Analysis
-
max time kernel
132s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
2aa2f8d7c5bdfdcab1165020dbc77e6a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2aa2f8d7c5bdfdcab1165020dbc77e6a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2aa2f8d7c5bdfdcab1165020dbc77e6a_JaffaCakes118.html
-
Size
4KB
-
MD5
2aa2f8d7c5bdfdcab1165020dbc77e6a
-
SHA1
62ed8f6d26e7b9aadb2794c763c5087623a9245b
-
SHA256
3bbd8a5f13ab274845d181c01cde65460779a3eb8c5e52ac52847e4feca95751
-
SHA512
5cccd6e93397a8feb2595a0bd821be085dc3b958267db31d7ad69d64b420c1e35f441be2c508ad8b6d764fd4ea517c0f9c82348de5323d293b467cde1a8a2f40
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ozQVG3j2:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000016e5e2895686dcfd82fd818e5bf6e785d7c1336cffa3be64cb3768a3a44c0a2c000000000e8000000002000020000000b036ed7fd47103b121d78c911f15293083a47db8b90fb597cabfc1978de4b8b99000000010128a26ffd187d7c9dbb2dd83fa80b11d15295824856cd0546f8b069e239b03dabb0d64174f1c2472ff8592bde433e7aaf9d63e5e9164b73f402a6ec2f361c682c061b3cc6960efae5e914509913a8d0b17a12e67f93bfc27073997f9bb62982fa632fbf26908fc43468f53d1e4398411dfac9a3f7ae5c5db7970173c9fb9dd696f22351303194bba56506bf08cc7404000000067c5450c312ceca081f9de570964b15c6f2cc18e57b6758f96a4f4000eae5d3f2a2c0f6e49dab045f174e8ad1f57412b6e2daaa0c72541c28392436d230fe054 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{178E0F61-0E19-11EF-99F9-4E559C6B32B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a703d42555799d673e7725230c3ad23337cf9973c204b2643afee7d8f42325ef000000000e8000000002000020000000028a05052c4fe2650a162c3e32b22085bf56dccc15540d714c42afd97711b4682000000087cb401ecc63b76f24c4e7dd166f6b7287bd09ad7069039b656cabfb4f1900d9400000000e9688cf3f5b973a77590aacd48d3a9cd04d6e52ad8914a2c89dd973968e94d4ed39e31dc2e165ed93e9639deb7baeb80b3d69a35ea700823089d5b6e3ecb088 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03521ec25a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421430507" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 3004 2424 iexplore.exe 28 PID 2424 wrote to memory of 3004 2424 iexplore.exe 28 PID 2424 wrote to memory of 3004 2424 iexplore.exe 28 PID 2424 wrote to memory of 3004 2424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2aa2f8d7c5bdfdcab1165020dbc77e6a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de5927293143a2c8e108b83b33a0c345
SHA1207c843820c0dea0bb89205b06e03186e86029e5
SHA2566f9c5f81813d184a2464828597a1968ca7fc0117b158dcb2c567a028e664fb7e
SHA512b705b0526b4a9353a66f0e50f24ac621f2100e459c3fca64d917a73829c7dd40e1abedbf7121de93659502894885662de866333fdc75a3bf1979d21655b38019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57827fc5ab14d4f19c9b70201e09d74d0
SHA146856bc0861fd4c58a6dfc60ac114b0cf993a68c
SHA25639f45b5b35bae1e815ace9f52872656d4d39f63e02c151ba8c98e298c0121c31
SHA512eb225fcff793ea61f7f477092b7739f33c2f05bfb167256b628b2bba7065c902668550d783c9a8cbb31b9ac33d3a60b203079ed8cda329ded5903daec207e681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4eadf04e5ce0e2f8daa977f2ba77e96
SHA1337c333dc22466ef118be4fd3cab265f72dd5491
SHA256aa69517245577ca3e4ec4084398058e32750a6e7c673e14beeb13c23a33e8d1e
SHA5124772e27f2c28d28f7de1941fa8d22fd4d08f9f6871596f2f2e1bf9e88310a51d3c75da40a52ee0141d49df1da324ecc33c33114449e8c977897bf64f18259f09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50eaecdcef0340905f475602689a4d1c1
SHA11a6af9b81d5375212fdc228a9e81153bd76f0e6f
SHA2562281ad36cff060887af084d914eab2fd2f8130a2cf9717196176ff12414e746f
SHA5127458549335f50d2df93d48a45a05acfdc7c553944b973c17ea9e0283514b5ef95a9ddb43932c4f282f4735dced94574c6a73216894384143cb67400d637d684b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cab3a101a0443b5dd6df191631bb281
SHA1c8a7ccaafa0f234c86260c9f1133ebd7c6c52d05
SHA2566d3312a526364972ddc58875f85506c8fdc441147c8f0b37c3edb7df3d02ae9e
SHA512a70d5e24bfe07e5a637f1bb0acd2d18f7184bfb15d7abb4d3007f7393183482ff8157c6552b0b91a9ade30825aceaccf16c9f84a77890e4643c038998b27c2e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5664b26a8dfa113b23190e32fb57c7f29
SHA195afa8ec9d5b01b706d93166840a337761b891b9
SHA2561573ef502ad4774a02d5385abafeaa266c24767e5a13fa6d0471021ea30518b4
