Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
37cab212208b31e65463cd41e54e13be_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
37cab212208b31e65463cd41e54e13be_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
37cab212208b31e65463cd41e54e13be_JaffaCakes118.html
-
Size
180KB
-
MD5
37cab212208b31e65463cd41e54e13be
-
SHA1
7265e655f25ae4a4d24ae1ae96ec00c47943948a
-
SHA256
1e70fd4121e5035a7d42064813e2c635234ef1dc68ec9e8c183f1c4f5c8f404c
-
SHA512
9d0e09165543044d66d173d6308b029514f2e24d7b10d9a117d599652981e0d0460634833566c18e613693e12066c1345324e7aae3735356889113a17e1a017e
-
SSDEEP
1536:o16+xTc1ZtnAeTKAInqqwuyFh7+wtJ3vsPOd:o16+a13nAMqwuchCoR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C3FD761-1008-11EF-A7A3-7A58A1FDD547} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001f3e456a465385a7ed15a10cd8da40e77df4de7bac91c62e5399675cd9681014000000000e80000000020000200000000a33a77a9c97dff2b9e5d2a0f3ca300a530a9d76846e4ef99dc38bf28e558d742000000061bc53996df5d8a577c554ba6fc8310a2efed5d08a8327297153111ca0e7e8d140000000bf358f4b9dc658b483126ef6600d9aead2c1a4a5fb2ad0c43fd8cf94010961c302d5f37f367df2d8a136c8d99e0504837da59b3ce1fd50dda07bfd8311768f85 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a2428f05f03f28ce7b4fd28323a267fb22f3b9b267eda36702b4d563f94c5917000000000e800000000200002000000085d25b804d1600b29778a895d40692da87aee4f21753fde2fce6acdb8c2d0fa5900000009d692423009cc914f6698976e29dab3c3c2a507c2b50645d8f970557dbdd38209a09cf58e44fd18220a802da1a829db7ab0fb84fb99e93745825547fe5ed299562abf5d7e16d6d2d37b78b871142af1582d92e24037d6b2c7dd9de9febbd7021676e8e6176705e0a12659f5d67198d41c2acf56abad19834cb5f6b34d7095867a036fb990c06173bcc08da80e853055840000000a4536d90082744ebc18c1abd6b73e99641f646eb9f8a30e3401349102657bce7e90764134f7353f3800e0bc4370b3d10eb829511101b2b7e855841045e32035e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421643089" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004cede014a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2832 2548 iexplore.exe 28 PID 2548 wrote to memory of 2832 2548 iexplore.exe 28 PID 2548 wrote to memory of 2832 2548 iexplore.exe 28 PID 2548 wrote to memory of 2832 2548 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37cab212208b31e65463cd41e54e13be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b53dfceafc4d90a76b64cc180fdd559
SHA17a9d0efcf07a229847b75faa2cd1202404bc3a6e
SHA256a7cb7af95c6692c444f2d71f6de1d829db1cf6784f562bc91f7d09f30d9da82f
SHA51225ffd6e56faa46e269db848e3ec59b0d1f76bbdf19be5523e6b560f0483a64833f1cc217fe689f7866e2f3805c6e1b773f1bd119fa2152111ad5e5e454c700f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5761b5635013b9b017d2d98d762e33913
SHA11803d814280fc8d7ee0ad9bb2d3d787e566d2dd8
SHA256a7d1483fdee7491cc2340997b96d0a3c58644b34f80ed3b105acbbfba226af24
SHA512cb2038d90b7c4b25927bb9f3f780a57e5d0affc24bae304d626c6074d26088a3633d272907a8bbfd1ac307bd12f12efcd2a3c5e29a91b2cca81f22953758b185
