Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 04:36
Static task
static1
Behavioral task
behavioral1
Sample
2d5fd943d5ae065585cc4289f2a1b716_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d5fd943d5ae065585cc4289f2a1b716_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d5fd943d5ae065585cc4289f2a1b716_JaffaCakes118.html
-
Size
72KB
-
MD5
2d5fd943d5ae065585cc4289f2a1b716
-
SHA1
6c5e4958591bfa8cb6bc3a84c20129396d2ef7c1
-
SHA256
9db5030e01042f77954e6987fbed1a6678259c7c25b82fbed3c723085915c1f0
-
SHA512
e2bcda966bc76b7798b4520b6571ab7754358d5d0fda304bbec4a3cb285144a3f6837dd2f83a7fc08efc24106054ff98e6db8aeb78cf3d0999880bbdf590b2a6
-
SSDEEP
768:JiigcMYRdsI+mInDD5BLd0gGezBp8L2SF4rOkroT2jwC2aZZGMdtbBnfBgN8/lbi:JYv8erOkkT42F0tbrga9nhc8nhVW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D58C2201-0E86-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bc1316db31c7aa39b7797b9f7d8f37f4a130e95b9d4132a2e7b2256af44a08f0000000000e8000000002000020000000337d6573b77d65e254c3e223e33b0751718a48fb520109994b0e1fe4c77b6e3a90000000c11d6c1d19c2d5e68eb0ddbcdd8322b64f09d4fd6f9a4d4b9ee05bdaf2f4e1ca625050bd41d5a7ae461ab58c7bd276560584d0ebf9867f1878210abaf6d82ead442b510b00d256c6abeed4c70f86ab6e06b27ec9575157a240a09291bd542b18a9d8e07498fdb26b8983907afd8c6f8892f912124b711558b1ae8f843e80fd3cccf0e8c677bc2ff4bb85b95d67774d2140000000eba53767dda6fd276dff50baf330ee1c4399245dc0543b6987d3d2c78a66940fba1af8fe6996534f747b762941b3b23f2f903a1bd65a6bc5daf1ab7350467b20 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421477641" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09e1baa93a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000032d692d5286bf70affe49e25e33c977f555448f51f909290ec337c246d96f518000000000e80000000020000200000004613e5bee0f0beeccbc58a06daf9a0498331f1ebc5e30f6ec97b2e0236042b512000000015af3beeffb1d4d0e689af4d1d5ba7886bd9225e0ccc17f5405fd1cc6031164140000000af62941f81a2385079992305651ccd64fc71aceb11738f4b7aee617731ed7381fa6eb23adcab4b16ab0dc839aa4828a543dc1436bdb6ae41b6f674a17e162759 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1872 iexplore.exe 1872 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29 PID 1872 wrote to memory of 2612 1872 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d5fd943d5ae065585cc4289f2a1b716_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6a3ef6f27349191acfd888623069036
SHA1c0e9bcd8828e7e27b9d8a6fabe6a600e9c0a061a
SHA25637b82af4f316692eb063e96b8cbf4f754db9937ed68f59810864fa2423cf053e
SHA512642c06ac7773f36c35b2eedbaadd14ddf2e29290e0a30c8d6986ab7e0f81291ad4074b24679c0394e8c9f1c6b6a3852d5e215ab908491048154006f6539b7403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc07193f279f6acfa74863142e43477b
SHA1a8cb2e3827ab53fc799061da86a34069303cb2d6
SHA2562450c7b54413c21da4dd5f4c9c5a9ca07122141f0f1446c0ac1799b572635c85
