Analysis
-
max time kernel
136s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 03:35
Static task
static1
Behavioral task
behavioral1
Sample
380cc6077c19761aad5dbadb229b45dc_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
380cc6077c19761aad5dbadb229b45dc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
380cc6077c19761aad5dbadb229b45dc_JaffaCakes118.html
-
Size
9KB
-
MD5
380cc6077c19761aad5dbadb229b45dc
-
SHA1
5886f2c668afa471ddd8ef795a792429dd4553f2
-
SHA256
785597d45241f365c3d6169fe21243b1111a51f123b77a92cc14cafe381ede92
-
SHA512
c3ccaea2f3281179fbdccf5ebede20db82e01a46a72ef218aee85aab25c6cf9f842a3a64c66ff6b4e06f0fa8d4c99d5a319bb9a3cb9f29ba7c60bb41325792b4
-
SSDEEP
96:PKnfPanf5qjw0fgFr7FFzmAUhrvjsFZYT6mccpDqLWe1aHFk:PKXiAjPI17FF6AUxvjv+bC/HK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bffd93c347d723395266c8f33439c56e7854d3c5a93bb238ac938a5ecaa763e4000000000e800000000200002000000048a960b86291910ab073261c317a5c37dd5ed127ab326d522518234f1544c8ca20000000e1252542fb2cef2866d54009c284e28b243b1f64c883b9d7f74af2151a43b79840000000798aef757b681bf4836865b91eec41cd4c81c6d1c16f59154e0b6735e252679e0d6a1513acb72e9d0b577173ca75b32bdf71221a431eb1fa853c12f86ab58e0b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B32CF5A1-1010-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c7d8f39816c5a1f8dc6f9a47480f5c3a982c5ec5f7d51d0c72773f702cc5b492000000000e80000000020000200000000de1ac0bb666c14f10d4f29e369f16451e56de4fb03afb50bc12145a0b3dddf99000000037522deb5b108ae5b6eae34bbf59cb444c1e2800f56ed1cdd1f193dc84eb87aca506ddef40c55fe0bb1be14159d1a9ebd62e7d0dfba2e5a565cddddfd6e21cbd2ba1722df7a88e651fc531aa3c7039e7a9699a6bb91559bd8f8ff9078f6a3ff2ef5e906ac437d29a0e300a6e33ae8bbab290e7c7089b590d67f11bdb9ddf74917c2a3cb6969bd418f7b6604cbb9cf219400000006c362032261ae8dfe5d26cb6463264a96355374ec7eb74944d0f4678a90c20a6e65afbc31bfb964df4b7c83bde425d6dd2f18935adcd11465a3918a4a33de689 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309a8ac61da4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421646805" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 iexplore.exe 2052 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2600 2052 iexplore.exe 28 PID 2052 wrote to memory of 2600 2052 iexplore.exe 28 PID 2052 wrote to memory of 2600 2052 iexplore.exe 28 PID 2052 wrote to memory of 2600 2052 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\380cc6077c19761aad5dbadb229b45dc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ee0723736387b888eb6e7173ce02e0
SHA1b41e52625e0918f084f2eb5247f3eac0f09edb6b
SHA2569f39154a3aa040c715675f1079f93b57781955b821f54165de10b475e4fa4f85
SHA5121776e3cc9006ff0ab0245c396c3e8685525a22f9d64158120b11b2928f1ca56c9eac145142a90013d9981e415e5f2d4fd17cd0a8b293715f94960b122927ff8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baeb42d5248b30b696ed372b7ff01a04
SHA1fffa08a0f78a89df00dcf9be99123c775872da10
SHA256c8231ea3217db1f508c08227a417eab637bba60162a2e7b8d80515734a9203bc
