9e3e6d1032cc76e930a97abedf0ec08e5ecd26bcf3396fbccf3b034b7d8a3df9d22ea5402fa4d63366fd103844cd10d0417b0efc739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6c64d2db41815b408d4c01d652e2675
SHA13fa822b70718baeead352c15c7eaf1172b8fa9af
SHA25647d7ffe315f8d10979b904cc7b89ebf7b766817378d26b87bdcd819c54ef6d1d
SHA512fdd0323de79088e68787f02828ef52b5b14118783867e93a9ccbb8acfdf896ac6bdced15ddf04ab2f59eb35af4373d5db310c6e889507732bb4bc5f85e4979b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5893de54c0e0e40de2b20a1897b3f5e55
SHA16d4f0040da4bb128cecc6a70aaeb124e403714a8
SHA256c06f88fb04ea9d56d704f36a8da91270b72858b4f640b92892dab80a9d74c67c
SHA512ea0b9a247158c57127c8b757dd949710c55065b9c6571fb049eaab44360cc8a8f505ad8b1e27cacc050936fb470b8d6d40e9b9cf083789c6cef3c46c2763e72d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9b8917d63d90f17b3be5e416ad743dc
SHA141bfe52f29b2b9df6649cd6b7b46bdb3fc863379
SHA256e572e3b64ed1524e9e755e194c8b3b02227bd7c526ecd8b7848cbccc988e12a4
SHA512193875d44c5c03c6f3486b4198c5aebd5abbf9e2fc81d30441ea2b8079db4fdc23a583df7b0939436f421ae1978b1d4737d4cc5f8035aefb13da241441a5b8ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c9992486395d82689508ef31b5a4b6
SHA17e8e16204193b8d243a25435edb2d3c5c8da5068
SHA256b8a544adb9b5efe2b722d1bb89d7a5b04b47bc770e1d069679984029bf2cbff2
SHA5126a6d8dc3a384f2ee8b001aa0b2413da7e33ea3e8627659752ce932aefd4f4a848893fbdea9484e45ab4d38b3834445cea5b30685efcd86749beec8166966a874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee8a3083ece527f192c09245786831b9
SHA13f54a746f44570b01c9af21db4a2c18a158aad4c
SHA256378763cf3eb875532bdb078de844325f6973651cf7c0845f8fa53cd33c7d5cd8
SHA5120e818dfa75a602f46e80e258b4e185db40e0c94522dfcefac2ce1c6563da086df26cc98d4381139e29c86341aee68442d2c07a0949ba5a2b0d8c847766c261ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568560a11b93d7358d1eabd625d153950
SHA1531efc678df5f6178ec81196a9e595000b51b9de
SHA25683743349555681e5b57d28c9614876c091798405325b5efc7729e469f1abefd1
SHA51258838388bd8f5dce065a2072fa876a4c3879aebdd133a71172b6187e99d69a8145164b7d7c922cb721c300512765672fe45bffbc2adf9dcfc273cd4107b61f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5223efa037edc433c8d575f3a930f4d1c
SHA1523820a92504d61c71e70ff0980e93a67ae1c711
SHA25616f40683c28c041b3deb8dc00ba660139c1dbc65c92572f12733b64b41c5cb6b
SHA51234545f512bd704f16c5c6279353f34000ac8c8f1d6d4410eebb85d5631fd1790007b0ad8e9e3390b65cfff1e23a83c645f4655ea080a0f863a998cbe22046a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504e70986b82981e6525eb467ac21f870
SHA115f5d6f7aba7c8de14f749a1cb2a4f3c1bfbe640
SHA2564229deb550241bcb7cafe1fa13655b43c9ec678d4c9ac234a906f6341c0a60dc
SHA51235989da0d9c9bcff7d53750175f5ab6e82dc8e8b480524522d6ad0afac460a944734fbc3299348d85657abea6a7dc7259349b78edf0503cffde7e8d339744f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f67b241826407f888a6986b1bdf61b44
SHA1a197985ebbde78842643e6d9eb72aa40d61b541e
SHA256b04bf066be987f2b54ecabf41d44855b5675303b4ab903ea676da52ff4138810
SHA512f6aadb4eacfaddba9256e4e906118e7ec20496112bd6e57053f92d6f1b135dbdab1e0676b69a5064d0c6bc7f9803b67fd9aad3b4e2bb9451abe6796eefa24d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b51cb27ed1530f9dacaf5cc28b8acac
SHA199fcfe7219d6e8823ed59fd4da071d967a2255a6
SHA256a6d4ddf64337508ad49358fd54d17ea6b1e6022c0e61aa9fac897a16485aeb3a
SHA5121ee53c98829bb8c6f5a55580fa53dd165a80a0da6af8d65333596878b5ab21af03de95f27fd34f9bbc648dfb055a128e8d1b0cba69046db36168a8130e208d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b897a5769cb8d1e11089d3ece98f75ae
SHA153c2af343523e71453deaed9f21f5f6670c687ca
SHA2564ff7599a7d0705d7bcc2f847ef17b478bb4a50fac9badd5552fd1a175354f4c5
SHA5122b19b5c0af080f4a27ed016071143436d0a0e7436d1f07bb2d6907834548f13cc25ce80815e7925762d56cc4e01bd2fd6a4ef1db36e5918a373a7f691954ea47
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a