Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 03:04
Static task
static1
Behavioral task
behavioral1
Sample
2d076aa742e40b8a246b74f55cdcab8b_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2d076aa742e40b8a246b74f55cdcab8b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2d076aa742e40b8a246b74f55cdcab8b_JaffaCakes118.html
-
Size
68KB
-
MD5
2d076aa742e40b8a246b74f55cdcab8b
-
SHA1
3c038a75f207eae98725ce981bd964235c3378fe
-
SHA256
8ebd64cc7a35c5497cf489ce29c07ecca1a67430f2a4b040861e74b89034b48f
-
SHA512
edba4b65d7f01b9faa4e4393cb72229011e3027b54e01eaf2b4d8fd45d802cc195bfe0ef67417ac4e9f0ead3d8b81323763c7f9983926f74b5c577b93aa3e33d
-
SSDEEP
768:Jix3gcMiR3sI2PDDnX0g614yLEZ4oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:J6QELi1TcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08b3acb86a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6A11431-0E79-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001df811b23ca98e1ce673a5a47e35d637e19cae6e7cb76919d94d4be293932f51000000000e800000000200002000000003f63853d3abdd12cd8ea214eaa62d149e3eeddcf38d3eda94031b738421fe8990000000755448dd6bf2611bff0aa5643b4a21e1ba6b70a0acc3c6cee513b016beabbe50c75217101716dd2cd22ce6bcdc7c13c229a39f7ebd164cc3cad663a90b908e8a72a98ba3fe4d11934fde59210625dc6423d4d0affce75cb6dd3cd49b73784d14eaf2296b3635fecec106e79c11e8f9c94d187735d8176adae05d0c111897d3affbdf56463dd95843f25d0fd49cc3ea0d400000002866bcf4efbda9976d82c103966965e28606b30fdb210ceb3530b2977306ae3d6eeca1836367632ce72086241cc91cd7e5debb4095b82a2318863f95f227e304 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421472113" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d988548e2f2a8704014db95464bdf0ef8852401f365a5659e1374dda38d5c770000000000e80000000020000200000002aa1fa979cdad042d257137fb45d4509118773972df5d64692eecd5851db04ac20000000a7917e6a38395376167c4b547c5b7a644a79d7192c609bc4e07d40c76bbb2f9b400000009f7c78a55fae024c5ee5f1b596b47b6192a23bcae9e2bb4511da5129fda2cd59ccd456093fd79a2fd130ced4687af4328b4b1418084071b89a29ae7489cbab53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d076aa742e40b8a246b74f55cdcab8b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c1d536016feba9e84711c8195d9c4fd
SHA1e371e741c2f815b2643451fc492c9a137003a323
SHA256b8898ebc05abe0e2ac16b1200b3ec7d2c798e5feec732023d2b550c923a5e89b
SHA512bff3bc817199b3d62725a36b24568907bd81970e18bd4a565f3f528c8b0d29e5b0f828a5080d2089f2f6ae60e77269cda0a49330a9f23e66456c40b3b6e53153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9409632e432679b0b183ef9c5a48d38
SHA15b65cb5d98fdd4e8498bb6b8671f24361c38b239
SHA256f57bdf7ab6684b2914a19b22a2052b2a33b2778818b93fd603b5976a22c02c39
SHA5122fa215b667bd43d69f4c16893fcd7cc7dd5ef9751c2154db2907fdd3e25c77bec846bede30f251d59da7179581a55c7842b76a43e436b9d9ff706118ef1c19c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3411a491dff47da64e3bab4d93b486f
SHA1948def7903bce6e49fc0fd4d36e5e542edb6cafc
SHA256a17c5b4ea435267623469da86e98635343750817d25c583967ff7219ad6c1c1c
SHA512392649f511d2b4e97c7057fb3bf14bfb26944c75f9846b627d5b4bdbc9b8e3442f32ca202f59b17ddaba1c61700d7f8c105ea5d9573b47b2fb68178f2a7e5f5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef40ab93b8be0cb45264bfb3351a4128
SHA15c1f3b3d029cc3a9d0aa3fdb1c664088f1f31d89
SHA2567de2b422c75da418be384726095cf304dbcd17f52d12ac1c2507c8b5da70230f
SHA51277b51111184cf1fbd1665925f743159480c966b55b9571cc1d805f71fc908743350b7025ad39919180d1010af1134d9f03106ca7d50d5d3559457108b6d6f2ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5863036e77c1cff3587a36611a5f770f7
SHA1af837422402669bdec5f5980eac95170e49e3631
SHA256200404f8477e672a3769a5dc2bfd0bde39681b8f7de3c6ce47121721b51410ba
SHA5120236d1ed20495b2c0c6ddcda4ea14fdc80952c05a450f20b1ef4ed865f2d7893e9cebee25aaf7adcd6c099c424b5632f14cd9c845acd279ebdc490d2da6289b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501bba556c39df14618707b8e722ccc50
SHA16d47e717435f25cb48ebea0b6e4bc1d76a5faf87
SHA256b7372bec9f0c4fa5fc01b341f14e9ee1a6dc4eda7c1dab2eb0f31c5e2d3e7b51
SHA512f13ccc8a2263c5c636ad5c751eec1e4568c0fc2d219e26a77b3a23d22119a229de0e744883295ca47c5ec04c2963e317fe0dedca24bdcfae664425cf7f992b7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970b9264d19b22519cd29a4a64b9006c
