Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 08:19
Static task
static1
Behavioral task
behavioral1
Sample
2e3117ad3a3c5c9c8436d6598d81c3e6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2e3117ad3a3c5c9c8436d6598d81c3e6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2e3117ad3a3c5c9c8436d6598d81c3e6_JaffaCakes118.html
-
Size
222KB
-
MD5
2e3117ad3a3c5c9c8436d6598d81c3e6
-
SHA1
f84f89e544c487dbdd5bbecc8bffb384e2b31fd3
-
SHA256
1ca5eb4f0b40ee7a4bd47e024ab24a0343e6273d52d2d20ff5830a4b09685e16
-
SHA512
5eb4449c5f6b88d5e3aea8facf819c74ca682dd2aaddfffee219240288094cfbfb6e92c0739ca7da1e636c2ddc22ecee6a01c86e38da58ee725ee4223006339f
-
SSDEEP
6144:daU4kvefyBsILAehBShqjJ2w8IIQrQAPFTAUaiRkggoqFD2WvUmelx5OPpcC+lNt:b4kGfyBsILAehBShqjJ2w8IICQAPFsZg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000033e57f1a855a8b162d93ef43f3567b0802c96903288df86997ec9f0ba69fafcb000000000e80000000020000200000008b66709af20eff88494a6cbbd4f1a7422b8ee6b98a3d4759ede0bd53bc43e3ec90000000698b434121bd0ecb083e876a1b0934e4d3faa67942f788b10cf81c059d8578f50cdfa9e7c53b02f60a08fe2370426949aad52dc54b68bc5c14be3296299ff77643075fe235a921d263229e2c1d2bb78f7dd0d4709e860e2e7349a71c6f140554f521e321968ada392067890d445aac588adc4037ae91044ac6b3e748341ccd7a936f79a15270f164facd5162bf0c77f140000000e8d06c9982e3565233e064195ca283d3bf01f7db768b8686d43d1de123604dac38129ee72a7d2cb2fefe9c8e355df336c3a75ccf2601b8aceddd4e35101b041a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{063A2A91-0EA6-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421491037" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f0c6dab2a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003dd4961d7c47c74b5ed60d284ba5068511c52d1090b4933c45d3c740a7d5f181000000000e800000000200002000000069fe6d8fef2c4eda255859c734a43d0508dd216e9b791fec17b88a6afa09b8d720000000f1f3f5bf145424ff93f26577712a7bda9fa3c263142837eab25e0555f3fce3d240000000bf47a13c592597883d7cf48074c8f35652f506b06be316102710f44a7db3053e9a2d44091b61ce2db25bf8f5d651d6b15426b44227cae79d7c82014dbdad008d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2612 2116 iexplore.exe 29 PID 2116 wrote to memory of 2612 2116 iexplore.exe 29 PID 2116 wrote to memory of 2612 2116 iexplore.exe 29 PID 2116 wrote to memory of 2612 2116 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e3117ad3a3c5c9c8436d6598d81c3e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c4cc7c8f2c34cf2bb15cab2d1ee46e1
SHA1bde3a4cc0a95d1d059cbb8ddbacd5a52894d06dd
SHA256e4c01684f493e2022f4ec6398c67ee84c46104500082dcd06e77f6ccb21c2f70
SHA51276eeb5a7e4e9ea4d75370fca67dd3a36cbfb88015fd1d2a971a42e24c5270cd1a8b55ee2cb79f83153bc0291da8bba24970ea46b93a3da089012c5dd513e526d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543e4a4dd184654fc76d85dd5a41abcdc
SHA1bd3a87bb1c0af8f8475f617f83beafd728c37782
SHA25654849d7bd6b370fd5cbbd734510c68b4ee654cb6a47e07a168c3bda9d8d95ed5
SHA512e6edf3e370fead3f475fc350a78205536bdcd6d4f208450a8ae75fbf24bb871eee4baad291de0a8474dd57676eb6bd9d96acf773219e68bb2f673b04186ee144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5612c07b5c77587a796217ca7de223781
SHA1f6bcf30590e6266b2adf3903e4126ab139658f6c
SHA256a07794cef29fcb5e06dbf070ddd2899ccac92ff2f29ce20e1d4fb9153cccf9c4
SHA5126833a200bc7591aea376b18fa6a5e35fa2988c60a88a2040783e868d057a8b03ee1aa449fc4e9ca01b55da72467beaebe8fbf4099137d26dc48f960cd009c41f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502bd6b378fd44e29c93dfe4a1d717980
SHA18650f00806d8b37f80e2c4694d779da5856b8df8
SHA2563bb32100310fd8fa4499ab9e20aa1b65bb02eb24d87d0fe318b8adc723987046
SHA5129124170d7612d280034f4503f3f6eb9429a8124dee531cf8131e9e153612943b0ed669f50f5325e31ece9910be1bcc21076ba83b5b91ae40de3c7c06db459653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be10a9e4dd3dedd53246098c2df613bf
SHA16a99f1e7209e6f830e405bd810bfff077e448be6
SHA256054f1290a0771316a0f6c80618b2b5ef3123e67d3fc41285df1043f3629e355f
SHA5128a37034bf522e1673055c430a0074f5e2401504bb38428054b33ed9d40222e495a239883411ed49698c12d9f9d9c3106243f0fd4ff61b7b39b6f1a1fa0f3105a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577a51692b53ed13405c20bc8a943c3c3
SHA128592cf7f9c8f9d4b1fc46c41043b04413075b8c
SHA2563d82683c16d94384805eb45a8a2f9ffb69f61ee0a12f4566d2530e447f5d8f00