SHA512b255232c391ba6f54ed12ac178b6e69687d295ae95a8d3a0d43ebc98f94a08f423c52979c7c0c8886adc86dac48221abb0b795185ecb533395059e3bd3c65ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec9436fd62c5627503f1b28ba49e375e
SHA1e0f0840d1027403af1dca44a51affac05206dfc0
SHA25643a08574f05f063bc3d8b114a0ff00d57bf5ba2c30258a9cd0312894ec7a247b
SHA51292258cd9457e600c8935af5d3d461eedf8a6fda7fcec5d74cac6afb732b49967375a3865b7ca859a72f721b9e0876af2370cf9b6f3ff42eeb71849519ac15879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df9b3288ec7ea36befa851f0f0f035ab
SHA16c0cf17179b57ebde14869d7c90608798d44ec41
SHA2562c062a25783cc84d7f0827d8fe90eeac33d20a920af7157d36eca49d2316b8b3
SHA51277fd79e210b70de32548af4af98d1c41b66021b7c8c39fdfae043e6c1b14dfe4b51e9c23a3a8161cae1625fa203c1018a914f909b17d634cb5436a40fd675c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523be597a71cc0df3668d2528f027dcc8
SHA1d6503b16b219693e36e8b68360e267016cbbb916
SHA256f7b0d9d18aad8103f5b7e3463f4243d7e3254d912aa439977ff744db89d6491e
SHA51271a1f571f7665bf9549ceacd1aea0dcdd485b919aa7faa5f90020e31f7b5c59fd270f54dcf43846b05037c4ba920f6efd2201a97e5865e7a0481daa494bb6b0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52efb0be8843fbdd4974cb8c8248095d4
SHA1b3fa1e1e91d66256add19180d7fae63c7cff0f4b
SHA2561763590432ea47348dc21b9119d46cd1bc6de149496bb3dd16e3a0d3b79d6be7
SHA512b18d0ae9d0bd85495dd84a516e1416b703fb27cfbf921fc1ad966f3a4a97fba3f60ca57a9d981e8c4ef362321880e89a6267237424d366173b66ff118e4c4545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab71baa15309e3e667575f5142a3de9f
SHA11814a072db7312ae3b99726be7995bc6d709d897
SHA2562dfe2b8f4498d6896ea234855442d240e5de9cba89b2ef77e9aaf4346d7d3cde
SHA5126b2e4152012813731a1d0a29eebb26d5aabec50fb7ca5c5b39b9a401802c7bd62dab716d37db8a7918092d6e9d936238362872758b08334fd67caf5b3a64d2ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2cea622baba40581a3bedd60c12be21
SHA165f388ceab1dc545c9ed6d54827019e77845777f
SHA256bbdeeb1a351ac45ab6926b6995a1e3d58f6dae320fef8300600d84393b53a5d8
SHA5128e10233642cf9d42798d8115e306f22350949146f14a238bfe62709fb2cfe6ae9f089d8b582e4e5eaf07d6d3beebeb5e28f0daaab05600c96c3d6120d4a17369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511d39f14f4c1a83cd6cfd8c0e703c433
SHA1dea6ac4c7cc17f56e1f2c8719736004b3df360d8
SHA2562e9eb079a5f3f68761ef5c77beb4c1a7b81c488eba420634292ab141caba40c5
SHA5121f229b324bf311887321d8ee1f6445e9991b3f60a7bbe5dacf743d7a81434b9cc7b1302dd0b39cd15132f329fa0d96a69c6a374cae7a25ef2bdb3d1ef39ec9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55837c779e8c9e77015b4efc0571c8491
SHA191e5b44f37451083198de57ac037eb80f1e785ba
SHA256c9b8530fde2760b03222695bb0b05cf066d8935f55c71b2a8c3ad9ce7654b5bb
SHA512ade19e96b39fceb9e01d80cb9d0eb04b602703820aaa0620b9698e37d5cd2cc494924bb4f6397ee8f156ed3088977e5d8ba5ed3e452fe4f316cd204fb24cd40f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52541ecb9b2e448181f72b79047a05fa9
SHA18bcad82f654ceb35ef10f1cb5d3256ada252c664
