Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 12:16
Static task
static1
Behavioral task
behavioral1
Sample
2f0c9135afdcbc0d72029710b7df4311_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2f0c9135afdcbc0d72029710b7df4311_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2f0c9135afdcbc0d72029710b7df4311_JaffaCakes118.html
-
Size
4KB
-
MD5
2f0c9135afdcbc0d72029710b7df4311
-
SHA1
4a8f29f0f819a3f35c884c380eec7c1a3929a7ff
-
SHA256
e1c548f27f2e672633c42f8eb68e3df7fa2d6ef3bcc8879f81db8f36a6b7f7f4
-
SHA512
c87ca0fd73d1401c1d03b0b04bb7b46d489eddf01d2e801cff348b2a5ebf9152fc4a2efe3e0666662631af44d5bd2196776ea12748f332a3c808df5e09a6a432
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oTlYd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421505270" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{292EB3B1-0EC7-11EF-910D-CE7E212FECBD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a016c1fdd3a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027606f6d617734469c9a02e79b7d5f740000000002000000000010660000000100002000000008b2e7aec6c982e1563ebbcb0a73b96d534f1d68fb8a4cb0afd59c24ad472f9a000000000e80000000020000200000001fc0b2b9027aab34ee942dc65760bad69e54e2da232a4fee4f7c6b48ce7b671220000000f6dd113e26839f7ad9d9f9e49209d0c5f38b2d2682ac0e72b918966fce14df43400000004c4ccb7374cfb4cafa5f35468fd7c5c4452d0093173c5f141c50b25d5fcb52a83c93bbcb9ce5f9c6f2a5d3b3cf8678e19e2810345e7c7b6b501648da7a3910ba iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027606f6d617734469c9a02e79b7d5f74000000000200000000001066000000010000200000006f72f251a389a1eef4ea5c2b6513092cb3ea2d0b5edfbf2ee135d97f83562c6b000000000e8000000002000020000000e46c67ced045d12b8e5a07f9d248b666e0d1d28c9f92657383f64b490268247c9000000021038b1ebdf54faa014dd5251624ffef03ea65ee099bcacb96b523e3ce9e64fc76ef81ffe3928d0755c435f87261147ae848fc5ff2edc0cbc68ceef8480814d855cca80e1755117d1b3620c5f49fdfcbefde97ae8ac3a4c31dc5812ce533c911853279aeb6c88f253b0b3b0369e7e87c92d485ba51cc5ac68df3a46e4295a98af5233975f6bc0de1358a91d48cf2afe940000000acd2fbe2de91a43d8cfa27bec5a8ffbe34ca4a13cb8391739bccc35afbb273668a8004ac0896ad1f95864f41683e42b97a15c4622f7e46e51e94c46e66bea45e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2388 2244 iexplore.exe 28 PID 2244 wrote to memory of 2388 2244 iexplore.exe 28 PID 2244 wrote to memory of 2388 2244 iexplore.exe 28 PID 2244 wrote to memory of 2388 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f0c9135afdcbc0d72029710b7df4311_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d4e0d52e5d7f4a0b2de8bd3df58991c7
SHA150ad10790bd1cad0e6a8e57ecab5c5996c3569df
SHA256bcc8e4c52e8bb53bf2ea5f97326f4f4c75e118a8671374405fe8ea85a958d6ad
SHA5122abcfd4638b4d253cb38285a001dc6443661a4100a16031ed0c20bce6b37f043f084ccae3895134a1453adc2636a1c7a42ab2ab1d8802d8e8dc1019549cd3523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daffa6625901d94818992f736ada4a2e
SHA1b78d868c29f6097941759b150f7e64f42aab537a
SHA25662073f4fa74d2ae8b05835e1c489deca1f9241187c34715d96f707c0316b08f8
SHA5126ccd75229353dc5056f7f2f8b31578616a247688196006400c16035e08301975b7553d6dab96095cb3d161ce515a4c52a47c27f088928d7ca2c381637b765b4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57df44c4531cea7b22f404dd5bb1613e1
SHA1d4cbeef8937b8ca58ec347388b6cd880f3089747
SHA2565d38d95ab88e7168a85e3af727408bba34446bca61c3fce247a2dc06dc4b25d3