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8a10ccfc5f6d88574fc796d29e25b4d
SHA1119bb130e83cce151956d1ba5d64c114cec2e77d
SHA2569f3548213ece58fde7f1612172e5fdc2a88bfc2b9cbfdb4f20962783c174e071
SHA512d29729ed8d84bf0c404cbdbca7de20f26701e1a0b17a7b43ff2c5d6965a99b3faa2e35353c7b0f2be5fddc8ed8eb8714240c194598fc1e89d1f1594efa037a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf0c0b88ad51f12e44a3df61967c95de
SHA16dc33957aec0cf21d54c1cf6eafeb357866f68d2
SHA256642297b711d1d12aa461362835cb7d07d659ae090f0e729cd9c41d7a41300a72
SHA512ec12d2c956accce9b7e3b06ae60b1b59e68bf767dee6d49afd74fb7a15cecc04906c04f821cb46e4dfac9011be8a946316a88e4812fcf846fe6afa3f22f80611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc6a5bbc39e57e2a180afb67504f12e3
SHA11384fac921c3b0d53435335b74240db3d49aff27
SHA256b1a201db437aa0f3f84bc001df79c54371c8bd827dae47b477a7b3b5b7e8864d
SHA512f6df3bc895332ebc6fb0879600b1654ecc8c07c5ab19305604fcfd608cf06ccf8e8e1421b60a20bf4bebf98825ea25f81063214589604add9282bafdb454fb51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d259eea7c7f7a45d6e1b17a69fe0930c
SHA1a109d4381906c92dba2e735256fdf657c078317b
SHA25607033069deb6fce548b3adf210d3894b17587473276c1aa80918ee99264dbc9c
SHA512c935eb014969e8f7d3d01647abf51097248898e9450d519e20d49a9892add5f704505daab3530783748dbc063e9a5c7c606338ef7d63c6952ae2aaf72b85a870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5174ce8d96eb50c6d26ca69671215d795
SHA15957fc7aaee4a6a04022e6d04bfc84f8948b058c
SHA25664b666d1fdaa4f43a9cda3162e864b71f81dd354099916e524e50d7c8dada73a
SHA512b7591bcaff111b1411c61206e7051519f6024449fd13795f3c68e36f87b1b2861bf2b244e3f1e56aeabb3b5200fc83962ec354616c09b5db2c704c5e019eece9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5621b947e855473584e428556097687d2
SHA1d2399e81ff365e151e79adc81be3098386d3907e
SHA25619ca04892653426ebc496ce8ec403362935fda5412b665354448cc5a1d40c723
SHA512e9f6b81b442ee7c838ccc3c6001690f601c9a98556154238b0c672b309253ec8153b9d66bba1c48e3471b32aa05cae60abda3edf637a09c080f5fd5c395687b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512c4278bc1b20609227b5f961af1e3fb
SHA16843f488839ed672c4c05ae5f2bedc852e18e283
SHA25666d2e2a9ec632854c50018484eb542ec7d7646af5ce10aae673f56ef92f7a2c0
SHA5129bf2beec027dda97d625ac9158f7ec67fd7fa229bb844185eadb1411b704384ce1155489a10210cbd0704c7f1825d8997fcb6eacf679e79a32c17a2511d5dfef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590fad9ee0558ad79d2755f2089863069
SHA19190c573e17cd701e8ffc9add3b854378a9de34e
SHA256e3279a5ad6f3d165c8e9308a1ba548dc1080d1ed199f328910c6c743d5dfcb90
SHA512779b5b9ee740e130366398a3b10851893695d152c517da916f8ab0952adc3e014893c8d73fa3edadb50572b80be179e2a14e75168f797af794b665da53cf4fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c581f4b35dab8a32f6f68f4de5d34ce7
SHA1a392fbcb7633c0f8294007ada766f1168193e276
SHA25691f66f69b1c4ce5ad7d195609a914d8eaf306f788daaf0d8982e1cd8fb0f9586