SHA512555359ff2a32dbb584111c22c0a868890a405046bdd047d64e7dfe68bcb674cb7c4a6106c6d2239308ff61b6a0e841225c2e4b7bcb450b7a81a0a76482cbc323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560140d40bf6f7f9bf224929be01b2c30
SHA14e86c18cbe00dd998c02c20f20c26144690b2754
SHA256fc3c08cbbdd02138c3dd8f39a4dae354910676e0315d69cb4c9273c5d29a3d58
SHA51284cd495060e8dfa7bba1f7d8de75efd1fec4a4ce3e09481a7fa237c1398874587a3766e5d3bf1825078ffee5eb9e5e852acfe7ec277ef8b81fb85d1671811b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fe4e27a45e3b68e6f914e97db59d273
SHA11087c782cef4f15e9116701dfad574ac1dfb9200
SHA25675787003a28bf443c32604a87cfa75d175d5ceac064f98a5fcf9451932e508ca
SHA5126ab2c76030057dda54485d43858d044e183b6a099b9d9e5a4e74d112fb9e699ff6c81b7a6166da061d06cfcfdba66d0bd15ba422473b8397885fa32947f22d2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5891542efdc666e2721f12d4191bdbae5
SHA15a4ad1893901dedef847e666cfd861f1298aec19
SHA256e7820349597a79ac646fe2421181a03d776f7f6ae3f32badd0508539aaa42ef7
SHA512af0a4340005bf252460924076fd31144fee9f7e470d71eb5771bf1d22a7123488b971128e9b6bab051be6dbbbd881366c022ab5de01cc74670b3a7b44965391a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9b3f43a8420ce0cf1c7d9afc7d7fef3
SHA1d4b925a7cd6bcba9efa1487723ed160016d9c3f8
SHA256a96e084fe42f7ed83947a79dd203f67e837c8e0fb3caf365803e1641e72720fc
SHA51234ba1b57dd91d9f1291e25c77d92c5beb5e47eabc80d77a5701466d6d06a1a481f31338002e84955f6124d9a56d0102d625eccedb6c2fae4910a6279d22cbdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fe26be27e74f12fce460d5279e62a38
SHA181914fd241a1c832b894a827580894d8a937a1be
SHA2567ff552be18408400c2ecc27e748cf2aeb893872abf0440ba0cf19b52c039483b
SHA5127455a31be0bdcc6179fbaf6a85721c4704e92b63cd775e6866217333da12f4cb077ebbab23a0273890f21e5cbca603b20791cfb520094c7b04321298fbcbbffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf182ce5e5b9e50ef5c4048c543cf303
SHA15e2de244d8bbc5aac9395397fee724477226d253
SHA256129590181b590aec24e50744b5445b4a41ffd643e207d200ebc52f0c67ae80b7
SHA5127755d795b9f885f90ba6f17b4894066785389cd70a349446274e9d3e08369ed66aad1eb9cf1eb0352739af4a4f0e8bae1276acc341beff52e3b56efbceec0a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da4bfe81d5801b304f44aa079c10a506
SHA1401c7e5650bf5f11ba2ea6ae8c6737a243addad0
SHA256aceb04af725be2cd459fcd90a6dc1b5ac0ad6024774827f537686a8e5f2ffbe3
SHA51287ab4a7bd37898f67ecf6a3d09803df7d857bd6a374b6259ef770808bfd22d1ab0aa46bd6f08fe327af2396c2368ab47a298a2dbdd455bb6f29df21d5497f4d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aa4b0638ea7115e37a3d582bd14d349
SHA1d3c0c76dc03c85ee92384efe742a182c508565c4
SHA256bf0115477b6f1d0e740c4f6587cea8fb92c37044eee5d90fe0da70062509fc24
SHA512552f6322016a93801c3ffc42b1b37c7d94aec941c2e9100338e5360710e9fa77cf5b0a97b8188fc812003b3c90cb5b36f29f6a48d9386c03ffe6afb11b6933ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0ea23241a9823402b53549628282d4c
SHA103acc6c803140edc55d9a9f8d27367c6173da7cc
SHA2565b1e06b111bc9a8f59b12af454fe655df2666d2a4cc0044b5833832f14f47195
