Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
31a22154208fc6e341ae15169d79b75f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
31a22154208fc6e341ae15169d79b75f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
31a22154208fc6e341ae15169d79b75f_JaffaCakes118.html
-
Size
28KB
-
MD5
31a22154208fc6e341ae15169d79b75f
-
SHA1
eaf72a6db2c383a0d760f44f43f88bfb6dc0a09d
-
SHA256
1b775c5b34c8c65ba094cad1cdae24b0747c6072bd279959797270b75c4ba9a2
-
SHA512
3a0196e03d69a95e145dc7f173e33d30e3cb4642f4f85f42112f7c0115d1fdd2c7ab0ceed1411b445ac42c2eda010b5ca2373e2a0ce8db2cec8f692fb1a98449
-
SSDEEP
192:uwnob5n6FsKnQjxn5Q/SxnQienNncnQOkEntkdinQTbnpnQ9e/z95m6sn3eghQld:qQ/K8z9ze3eFSm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0005e27433a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000014df9bfd5ec3e235bf56becd563a5c16dba10a9396daaa7baf8b99f8d90ab4d6000000000e8000000002000020000000b04936b55479d13506077f87a76e48539b05cc2bd2cab3c668ee0cec6bbe667f9000000055c497cdbbd216896c8b3a17af52b18dde6722b4387554b934cabfac7605673d45938e9a3aff1a0d97a40cd00bc7dd02af15eb785ab032987e2be817fc68e118034da368ac8192e852ef9fe6a5e4901069ca4c2fd8604eb6436c7c01537570832f41fd9b6941eabb6f87763f98b5b88a3eaf30ceadd6518acbc9b65d08324b38c9d97e2f2ef1821038932d173e585dbd40000000c6ba5fbb7af3a4229a2081c72275436a1aa9ffc03201b31d359c2fb30bd643803bec60f29136a9780f5035e2ffcb41afe520efef066968a5b08f7943fed7070f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A03D3351-0F26-11EF-9B88-D6B84878A518} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421546272" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000074019319ea0f3064d5bd226f1bd8efada6b5dc66f83a315f135c0be93bf977b2000000000e8000000002000020000000a341e8ee9430f96b9920b16175d97cfa5aae998f18ebe1a00747b8233130328220000000453a5834e7ca1f6f159e43fa6e7e7f60df10aa1bf2ceb22e355f5ba285cc8b1740000000f0224b8c2387d109b70c866315aa1573398388c2f67d77ad24a9d191faa269494255b4591150f5fe05b510f23cff0746510bd034b8b8614d06fb605ab9ab349f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2820 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2820 2236 iexplore.exe 28 PID 2236 wrote to memory of 2820 2236 iexplore.exe 28 PID 2236 wrote to memory of 2820 2236 iexplore.exe 28 PID 2236 wrote to memory of 2820 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31a22154208fc6e341ae15169d79b75f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56186f0eacf73243cfd92e78c9c61910c
SHA186e12ca64539fb929672c3ad15c4586da83c043f
SHA2562373c946eb0900c9d37977ba69f94c6f35a9974cb4c355ce6ead0c91248d89eb
SHA512146d7a4e98d129bb6d9f79eb82e42ae5d8917d1d860b9c3528143503696cad195db67620ee649667bcf0990b49f90beacc877a07a8ecd2eb278c046569d91a64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f158023a3a0e38d3440958d08bd65f6e
SHA167fd818fb776ef575fef20e54b017d4290e42d80
SHA2561fa17f144c67d4c9a6e6b1da79258dcc1ecf12b10dd924266ca0969b380a8f14
SHA512ed34a85e2b4222192aefe54a43746985769776987be0a55ae70e1c3d077f91e5a9c9bb2d36b78781d11533aa6802594d9700236556504f140d0ff064d3b4848d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567fedc47a58d444e64b6f4de727c8a78
SHA124746076fb9359d45d0653733f3208987ed2a184
SHA2566f7af399b7ea1a70b908bf20fca07fb35cee8fe613b39cdfffcd0d71744ba985
SHA512cdc310e3986f7feb198fd71e5c503a20eee520dbaae2f862a8fa392dc7d34041596cc207f1ea1144f7b1cb7d23de8432fc2ab4dc3f41e662b402cf89de1f7997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544251262597e59dbe39870519fd74dc4
SHA138149571d7ceb18b6c1de76ef3e68d128ac59a71
SHA256626575e39a3e9dde7ee6689c93e7da3ff8bfc177e877ba39fa70e0f3d9f2d9af
SHA51227732f3c1629b1f1d2e27e972601c955533dfcc2d3d6f79a1b1c2815028f3157ab1a909062f8adbf246bdcc40123cbd0b7d8a646db3cc1363d2560450301f137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b6b9e00ccadbb592b95f3255542a3f2
SHA1c0dfe617199d52233c30b9fe39931462f121a105
SHA256102aa4c86a089ceb757dfe16afdccff3bd2bc236589921205642892e7434222d
SHA512eb7a49c3fa6a6b3d0b1bc79c56bf3fa2dabcf6fe7b3344138cbe506f4ecc9fa7d03c31328d5c2c64bbf874fc49567d03f5eaa220d398b9b026177ebeae507e0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5293bf6768d3e5e8b66c3321d52e1fc9d
