Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 23:35
Static task
static1
Behavioral task
behavioral1
Sample
372207e5b8b7c2a9223b8ff2542a84d9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
372207e5b8b7c2a9223b8ff2542a84d9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
372207e5b8b7c2a9223b8ff2542a84d9_JaffaCakes118.html
-
Size
34KB
-
MD5
372207e5b8b7c2a9223b8ff2542a84d9
-
SHA1
1231ecc20cd32637ad929e5c2e3215d3b888929c
-
SHA256
1c4875c1c8b6f7fb9e59f5084d32a0a2698a81e39a53322e0e1fec00d37d9f68
-
SHA512
265b0f588dd6cf7ba8a86ba82fad2b7b375707c7903a8cad8c1430ee9ab50f851dc160615e03c59f79065a5428adb6b8d5c37a4c1646a812a1998c98e1742afd
-
SSDEEP
192:uwTLb5ndanQjxn5Q/8nQienNnCnQOkEntsGnQTbnFnQOgOcwqYjcwqYHcwqYQ3ZF:DQ/vSv553ZJAd3AuyHF7
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421632393" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e393e5c42075d95ed107948f5b7c7c5749a717a2902f9910c4887b44522b4a23000000000e8000000002000020000000b1447b191fce1dccd0bc57a86bb787cc184959d3a589c9752eea0da53357ebb620000000dc1a370b5b60e38dc9da129ebc3cc641e079bc9bf38050d30acf575535c4298b400000000fc89d75a13644020d869d2e6a7d5635660f152cb1793508b066861f8117371fcaabf300c44ec5147793dee48db2bea85bac8d6e05ae0699089852777dda31ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200eb1f9fba3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b4d59a4bbcb285ffb131af4e6c7b0d87be94c17f6b166584f8d4e521f28ba861000000000e8000000002000020000000bbe3775612f8c9c6617b839c732c94b61aecfaec6f4cc482ad68b7351286e2ad90000000d778711ea8f7373e0c2a072cc2660e69f2e6386b5edbc40f4a09e849bdee75d463424a13e242e5dd50c0d573f5707ea36846f776c7be64c7cf8a087196d684ea9dce046d4701c7e1b0a4b92491a8b6763c67eaf9ced211ab6006a74ac69611835db1c5d8a278740231b37e3442f93708fe1ed33f9ae1efa8d4fd48c0e35bdb7d03125f1df751f55383b18a81dc40bdf340000000f7775f943b15196362e0bde4b50812b8b08d74a8ef868c9b2857ed596e99e4c103de669a0a8dc3a7497f2055baf14bd3119c38fbc8ea1b02425361ea30b256f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24F1AF91-0FEF-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1200 2008 iexplore.exe 28 PID 2008 wrote to memory of 1200 2008 iexplore.exe 28 PID 2008 wrote to memory of 1200 2008 iexplore.exe 28 PID 2008 wrote to memory of 1200 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\372207e5b8b7c2a9223b8ff2542a84d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c0f8b262c0ccc38fde29efd21d5ad03
SHA109b9baaf50024167bc71d4f91866de268c223ea7
SHA2568ba9dff26ab5b50c26d0338d97ec8817fd92a2abd16cf173fea451ca012a9d62
SHA512b30f11f9be5ad30da118f0b2d4b4b6d407f6f77827eb888de657a2a2a6f28cd9b2fe7e548eda6d715b03250dc00d62971d2ff77a0edbaf9c00165b3f0b6c17ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c77b583decc46154433597967a7045c8
SHA1d3eab4173a9b3400be81c74337b2425e1373b0a5
SHA2564917d3e3ffe39ce1b5b1fd4c1cd856f2800d7303b97ce62a0f6164cc7db5be14
SHA512f177b57a93e804f4737927383551206361dd098a88053e3b79470433bcaa4674c50ea43e8e7a45ea2c30646d3398f74b1840f1a83d3605837d9222064ca6b674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc81c28630436338c4a0e35f0a5fc093
SHA112ec12f2b3039934ffbe6437f7c461dc9a499a02
SHA25660cc332057783a5fb390c18795a65f17f7d7f4c400f9fe82a2d45d97f2ec45ed
SHA5120219bc1b7cdaea53772f6727d09efecd57169e731d2d4d66c0e552419960ee24dd44a795cb02669b765432ddbbdfdd892d27152c0bfe382d1e9e174f739df8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dba60ca37fb462c855b5ba917239d9ed
SHA18eee39740dc3f907311e35addfc05f36d9f987ee
SHA25624d0947a019a8e63cc9dc0bf0ececdc51ea592a446da6fcc9957003e7c92f355
SHA512498bcb18866dd7a8daff4969d186ce691d47f6468e8eb110ec57f47d7964f90eca59e182efe5b8634ca62d5bd4312fc1724146e997ed94f2affbd3a6fdceb8b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5904e8d7a7f5f0217c0b1c6d6e7da7c6b
