Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
364a9934e8ec1048f9cdbbf88ab349ca_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
364a9934e8ec1048f9cdbbf88ab349ca_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
364a9934e8ec1048f9cdbbf88ab349ca_JaffaCakes118.html
-
Size
461KB
-
MD5
364a9934e8ec1048f9cdbbf88ab349ca
-
SHA1
5508541c965df82ae883aa20c7c937d506397413
-
SHA256
08fcca67c635f888ce56eb0b97ee4fe9cc1aae2a1a1b751a1e9332b25fe60e87
-
SHA512
3e35e63bf2592fdc68b0d66a560f1a93013b6ca069a1efc9c9933c24d9d9b603adf27e862c3e3a5ee36243c4beac4c9ae3812131a7da05bd86c9894ab9873a09
-
SSDEEP
6144:SYsMYod+X3oI+Y/QOsMYod+X3oI+YGsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X3V5d+X3y5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421619428" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e74ccddda3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4AF6BB1-0FD0-11EF-B2C4-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001c3557eaa9805ea3dc8c55dc6dd1cc990ab34600c2544436128b1836d31a7202000000000e8000000002000020000000f4fc218ea02ebf4a326864f657d9354284deb687a0037593359759039f4c24c720000000519fc8e6a12d4af9df45fe3e09a22fa91385d511bb4a55d47f1150f3be36f6ab400000003840dcfed17b31b02ecc6a1cc171bfe747ae39e54b6f4ecd5351d6b81eea9459c2dc31749bf186b74005c7e46d41629abb4008159a8ba53c400a5162b89dfb52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008aea7fc53cc0b4ac7554107b9d4f13e74d901bb4913f7143051060313c923292000000000e800000000200002000000041a9e9118e360d2929c5f9caaa883aea2cbd30ecb4894a9dff4726bf8dfe5bcc90000000fbcc2204bc1ae77bbf2348bcfb7eedae952ee190c2dbebd6f13338a1ced90d9d87fd391eff8f2fbb63fba60ca21122710af358c6ccf64437d95b024b67033b0d17095f07d27f16f6b52eaa3d81680199474af7b8965063b5c180a059925596ca8a2df7df2888aeff01ba81208adcf86deb38be4020d06eb550df0d2fbc352f1b4b2e3395c4e1b1e522b4f8f86917edeb40000000c1f7159a77e38295dfa625d567ef8b9dfb3eee69a5e50be37afb0060436fd05a71c04678097081b78fffddcf82301ecb7ea385eda0e1a85ef314da6edefd992b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\364a9934e8ec1048f9cdbbf88ab349ca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c99c8ad10c41e6702c6746025404a705
SHA10c4afde0b4dc2d743b8538d0978f52f87d508c21
SHA256ca97551da8ecbfcecaac8b39d74849a09da05dfe74af9ff8e81cad34152d2e55
SHA5129cde354d6a549abdc24261e6878ba3fa0c2d451f92102f81c644db915a7313fcbfec00525790405d5af3dd928f88e3918edda47a5e4e5dcd4eae0baaed300721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9d6d09d196aa97d0707056cd62ffe1b
SHA1455f730b845671c6b6f089647beea9a1b65fbfde
SHA25683bd0ecd74947c32f80b2bc90d66ceba34251a6e4022289a750c0bedfccb4dc6
SHA51265e77996ec4b5f108886cb97352e247b3540f8422b015fe28da100cce2722ae6e2b4d3769b4d275497401e6e2fad194704c2d875cf1d1f81ea0fc25d3e448725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db633c1b8b367d4efc28e535f66f58d6
SHA1e8b2aa3c8c461ecc4f149446623d7c6c66c45b22
SHA256d6e5bb83bcafe14bdc7c0c29cfde6cea1cfa2b409d45a272a4a8938aa704f4d1
SHA512466058dfa058d687570d191870c1172c075fbb229ebdbe68bf60eff9bcc0711341e897129894dd7d8100b4a41bd77e2ba122b7398137aa061f2bd46ad069031a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d99436b0f2bca65eb5311ffca0e38606
SHA18492117acf7cf38b9686f01b4bb3bfa70aa21353
SHA256e843f08d5fcf8fb9650f2d8bf7093a24f2ce26e9c0cf57762360d658f5ddd388
SHA51299aab7b1071bee772eb07c7269735895911e0c2e28f6fb936da9dd69cc7ee4c2d8a0326a1cb3deaf5a78bed5263f0026d6fe601201fcb44f7015994c72439067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb2d64a951681d0aed553ca0527b771f
SHA12a0a6d4448a9155b5d42dd8af1c47bd62bfa4c9d
SHA2565922ac2322196cdfaa07ff6a3c98bae8e7e997b2ed98d806a36876ee7dfff052
SHA512130c21aefdff89c31f9d1d3d1064d64193cbc077348d66261e706f949207a19bfeb31a9ac965e0dbedb01da9049351c95b49c22a4313e3cb6f7da98564364560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5164e3bd6bdd8896007c84fe313fd71aa
SHA1652febcacedf6fe567bdc9e9ba524a8c75db3483
SHA256922cd72dd1b5ce9588017d92a1dcbdcc9282a0e094096edad08d10e947610392
SHA5128ecb0c8b13b6480a259baba84a581b705a8e3ceebaa183fbd31d8bdecacaa88d6d2e3570ce135f5a926952366baf4d6b27825507b2445316dd491c685a4a54ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557efc44a6138bd6d94ba57bf779325bb