SHA15ccf91363c7b7df99eb4a1267788b2a0930d5df9
SHA256d4316d08ecdc06c004c9a696b040f299110c3c9f88403ef385ceff4fe52c5044
SHA512830c4d3fc75450dfaae7edb691b2e365e7fa0417bebe4269d19104895c4c8e81d6dfecf4a6f76813aa9dc25aadf4e54d9fe480c4c9c3756b722385f00cdbc506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586acb8ab616be4d9fa1f87c723f416a2
SHA18e71d358604209319e395ed104adcb5186b82a0f
SHA25681f13dce74adaffff3c33b18d43fb99e0f961380355d523b9e6b1807738e51c9
SHA5122a233b3147733e51fe7eed838a51423b702edf1d49bf9dda489d125595a85990ac8e4ef4ab6b2d866133ca9713952da7b28ba09040168afd3d92f900700b7cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da1e14add6dcf109835b18d52e7d2f64
SHA1bee97f0bbeaec7dddc0561d492cf0952baa3de31
SHA256242304429ba131d79bdfbd85b96528293ae92dcadc4f8931349bceb34933b6bf
SHA5120122a51d5441ce9040f98b78c3b5ee352d624a203823d0b0db9342834187bae7af48159cf05643b14a86cb8fc32823f67f4c9791ef14cdd5565317705ff68916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73e03855b53a758999b157bf83d95e3
SHA174eebeab55b149a9ca905fa61c75c7905e26f1dc
SHA2567f0286008a5dd3d97e2e06689c38872029ec9ebd0a1467a79d4bd396015bfd0b
SHA512c0a1aab211756f6a5031b2c00a115f61dfa6e393c7a9f336addc28d73a8e1783546646290384c40ccad9c360eb65f392cb321afd111e619d3bc4aae0fc164c62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3dae4768822a9135266ec6cedb09137
SHA1438ce588f9c58a6283e831088a08d29e3a6e3015
SHA2569ecfd4db1c69d0dcb5f03463ad31ecef13d8b69e59acf5c6b70ae85ec50b49bb
SHA512de376b4e88d9fc5255a51895b758a98ba2243c584b932da1c1af7b13bfe3eed71f107069fdedfc629ffccbffb51d6d19efc76362455d8de7cb5003d6fd0133c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003a47c6b7889a657ff7b0ccf11913f5
SHA13391315da0400f5b8852ca040115e3fbb2f0f20d
SHA2568ac0e8eabd444355c113108c799b0f5815528ac55327a22723f74bc60964d493
SHA512aedb2034365f2aba31b58f171f875a3b435d69506cedc56f4388b2a773b184bd42c925850792a084129ebd981c728a0a74265eb956785151c6232bcea8df80e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5023c425a281bd671d30d07233ce8fdbf
SHA1f4f7dd15e2ff130951eb5e19b5a08586d5671dd1
SHA256eda733b5d22ca3450a93468a3b3ee4cae2afbf14b53c3d09ff33fa7d1622cc9b
SHA512e6b35ff8460ffc448791d4861fffd0be02405bf645d11879c9d158056d3c3485e6e252d1aede3d7a392916fea5cffb99e87a24f6dd84566cb0edce4f376c3d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee1f49960cb56e98202354cd15fa0ac4
SHA11eafa7c8513c313fbd4b84b50ac911cc1ca41b5b
SHA25615be8897f0404febf847768af3e026323861c4eb0e3b472e378b7036a00d19bc
SHA5124eb584954915c772a26589620bab552441c6ca7747bac06d03ea56a07dac1dd8edc5a8ab5abf2d0a23c0d12c6d8bdd6fd3e943a6a8a33eb3588357054f8a9cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a301206d7e2077957e15812df43f57d5
SHA1ce25afc5e48b21d14c71902b13210f521f4942de
SHA2563abf4f3a3b81b76a72dc76e6fa964d95ca46972810639ab151538375587ddab0
SHA5128a85d17336d55816bba6e1057dd1b25fe67833155a0a725e9c13ad183dafba15585a94061fb0d0719d86e7de53d315199fef37b00ddd0eee1d4f8a681004c362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5676691795a30ae0d373b312258276bcb
SHA10331e62d2bfc06c01c294651fb9796305bf95538
SHA25687cc547f1a6b60f5159f2e63b2522a90ad0019223e3bb05bc420f24cba2dba19
SHA5126ef8fd5b8394ef43eacbfca4ef892bf1019782589cde5d63299ce9024bb6d1c048f7525150ce38c7b4efa0c0b258241d5d30efbff95b57dfd5c33df03aaa6986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3b8c3e58f900bb2a11162e63b575227
SHA1e966d3a1c758ddb4d8f8bd9dda68eb76bf928e80
SHA2566bd06a611180014089496a1034a45f83169bee0364356bde121e0bee841f4b0b
SHA5121c0d86702d9403d3167200287ba91d7122751971aefca72ba159aa31df78ab41af03dde140ef8036a5f17218d4708598f6d73a0ebe787448eae3fcc2c8393579
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9bb338f8636a460f8620d8124f6bc00
SHA1f12af07b0872a343137fa5d4924d97e6de379c0a
SHA256ca0e90de7f79f91522dc1c4989f8e5eb08b01b888f65613a06934a540fa4451d
SHA5122d967bf1964ecce518f8673a1b8a0f2a4a1cc2ca9bd82919127a00876e02c48cc242d029dded95453b532cfd659df4a74424241f36ea2d11b0115bc8c1f4d8a6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a