Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
3094dc2ffa0ffa51b439635cfb5818aa_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3094dc2ffa0ffa51b439635cfb5818aa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3094dc2ffa0ffa51b439635cfb5818aa_JaffaCakes118.html
-
Size
33KB
-
MD5
3094dc2ffa0ffa51b439635cfb5818aa
-
SHA1
a0e405dc98a5be454abff8ebe9150e779f02f032
-
SHA256
040a5c364251fdae222525bf499cf391e14ef888725a3dd6fd553ff497452419
-
SHA512
19018d5f6c13de788d9b8ba194f5f7a9014f8db0b6730b7e59d7cd9c9e718ce6d49a9597be9072e50f76ef46e558577eec9db44e119b98b6147ef6068d1c0869
-
SSDEEP
192:RWSoO5vLb5ngnQjLntQ/jnQieXn+nQOkrnt9mnQTbn4LnQUhs6wV6wVzwV6wV5wk:wSoglQ/gQ5Gg8Y
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000025d56fba0efee1878801b5f52dca03e07775e248816733a46c30574c604884a7000000000e800000000200002000000020bf5d43f9d64fdd4d65d65adf24a7b7bc79268f55e013f9ff644a457c7917bd9000000094542c5b67562b001cdb58d866d8f0247da98c06bfe95e45c478e641fe0af20b8ef9f9389876bc1be2a745b92d752586bb776b8daf26a2eb86c53dc5d0e3c2abc0f05ee9c7319ad452b1f9951259d52a314f62fd3ed5cf63b10a4c253f710000b687e4428aa3e0e81b797938c65ddcd486c2beda6034f8fba5cb77cd524c1057063fe5c79e2df0fea05b48f7377f481b400000007b4004527ddbc3d334d099cfa0630c8d3ff4fb7690b90a4ef481fc6567b730564f70e0188898231709d12bce7e84e767c2c4331d85c0198f8939855c747ada48 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421529755" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000be44ee71ceb7c9841a0c2d7676a184b265c780c7da82fc212630ed6d6ac13546000000000e8000000002000020000000219f81657b5974ad90b21f90ea8c0ab0cd0472555c68d1848f29a968f7f2b386200000007b5e506cb4b8bbe1170a184931b4e1956d0d068de07f9d31db53b5301199be584000000078b96a880cd5a0c20af53e094618f330e376a354873b764a70567f720ea4c4e88c94f2ad20c620499e2de594fd51880dd3fbc9763500a4acfee5a2d21c6757cc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a89c000da3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BEB0571-0F00-11EF-9449-6200E4292AD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2128 iexplore.exe 2128 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2108 2128 iexplore.exe 28 PID 2128 wrote to memory of 2108 2128 iexplore.exe 28 PID 2128 wrote to memory of 2108 2128 iexplore.exe 28 PID 2128 wrote to memory of 2108 2128 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3094dc2ffa0ffa51b439635cfb5818aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f7e613fd75985f3c3ea1e452bbadde
SHA10e4a8763295800908acefdda5148423ef1a1a014
SHA2566c8137bddbbc814c0e7c54447d3cdd55e3d21f98ec42f9a07a3066e56a7223c3
SHA512e05efcee787d5092e1cb80f4afaa85811222dc1ad94e36a0a69eb0b263a118f89c33365cedc34c0b6af0f8687207749e003880fff15543537099e0b825f035b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578db098346e57f08868ec56a9a550978
SHA10729c456b356dbcd2124046b07152c0f45bd6860
SHA256016b9391e54099c1e0e05d0131cf3e8c17f481b2d344ffcc620ed7fb76c37830
SHA512e702a0b7996659f135e250606bc08e9c7c19a980654aa955f5f0e02e1f7d6f5612beba89a5e61beaf05d59a0eada3853528d63a2713e91521769ced1b6c1439b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56013914e6469d6a9dfd413fe687e021a
SHA14c1b81d3f16ab304d99324c02a89c1ff2b22867d
SHA256b8fe225cf06c4b4bb9efb4777b9b3d56b91e8600691503e93ecb765c1cb4bc0b
SHA5121d50afd53d2cc4682d021b66bf3e6a77311f98e0153e3b60e0936fa9ae0ec30c43e305047af699cb48b2916b0a4fc3c257abb56c59421cfd5457c796851a3004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573758f2f3f1a53757d31bb120b4e8b10
SHA136ba10e4f7eb9cd1688d0aa03611aa7929ad2869
SHA256e82aba679171573a40848745dfe420c14e32fc6c6f4190074369aa21aced4909
SHA5124fa2b46dffa69fe742efd471eea83428d3556b9140617125cfa7a19a8e9bbd5b51b8ddeb49d2e8a7709262c1ea4b2eee075eaf7a3afe44dae6b797e48ad6fae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5914e3fb14c40b05ba0d8dd4858ab38da
SHA10af553c2e5bff3b75307359d5d6aefb9da4be6c5
SHA25683bc6db2859d4e55f54eebf139511373d189ee22423802b9b3ae75f8ee067e7b
SHA5127d21e044b9e5136c5f4249a390067dc53f06d96f4b11eb9f0a989c3aed1fa6c764de0ed79943e9ae5ddaced39a7bada78d0b2dfed1000fb5835428ed93755653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d81a7f821274794293192a5b030672a
SHA1e90ca2708e65465a5b1d648a3ba570727283fce5
SHA2561b512f80463ca494c14a18ddf02ec8dadcd547505d92c27e1916ce7923395ee1