SHA1d847a24210bb8243577f11c820f621244ca84bd8
SHA256bfd352579fc169b8cdb6520298274ff613c0f02e892a48868d9c981d9a0b2c0c
SHA512dec8e948b62bcca91e842b076179d871a88c6a7b87bd4488c08acb35ed990f9ba889c2e4eb3df44fd76786cc7e2348ebaf055d2a9b45e1f5a45059b622ea8994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1edd8e7dff9eb5f3a104f001368967d
SHA1e26bb12a05297eb72fcf09d3910916ac9b8fc8d6
SHA256b7d2c32113553551e5507268fc67f533bed456f3c7f0f8e177c1f88f5d39ee10
SHA512307f035cee5ac508206febd79952c715dc19814045be8b0ab9d02a3974d748ed91bfb7c68251421e115abd00a2aef8059c52031ac4185d50ad13de2e9dd9e886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ca04d34d9dcd55360c90b9061a2447c
SHA1751b2cb867a780257763e016c6e1d6f9eeaf8b17
SHA2569159aec427bc511511ea11c652ce3410b60e66f63ccebbaba441ed30a8e2ba21
SHA51286689b965526f824ab4a4f52948dda07646f9a985deb37a9b18080aa4d63970694a557069168bc6a4156782b178a24cbfc8f117890174651c256a40e479aabf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8391c56b28b9c42003d101c9d91667b
SHA1562d186625ef73236188c2badd947fa43ade3e20
SHA2563807da58ea594d0b4eb9842c429084110e3426b11cc653a93a23c958a505d409
SHA512352e7014955d80df7efce5a0c20394a0055195de04b00eaeb80cde0a5312ccddf0df19fb3742ff4cce04fe55282aafa91b93a72bb576fbb1598f75da22f8f4fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dd7fe4ec7f0a17d54424375b6a79b50
SHA144a83d04ba2479399726586c05710f4bcd9f1f4e
SHA256865e2f2177321b460d57c1d1c496ba8f7555b64bae662f4f51bb87fdb2750e94
SHA51255fa66f17bc2ed1077e2fab4df0acbbd136ca7e637e410e058223b950d850ea06f9f52cadf03186191c5cf6c20882204dfb71908e0805603a3a328ad30a7c555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b16fc8cb2119e1977c4ba13fb81697bf
SHA17b062216ebdf62090642382038352eb2e30e2767
SHA256e91a96c837ffbc7a08e7eb96c9120678fa98d982277bb82a3abd893488fdb661
SHA512ddf65d6ef194273558aa7e856fe3d8d76cc2e5ae6062a3c452f8b66b95dec2170fa9c53cfb13f13aaadc15b3bc4a4219b911f124c76e3b4a839f2b74021364b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fec6fcb768dcae6e836efcd57d931b54
SHA162ee7f5067178a3d3a99c1bdf353246fcc5aa6ab
SHA2560cca0b7139404b269075e8cf7c2e807ca25e64c9e58274a42642c8085d80d8c6
SHA51204b9cf6e209efeb479fb5290bf81ac1267eff0b71045b032d9b60b7b3c9c076510dd00806407c519b3bf353f58fbfb012661d76d4e150e11a323130aee94db5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54805f496416e69df208ea2273bc6c6f7
SHA1fd2496af7bcac9882b5f1c79236f49c13df27a6a
SHA25643a3d81412c804cca09f1582270a75b492bf05d29bb4efe0d658d707be096bb9
SHA51242aa2b82051ac5612e282cd3b7469c42228e8c9497abf68ca446d230dbdd0170cb8ec07e98e9bdbd0121e294d312466027f3459f3051c6b88add0d38707fdc72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c220e8f1c172236b668df2d17311f572
SHA10129bdf6aeb6df9f02be6ed3a578dc0c63d06da6
SHA2565e90f61d513faa6da47d518678aafd0463949a9f2fdc8b9335e555fcaebcd1b7
SHA5127bf499120768a0caa3db98a4210de3e691c5dbc45bf9bdc3c6dc20c24aae14aec44d2c5735bd7131a7995bdc86bb9ae30aca0dfc9b61e53e05365132e7d92ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c501303c077d4cffdb5271f7bc3e392d
SHA193d9fe0a6f6b8c0aaad69af61f2baf64771b1fbb
SHA256ae1cb3ce4e85b1a36315c33ff16df1f6d979877ce00b96e6db4e975edd7faeae
SHA512846c9d55cb2e3c0b98ab784076fb2791dc43c0b4cfc43383a44a9bfbfccca15705f5d38405f22d6ab9c2e3146d2738ebc62aa5b14de8f3ef21b2654252d1dae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a36682e49fcbb2eb92f79c0ff20441ba
SHA1fbdff003e1e33fa0d96eda1a3f0d8de2a5da87fc
SHA2566ae375bd7276270980aa122d4523a15de08bfd33692ba79b52126d98c330ca5a
SHA5127543fc1879a7182d04bcd463cc677c726ad69f6ce863d362cf170f40c086199579ada9738f0fd9c95087e6dea923bee379c7b4bf81838af232359deffb0f4a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cc79162cc6ef77a38e793fb1f085a5e
SHA1954015c8b1c38dc2be7aafbaaef5fb6a01a8a9cf
SHA256cd3130384e9aff4d4766d0c19c6606b2cf58d076f40aed31f53c4e8564e9d586
SHA512f643749eaeade053330e971c76eaa0eb9c5281f47413c2ad37e65c9a5c843badb99dec6deb996f009118db22b118a094ba9e34eee486e08aa9da32898329e279
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a