Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 09:41
Static task
static1
Behavioral task
behavioral1
Sample
2e82968d5eff91a669ba0f64245843cb_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2e82968d5eff91a669ba0f64245843cb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2e82968d5eff91a669ba0f64245843cb_JaffaCakes118.html
-
Size
6KB
-
MD5
2e82968d5eff91a669ba0f64245843cb
-
SHA1
33cb97d9eec9d5592f4f22f416c5b0969438a354
-
SHA256
3194544cad4793d1aaa1eb216ad9adfe633794d8df1966b10b975f6961439d94
-
SHA512
0ac1b6c59e2cd9b4097640c1e1cacbae4b4822863f383a7847b7db0da536763741a5e1e90c32dfea0a7463886bf67b16d0202aa3cc07f8708c47a70cd5855884
-
SSDEEP
192:IhUPTNPa2EfcwjbhlhJALVWlF2jIu1T/W3K:EUPY2E7vrKU+rO3K
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000008ef18d8ec5dc27ef397d107c37fb8fa2dfe306f795bbe7f9971a67402f0f90c000000000e8000000002000020000000fc50f274232ba65ef1929383b9a526f4db1bfc4956db244c6fc9e54ccd14689690000000cf569db4fd03bb2d4133180218bf3aff8fe4ac597041d09afdd632937473d2df192492aa668b2c88f78676570a7787e0d22820f69e1c40b4f3e8fce3328fd570722ec5b096cf529d6683405038011cac1972df0559ac1e79256a1559b69352d292e35e0353d3c617d93fd4c6ae5bf5c9269ef694c9afeb4aac4ee2f0f1ebb245012db91c913d7e3feb99032db6d9a28e40000000941a9e110c02ef4a22818d0881b71e6e3ca94689243f302eb70fa949617fd5392dc4de04f66246e971d549cf09ef977688b6c3e5a26dbfaee389fc5ec2d61f6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bae75042fcb6a2c16bf9a409c9fd0fb3ffaead598587fdf0576269f7a6515f78000000000e8000000002000020000000c274e7ea77122e69bb55c63e59cd8eb75a257cf5b3f29d2803124fd0e5c5c0a1200000006709658e92e7b56ffd235d67f6bc49f2944c2a3c266956fcc72e71a7464e28bd40000000ae268f328d285e2d96f1db90e4a00f50df5991a3ab730378248fd9a71780d5f9a43d54b6aa1aeb6b22535934bf382b0072d6a1c3d31eab8222a525f489138f23 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D296D91-0EB1-11EF-8554-DE288D05BF47} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421495962" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f070ba51bea2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2804 2028 iexplore.exe 28 PID 2028 wrote to memory of 2804 2028 iexplore.exe 28 PID 2028 wrote to memory of 2804 2028 iexplore.exe 28 PID 2028 wrote to memory of 2804 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e82968d5eff91a669ba0f64245843cb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb84a4ed5bf5019885640f6de2cebaf1
SHA18e0715e3e314e2468033f3d1a12b017e89179087
SHA25673c6280f5d14ab04158334e2b0118afb01307a4834c205e15e91c302865f5e3e
SHA5124c075cb352044641591e1d948bf8d7cb16ab63743105e36f408fc24e2417bc0b9bdd257853c24abb05c8abda67c5d633005d6a54bc31647a76ff24c5226dbbdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d55db23732869f6723af3b31df5e2f1
SHA17d086aeb3d21d38f9c9b8bff492008661d95f13f
SHA25694706faff48faffc4e9aa204a03528f462520595dbc9ad1f2b21d15159f8db66
SHA512a387f1feae0f939059b5259bf842f886268841e633ca1dc65cfa4140739ec7f8c2726ea0b55a596fe65681e520ef762b74da6485c4900f9c4a27572884a61387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542a9ea70e271f72b868cb0feb4057891
SHA1c903cd1b1cff8a9ce82643b3ca442e98d951836d
SHA256f8ea22565342012ee1fac1532e0cbd70b7925e20c5bda700a511e8f6ab07d261
SHA5128ad393fd9203469fb5124f9e2ab51b833db86b5a22e1815b1eb7be6fedb6be9c80b54452c3fb52aae4ff7cc94028491cdb162c70837fd60a23407ea5a7c522a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3611ebc95ea2946e0c38c268adcf536
SHA1096fb95dee1ed5062b826d7bb3da13555ba59da3
SHA2568d3de71e095156fb7b661662bb80c285aa499696694811349037b047a1d34190
SHA5124b16c86885dc42420d1cd7c59159e9a9f07b806efba97d066ef52719e1962ceab7e7a4ca512be77a67f1c785bdd8123c1a890b772ed97339696e46ef1905488c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5684b25e5846d9697313ef040f42f8c3f
SHA15ab38ce9f1778667950983edc6a9b208a6b42ec0
SHA2567a086e80652a74201e1c2d0700eb954fdfdf1b97732a40a75b0ab0fcfbdb0988
SHA512bdde21fd04daed15b5b706d2c435f28c6a6e65b5807ffda8daa505c2cd7bf1aa2fe0dae7d91693dabbce1306a217cf516ee9bbde876962f5719de52003efb7f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8ba515c50816b7f6bdf3ae04dd5fb6e
SHA198bb487af2e894b5652453f5066668cdeb59cd67
SHA256cf2d38882821fe60ba072e30e3ebb31f906fbe391129fc579e6b5a763cb8c7d3