SHA512747a45a57973ebee348ce435e7819bd00db09b32bae8971b042d6fb3175b53ba197f52ca5965469ad635ec296450a7ffb07e3ac29203b322e2a7188ceba2638c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e74834c320df7a1da566b3ffa4b7413
SHA1025b67d39b15cb1ad8bf04047aaaa07b8ecbb5f6
SHA256a271769b120fc75989476beec2b21de2c520a76bf2b608351d6ac9c8510c1980
SHA512443fd2c8d62194794e579bdb8feb6191225b1af80e1f67b6f0de09ca3a9d3e5133c91827b4ce734abb0990746e1892e5df2108d8003f65de60f7c430922c96d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d25983a15788571e50ed036d6b3f303c
SHA10dbe660903913781c1b64a63ab03252564699bb2
SHA2569543af6fb9ff481978dcc885702a3f044f4d1d5cc0af3fa50a76ec7d83181ca6
SHA5122981cc13012cfc413a1bde15796508fa38a4aa36f2400ca709a5b2e3436aa7481a5cbbe80e8073c159d48d3cff41f9e6bcc854d152965f697e012e51cb73c815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59792016e3311445eee358f18254bd424
SHA1335fab46d093a146b8671cb66e7a778761f52a14
SHA256944b8c0943e94b45cb0af2c621897442eb630e3e0ea0638bfe6f70f2226282c8
SHA512b0e2a1ad797c82109ae5d32e52717d201c2b0a7e7bc0f5a7aaac0bad4f9d1a56b2995099b07d3ae9e46c7c2d0785c19846fdfa06ba1a313cf65211315175fc7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5603e2175c3d12fb5be5987f4395eaf18
SHA1c22e3cd87dd84727f92af2a0ab6ca12950c73220
SHA256a31d3ede35f0cba5b2ed38f1e9c9f288a86530c1a54e5ed6f5b861ad634390bb
SHA5122ff0d1beb63d0521dc8bfeaf7158e2c8fc97944280e1e0900df1975b968d36b28b9c3ec654961665c660710d0dc1bdf11766dfd93e9540c663ba51c2432f5f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c899f8cb9e6db909c9e8e7a3de8d75b5
SHA1edb291b1135af0b22e06098131c3e683d7260c06
SHA25666284468f72bf7e543d098c7f4d76c0869b1a111c0f9e1be6067852b20a4653b
SHA512528bb25697d1009c3b30874a92c5588187da003ba5624fa1750658c8bd296bad90a561362b0d1d02266dbc0e287eaf4bfbef72fb1766ff3552322da0362e362f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa3a8f4734cc0c423aaaf0dc1f77d6f7
SHA1a1e25f2ecc4f19e5b63493e354aeed3248a8dc20
SHA2562bedf690b8510777ed260393f88dd339d94eba7910d3f2bd83de9aa3d80d5139
SHA5124000a699a930d1db8ef9e1bc4c706cb22ff4c92adc3bd4dc05865450d212fcf31c7570195929b919666923da3538374c55c0dd3dcad2d78802934d3a94153a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3c46d03c664e9fe1fddf532b12b4644
SHA18bebbd208831c5b7f747b9a61f89dc233c9d26cb
SHA256480b8f989c74567ec99f82a41ac068d259f2b6744a44b5e7bebbdb99a221c29f
SHA512395d75018d9a6fb9cbd45396b98dd3c9f515f8015e4db8b816be847eab82165664575f104eea39c04f31b12b47e2746f370dd95005323f8b0c1a2671bfcafa69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569b477b11fbddfc6b86bab45c6979b51
SHA143b5bf08048cbd2c639c848f1e64e3793a28b738
SHA25645d04b1b83b5ef4b7b51dddd7e151f69215af3c36d84a318c3dcd4d93fabcfc9
SHA512aa5b5bd94afbf1c0af8b5036fe470546ebf3b59dd66bae1111ae8e75e2ad2f1026d41436e456200164cbf7ff861930ce3d2c8b9ad837dc1c6a3089f431500833
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a