SHA51228bfbe7217b20c6d52e1fc14e2748e92840c5db8488a9b48b0301468fc755e5d2013b1db783f7962a5102217ec0d8d236e6a8b33baf92178a2ea877dc65e8b04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564fba2a880443f1c2bb361d83d03b32d
SHA1c61d30308517ba3f4f1cd86e1e2ea9060b7cda3d
SHA256404a119b693a9ee16bee5b2e8c46b2918b5d1e6b96b01cf7ae8c8d487eee3fdd
SHA512b847ee3af000887889c88df29ce12f01e6815c15bcd4f856b9c7ebdd8a83a31fce592271fc3d35a17f03b1168b5495d3fbe099145859b246827f9f10b15a862c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54004e894894141846d4b6f6cdbf66882
SHA10101d87d349af9aa919411b46f3cb20198278332
SHA256b4eda6706c992eac909daea0b5e17042bc5556b994852fb4afd9c7d2d9170969
SHA51282589f371714b7f1df2a4ae7f16a63e11b07a71d776de50bad21f9d3794bf7ef3953380960ee36b8334c44b5f9432b60b6978dcf632266f0950b2c689dc66d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cac03363ba1f3b554cbf55932f672b43
SHA18c55d5147f25c87d240334970034760208b0f400
SHA256d8db2f0be7775dea3e6cee03ec9f8596ac107ab0a97d174631329f3c52087980
SHA512c9514876b07c00a72ba3b9ec80ce0272902d5d48899236321f97f9e858b150b5c7421deafd0a8a48b1a842d95a989acfd8b1f65691d204d767437ba7625e3173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513cae5751db0f448b09d4f5ba9381b22
SHA11d150adf03c98fabfd4b1ed60107f34965e47ac1
SHA2565ce46cae33b96266f389d1665879087c9e874d898fad953549dff51e71e73188
SHA5127f8de15a26dd8a7ee00298efbcd26de2b4986d1ae80d1a5df20f628698962b391fb72b9f33619470d1a0255f57f6be0bc1faa5daf5d39ee3ce9100e8feb0a067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f66e852b3e8c3284c24474a5e8d183d
SHA1b8bf167e35e65188bb193fafe3f259127a41ac84
SHA2565c32e18446f9667a4f71784c455731985008481a8077949133d1cc8adc5c0c07
SHA512d861c7511ecbc857711f37910506ef09d3cff8ea5f879668af9704bffe2ecbf9186f08668e0a8f673af714d1a1471f21e6b7eef6134dbe020cf8fff33965ab56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54da4434066d799ecd525178df5d00d9e
SHA12464cbc4d6e9820a37d20683eafdd1475c7dd005
SHA256a408363b0b34e6d7a7eed24a1a5ddfe3418f070e110e01f8df7a85b33bc9fa39
SHA5121bbb8bf3a9d45b203a496f0c53c46769d103c63b8eb844aa99bc46724aa1f760639796a9b7eaf655462bcb60d2c468c56ee039f9714401148fc06f2b3fa89be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50207f3a0ea3ba507c50ce589f688b21c
SHA17f7a6f34f4d18ce5e746c5c92f759526c5f54ce2
SHA256d52af6688ed0c9895c9a3cb054b26a1b5a6e688f313fcdf7f761e058ec5be913
SHA51297b56e2e95887c90460e66eb543108e4110fe9aca8557305da4c73c396111ebdb604df886ef018f227d58073f19a9c5288612c818922156d2a84aa9baeb5f65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564a921a334fff87c3ac4ca8584c38fb2
SHA1447ece339af6d3b2f6f3123fab90a7d290717816
SHA2563bdea2769fefb55ade14737540b8d8bedc21eeaab0e0befc6062e2bee0162a8b
SHA512ce28329ccaf591ccbba3921122ade3eeba080fb1b09991fa19c97e9cda3dd366063d842fcf32f6fb8712da1563cfc66c2014c1bf657bedc36c53436978460b41
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a