Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
30511c1a5b032a647e4f42b6c1ad5f5d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
30511c1a5b032a647e4f42b6c1ad5f5d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
30511c1a5b032a647e4f42b6c1ad5f5d_JaffaCakes118.html
-
Size
461KB
-
MD5
30511c1a5b032a647e4f42b6c1ad5f5d
-
SHA1
7d5f93930dab9f9ab618956097180ae76a7c183e
-
SHA256
83967534a7c27b3c8cb66c5b6b7dc636d2e474074314bfb81f8a66a466552888
-
SHA512
b3c3d3cbb2237fd6c37c8660c9ad32b157fcf56fe311886244c6f34b4523f174c53250ae87fcaaa4af5ad8351fa1c33ecfe901d873859099088dbd05627ea5de
-
SSDEEP
6144:SpsMYod+X3oI+YHcsMYod+X3oI+YXsMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X385d+X3N5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000552e2bfcccca9d12c2936303243dd48bcc6cdbef20d92554682e1d8373f52412000000000e80000000020000200000009b248d5b1c29a15115631605e647c09214fd6560bcdfe3a696035f63d2d28ea920000000bb7de37b954f59c19703303c9f7a0224716ae1671f70e22a7cb9f4f5a8f7b470400000008f52d293b49f96be75cc28b3c35fdf964ccca1545c9b51053e81038dfb9053567ede55cc1711f005b79c04b56209883f65744b4ef25632ca4ba3a492d7a70c1a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F84E161-0EF6-11EF-9CBB-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03d560803a3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005eba611ea4d583141fc2ced179ed3dc52f0493f8e48c0322a219d60334c099dd000000000e80000000020000200000003f1affc4ff78cee763c60f2b5c68aa8c47d4be83efcca5b38436c64b5ab4c28a900000006c104cbf4613eecdb96b73fa8ba67f99b745c436b1e4933e498ee823275ca8238b62a0052ca9851f2551524b196302be0e1b13f1a08edc89523f00561a07bd68dabed6417cc75090323afb46396ad60da8d44dc5fcd3094531ba680c1f5e870d1d54294a3f589b1e0d9ccdf42e6ec6df118e338e9566b275a39f15b0638e15892abc94f99edc731dd0946f94d257fbdc400000002dc03ab4de755d686d1d930fb609a38443731ea25552bf1e263e89ce7b441a71d4f9221c8c9d5709d9abd96d0c4ce896c8c9b2cd89508de0be1ac70093fbc161 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421525468" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1308 iexplore.exe 1308 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2972 1308 iexplore.exe 28 PID 1308 wrote to memory of 2972 1308 iexplore.exe 28 PID 1308 wrote to memory of 2972 1308 iexplore.exe 28 PID 1308 wrote to memory of 2972 1308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30511c1a5b032a647e4f42b6c1ad5f5d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535670444dc601d2d0626cf323762def0
SHA11fbab4be0ead9d5b002433ff4940ab206958fa56
SHA2563d554cd007b55e6233ccd63ffd39af6f25767e0e826e83b9dfc20787ea51cd2b
SHA5125d2467e1dff13ad3f21d486b9d811a18f011e57b004dd7bbacceb80ce243acc02d765ec6e0aa9c3c9411f504ed036f347e60c6501d99d7d0e0bbb783487fd613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f76fee710e5258cbe5a2c3e200374784
SHA1120d0af0e24f6be5e959b314f57b1b6965ad41bf
SHA256b992af14d1c45b1a9e70a46503eb78067c854df2e2582a0d807fdf42b968a825
SHA51279dc1d326e652454db035219e1efab12b76a401fa2928ba74520c8403aca676873e5eaf22a2cdd5927782ac305386372e5b7b3064a1a6b5e24298c91fefc93ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee4a50bb4a96e90511e25a0f80d7213b
SHA18cd5afa6be73ebf481a1769a5490b0c9fe4c38d2
SHA2569998da80f6c56775573cde7f247dda468763ec60dd59800700e86905646e33d8
SHA512a6ebf60b9d3ef6d2488f2a5a54dbf410d71112fd0419a990cdf0eb46edee29739debf32cb331ee790880ce5307f12e93e38ecfbaad1cd52a461a80c2efb30000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509ea7cab933576c02db3183f34fb951a
SHA1e4924c365bb8d94f47bfbca5023f48de0424e4a6
SHA256f77c02b40c14d68e44abeca239c254dfcb692c7e8e7876f4fb01644ec499ad88
SHA5122cbca2107f608ae9356f69e9e265f8c28b9f90808fa8b490fb896aa2ca3cb9d422c8eb3a39490e514ee01b49c7542cea126743fad1a80aa7f6de1294150f503a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5025091608c477dd48b3d1b248f268
SHA1a200d414c3e7c6268660dca2b8f62503c06542e2
SHA256aedec551ec2c464ba2a9fe2b607bee93064595124ded96f529f1bf72d7fac9cd
SHA512dada5e75a077e68b3ce83d639600844fa7730ddfd7742a371716d132a04402fbffd3dc841e5dd6214e39749458b5e575cbf0eafe2b8abdcb3df888ddf6281951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567862064033e608f343ce9cd36f01af2
SHA12799426069cb99884bb4e21e9d7e0292b7887f55
SHA256240062463e96f0d786159699635a74743d3291f385a02e164350cf65db47333d
