Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
2d7fbdb3d60cb2699b46fd8d55c233e8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d7fbdb3d60cb2699b46fd8d55c233e8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2d7fbdb3d60cb2699b46fd8d55c233e8_JaffaCakes118.html
-
Size
244KB
-
MD5
2d7fbdb3d60cb2699b46fd8d55c233e8
-
SHA1
caad102edf2696d4ba779422a6223cc790ca7176
-
SHA256
b0fc3dc64f90563b2e27964bc635850d8f64dd95d944020e524cb5f3a7004c01
-
SHA512
4b2b6351ca8d05d339ae10bfd129c60744c3c7aec58f5ef5bcffa66c35319577abbf672e85922f107d5e3164da6289214acfbe1cf6289412519745e890929111
-
SSDEEP
3072:SQc+I7hzYyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:Sf+IlzVsMYod+X3oI+YS1tA8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cd908ad739c2f4f9e2f5e8ed6268b3c9b74bbb00f78d8dc85983caf289340d3f000000000e8000000002000020000000843c11052eb51c84f340f58f4cb8c872defdd4b79ef46d6ce6fe20ccd1cb3e3e20000000f92e3ad987580539a10101c0331a64e06914ec95b35e21c1a8d1856bf156cee140000000d1a865d3931442aa24bad4ff395877f1c5c045440c5e204a9d7d119bac47965bc91bac57b4bd6d9b58eb44b55979e4ccc82fab469fdafcd1dc3702dbbb4c983a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421479425" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006c802e16f62a64589d0f9e93aa826e663844ca117528e6571a32144aaa5daa34000000000e8000000002000020000000ac4f2b33a98ef68c2745451e55e3e59d5f11351f520242feb34bd8567842727090000000b70b13ee39affd993e965507cecbb40b0edce11b9f9a03526e8fb537783cd1581f7f3fc652a4612f0a37625d1ed2ab0ef18e2cde4de7a3287b30a4ed3faecef445eacf00c54a1859e6c32c3bf6001968e13cc238f6580df5793ed91147c936c259ce4e91c1552c018f265878002aa2af99054746d9f76f3a2f5504ab6cc70c6ae0da332dbf372a06e7266e3bb9b5972b400000001977ae7c54d5a663f939f0486652c538a524736ce807b2305188fb85b10f5d06310d4122f7a0af1180955ef86c3b77470225ba0a3f79296dc52cc5df930e6784 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ef92d197a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCEC96F1-0E8A-11EF-AA6D-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3044 2116 iexplore.exe 28 PID 2116 wrote to memory of 3044 2116 iexplore.exe 28 PID 2116 wrote to memory of 3044 2116 iexplore.exe 28 PID 2116 wrote to memory of 3044 2116 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d7fbdb3d60cb2699b46fd8d55c233e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c53b9a4cbced4e03ac9d84e243a0711
SHA13911b4258920e125b40bc2f9dc9beaf3f7a8859a
SHA256499c40b4bd1eba9d07214bde6ba59cd780c5a854d58e240f9a91072b0e1086d5
SHA512ff71862158a6c2d055f0b3e7d97615c631bad63b184c345fd2036a8a6e841a63515bebac7a90c86b32d087a21ac6fd5d9d20372c576a6a550bfd1974e89a06cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bb179d58de7b6b6b9807ee4a6157cbc
SHA1485ef9bb9491e7199cf06bcd32de05057ba58144
SHA2565aee7c09263c8d3f809db8a5002d18fe101ec78a457a3d608a8212b7f4b3d907
SHA512a00396dfc2c211c24457dc0405902050cd9e5c5b2a98072a87f79d316cd32300a11b0dcf039a93e4d926f774785eb9338043ea26d6782844500b53d0aa88bc2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5550e962bc844c20a92a6850963f4fa2d
SHA143d22652dc158206d1094d648e16ec428b8b60f9
SHA256c304ac6e04c9f54e28d26e55a7fa7f78c05bb2ac6336a947c93143b5105e2c52
SHA5126ee365e03c0001866d77548e90a6dbdb6494594299b80eb39573123c22a4952b476f31fbb247c6c7fb8dd342896bc5d15ab286a1c369b6fed190c5171017e875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5591ea7bf036f14ec848e18e6910291a6
SHA179d31ffd76aaf73d6c227bfbd98df5417e817557
SHA2569a3f99805234ef7cb2b085b16d1c1b886c3e8c31c4f318d870e70c6e024ce6d6
SHA512220ebc85f20217461c13a20b10f439672d025955616b538f6dab36b59f90772efa40d97965c4e67ae2cde25e29cc0100b13a7b9303076fa888eb65f25ab966d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e71886f3defc1f1fd266bd7ae66c73bd
SHA13bcf1c5eb19e8839cb1ab423014ba60a9437da13
SHA256a3ca222c9a3760ffab4de0df129374b21614a87fa1360b536064184ac1fab516
SHA51201e44b97e234bdd19efe1aca2426fba5444b0a96a115df687663315cf9040c55f1c2de5074cc0240b62798c0ca7f667f9105e90b36d9b3ce58ae6fcd13fd8bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dbc0a6aa53bdf258fecf27026a866b8
SHA1eeb477b9cda3c7ab4a30bafb2611fb7a28ec0d1c
SHA256d02034b60012d80cd3968328559b3a0f9734309febf0b58c7c87ea3c3a9f4262
