Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
37317f29619ffdc61eb55cf1c293b1fc_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
37317f29619ffdc61eb55cf1c293b1fc_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
37317f29619ffdc61eb55cf1c293b1fc_JaffaCakes118.html
-
Size
3KB
-
MD5
37317f29619ffdc61eb55cf1c293b1fc
-
SHA1
55679f00d37716fe8c90889d69cdbb03e6634000
-
SHA256
f7bebd95955ff01b9acd09cbcbf66e5dc758949407d820200bc07159930aa333
-
SHA512
a07cb0e266a44b0e0c42a54036ca62d2e47da6dc9b051e1737530e3a972744c3bc69dbb6008cc5df87f0cdf1d013a942eb2f09275554d1798c7782d5d6dcbca9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40112925fea3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{507BCB81-0FF1-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421633325" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000077723c0e20d4d7c0c8ea5d0f3a18ce32a4f8bd49e2f71f15e03d837f97ffbacf000000000e800000000200002000000042cc92a77b96cedfd05199f123e89b352a9f26741bc443c1e39820ef554c7df220000000d05bdf6fbcf0398a8703c1d863f01c77c8e5ebc7c4f5355780e8f0347a1b4cd640000000e4bf8ace322171eaf16347367f58a1910b25d4313fe3eb62833a5c64769e4a264e628aa36e4994a2b010aa496c3de28316e43c7eda596e1bfc06cc07ae1a9057 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005041266c88d4ad6fc1f626bfe11d657c928935c3bfe0f2a7fdf41873a4338a0d000000000e80000000020000200000009ceb80284aa7a29f5fbc5b67504c3224a8b489f4b4352a197dfed2d173b4e8c0900000003ba43a57c4658495c88946f0683dbdf3f563285239f7ff01a514300719c9e6d1dbb3d9f74ee012f72c0593c4a6ef4668fe8ad4522310e42efae5caee6f838392a29c12236c4218e81e83c8fee60595d5809a7b6831675e6c40d1fc1b4b89c9e5691fcad5179864aaeef99a5dbd7dd9249cbe7e4ed7c48c733645da10f897e43a13bc724e174c2be3011815945a53f6bc40000000f6c5444a45dbbef878236b97d9aa36b0deb4f0fa97ba43f475e2be0e896aeee16c4d60ff4ff8693156c088d4a49ad76d48eca2ff34654bea62d222def6609971 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2412 2036 iexplore.exe 28 PID 2036 wrote to memory of 2412 2036 iexplore.exe 28 PID 2036 wrote to memory of 2412 2036 iexplore.exe 28 PID 2036 wrote to memory of 2412 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37317f29619ffdc61eb55cf1c293b1fc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570e3700b57411bb7ab0b9e65c53eb0f1
SHA19a79afdd2c597d74693a8b9eb92715aee16b6136
SHA25623c79c9dc5db5b5cad15317e858578212c854ae1ad495401194491191493e324
SHA51203e66b66d4fbd797a7dbfca9582aba5d87b633e818ed0e3be811564d7838cd690275d5573168abd8e1f3b6875b4a688cfb3853707ae34ab076b661b433abb92f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8ebfad53923a42eff9404033ae498c2
SHA1d082de90c201dbba8c93fdc36de8a9993f53aa52
SHA256d653f4d5e71e38162b6b17d5b399f87647b64f720c850573806f983876460860
SHA512e1514d4319546cca1c08c902748f178e36f365ea6e3f09440019db16fcd363b9c3144afb0fdf119b74d1a05fd1b4b71f2aa627a9ed6bf1d89ca9bea070a51933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539cb55c6f6d6277b3212279a6eaad82d
SHA1aceb30a0c8ceb2e18e22ae3b6a3656107dfebbdb
SHA256840474c052f431acdcbb27ca727152e6e421822157f8a4da980824346d306155
SHA51260ec9e2fab98d9e4ca58572ed3c2669fccf703009cc7bbb95e3a6af282cff464f560f705309d1f6c2354b4eb43dbff77e38df0fff8691a12ae861c9983903d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576780f8dacee4400663af69f135e11a3
SHA11c2531c66cb59405214cc8e17aecf1da86c7a38f
SHA256630edd26d8f8e05f585abc4d45bf70e7583de52a659afce015ac28549e49dd87
SHA5126e696e43c9dd0f7a35f0fc10c2e3666517a50e9d56922065f0da2060cfa712f05ada24b669dac86175b263159f92c1ec24e80ed72026c2fdda988a361abea4cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5876fc2f960bff4d57427f88ed2a2cbd4
SHA136d12ab265ef7c950ef78074f88e9bfe7de84b44
SHA256e963951d7451c0113d0e191fae9159939f1c7723da35cc70f217a3b0f407e101
SHA51277d89e7380fcb9684f9a81667f0ccc325842577f68d1e9c285e5ca28428e9a95b3c170f70e92c5468b0fae806f69f2fde7d86089a12a0e6dc8b6b47feba8615a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563c52d76a6204312dbce43ae12f36c65
SHA1e8d3200d847bec639b30331a030ac8291f2c437b
SHA256c476bce0ce7f20e451ea54a3e938d14201efcace77a8d2f31d37e44039b00446