SHA15878028203b62f69361f2890c8a07592ebc70d87
SHA256cd7f74ab581123373fa302c8cedfc41d834e03e383024868bd969eb4acff30c8
SHA512721313a3ac50e7a99e91e077cd41d250bbd74e2fc8c0386e476d1bd4807612c3cfee53e249370b002dc62843b39044158050e2b44da4e94fb0a96621d83124c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d23622625ca8e012f6610d5a6a1fb815
SHA1df4047e0d3d046c6e0ac4fa5c4814298951ee6dc
SHA2564173fa08cccbdbcc9b7d600ee9d597914ac2407a89852e07a39dd8d97aec5897
SHA5122cd56d6af49a66f5a456b38c5bb1390f3aeab84374b50c9cc84ad2bcd2ea3b654bbd8b2fad6e6deb9aaeaf200a5f66533f1f07ed3a93eae2f0a044b53b0a6468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b8cd4b353b8c4f7750ce87fe1d900d2
SHA13f4d845a608f226d5230b7f34f450ea52e383eae
SHA25659b422e3c0a8e33eb00a904f49bd3f9206afc38e5b34dfb2b5fe9664ad39eb67
SHA512b9fe311b5f2b257338b0b31ccb69087be4d3aa1bfd758c8df58cba03d20da544d591e3f36e0b11c7d40338892c4229bd276ead80f52f499d1f614f077e0deea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555336bbe2230f5e2e8cc254b14109b39
SHA11cdf0257653b8fb6114c019178ec4666d307a9d7
SHA25657984b4eb66118fafe61f82f44d3b05c041dc369ff72e1687d8d82fc7aa303e4
SHA512427877f6ef69928bad6c3c4f402a7fd709f0a8a9c60fbddc1bb83af8507b97fe8daa22c99222e6f3e6664644458e4a58c818bccb88425f5e275c5280991ba8f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50191302cb3488a8ff4fafe620ff8e617
SHA15e6764b4938a5eb0c376125fa3daa92d3030fcdd
SHA256bb52ce31a3ca2786354e107d8e22c2d298cadcc0501e6bb59509e3420a903967
SHA512fb9ac03b25928b5fa41a18a188d312fa55063f6244d0749a88380ca06556fd889bfbc888aeca146d0e2629b126b899fb0a6ac2f59bc3a836577a5de0abed525d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568f63c6eb7133248f79a3367098cac32
SHA1942330a94fdcfe6747a7fb9db3a62a9f7cea28e3
SHA2562169924691f3cee2efe3806e75bb43f13c01cb482df8181dcbb8f701049637a2
SHA512177d38feed85615bec2d4125b4bc3d94334e9e3eaf5b906f6eca2f6ad75789a81391525c552ed46026d4ee4d462e07215247712f65ba1620f407600e4ea8e99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e24d15d38390777f880c0dac611acf2
SHA1b9608cc79400c239f33b5a21abbfe828519be322
SHA25628a691b611b8847eb8972a7e1468de31816c77934947c12542feda6634f63faf
SHA5129f071b056f888a53cf498e4e45a5473326c290db5d0817cb9bf0813420ca61c596935824e1654ed373e09cb8c084384dd2178e062b27a226fef5c0ea06a87e1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3ccbe665562671ff6f453d230a7797a
SHA10a986f6b797899bf41ca93308e4fa3d6859f7706
SHA2569dd26dcb064a520537897f03c0ad7f726ee5213f2ca1d9c8c136b4b858ef42f3
SHA512df7c091bc0656ce47d790c55a6490897960db401183caf6791672d288ecb7148f36c5f2f693e56488bc5a9e6399e576875de177577b9a1a30a71c6444d914457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aa5ad362f20b804eebd954e5598b6ff
SHA185d2b44f444d8d6d341207a7131ccbcbdea0c0c2
SHA2565ac20366f2fab41d9e5da461fd527a0775871b3d7898531eae7c714ecc7781fc
SHA5126dce26db42c239e8495b4aa4ad88cbc4dd659ae1decdce963d386f1bf8267a375372b7876e8bd53fab665b58bc48d61c03dab4891f02106b35fb93e00c716c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad34a138329deedd07a5e70cf8c805e5
SHA164d1968caaa5a9e905212932396f28482a50a524
SHA25640df399362798c22a919a7d6064953e960f4c893ac0fc9f9103e59bdf271e310
SHA512c51e9189210abc2eccefb38c5d986ad5b78e289b691e966ed1b0401d17904814b599f366c4d1b0505bd98fd526619fd325d1b8e5cd936819766e362fb93a485f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590bfe78e77c972cd404f84ff0a52df94
SHA1e2869178f18c46651bb3d88392766a6ac636c0a1
SHA256224bba4f349c87be66587c7ba8e173fe46990c17d8d7a891a688903b77e179ba
SHA5121dd35667637b2145c73b84d31fc5a08f33cfb63ecb8d16ab2125bbc69afe0ebe9470d4ea07c24b7b2afb2693f29918c178e23b4af85e6c3ab34c22867818011c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50afbddcc7fba8b67100e561574c04602
SHA164c19833eb2e13d5127c73649e2a696918d50420
SHA256b0ed8282c88843e37f4525867c6290bc9aaf11eccc94eb2af4f83aef57da4014
SHA512303d25713478a00d5b4b533c9ebba832e8451663437aeaf425ef653bfd29747ef652db84f79c7e852cf6961d6571749e8292887b342bd0152929f342556ded50
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a