SHA1b4b557f7fc1979dea1f5eb014f9d42f07ae00a35
SHA2567091240e401806c691b9ac8513807270e69a29e5c2bb68be4cb4f7eb23f74cba
SHA512a0ad5dd15f599d1842e252124b62a7a6126136f2ceedcfdd65f8295afa49160707d523f68a3136ed29a8505ca20eba8261f4aea96e225674e35b40bad2876478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547cd08a56c02ce31bc2e016c9fab1f2f
SHA156c511470f2e85b4ca699860475d4a544c873cfd
SHA2560e945c6a4d7b9e8d8c5ce814000b54a68db663736120a2f73c08b3ed38fcbed9
SHA512fa46826c6c443852290b58477871e88fb1264b3899d5c86d7e6e69e315a284fb9721f34088c0367f4df9b8a66da4a35e1616a278979cc5a3c60d5136e853e3dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acebf14f17594ddc8274cf6d604f3c84
SHA1711889811bdd67b1ceb251381fe9cb92aaf8e1f6
SHA256f385f09e9f8de6df73c0a8a75b77fcc10f704381ede47322ed76632cce67b772
SHA5124ba6d38eb00d17c1189e95ccce7af5e331271276a7fc900ee4a0b2e577f83772cec86d2c1cd3a65c66451ad181d3c7b1047361c9c896261edce7d06a71d9d5e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdc2f9e1f19700f76ca7085714c2defb
SHA1b2384b9f375b3c3f49eac1cfed8a77b6ca48a519
SHA256e3799b533b5de64a512ed86c8747d1d34e27706b9d0bc7e0bd859799448e2d44
SHA5125b3f81d0a72b456daa3915da7997d24ed638241babff1f9b52e69cd7a757fb157d67e6b9cb10e2ae4505f6ea87216c66116885e52c85c04ae80800c8bffe5ddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8d4a3740853e9b3542415f8b7d21cd6
SHA1ff966ec455d30fbd0f9cddc2b73b1741aca4830f
SHA256683c91d9cf662f1fe42d6cc120f92c4c0e023900a634244f2d9b36e55a2c8b8b
SHA5123ea48df65c0447bdbf4fb0c120de9a01008b44ddf913e59861213929410601e1ebe27fe0fd51aaaaf950fee1a3e074993d0a4ca7dcf1dd068eff40d9d4ef0028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56111ba8a620d5e77ecf3b41648193a8c
SHA162ddc8cc66cd29339c35fe353b84f41b4855e053
SHA25695fdf626a75d20c273a71ac3db8b8c76ed413e6c01630e9b84fd4618836d6c53
SHA512f1b45e6b7e90ae3abdea767e5cf3c492c3da755e515a51ec7b6bc586b48781113effee64d10df589f5e606abca54d74d6d44be81c72955632dce820939f9a54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a6bcc25289fc40f12fb0278c31a0280
SHA1c06915463e4a18e689f2640588f8abe73614cf12
SHA25625e82e15899727297df1161ac30e1f4cbbba9e528f1dd7f8c16553b5870d95ce
SHA5124a963ad414d96c936a00fd6976efc36692bc5940e48d110d9737afb88e4f4a138c3297adc58e177de14fbb5d3deb284ed69f5d0c333810b28c24a01b73f1d4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f11db013249cad752e8632aa667019b6
SHA16dd18c85f43ce049f1990a296d81e29fdb1e01c0
SHA256364e5acb1e1874e4888bf5787a5cad61475e6996c207aa55878761fa8c08c303
SHA5128bf84a714b96e3a4abeb9262220c5e21bb6a51586d2e646516eed7a934ec39414bf45ee19b9e5a7ad39f1405a25273aa5a902cb473f03c73c7205528db8a5f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba251c05f40dbb356064bd8504991c84
SHA1a6bdc6a99f62c21d79eea18ac066674a6f1cddea
SHA2567bbf667cfcfa56178c99a909325502c46e49f33e8fdf384fe23fb6131fc8e1c9
SHA5125f2c7f29d6ec81f2cddb50edf97f734d9c1f4424aaf18160a5b96a9fe3426c1be515d6da104e6cdb7074c6a18c788e8e056c0642023472c06d4038eb8aa5a866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f497802dfc9a6a70f5a451a38761d2d
SHA1392caa7fd5d9b14a3cd36f0c571be6332064b8ba
SHA256a272e52e1295c2f4940a872d8243eeb3a41c750944499ebfc6e133c076235db7
SHA5124549483447eab2536df70ac43b228cf408505f8549b2e3f86ac18aeb18d7c7a664d62fe6b4a2ea1ddd6c37ddc603362e3fd69f9ab43470d20e9939a6f8205086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560e18176a8d855c0fd70a80f29802d38
SHA1ca950d20099eed07d3d91b340fe05572c461ae7a
SHA25693809090c4f06a4941446a6dca6634ebff7355108b9fafd54ef1dcdd69fd3d7c
SHA512209e214966295fbb6d3236d07c0a94e6560e69dcdb7f7d90ca7d7cf48ec3f32d2aa6e5d8456a1d4df6a0e60b4c75e0fbbce0a6d40c4b67979c78e8bb8c07a214
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a