SHA51259694c055f1c8f62b76a1dd5c2171a99d4d6e0c1b9c154bcb21a9f9c5e949f8e4f81b63dc612fa73da72588d2b60f2ec1c514dc66fec93085d95bba1f18a61c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c82fcee7daee59a4de9a60f783822d71
SHA1e300c5dc2056a1a9c001dfd35d3b9ab2596b39ae
SHA256dedefd1d27df0d5e9c0738b80a69b8061bbcc5b37f493af0a2bf012eab6bd178
SHA512c636cc4e96d88f9d3f4f5afcb5857fa5b8c1679a461e12356da7f8db2619e92322fa58a7b84168119d64f27332ad90e83821f06e79338e893e5b175c176f2eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521130640a6c0ae36949777099a6ccec4
SHA1dd12391987f59640ca68e957a891bf697153185f
SHA2560a411b3b1aee38e507692272ae9da6d00e1fe82b973168da12888abfdcf7d837
SHA5127967c172e8f7a15422745ebcefafc650348091dc99ae39ecfb9ade16c266390741e0e6dfd4af8e874e3a79466682e898bb8dfbc6f0c65b3ffe383509b12ddbf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e299573c5a0920f2e5592d66078ced9d
SHA1338aaa38c7f960dd738ee80219512711f5f9728f
SHA256c05d0b8c423c1c77956d297bd4df85611a7ba6ff71f1f6de74c91ad9237bc9ee
SHA5127031ae34d7a1c091f92c6bbce98727a2bfa52d65023015749164ed64d81dab031040154928e26f87338b9a388b619c70e1a977277b494649323d6b2c5f31df56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cac224dd6ca6b25ad798c484e48f008
SHA10a7d026bf0d53abc58c74e0e7c2094ba1f7c8fa1
SHA256bf513e796ffe8e4d6a874bbea617a4172aa38682bc0006da42458b9ad29819c8
SHA512957c9c12ab84d6754d3085fa09806fb06ff1f0eec7989edada3b52d96ad4d4803b210bf2a3b56ec49e9bf80d5f0f4b3dc9bc1b422c886b351ab56cbc7fd93c1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c014616e9d6dc18e9f5ea9a7865711c
SHA1eda96b09b51e7192959066032a076b8d09f63272
SHA256b5d89065fb15237f00a63d24d02b57a04baddaf77cde1d76be95f013ab7a4d34
SHA512a218d5d2f414073e93b0f99dcba5ecc1014fec291b8be5f066bdd6c149f19aa1dd389a860a02221876f091e3400f8a41d058e6fb576d9b9807826fdfcf53321e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3ee8e1132194471dbf4452efbafd8da
SHA1f496bbc4ae4f4e947e2d38caa5816cb828f6c050
SHA2566f5999a71c0ecc28b4a23f1184188eccd64576691cf38b682ad2c351970276e3
SHA512d16dae304e16ce1ee86fa4b867c28adc9b02087457e32a9ebcdbecec06c47e460e924b1b4b7033cc99194600cdd329c80b10e0676a46cbb471867975b613e3c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac70f11a7a1b6c7b3c265736287a8a1a
SHA13126481e78bc51533fa0789772adb3246156f318
SHA256f3d39f15f0c12bb189570ba9c8c9fbeebcdd022230ce88453a09a1cbcf4f4159
SHA5126e2db9756df41ea601f3c73de86a0db826601106755ea13ca4f9917551e2204ccccf60288c25b3f2465a6907f62d4b95310064fa3723c2565965aadcdaf0d551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5382ac78d06d178b75b5fe37c69d7bdd2
SHA10f9d1e3b4263f98280df75955834c41d1021987a
SHA25619f3938d5cb53c322de038159a22f466036e4d40e79da9d055317bf02372c3fe
SHA5129ccbb32e8e2861763a916645ea195e30e3e3f0de1e036ffd051559eafb8dc286e343a73f54d9fafae5772d1d464586749ba49a17ec5d6a698637af9c82589aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfae7bf5da35f6988d61c40277d89297
SHA186d1d9f38abcf2a07aac17b02049b6a2375e0b49
SHA256b39f7159a460d92230438994f26f144000a6bd4defce6acd66cea431fdb0fc90
SHA512edeb76c080e2160fd7cd8f8aa5bfbbb537636d7c29bbf1f4a799233ca9489fd099f711300d04135ef86d60319389bb6d3c4ecae1580d075f457246ed9e6ae5d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552be26fba2537d7bbc5fd4482b1f9791
SHA10c4ce26bf2dc96d43fcef1b4095101b2911125dc
SHA2561904d9125f3af57e8bf28dbfd407d756be9b821ec15d330d1a0eda8185009e66
SHA5127cd551604ff80dec62e011cb108a45f4716eac52043c005573f13872d2c6a5a3e863b27092da7f948bb11610b954d98ca5c8f4f39a558c94d6795db589748695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8a8993754e77d7343c429501461c517
SHA1da5d14708199949e724aa4194e005914f3295cd9
SHA256aecb89a7726f8bed06d314ad844729ef7db9288a3b8ccd6a483bbe222ac0d299
SHA5123157fc6e23859529df880e43e14cce7641df99de6297e2fab9cf9deae8b09679f7f5e5929680d1e0125a4377983b39012136e7597eb7de0de34c68243198c8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ffeff88ba460b52bdae0668c289afc3
SHA11f5f107dfc9fffd680bec8b2cfe1219cea75f53f
SHA25617237f4c36061a58473bdd2122efb53ed4979265fabca302f8e4dd0bdfa057a4
SHA512f5616ad66df993a1449cf809e0ffcfcac2836ba8bcf05158f2e373ce715824f2637ded28432e79e814b36dffecb6018951a25b81becf93e280a792375493852a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a