SHA51208073711399ad30d51e0e09120976bbbda80953ee130e0760889f53c9deb0c9f4d4b570cef3d213ff13e7434734af6a62386604f43e6ed076d407dd9ab216746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fdfb5cc49886f17a54599df70e94214
SHA19569da0cf2683ba7ff37250b499695a495a84c2b
SHA256317594a510009077f4089d53472db3609f33c0d55c40f334f01be9b54235d049
SHA51254cad2a6422f48ec21006ed890cedf8a9ad68b9e7021778935c569efabca1c37ea7ac3581034c9f727711ec4fe4daf08c47d2ca4b7df2f7d2795021983be4a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddc61e35d3d1c7379618844d9b9c7a42
SHA199df7a478bb1b164e3e7864bf0425dd6b5d1c4a7
SHA256c03513b7e03a88d847593486eecbd27493bc4e360a16ab255da1cfab92c64529
SHA512052a7e3769c024f31f51adc455cbc2249ceae6963da20db7abb0ebea0e07bf7add5e2594a5f1b761d0cf12158586094da6b69c98ac7420adb2cd5a0a6d08cbf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de2e1a71b866b6ddd812e0b48a12d682
SHA15367a906a29ee8b24f8a2a3976ca82f155738430
SHA256853cd6afc76ac5019ce3a3b8e634ccf83828ad5e9c823fb822854f8068127ef3
SHA51284ab4b79d8287a1257d8253d518131700d44146f4d797f36b3251df072b76768541a50f0b2b0abc5587f2b0d0f45a338b3738034805631288a93789d54817f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b56e50e0703cf798e7c85783dffbc17
SHA112d3818796f8e954ff1f4738aad8d16ab95288d2
SHA256b1be6ec0643ead9865fe146e0ecc4b9be58ebda6ea47e7571054a0f89228473c
SHA512a79479c2f236a5716f7a1ed8ddffa2f413793c5e7483d5013d085c004df52a27a9cf5d873881dd283bfdc429d60df4b877ed291c6e5fa612b7b24541a1046b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a61a883e366adeb9932479e5a56d33d
SHA101adeb73767cc9564f57d68ba4bc8733a434529e
SHA256f1f23581546fc52a6225063d37dcbdd879c71355bf8625e6643f5f80b7c18015
SHA512be67a14b414be3c9307823e11e0fa1be605f75885483e7149262a9fc34d92b2b912fd1b1e4d428d26139b771b623b06cfcc20653e9529a0a713e244927065482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512a339dd18e1d1b946cca966f6139eb9
SHA1bb490942521bd194c074eddf70e84e6e944c791a
SHA256c4fecd2010b6bab0e31cca3b7ffea9d87cc91c57a8a18924153035aac2378f36
SHA512ff085ab3541deac0fb5ab88d40a944201cdf8e9379b6a9459291fd32ccd54fabb71aa64eeed61a257333a8dbaad00da159aa5a2b905021767305e81237fd451d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed1453fc710bdf1a7d1c697038051639
SHA1f8749094cc26d4738dd7528f0b0d62ad871f1349
SHA2569a3a66aed97cafaa7c40977a7ac4e9b104de70a86507a9348cc99cd787e061ad
SHA5120095b59d04c4c14635b88d73193d9f4fe5d753ce81b7276436a389af01c80a21505d96050c6d042b405eea28ed9ad974fb563652937e4bee1a0df6041384f561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b95395128773f8c979c791491e891ef
SHA1fe1e4427c689134ed992ef97fe149db792f811f8
SHA256d0d9dd9e777fa0956df6ac0eed401d2483403313331bcdb8a32f56f64769ac1c
SHA5122ce56f2c3fe19e1ea1f67e2e403c57e8da0a44442fefefd68257b339fdf7d28faaa8e5908002d11be26259553c138e8ccf94f5c4923f7c3d40a60c703693987a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1872a3b26cf248addc42e40deaccb6
SHA1deaf12a8550317b418ff4581ef96274a1e49388a
SHA256bf099c4e260bd934c7c4b1e8e0dc970f2e52dd9819bd60cb90493e796ff32c2e
SHA512eabe8e0220497476f9d6847acc30dea9e7bb3a9a99450b126b1f3407495acbe8cdf52ddcaef813346e867d7bc77ea2ec61a636ffdbe9b7650e5a8305095805b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0a3ff3271c5278ff800faa0fffea12e
SHA1d3e1e5e0cfd0d12573d6c4e69c96b3586531a1a3
SHA256b315e766f614a4f7cca917477caacb749b92364f6b0219c4e364d55410cc1e9e
SHA5121d09fdb20e81b9e76c8a532fd96ce92689f4737517d402a9c72e1d0c97a14be0bf3e264f5b20125431ba2850a2c820e8ae0a0ccfa8d1d0aded178a8149ac13e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5602fe5a1a7e032540d540842e209de5b
SHA16552f99e4022d621f8d24f2792a89284de98ad73
SHA256cc3ce11dbcade7ada86614b00d885a00661bc841f9f36448bf96950e3a78d6d3
SHA5128a3b8f3b584730d960111ba674f4ea715420f27049ae3c1094b737a24046bacf8ae989e809b1ae01ad2d59f0912a1456ca3414d6293ce2daa1c875196a726828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e17d07875e74dfb0cc457488702972a5
SHA1daa33bd2ae8945ef6e80f44f1a048e6346094a3b
SHA256a4c4df65c9e549bbd612c81b4f82a40b00ec3157b35ab7784e8d843c808b7353
SHA512af3c223b45cd875565f3b76fe2e4c1d040e9a2bae8c27651224cd320dddf8a66321c991e23c153b875cb2f27ec171b8b7bd95ffb92d8194b2858c290f435a0ad
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a