SHA5120e13bb1e882281425ad26fb6a50d28dc3d12f75e22491cd49e6f71a47ccd50d9812547475344f76505317cb664429101c7d0a7e3c81199f40abae8a1e9003ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d55861b047f261d2a9c46daa102ee006
SHA12a7d6764f5bf4dd3b7374d6b5570f981f4a70ed0
SHA256dd205647ecfc4f03cd52aeae01288c52e3de3c3072d62333e60b70c238685991
SHA512cc06338788f036b6af1d560390b5c5421779ce5dcaa0ebaa33fc10a808ec1eb63b2ea39aab3bf25076da2e7a2c40b1a2cb1ebb8dae7871f71aafad034f9d4b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56536933f4334d3cfb052783296b70f16
SHA11780c1c31d3dc6b42fd4bd0f101fccae1a49e189
SHA25643892726dd07e231f51be968b231c9ac70de944e0254d2d9663b15a3ea415018
SHA512e75ea94320ccc4e27c4dbd0ce482847e9b6e84789770c474fac26662b4fdc2f05596dc96a5bebf6ec9fe060c07ec9bfe78d7dfe68e2939fadf0769a413f60069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a49403310b92b4e48c38a790f7022a5d
SHA1dcc26908eecb587c5eb76174dabbb0ff4932263d
SHA2565f5f2fc41d92d01fd8b595ac78ef16e32aa20d9e2aebe770202a7834112b569d
SHA512d36cd5058059fea0d6a9de45dd5c7d19fad2fc8e6b6b01186c51f1378abd03c930fba89c610a75f57f58f43c3860db5b663c03be1b0ede071b4e325ae672657b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567f97c3abc016d804d0f4dbb12401a27
SHA17ff3c88b7097ea4e77eef7154d6c85880b3d4733
SHA256cf85a63f58cc6f91dfe9c51b88b55a20f890afbfba844456d6caa05245566e67
SHA51239bf8f15eee72cae54fde5c191ae8c2f1fff00c649e33e5d4b7e0c6cf9282a613852b270dba297ef5a50bd3aeca33b1b7c4e3be978764685e9de5865f3a80b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a395448222ab724be4e7c542949427e4
SHA16b41cf4d41e0d7fa698938bb02bda636537abe47
SHA256aecd3238958e484858a346d6081042bbed2681cb47d052e239ba10ce0becfe23
SHA512e1c473883f6e4a262b2e611146ef9b665e12706b37f84d841a4885d87c7923bcf2367967422b1fe65427556c085be883a0dff6a3242984728dced9fe7c5f5a18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f30a305bc2fe65279874046367ffdce
SHA14ce3f7f21b15824c21d533c8af3698cab5510d47
SHA2564184106a6940b829f62bafaa3034fe4135cce22208642f2d129e15f41f3743be
SHA512cc9271a86178cf876ffd351d2c980d0ef77f90ef77f4c9db6bf16b5eba212873739ccf7b0271412634fceead8e3e2868b61d59d1bb20f96881c2b300e9728dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51798d026dbb935da28fdb30cab4887e6
SHA16b06984b0e57316291a8460465344171c77fda3e
SHA256871ca4f6b0ed42f2a489640b876d80610e2fc0ea7cef7c8a9ea5ea6fe28772ad
SHA512cf8af06ad0a8aceddb4dd3c926e0ed0e9d859cb9844fb8bf16a3abb077d37b04a3bfd60e52b55b7c7a6943575c501b9b73e17002798794a81325c34c22485cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f571c71c65f5c44199e66db07cb70300
SHA1e95296e22dbe224cf770a4262b5566d0e161954b
SHA2565e65fc3de57da46f1bf104d7fcb46de89cac36116c826fa73552beaeb47ed082
SHA51246548cf44ed9fc5cbe0f64a8658fcf6a8d60d0043d5a1d6f6bee65eb5e4d99de0e45ce2c463919f0d1a49d8d45c58218b6c706f9cc20cdb7e2e1ef85b1a6a669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a87c912cd57ddb4d86a31b6bbd1ecb68
SHA183f9cb9361434e5d4dc2ffa1abf76ba713a25514
SHA2562143fcb7d7d0fb929d0b1985dd887a390947e3b2478df2381a41bb5a5629586c
SHA512af6097302845e6719eb72a9d2c8228b2a043821b61bedc2d98448d232e5aacac39902a31293fe4c65a97f0584627f9cb34ed592bffd2c76f6d9f007c8d852d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d29476b8144c604e6d948a442fe62b6
SHA1ed1b2544083550b5a624049226d88c8aa0ce5f0c
SHA2567565b78a460fefb626b3bc46cf0355d6f4da21f999f6d03f9556056e4f0b6e0c
SHA51266ea3db25036c89dce8f0fa7b4eab201f341a197a8b572100bbcc2ce3f001eee0e5c656d4100c7beeedbcb2ac78e9d1287258fa617576d2711848f33df364467
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b976fb61f932604d9d548c7b14f04a35
SHA197130f9537b49e2ce77cfb79366459b9ff2eb430
SHA2563eb7b3ad52ed9f8727bb24326d50b2476f74962d572b2818775de76eccc83d10
SHA512551117c5b0fa518cb2fd172e5d47ca2c750911d84e201cea2a8d044ce4b26597cb0b73a6413951788ecbd2cde9ac271b937c7cfb30c7833729b6342e63ee7a5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522a87f7e275fde20c84b315d2063136d
SHA1434fb3536b3cfac5804e07439ca8448826516adf
SHA25697670306b45dc908a869f2ae51636747160e01d69345144fe96cd4c330171d3d
SHA512e5ad53a9b263ff50eb5c54ed4a4cebeb47b42f089ed67d533401491d11b70a049be248d78fcc5ceb24c6501911e7e750b75c96741b733990c6775a75d624bced
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a