SHA5121ddbf572f99eb958da991c38c81db6c349c280b516dad4c130185a9a84225fd972a4f4b134af7ccf545db067609b6b624ba29aecc3c5f716e20010d4efe99950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564696e4db6d074ce88470fbdf550dd85
SHA14649400b1bbcd5106755afc2a3e2accb36c11501
SHA256f3d185dc5b010792ce44deb4db06bb4d223c528ef2cc5bf844a3bb88d5fed38c
SHA512c7481d181285bb473ef262f31840923aac4e71164db785cc10b0e82e1a34cf83bd8a1e8fe0c09d60ee03b9346049c227a9cd93b838e9c1a2640ca0c8949be43f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52693235d24ab6f09b3ac0a0c6dba80ec
SHA132fa3468bd1b31fdb3f48924acd019cc5caf52f1
SHA25642d76cb0d64c8a8dd0fc724d6f763e7c964d04fdd684815976f6fe57a52d65cc
SHA512be423779cd29efcc0d462fa8f7fc514551c4550ed247a3d45dc5485d71a32c60a50471c7ef802fdaceafb13d3c1a0220e1683b0d2adf991d0ec2791ac0e7d0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2a1c155fc1b2c87fe35b35b29874f30
SHA127d187371f7e7977829dac9825da85a29ed49dc1
SHA256d3df1c9166b0d38b0daef2dbaee3044216665935f964e9ce5040052ceee6e67d
SHA512c1fa95ff063e895b834b8e5a295e9f581bb43adb61b8024054fb57f887428cff0e9ac60a6e988dc6a6cf49ffd5db1f50a2ff488d2d332b944c35ad92a49ee758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ce7b7181febbdc580410df94d5aabe7
SHA119a6f7cfd5086b0ceeb1ca4b6df8681b2004f8fc
SHA2562cdffb29614ef029fd91457892047f6e4b679bc067f2f1df54356ec626d44979
SHA512ecade018d93afa06898aa886352d080c11fea839d380dd43c0523612a46799e9a89fcfc5c0d3852d8a5200497be4bf6a5d0c8eed933f15a9689988b679702061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5797c2750e46d72a2c66001fa3e4d2ad0
SHA195d0ef97fabf937029e8f2e31c73854c702095c0
SHA256e6bfb352f06f84332515b6cd1cf63c46ab48d38822dc5732f9360653d76cf37d
SHA512d2c2b0f44df507f307645efae38cc02b93e768b3d4359e5fee3b8185fa324c8bbadfcfaacc44aa360080234c83c299929e1c49b87e857a4f4c0b3aa7451e398c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e3d32661c1428e9da69dc5672458b95
SHA1b7ad28ca7727fdf1f49d68eea0492159f306b143
SHA256bab53f2773b560bd99a7f705e7a144a90c12d2a776752710526d5c544ff02920
SHA51206fc22d3656e1db7099ee7098e9ccdb7b24940d83074fbcf4583d5bc01ecdefb77aec5afd73c7a409ade484985d23420268cac6ace2aaaa61f1b3eb1dc394191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ba74d3b840bd52f592f4cdf7fa599f8
SHA14a6d865b988a7d37849dad47423ee8bede02fbd5
SHA256575c3caa1a636af6d0f5e2fe83d0c806d04a075b195bea5c509411e785af921f
SHA512972249dfb1d78bd2e2520a556207ff4b538087201b2dac0fec1d24efae39dff3422d65cd942a8ba83580f4e50f48413ec75836af3a6e46e12d8b32882bb8bc1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506d385a9b363308eb6163d15970071f1
SHA1ff2a4b3afd7f84e5cdd78534cf80a14bc2e26b22
SHA256892195c309194ad3f582a61814dd2ca04fcb91e12e792b559fb36e9f67c0c84d
SHA512adce26d70957a5adda43b0dc68935bd0bf2cd7070d6577c9401549baa46f01eec98116429127d542cd788d9d8388295f027856e9eb3a7272468c033d1020f877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6d9e8df5919703707d6c5477b34aaa9
SHA1c649ba7792aebf48e54f34b69cc94f6dcbe489ac
SHA256bd76aa780a2102dbc946b17a375d62775bb1ebc80df0a9d32d41e371a801ee01
SHA512c54701e0a467f69bb85ea97a7976e1f4440e2da45d45ac29f9b06b6acaf83c5de6d7672b577fb8671cabdd4538c86a2b4f3c7b67f6453119083521d454016111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59a36b55953e6975610ad281839fa606e
SHA1c6e0bec750cd3f6e490bd940ecff753d5e97556c
SHA256f281cc6ab7f0706df2428e7effca1fb11b6fc8e09a375338a7d8a3391b780109
SHA512e9db1fa34490f541d6b1338144d456fbb9ca9446812150f3d53acc9bc40087bca268b7842366fae503e3ff6fa731be9056ff37372f3c449bde3853a78b418fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a