Analysis
-
max time kernel
144s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
2aeb45681e958ce48ef0f8fdb3d4a499_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2aeb45681e958ce48ef0f8fdb3d4a499_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2aeb45681e958ce48ef0f8fdb3d4a499_JaffaCakes118.html
-
Size
12KB
-
MD5
2aeb45681e958ce48ef0f8fdb3d4a499
-
SHA1
a03c7f0a8c661cf01822e42e8755dfe329b4c3f9
-
SHA256
a703384717dc2ccd3632ab90ac5894c5df89bee457099f5792f7555bf9dfdaf5
-
SHA512
15382ba1ee7b1bec1496ef2c0605d5a94b102d40f0731d6cc87b4bca65fbcd64fe130760460067ea48d784baabe9b7351f80b97910ff9b55530003e10a856bd0
-
SSDEEP
192:5wZpDJnDk7He+227wikzHj7O+B+q5hRPimBGLeM:W9naHeR6I0qJijyM
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D0F0C21-0E23-11EF-8706-CEEE273A2359} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a024e87130a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bc49f0178082a6cd02149850b3ad8ed89f96f55512b19fe9ec6f1105c45cf1a5000000000e800000000200002000000054c7ecc1d9658c0eb8f0628d2b4d094b10b9a6a001b657e98042c94de26716e7200000000a43c7d011d7d02c7fd7694626d88e858f5386a06a9e2737fdb232f75e68900e40000000554c6207027f31fc328c009efac5ef4d27a10c87538b0d97357688cf91650adc808cb9bcaed062e27fe88ac7c64749f6cf4ca69a50863d5cc0b5d7d0b49e6b33 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421435032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006c0cc424432010a85759371ac4230e8275bbec6b573ddb86ee60d06fcc20f104000000000e800000000200002000000094bc20570400d8e22dca6f2a6490d6215a2961b959bf25c1614d442aedbc066f90000000ec87494cadfd16bd14578f3c9dd3a3628753e3938b1badf6aa98e29727fa8e2864f0511852b797c09d92da7df36dac32e9fbce37af0396f2bf45195cfe4497c464fb7b55c9c64fa62a4b4b5f427966e0f6b1d24e6d52d7357941d656ad2e6bc9af2218f4fbcb28643b571ef9ce63e1a6ba50cfae045b773a6b6ec97adfab9b881fb0ee8b0eb9f812f4efedb0966eac0940000000c7b19018af6a5a1f23766a2584a9b6493a970c1b4cd0b867c0da188fe44adc361f4fa1202df193e44339f49b3ccabc203cca9f9d67c0cdd59d734ab7d2826486 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1184 iexplore.exe 1184 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1184 wrote to memory of 2080 1184 iexplore.exe 28 PID 1184 wrote to memory of 2080 1184 iexplore.exe 28 PID 1184 wrote to memory of 2080 1184 iexplore.exe 28 PID 1184 wrote to memory of 2080 1184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2aeb45681e958ce48ef0f8fdb3d4a499_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad6310d7ec2b5c8cefd0a095eadf6a93
SHA18085635033fed14a0603b98601aa12710dc663aa
SHA256dfad61e0633f233799c7f1ef830a271445f9c1efe995e35a2a2215249c4c2e7c
SHA512c035f9bb99c6dd6b711f281847763d4cd928d9edb62c24e3a988e2606b1dfd66d423122e6fe0ec177a671595f2bdf4740333f7de49876d7dd2bd7f9f71cb3078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b40a7d5523a63663f4769381ee5aed0
SHA1ea4fc2141160b6c4f274b36dd70c20166bf3d998
SHA25634ceafdb5e9a73f84cc7fed1832ef33d17a74595cdb84ceea1ef5f35f2447437
SHA512c4f36e2d83c42bbd79874a71011d7841d8976864ec52ffc542a234c0559cda4514cae20d475d09119cf2f5459217486678e07eaf8b1c938a57d7d65bc254c014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c690872a26d6eb9dd97d59a848663e6a
SHA11a54dedb4b67b828765d8267af72aa3b1ccbdd8a
SHA2569807aac6effedb3237b43ee7cf6c920615e5f734a23b9c4cc6367c37f718ac56
SHA512da7b60f1c8f9912256a2e394819e2297d035d386723ca8cc88b5c097baea43300591f5fa515283d7a585b6f94106c38371a1425f42d886572a99b86f04fd0023
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541880f6a1806d796c98991e80133c52b
SHA18a4441710ca006a554107d7a656ed6be88a89c48
SHA256f98910dff79597749195b57a25b13fa935b490ebfc8d84f383e09cbd71bdc2f2
SHA5121ca05a376f9eea440cff77ccbcec43ff680022451ece21729ab7a18802af57a336ea3e7919f4373ff06412efd175c665557ab9820e962aa0877d365200e0126f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5331f55b4a77cf4bed8c10f579e4ea248
SHA1fa844e2c555835f28c08e25611ca98e00bf7d462
SHA256e340e85ee4abc04cc6c55dce88a5de26bb0f66754e079d788697972dea7f09df
SHA51247a2a9dc092c50c219478b45a00ff16c0e03c98c4a005ed47b3da1d4b11a97d02d507a095331b81603d5a5c1d283bf8c72a1ae37a6dd90a4a9450c66601e7342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c36a3a9ed9c12a7fff7ca323c2e79891
SHA10fa39d619f1791b4c663f3dbe57d59faeff0d13d
SHA256d95e24a240ebb25ddc8420b2aa6c77981c6a282c69064cd82cd6c80b0f012962