SHA256f7db906690830c2b16adeeeb5876a48c527de934a10adf1b8fcb113a1b545ad7
SHA51243cb5e77cf498aea1d8f4f203de951c53c52530c2d5fd641a776946e7ecad3f2aea719e25bd0c347001aa7fbea4f7da825894e6f141f809a00476b2d3b71f774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a77595e8591decf7168e66e826258d9
SHA1ab1c4c045ab0249a598c431cd4263fd5f83ba4b5
SHA256449b77e5116cde06162aabbf180838b72bb5e79869aa3e11e140a5c44794d798
SHA5126280ed473a6e244cd79cc4c927779d17c407ab787e21dfc76ca20db1789ad7ec12b152cb35bcf3ad660f1bb891462d36d9af19d90bbba08452c81836f09525fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d76a2249c490b9261c2c41840bb5484e
SHA150efec468efacb8025c17c109708f1224c60648d
SHA25686f5158d8acceece2390b9d83e8b841489d65e4ce877da80cfa3f1338f5a2700
SHA512a979a69d9f7df1a4772dfc53e5337b64183f1322d69f50a35fb3eb762d2df385ce2a2a388cda5ba4806ba6396426ad612b6cc019b9f06cdd5ba47e150123dc07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab00301cc1d266005e5b684d479fb553
SHA1e3d02b43c739704f3386a83b3f6319c6dc5f4697
SHA256ae4ba40baf59d144150ad26fd3ac95e3338e49987f29188cf0bb5b2f54e9c53c
SHA51221eb227e94bd7c70da24c6264e65b91a32f94f1930cfae528ef6033c902f1a15e3eb8a6015efe83bf1ef7a69a59339df83565dd5377edbe893285cb4e4696b8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d843b92e759b39e2ce2866df588be79
SHA1f4b17c247b9da0c2f5bd75f8a4578421181ed81c
SHA256e5d41a8ea2ae27d85b20ce422101b97d6aa0a906f90d69b7bb8268e8a91c2f43
SHA512e665acd17b579162b7adcc1a6632f172eb3e5a535bbe4ece612e656510182ea80a1815d2d080dfc86b98a25e85bdf37ef758cab5b4bb77a0bd63740f75898e2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551fa56b00e2d611eb82c19062fe5fd09
SHA1f23967380c990ea36b17177cedbb19b4b59eedc6
SHA256002654e6d4f2c9714678816a8fcc17f130def5da3baf8a78d4c8e630f4124401
SHA512fb9f1b3126d2888821f873678268e65a076f51fe53f36107131f3c45942ef30414bdb866f148ff530574eb0e8109cc6caa2ae8c8915c1845e3885f496c778464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcab070687aa901aa1ae1047399cda2b
SHA13267c7aa20eb6f1fe9ca3d3b05959c9e0d6f4372
SHA256320714be5974cbb55a191f33c4836e1cd974a7126df9252793182634b1b28e19
SHA5127b82e5630e86a06e0f2c4c66b9984ae1736a6b9245356b0283ad088adee5b1e10f308d5bb96cffc784acde03d50eddc3d47a58f53bb4aa40ea4bab438fd5512d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5330b978e7e6da47996267e858010a6b6
SHA117cdfda6eb26d6f04338a097034c3c15643f87ff
SHA256355b1fe289c51166cfad61f12a80cf04a8e4cd4c07a3e8d29ac24015b50869b6
SHA5123ea260e4150878dc11e06d39ff145ee98d364f69faaa2115854e727a2d6d5d8a33a97d3b2163db0e8ecdd62082354b8ec250098c4e2114b283dfc56e8acaa8f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e045590a991b0dc860bad8cbb0f039bc
SHA117352c079a4fc483639717befd7851d0301c2c59
SHA2562c5886df2a46e64decfcc65bd8647a0a35b4517896124875f9a40796bfbc7ea7
SHA51227c7df57868c2fc9c614f04899bce4ee27b5ed4961646a90514af1538f9f6f038ea39b184e547a694b365eff41df0d4e495037e73d9cefb1362b04e6b0359ee0
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a