Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 06:34
Static task
static1
Behavioral task
behavioral1
Sample
333a83622fde27dfdc31b7f46a1e41b8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
333a83622fde27dfdc31b7f46a1e41b8_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
333a83622fde27dfdc31b7f46a1e41b8_JaffaCakes118.html
-
Size
141KB
-
MD5
333a83622fde27dfdc31b7f46a1e41b8
-
SHA1
df409c7ee7d444005105598ba1806bbf979330ae
-
SHA256
e3f466606eae1b11302da3b66acc0b21b0282859c4a54edfef898d1c65869f41
-
SHA512
53d2bb707673160170ef5fe25e2e0c7826450cd8b676357466d19691efc48e0f124f7aae7535de82af7d362ed46530c12b79e142794c0acfce29477c59b235d5
-
SSDEEP
3072:SQifUGx7dyfkMY+BES09JXAnyrZalI+YQ:SQifUGx7osMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421571118" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7997B831-0F60-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2736 2340 iexplore.exe 28 PID 2340 wrote to memory of 2736 2340 iexplore.exe 28 PID 2340 wrote to memory of 2736 2340 iexplore.exe 28 PID 2340 wrote to memory of 2736 2340 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\333a83622fde27dfdc31b7f46a1e41b8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5f7c83cb3213cfaa8ce7ccbe403a033
SHA155f1103a91b88030027bb084db68f1942daca58f
SHA256a03be566185f9f355d6542e8f7fb4451ec9ed16bcef096c49a1045d29f168649
SHA5127ba5e4877cbe97024068a3372d4f6b1a3002a4f5837386a180613f84c44e461cd46c9f8ac3a54e4a6203cc00db9844344ed87ba94f9d5d4cd4a6aebed82c46ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581ab3818ba58a53d93fae6925254c6b7
SHA1dccc049359a07bd2fdd405bdd8c437cf1e27434d
SHA2567979b01a8af4c19e132b68bbf67e1dcbe4c5eb7545836ae92b1674fbeb2479b4
SHA512b7a7be48d39154f0338f2345e7a89470d0800f2e64d069aeb262a9a5a7c01cc11e80169198de84a09061a7e820dbc9755424b5ebc3e4f073bd21ba4d9474717e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4275e75a6e5dd0f0f4ee12fd44efeca
SHA18b9870d3e2d0dadf14f475a98fd0d884c07e034e
SHA256599406b0297b55ad5f60d5d67a9e51dc74d434a12326fd115f5625662b6bcc05
SHA5120bd67dc410acb8256af463539e5080d924bd20a0c0057d0e8896086ac5587b2e966411c7b4a20b15403cab6a32fd3b61955470908560401425d28c0078271e4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586151934dd7769f5ebec4e0b65c73dc1
SHA115d99999fee2b213d70fa34ee745efc846a170de
SHA256683f8ccf9b7189ae278fc323f3fa016bc7a984e85aaedca447295403d00cbf39
SHA512e9d4334128eac1e327349dc78684eddadf7359bfb0feda8721767eb288cd81634280d5afd510f430992df456e6555def7caf5cc4304400a881795445e31b201e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcece9e2ecd2fe244960aa3524d1391a
SHA10a978e8f0d6df5a53fe0e320f134cca7aa378862
SHA256ee87c433b26bee3b5ed7d1be98965ebeac31519b8e89216c9a8200467bf958e2
SHA512afd7078642e5f202ebb0bf1842d07c9eb31cba445329d1aaf83ae4b94844c2c6126fb185adad1b3dead2a953802b8e6cb497411cdbe5ac2b178b9dc6e070f505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aedf9da10605aa6802633da4dbe0f41
SHA1eca553b2054092eb27f18974af199f341e5770b5
SHA2566ba4707c5271281979b9874fd882d6ff43e9960fed31d82f3e75ede616480ff9
SHA5124ffbcb223dc92f04320a9f00e0d61744eaf9aafa4c431d6e739c6dac074da190a11bea4330d1079e4968c16175babf37922dbe1e88f096d744fce8d65170413a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50349308a076a5d78a580c621ac3664cc
SHA1dcb3dcea74161781e32743a9b2e6d9d47c8464bc
SHA2568f8c9b7c84e299fd2b076ea7fc5b0ff6f0c6c96adfadcd1854788f90cb6d33fe
SHA5125d8a7d43880cc6b8e4e7a4f9fc02c0cac363022abda265dd2e5c842e476d798a9243d106753bbf1f9ab2dbbc35548ec3da40a8508734bcbbe9ae0f67abdd8b83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6f81a3a799083ea3757ffffad9a6e1
SHA1523ed0e45f71138a589e7cfd9f82e3fda56bdbd8
SHA256070dc465754911f1544dc878f85fb94b3dd37cd814281c2e293d5911359b97de
SHA512338b583bbf1602c8502110c22ddf17ad2a956a588139b7547fc480416c5522de9b6c5e68f1c11db526e70c32f394997dc628cb532041c35c32b8153eb43bcb7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b2f0a6c488a77863c8b4f123fd5d98
SHA1cafc659f99e3210fdfc272a13b5ef1e4d688b610