SHA5124721b1ddf33a7c7ea9cd688a82b2133c8fda351a8d01c27df3f61155de4909483152eec662d88f75d08bdae216c36a43d4477daba3d1f591236c02159fd90b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a07c0aff65ebad332b87a121541bb89
SHA1e84d5cf405cf29380bb447508b6c8a8944ec2c31
SHA256c8f6cf1637518f9970a76b2775a54ba72df99b78ea4c2ab4176c16e9f37e3770
SHA512ba612b87c62e7c197c1ac0792a0874cf620ebf01259c05fb325a05eaa222f39b982663888bdf9890f74c9dcacdd342954e5da61b9de93a1ae3de9015209b761b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb3f5c26a8acd5287f64cd9ea2291e5c
SHA1110811441c7a60178b2a3e4a33d4e6b3cd22f920
SHA2568b355734f3ace35b6f0d8949c1f69a1761c45577408fbb8c4861f0fbba565e9d
SHA5120c6162514e8af5e5f3fca280e36dc8faab0501fb9fb3f8c0b2fa15c75a5cc67dbbe309c9e28415c50dd5cd187e903993c2b95d3c3a4854a375820828d78f9d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574e022e341140ec1b0a95c6806df1955
SHA10bc9a823e42e8a024cb8bdb6ec83c518e0dd346f
SHA256d8b8b58248ba4548410e204808521ca66f5170a0603d634cb1d4f043b2b6db54
SHA5124ef896f9b4e542da3be0db9b81804e7cbd1066d6dd2a5d73509e2d2ae2b6dfa2d663b3db5b983f0b3013381dbd0eb5e72b8a06c581ca1f4b99695454763ded33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f67800f8c4fb0d24160ae8119df750d6
SHA127bdb6a397321c64540eab4417ca8280405f5870
SHA25630e0ca41f2d78182fa0a61d99a85cff16a732c52f7c07df3217f776990448c65
SHA512a487528d05e7a0b95d6ce5962b42069a2c6779065a5781fcf272946f4728344fbd8276a94aea6837bb583be4cb108ca66deec612141d62d8f7d1ef7fa6c931d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dfdf0cd04288c6253cab7c12e5bcbbf
SHA1f51295f153f79dd45ebde153d2c386159ceca644
SHA2563b36d006eed0f6395902c544429bed5ec6176b5b585bd88e15713aa2365fe852
SHA512c3daaedfa5098e89811f39a8d1d3386c2b5ccac18f6251149d44489564bebb58e22babd49a86f56c02d8c1d32878f7d27dbdab1b929c7ea190513975525a068d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51508bb2e398e1228844da7d1e23cc9b7
SHA18f0de0bdf2643209e10c4213510c1e711b6ce24b
SHA2561807fcfe70e8a6360e2f627b95932384b4beaf26342411cd5377f7cd58313eb8
SHA51285e6c3bbc8a8f12b1eeac7b0307f8f9ba7f1f2d85d571b58f13028e5180c773b13145ffef6b315f596805d3c34530544e31e6e55b002bbf749008987f9abcec4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb84abf6338501e9e004ef6e004da005
SHA12204248043e839f9789a6469e9a6ddcf4a833319
SHA256d69d2b3fd47006bde0b8803a563b7d5d6f1fcb402ee2f6dd64cba253310dc61e
SHA51283a4bdd17e33482e288e2beb148a5a1dd761843084820cdaf8a9d093249620f0e87b264129310e01ccd2d85d375b838af30eb85b83e4a21aaedc31cfd3e696b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570ac0f07b98b081797a17e26318100f6
SHA1dc0dcda629ed39be49952fa70434e6539b3243bf
SHA256a1dfd1e56c50c6533c00de1da851d4cf557e678879f6536d00b1bae563295de8
SHA51212f845545c195a719fb2e76575d28bc818cf19be91e18e88789ddd754617a430975849b2d077659ab7dfd5957d3ecbc15d032f477aaa0dae6cacb5294b4d7e16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1a2710afdb499c919953834f913f476
SHA15695ef56cb35ff14a3e9ef9481bc3aae6708d3a3
SHA256bf3c4dc60ecbefa70f32a88efb0ace8db11c3f578c2fe3beac3bea95800fcea6
SHA5129afce49b0470b5289d0b0a05d734a2e8d2ece38d654778167c820d736c4f3c1a334f9807ceedebe2544118526608150784a2f9ebe279750fc5c2eab3df05bb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aed32f8dc44b1409370190b311feaa03
SHA1a72bfcacdc50539f5b360cb122b520bbeb3bc0bb
SHA2567f65eeab5eaeae8521aa4483958337fb9452bbbb4dfe27a10a51bfb90945f7f4
SHA51284e3aa2496caf5d931a9c03030efc7bb47392ddaa9b5bb7142c6bd4ba6ef6fa8a0d06bc47a3b1b7c57167a15a1f388fb0f7b567ce4afc6b50754da47d85edcff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c52a84d45989d7799a26813978638b6
SHA19c69ed078ba735f14d629b996513186bb6987138
SHA25666b574f82a0f87c8cf6cdc087e48443a85a31a3e41d8fe5fbdd508ffad4862f4
SHA5126aaa762a849afa3e52bfa381e419fe0df72a9060bcf83f1cc2ed0a4f62694c281ec48cfec291f169d2cd2f6bed2506460cb1147abb48f360954194ee2571f9f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58800d230dbd3341c978e50501a706034
SHA1aa7a44ea292984937015865f30748515f0e6e252
SHA25655a7ffed99323e42af5ab0f1e3dfc4e0b53fc096000898520ce841665c88d5cc
SHA512a0ec0782ed4fe458da96253b213e130784a1bbe7cbeccd7c9c793a8c48df6da2b75354d31e2d816604464030070bbf3032790f51904526ca560555e5f58e5223
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a