SHA5127cf40b637569810303dbb769945c197dc397ad26f77c4bd45547424555c9d344df8a3bc6679478c32c728ea6582b6209015ecfab00cb70ef8c0f4e8e09f1a99a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba9dfd0f146a84361f73689d5f8d0af9
SHA1d6ab4cb24efd309dbef53f1ce888344e18ff82f2
SHA2563825a91f936982d5752fdd8e4f9f644a8ac6ffe599c67c94df3404a6071fec6b
SHA5120b662b8e1453ee5f73274b6345af3cf2922c178d6c11efceab9444a951c29a8537879c64d1de06c43d532da6276a4c2ba95768a5fd683630fd4ace4b11a92ce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5775a8a34b80dd777b67786ea9bd5fc82
SHA14a6f217388828a18f33980b1fefff17c77e548ba
SHA256ca29e755d88f7346965e1c9824358003a4b390fc739608c04e631c260581c6ba
SHA5122cac4e7c19ea469a7280641c36a2aa374302df8d9d920fd6e389a7c2054549e0e01c71e422771d1cd0ce93c9dc2339f9c2cfa02eaf1a6b9d90dd1f57e8c8ca1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fe9cef4e755a60c43027fe6a7eddae6
SHA1fce978c3516372599a2f3bc949128981f8776e3f
SHA256e7d144ec960fd2b8a0197ae39271f323561d33d7a3ca5b1c219b1d83c474c61e
SHA512ad90eb88dafc7be165be244bd047e489f8c3bf831ea5e0d9ea62ed2cb3b4b0dde8bb1c334096d10bdb1607b5c876b8f7cd0403cab9c649a1f4645f947d5e9648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f303fbcaa9d9d53d3f70252491251d70
SHA12ef8590ddcfecd1eabda748f9d3179463ce6f9f4
SHA2565233f5b8be91435de2d61f8a1ab4c84c4d105bcabeb675e061c297ba4a4d2e12
SHA512b25d71bcbc90a2bd7371a65f0451dbbc73fef6fe858238b634509645563fb8cde1622f2090a1b0608112d1301afa9c3c207b4fe40e58ce0f27c65669278532b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5801be460ba769665621fabd8f4cd4f8a
SHA11a1a9fdc3865bcbf7387a0a02f3bd8adc50d6dae
SHA25688c83930aad24ed340cfcd57652096439683f6e5c0130a60baab7156acf4bcba
SHA512ccb465d28724ce1e7cf2eb4521fdf2ad363d8e4c2e0fb40842216e60cf04e19c50654b0873b181bb762b00d47f71047ae056774d2ac584aaffed8de8de0aef65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d54265edcc9a8a4b3b93709e04756a89
SHA11a8fa6f3b84a9e6a48743916f5e55eed07404e06
SHA2563b73c4a233ddf250e7c1ca485f332863ecd58944d33885cab9792aa4325a4eda
SHA512b87ec4afbf92b0d7f6eb36df240c20f4f7a5e4ba120e21b9c8376e881a5cc94d753c88929e3431ad7b792478b7d648024425b9b17956115f2bfe3deb3aa2ecd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1b7b689f2b6a04e60ae87a847135de9
SHA13330d0bac4697e5ad70df57ce59e80c9d26d74b0
SHA256cfc4d5f3d949533ec6961adf92db19fead9e0272fe2f36e9f266757a2714b620
SHA512a46a2e0f9261c56da1010e0d179e074b88368ffa59bd0e7d6afb72cf8bc945af67e575ecab7f83bb9011691e135eacda88ad105d076fdc49d1d7d02fcfadf0ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcad1c9ca69e64537547506bdd335c15
SHA125d871e0b2af9b96c38fa7332b76f2f803902515
SHA256c4776f81ebc3ece42c7a7b57a66d35e318585c13342691e06c8e36b062d2d317
SHA512e23d3fb674fdb33caa541d819a5722ce0eac5363e1cb9541be2c479c5256acfb48793a2180f460aaad98a566a08404645cb8ca57d26a6e4fc92f92c64b8ef7bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586cb1c74615ffcd93485106361f8d8b4
SHA1d14bf79695823e473dbff93a0a103df9998b6197
SHA2568e4f4037463c8764e3ab223e22fcdde9059162ee894030498304fd6b0ea2946a
SHA512eff2c80ce34d458d79c1ca364c4b1184d422b2fdd5c5c75aaafd54bb3d2c7029dc39b0e6547c6e90827122b898b5081ed1ce6bdbab8ac616ad222f9a88287fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53327924e3cc13781900a1b3a76cd0894
SHA1c8940a67849eb4656cb7cf8037d3e96772bb5359
SHA2567cbc004c8801fb8fe694492cb5d6bb3339757566c19724416026459e8b7b9e23
SHA512c1dd9ec76dc7a64b951f5eaeb755c3ab300d0c9bc8056998407401d4da911efddeca54bbf51d0c25690b5206ee8d25ac8ed6f7808b489a648b4fecd68a5c2d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0ea8a82950de8b1ce274ece6aaae552
SHA15ad2257eb34c2f7cc793b98db3244eb5560fd6cb
SHA256832eeef33f92db14bd0f1c6693b5b0fd3144568f4ee21d15a859f0c32f004858
SHA5127e89db503f8fd6b18e22805b3f1bd3a4b870f33fb57681ff07bd001bd01a9378b838d34712ab4d4f452b50f0e0b8f3df8558752fba2a4bd36a826bd889ece5e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d894bae67786dfe664916ef35a71b13e
SHA1f7e98c473b82071ebe559a03fa74f6ff4c8405cd
SHA25623c0f610e81d848dfe0a23711456b66fa95457494a80e51b311e66690da8d215
SHA5127c6f29fcefa8c1bb4f4e939fd1cf238d5ddaa1dd1651b8597ca5339afcaf755c4119ee9592daa2272d424b482332baa1665a7edfcf7809e88d0913b747364e18
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a