SHA5122d6571fb4d6f28810fbb5efaf12050f15cdf996f316ea925fdf459e943d222833b509bb8019cee4a1baad5f40971ada2bcc6713f528509bbb19a3f3305a62eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5892b7bd05ea745f8a32cfa147d50f91f
SHA1fd4c132ab0fc75969fc9fef664f17643893aa833
SHA256309abf7a2e8b79b6040948ce407e3dec2993566ca8268690b7699e1e5a355b3f
SHA51246d8391ef1f4a788bab765321adefaad9def3fbe4694a07b6e22c9e9881e4641e0efee8f75e85d7925ee4df75636f2a0dce52b3e2af70bc3ea4ed1f563ca00ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563d0b9200e07a97402ddc0c06deb2a1c
SHA151d4c5405f2bf1d73be5bea46fdefde04bff37a3
SHA2562cea0f294ed7c245f0201a2eae4927825a776a009fc7130187d1c38413529721
SHA51215802a57ff7743ec865f458ac53d1262db121e4aafe7b7ad488b4e2ebeec7457daf355153d54b863b3dc925aab8ff9d61865bd99bcf4405ecac57900835dcf96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57707916c2abba60a95edeccbc902c168
SHA1091a65b0753044d63fbbe5323909fc22c06c2fb4
SHA2564221086996a7fa578dddffbaccd66657e3448c36031a5fb721d7b976a5d86883
SHA512ad242a5bfacc1409435fe8500f65ab43a315af781c1b12b4baab788c2e0ada61020c75f847d20a10c8b51480e409335e17c4267f4d483a18b5d834d1434d33ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59650eaee52557d909f13c0cf8951ab53
SHA11cbe886085585b108f00dd90688c3ea4643acb91
SHA2564af37d218d67950a6b51f2e725f7482763a52af312df41c5e06b01f4922da0f1
SHA51271407199c11affe243d6a3c6f67746bd5617f8e0c33367c21e7ce10d97d0dc353db4fbf2568ba2a27bce9733f0993e9b97cc3c4e0d7763ec6fe1669a0a714d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064938a2f39b02d14e967372d79a837d
SHA1ca69d4390f3036bd7a513787e6ab4a3f28b2a90e
SHA256e52443b2035ef5c466296ec981f9a140bfc82443c93d1da2c0b1942018237417
SHA5122adde289629b3c9a1ee0dad1a827abe785d558ea1b0845c792760143a248e9a382b14895e66f288174d72bb14d87f97083cb99d6dfa2898663085d6b1cd352c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52466eec515d9606b176b176ddd245214
SHA10b767784d479aa93d48aa4fdb4011e5535d77f5a
SHA256125d9af953147b106a82b50908d316e5d093c49965af799c3fbaa6bcbb23eb76
SHA5125cdd2ed8d85e60436957e5747e520d1a2dc41bc09a908a04230c1a34aca654b2427fa4c5535bdada15bf909e0c76899b0cd19fa1dcf70c01b22bccdd2334828e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bbadf7d40f864559d46ba5841e649d4
SHA13103d25ba7d2328ce5cb8fc6dc7ecb274dde9017
SHA256d8add54236f15b11f61d52edb297ad32c39df62bed6ded6911703c630221c784
SHA51210eecb3eed311be7a59881e4fbce8c63e7ef9363d0b23f398cf6ffcd4eabe1ec95682bdbc213d6aa09dd1401008f269b62724a366129dea793f1634fb300ce61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e54dcbb46d367cf68a876c292f757a10
SHA1a430c5843cc83ce2edf739b96106b8c96043d7f4
SHA256c23b711f5dd9c8d45c549ac02c775e5b460bdf39f4e5e7e50e912d588796190e
SHA512997e963cf3b0d1f92902b246ce5f285c7929e23e2382aa0484a93d999632daa5171ce76294cecbadd51f1d9291718c16eed57c0c8ebd35365696ad1663d4c76a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569f5b04165b6fb3931ca3fdaa282fea5
SHA17e094910fb5013f13f13fffe4f4742fd6e4cebad
SHA256ea9fcb27d91740f6989e2542d89bdc8f257215853cd58be2c6cde02564147b68
SHA512bf818f476b2d31db1ed5d485a05495d36380e9ea61bed82d0e8f1e251f69fddd36bab5d1873824bc89248421bd1cd9dd3255e5390f672dd3f021d501278e308a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4bf480bd41726cbc9633fc0b19d72e3
SHA1b17adcc66f045a3154a0fc546744be8232b5d04e
SHA2569945251cbdc87f6e14b4ad0e1fb73b57f66c76189d5adaf74ebe8c7493fc01f0
SHA5128f24e4efb7759c9eeb97d314bcb13f08c8181bca6925309e695c01c30a8dc18ae3da14f448476f8a356089357ac51ed1af790eb5f2423d6733ec0c94b3077243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de54acb5ce8b5d444325bdec018cfef3
SHA1adf02d3f06abf384c4dc841ed944ef0fd3b0ba0e
SHA256a28addbbb8f4fc581080aa93c4c3d105be9bd56905416a2d54a2c8186dbc0275
SHA5122ff124ff5c79284ca5b1dafca5fed8ee0c43d62e28daba135588833d7290bbff930d0039a8140ecfea5491761675c8b831cab321c9c7dda3529b7d22ad1b1b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568f7fdcf90fed25fa4f0535705caa6b1
SHA13fcd766d5895f35113f6c55ec14b14956a5d6dd5
SHA25629b98b0bb7d401f8130df31b6641c6ce67dc5f3245f685a03ba3b6c28f7111c2
SHA512712ce3702b66cff1a2fcdc0999ddeb8b57e2370017f6bb089a8cb30003ce17186078abc29b10d7d7f363a91ae950bbb27b0ac499e92a7394a53f78fb264a00dc
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a