SHA51253017bc291a551fb1c2574f8dc5e6db4524a67f1b090aebc86fec5bfc275fdfe155f088a5c4b3f29cc094677d3881fcfe3d8d03f8e5d6c61b406e5da63d70603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5f4a697b0f5159e093aa087a038021f
SHA10ad5b11351399b326953b4d7c56d9acfd3cee617
SHA256ddd623d261d7a116807c0872f2add7418002a28d6bcf1654a215c154a665363f
SHA512a14a3c93b147c7bb31dedbe7e9f4e14cc0089650c6f1a697bf00aaad68ca19617cc5b09f8949373cb672b2cf480a95e64411cf084db3547e0cd5a1eb17f41224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e7ac05b32357c96a539eeaddef9fe72
SHA1aa31d842535f7cd38d2b2ed16be3ba9447d64cf0
SHA2562e3d703b2ca65151646baefaee9a210a7fc524d77d11ee592bb54415a7796539
SHA512136b4b86fd1e0fcd0a9387252a1abcd37502e935771e325d7c343eaffa205c82507f157dcd25a1989b00b7099fc738f6a32076b5c61b599cc16e0c77e8927836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e343691e9930b26c83dc1e89662cf68c
SHA1a6c8d0ffb6fb5caa1992ce0d8b4be16f8eeb14f8
SHA256379d96ef07b0370682e4ed172b2cad50da6c8257e4e6f400f6baa4ed0c4b7a00
SHA51204596eeddeb249d585995b2515e16b4a112fa982eda3b1ff047ace32ff68aa09d930b5507c0e6cfd66bb8e979edabb38ffd0b1906ee8a9d3b6c991c276cd696d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5effd6e95607f68c10eb9849ef8a9c539
SHA1e3c93438b0570af9a48560f6c7e92c420eb96d7e
SHA2560c3d92671540ee589bca80a0c025c2dcfe121e1931124652da7c8a56eb0bdfea
SHA512a5b7e54d6bd7d50d9090eee6cafd2d8a6491afda70de827433069a497d3edaa987acc3c009e7bab0706edb20090ca4be50c4ae73d47598044b7ea9155a1c2e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537cbf4732b360d8880fc65f8e9a41e94
SHA17e1e00f8179ca0cdf690983b0fbf371c43c3450a
SHA256ef29e1fb07b9ae52f0b386891324ba083b74f5863e174c68d522b651640c5e5b
SHA512ecb36936197a9c9a43f4fd2c562e18c622f576d6041a44c1331341797e9efbaae5349898bc93a626a787f16b1f8203332af7afb86eaa60a9c8345d37b02caf03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f27ea550392c3f9dc1dfedabb89a2e7
SHA1187e659a6ce3931df0c9cfdf51b9e2a679ffe131
SHA2565a602b656a3809af3e503ba2716d4341160d14a0dc018b3ca409c7f640cb8185
SHA512e19a763a9d341c9a9b341e801171fa7adc915e7542f8ec44d9369917ae08773b833e80a27776058556ce411bbc471338d26da7f55948816a4f773530c5910367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5277f53b237fe1a76c8b1c42795c10242
SHA1bf1a740b245c5ef4567ef1d2d10fe14741802e5f
SHA256d0d5721618c59b9a05c17013c60ba5167b3b2ece42ff54dea6513bb22856bd5a
SHA512cb59dfed3e51d4258a4de0ea40e369903d721e26e888107b809b7746476cfea8d5b6c2b2c98cb0632911fcfe1e7ac6b771c2ae4179ceea2f22fb427f4c16bdb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d2d589aa3bba16b3fec01239e2c4b55
SHA130f6b5039bd35ec7e9b40b4653a0ec911dfc601f
SHA256be4e8db8d7b6e885d357daa385209506127d95713d1d165a799765b929ca41b0
SHA512c31d33c24b8398c9c26075b5e2ed15488c6f1a7b066ef02abb064ac78c0268100cae37a5df136a5f32031519731e628627efbe2194826ea8daf9300bc467f989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557f1682d81a8fd78445895a01d94f803
SHA107e546e863cc133ce46a4326617b279255bc3a59
SHA25675768e25e3495407c7829eebc97fdd1613912bd616137c92d444e70eb9a39052
SHA51285a122090c5e6a3d1e3f4f30370219322c20d3d3507741dd2290f8c485f0fd68835200f39e02eb9b935a4f7f450475181f5a7d227865d8380bfb170b6730523f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530467727bc5782c617d48b0896c6d0aa
SHA16774e5250bce4199d64eabffa59b2a81ce32ee1c
SHA2564b25c16fa1c65dfa93af954c5357b952304586000abfc8c6c4a6708e8dafbdd0
SHA512726a920e365a6567f9525d81f2e0b68a3a45a7072e78b7dcc9646820bce5cb293225a7c33c88b0420b7cadb83b295eef9b992e76a426809cf783f5a78cbdd325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5554e8db81df141a72515f11e8100d353
SHA147753317f939ddafdb4247fb946b0b520d1c45a4
SHA25634dba145df35cbab4bb49494800d82a5de29538b1f47320e70547ebba6d89e8c
SHA512377f92f344d887bc8c139018111284a78af0fff0fefef42dcc706aecc79c01bf670bbfb27c063b32b4e44f39754e0a1ecc96b21852202b7f775c1e4368a0ee79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb611d17fc7e2cfda7ac999628537ff2
SHA140d375bc86d744a9712e34d639bd765aa287cce0
SHA256a84689e97fff759eb6f4555c4ba8b2d6646d8675b7689f4f21d0eb9f45936be6
SHA5120a5cdfe613c72b9c7bc01a6b5bbbb37a675c8657a76b54ea898d91496e052bb495556c7e5378d5c77f72f09d735a6d8b97957a7a6becf3dad330b76e1b35e306
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a