Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html
-
Size
462KB
-
MD5
2cca0aeb5ba8659181ab0f49789b6e63
-
SHA1
cdd5ab5fc3225b95d2892b7cfa379da8fe14a24e
-
SHA256
06e4532a8ef66bf326f869753fac5416f914b98d5fbb57b52b216aff75b0968a
-
SHA512
4d73add621ec4b92d5d8261c43520ee9bcf6569e7d29c1531d7a9f20db4f8b52fb3263815b11426e79d3f23240f59e4687f77a6ff9890941abda0eb990bb175e
-
SSDEEP
6144:SfsMYod+X3oI+YnUsMYod+X3oI+YJsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3s5d+X375d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421468244" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604202cd7da2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F47AC7E1-0E70-11EF-BB01-66D147C423DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e43a55db6ca637ddb836c78ce14bc673b0708dd40289d73b7975fadbd19ec30f000000000e80000000020000200000000ce0a4b84edae0d413ae1e91352333bf0c6e620305e18d9f88f6f1ff5746276490000000e556b5279a1a5dbce68757aa8cc04eeed245079318bbd0148a543b4ec4e9e29ac376e6a523385363a64832e7c008d6a7a5c89cb21d972806fcea5d9f7bfd6f1b0898723945d473cb11eb3f25217117a79f28bb4806c4465ca8224007e97e7820f273557bee19cff71b3d9137851b448c0df3592e4f088eead7be66331a9b1f1f8166dfa5547828e51da7f0509d261072400000007ce8552f8c9d2635bbd076ffd255c0a413ed2adb157df9c00c86be0c9b854338b259ff261527e717fccdc442a9c80ffe2e6cf5ae7d07a835a66b812f3e083b68 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003074071afe8e0368f9d601b97fdb6abb1452b543ed9adcacb1ddf573215cf656000000000e80000000020000200000004b7d4f4b8db7fe14db5dbede1ebba31cd593eb3e999bf1a43ebbd579e7c69ac1200000009be82ceae8f9a583f680a3b68b800fea52d1fcd923977246b4c591d950c6350540000000fe5a68800e880b14829474f6d02124b2a696f013dbb873b07d9b3d61f34a34447caac112e6e2dd1132d068c2351e3c74a0c57335387e2ebe3be9a2819590bc80 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2192 1732 iexplore.exe 28 PID 1732 wrote to memory of 2192 1732 iexplore.exe 28 PID 1732 wrote to memory of 2192 1732 iexplore.exe 28 PID 1732 wrote to memory of 2192 1732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a8536f147463b2ced54dc603a32540b
SHA13719a454ec138149f5a46c6336cfe058817c15d5
SHA2568c1486dacd42dbc0a17474f42f63a5c110929faabc64940fc8189f6c419d7ad4
SHA5127af99b940eb88f2d6e2ef56cba187af04ed16def7354c9042af19555ba523b863cf5c0d44764dc7588c3e48b057af14d34fc310cef1fe92d09498b8e7f98ceaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8142c188bcd3b03f1bd422ea927ebb7
SHA132ecc86d1b98b3b0e158fe6024a7be52e056c9b9
SHA256f7e910eb405da60753f5a83f5578d11cdafcd8c275d0ebe2f3e66b82653430b1
SHA51235379dabf10a60f131370516af285a35a78830ca1ab805e6adc91af37a8d75d1d686bdbb8fbca2c6a0cebc47d76991d1a5057becffdc194e5cfaf78798215bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da827b7658e619308519839e825b431a
SHA10e8817e93146ab50a53af926206c11b0425d16e3
SHA256802825f05d0af28456b8596cba54a88bf932a2ad30377ef87772277fde5fd188
SHA512fec570600e9d1f0e0151aa32767aa069eeed3f5a6c3f8e915901756f3ad756c449ec0415fff1b55cc82f04560f75621c723fb9ebee2a9a65a72207c99ad82f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3e3048ef25aedaad5a4236656d99c88