SHA2563d3cd3cf4bdf691ae85f9750586bdd7d7613d0596a916f1484147e4c1b54c26f
SHA5123e457a5862760eaefb4c0f1c513417e00ec918cc20587c7fcfc2dbee95f333ed8e0040b4889d7a6ce0d48b42e22f05ab4df852795b5786675adae50e8eae477a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b7ea7959445a71f2a2cac1153921fb5
SHA1ab8e5b3c0a93e276b5cb79b8b0accce5faeed604
SHA25621a56e9e0822d8c4339cea65e5ca094426c08eaf44fcf3a4e0dac2d2f90655b4
SHA512ed97bf1ba7f0a149f645aa9e415c3f7a5af5675a83d46874a556ac57ae6790742f2f2e322a984d2969aff770ff8efb06fdb1c0a1c5f77724881f6e5ac4072fd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580b82c45a1cdc26b1a8b68ff72ef6fed
SHA15f8f7ff415a109d690ace1cd7e985770a5abb39f
SHA2566be44b9df12fb160a507e00221f2e3e469fce721271388fb35068563ca84c827
SHA51233426a4ff8f08d7efcf354a0659cc78d3ac51a053fec3ad0d92a9bf7db1523318092d6f70caa0da6073fcc694210c3d3c4046297c34996fd896fa67f00e8b41d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c55b8e75d3efc47a6271c32db52bd876
SHA1f334441e19f72c284dc7be4e10dbbde547fabb6e
SHA2567696b3d9d151f2c2d52c181f00be6173a6e570de60e5a58cfe80008db333a833
SHA512caefb9acb92a79db0a65cf32ae1f37cf9fa77ac69adc300054cb7723fe32c632f70550751dd70da5ef1c8446cb7cb04bf77e153e7cfab362b1d28f8be5d64a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5475ec267f596c0a39a9a3236dde77a59
SHA1fa76b68fabbdc6e95443f8ac09f55111956fabce
SHA256a7534a6f4235e1bebee02a35b89d93c42b1fddd1d25586218d5ff63356101feb
SHA512d3de01e17a0a5a08a21afb49c5c3eb235c83a78b69eeba9e60f51bd186d4701179a84a7d547f92ea112733482241d86a2af91956f039b26d48435304de215d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533f728e634c7903806af8a24dbd4018b
SHA1c43710e5c016fa3eef9b52cefe62e7d06b509539
SHA256ffc5ecff6abc720d410dc0b8a6c84c200fb6559c6b48e8754cd82d45abc22897
SHA51237ce825615811970b330c5a843833e8a9678558b73bd268c455dd872db0c390904e32e0db6dda1dd16dcef24a2d830501206de3172a760a94cc1891f9c042903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ee9cc43073c767452f7dc30b5c2544d
SHA11c2d0ca573e1e09a4c5d23f312b14a618bc062a4
SHA25619e16d09d43aede90f24038cab764dddc7db8c645e1e93eb949fd49f1bbbd4c3
SHA5124a6a57231120e1dbd106467fe7454f7d0a5e1270d3530f26e5e632772ac045cf57a97fe324597c0d6fe225b441a3823b9cc3dc081468dbe923435dd7c280a4e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb7479f482b165b5774188f656f2a3ad
SHA18242fbe7c587db148745d776af60be9d321e15a8
SHA256a8a1f6d4fdbb0ddbc88d08b376708a156decb32fa877d9fe98c4aade429a43e1
SHA51289a1d9d228de0ae8f3fd7b84e03008d2ea0f59c521da5b1541abc57cf890997c3ff489e23370f7d0d17c0ea11cdc27cc94d8537937f2ec584464d7147feb9ad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d507e861b48da99c9ea7004273cc26b5
SHA16537daf3786c8d9280a566221ca1d185a1607778
SHA256d144d3588a5b47ef9cad3fde6528f71fd039d424b7e23111a5d92b902b6db416
SHA5127dfa46bcad2ce92dc72427bf3be55f824a4a61f35fc33f74f6ce326150e428589cd72ab45fba80f47e3d23e002cba26b28dce125483b173c42f463265661c910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53522553e3039465e747b6ef5d5d85f8d
SHA1064c149f5526ba24e0cf334b49e32e068feef825
SHA25692f7e5ef35f1ff746ec6511e7d09d4be942ca6365054f1e9bbf5d1b0429af7c9
SHA512f994a917fd5e8b43c2cf3345ae31da46ef60ac0a4be07a080d4e7edf55eacc1d8482253a418b809956da86bc3521d78e03b154d3459fc1293b185144fd95766f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e0908e7280938db5cafbbff6c3ef109
SHA1b49dae2bf1cb88d72d9dbe6b79292354b431bdca
SHA256c42b545bd600a6d0c978f82623bc9d10fd44064e40cbf65f660cff086ccb5dd0
SHA512b7ec7d57004e4c696ff3b378f59d2812d868e0b15ceaffa266ba2521e9065a7d13deb788729651d45bf5850b9b19d4f304db97507a5b80f02b302677309d92e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c136e33d0e3348c793d40b847239ae79
SHA109d684a1acd4c83f004325b76d87884d1892e600
SHA256b0a10635bf3c80a557b8e1c2f85f88401bd778d24c6ec850c9343f1ce3e60d4d
SHA512544002160d4045fc831b4d871ce6d29b0c0afae54d62755f1f3100cee8e409e36176e9959a6c8c053da2b27c49172c3a1467fba48e4c0e40d2110c9f0986e7c6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a