SHA512ff221ef660abc4ed449f7c44d39661fa96c4983c39e34a286aded6885154b0df239a9899dc8f4eb9efc52451a0b7a7baad5839590257a12f4be2a079f640d08e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfb3c8fab06a6ad7f56716faa45c1fc0
SHA12363d27dc4a0f70fab4141c624159e4fea227a3b
SHA2563c8628bb6a9ccc8523928132c9fd29f9877fff1191679ddc1bec140491313409
SHA512542f2763703231f2836f2c926560edb5fa2342c06c2df4593b04690ed5e94b59ba5c1adba10852eac6f27255dda58b7a08e0c6ac82c59e9ec1044a294b9da143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589bdce900b53ec006d2406484304d2ac
SHA1872b82b12dfe3218abae0ed65eb15c8f0259b01d
SHA25619e16b5cb822efdb39702cf1a4200a988d158208edab8a3322fefed604416f70
SHA5124c85bea97fb18c13a519cf788fa2da31f0a0b2eaa4faeec45bf2461a22fd6405356b5014f76c03f80044e9b59185f0eafb6f893f4e9054a88a81d387ea37d907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567dbc260014bd2442d83ecda11bd86fc
SHA1baca43cf1428d8f39f6cd7f6ee35de8628c8094c
SHA256419a82f9ba2af17ae677f9594f54fe43ff12eff02f0031e2eae7af0498262553
SHA51270da93f2128892a6befad771b295e5c168c9e866a01af6d0bbbb478afee4a8f7403d12b2367d6c59d0108233c1ecbf81ff957a0677bfa20c96500c1da2fd6554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3476624070ab2aba6ebf591aa22d2cc
SHA168d8e4b1ca1d606fac51dbe605de9f7834e84468
SHA25619a92e8b10885277548063a96cb60102059853ebeac49d1217974c02ea1f602e
SHA51227ea0b0c0ff758cd8e88e5f43b9631c620ffa870c435c39d4161e913704b9cb440b3c484b1ba7b9e4c26f3960d548ce03b8c541e93f41cc42cbccd6ea440ec6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c3aeab5d8b510d78d1af1b265907677
SHA17625f39c44ea21508d0c9b52611f3e5ebd867fc4
SHA2562b79245dda1064bd9183f002ebc8ace3bf289ad6d67751d3ad5390e44c51bb46
SHA51278a7d68d786339f1ab8b0d94d04d840dfdf5eb92cae0e86aec4bdd82755eb34294e534d0d901f69cbee2bdd922d882427af8c96969616704224ca75abd6ccf6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db4cc2444d56b7711e937975a585645d
SHA1699b6ed3980195df67174a9293c9401b22d341a7
SHA256f813504f26dd9dc7c252386bc03879782989b8154d2f922a5ed4590c02207d11
SHA51297cf8bb12af8d73757b752d0663c4a3c2faa314d78e668185d4a7c20fd7312a76fc84d235b7dbea4451d372af952e5f9835bbd109e21a6fc509c36f66d8d5e3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5515ce6a2a444dca637e73cbeeb2f19b1
SHA1e53fd766f4b5c40536ec7ace1372f396ce67d336
SHA256a985cb47f6face0613dd7980f4d436f4b878f8cdf2d9a1cac63f2601fbcb625d
SHA51214efb804337cb4c8b915135fcae5753f6b040d91005c0b0ac2b3d86d211dcba8555912f2649a05c8e747ac576b8863c1c3b91cb26acb2ceb0e50a2adbcef3c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb449da2121914c7d6beaf3e4b613a3
SHA184a7ef61af10f70dad6d0543fb2697434024ff3d
SHA25628b56d55527e32e61059b639715ffd965a50d750c1e28a1efb16a2d01e4e0e55
SHA5124efff967c3181037401b47486e9d7045b3606fb4c32bd0be523e203cd6565fb2b1153edf2fb1b94290243f207631b0a07b7ade06686b15f3db31f6c6b7ea1c5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee724639bcce64378dd463b5a995e003
SHA177bcdfd0b306ef0e775d4e25387db2f9d22e2041
SHA256088a03fef3770517bcfddd496edb7b55fb07320ee2f2474372a432dda3f0c8af
SHA512b0b56b3659b50b3ed27f13764df40a0e6ab2592d9a18f43f746215840855f333ddebd4ffd1b41fdbe1df347e702b386bb925597da00c082c48f3ee9cc7e7e725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e03cd888dfe559b2ae2b078b4518f4b1
SHA172ade82c85f5f9962e218a784968eed8e42a2c0f
SHA256413de92b866156a7220243c3bb8747823d0bdc2a59b66754ff187206ed8c5e35
SHA512d825edabfa18322b6d1828c632567cf42c7a1c2feb7cf7ca06e182029bad0b40948b7919bfee108f06e97b229c9aa8ee9225bfab779a74ff08b85dd8e97a289d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5278a94cd291a3689edbf55e3130d157f
SHA1efd455d632f1e93253888a982a9b24f6b80ecd71
SHA256d95ce2ff35382b956f19667650d6d66d99587d4f1162b060263475bfb06b2e0d
SHA5125911618ad33e26c00e4d597c4636bf9395976420a76ec8dbecda71d55c2cb67baa39a269cd006af5ad838108efbd922c63baac19a4643317368241f8d03af173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e8dd2c44d38540705ace6018ab5beea
SHA15ab93b0e40f59b3005c9b3d19672bf9b7c579106
SHA2568573eeba5815fdbef8733758eb7ffb3431d551f8a95cf71084c990b7e4979328
SHA5127cbaf2977bb023dffc3dde43880c3cec4a027935052f73d2af2532b0922b41d1be39a12c085a95302e5a3c5fee3bf8091e2c0e0e46d7acbc1c08e8ca580b2683
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a