SHA18993e7c424823c2eab35d10d58862ffc07b97b2b
SHA25646763c1eb94f668eda08ff061d39de45e7a8e82411c2850ecf612eddf1357779
SHA512148184c1bef54649767ab7ab58008dd64337b1ea0f2bc88ddfc9d30996bef542e9a60960b0dc108010dc5159dff36d984ed7e3174197ae1976dc83c27fec2443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520a7af7328d738b8ab6201a014590381
SHA1f3f9f748c02226b7f2f0437e238af183db6ee4b5
SHA256791e86f764e61099dfb8b384e10d4b85d11d05765175381026ab807560e257df
SHA512ea4b931754eb162891803933e9c72a24c742d8ee644c95904da8531e615d6679d32ec32a2534694fdbc467415a970a925874a398fe64e3c7f3f2537c5f1e1dff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc2e42a907500aad9eb25ff091f488a2
SHA1db7915915f95013164a2694b45750936be149965
SHA256b19c785b7dabe7b3dd44fee0b048306d6b3763cc8d8343d499eebcce626c03e9
SHA512875faaeccd0108e835b9af3c976dd96460aba26aef380f8d052081e7409aa5efeb88287e256dc3b336ffd78b92b95583997ed1c521a525a9bd218e012781f8e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584e4df12e28819e877a06a0c437cd85f
SHA160c78572ab287b09130cb89e09abe0aba65f2e25
SHA2563162d9fa9f39680e407ce1023457489f2e864abd7af6e1dd192eb433e38aee87
SHA512dc6fbc7e1848837a9643ac4e87b122cfced470579766a2e89f99e813e6aa89d1ee7f758fece43ba58b1ac76258615f69cbbbf4ea77c4567477b8f112d9d84518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f42d6837e69d455c0ca5060e62bd230c
SHA17a6de465aede676a1d2773cb8c67c0c2e56b8498
SHA256ea8cd36a8a7c34819fba6a1fa5ec33c708a973b6ad5e52e5210905490f94c0e2
SHA512f1266d285dc79a62bd20b1efeaf45779393c7fe2499b5b5a20966c13557c0829517ac0dc680bcf06bf02b4d2749e2b83a8d8b83cb13054cd5cba369da06280ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55896b2f5b5e308748a303bad93f113d4
SHA169750fc6653584528a236e1c1c7ef22aca499437
SHA256dfbc1e7344b51c9a8dedd70db4f82244f007ac0cb901656b09c5b34735434863
SHA512ea79f890dc7a2e3ba028f87307577a6e905051ddc38d671d233c96af045bf8434f9058dface8a2988f2bf3437cf6f9489dbb40b3c91edae4d727640a2feb7d14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac1d5dabd241c69b0322b4aaf3aab0ce
SHA19a8fea5cefacb2ae65ebbae8e2244c84e9d05a99
SHA256d53e6625ea7a410d393ce9defdf557872e1f9c738799da3693988499f0b67a7c
SHA5123486c8facbbdec39260cc3a1740387ca8ae6cb1292f7f265f316bb63244022fa3c48d5890879676c0a9a9cdf3753bf717d3643370061c2ed39283ea455f6fe67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dec4145fa4e91f50d33da23813ab4d6d
SHA19dbde7fbfcfe47fd74c453dd53273a262ae40378
SHA256b77470caeaab8ba76c076b382ca0779db3e280478ba8b89f00cba21cfaee202a
SHA512964f1a27029784fbc079632bd5c1f1cd52ded1ec35a3df94e7adbebbd084d604134f6486e6bfe51ab895ea47df4c47da14db581a751ac6f1538f84c51cf7e50a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4edb8087602e523e25b14e23a5f9f97
SHA19d69fcaf70ffd5a7ab67a8537d50df0c39de863b
SHA256945b9232d18db82fd45b9a160d19d36ac81d0a98d4eebf8246a230b6f8ef6937
SHA512fe7094c1fa3916bf69901998c6ee4a5466c21e59bd99e2963526ab134a3b96977b5a406aaf2774a24492b553daf0b26e97a3019dadb9193c317952c792f49f23
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a