Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
37e1dd89f66d257f7881d4291e5aadb4_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
37e1dd89f66d257f7881d4291e5aadb4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
37e1dd89f66d257f7881d4291e5aadb4_JaffaCakes118.html
-
Size
461KB
-
MD5
37e1dd89f66d257f7881d4291e5aadb4
-
SHA1
732be942575074e2f72a5d03d777778537eac1f8
-
SHA256
338f7796d7f6b1413fbfcec965152bfe21ef4e17160db4c149f6099767c79da7
-
SHA512
88aee45715c1f9b1962c5f83d57af22f847c888cdd94dace16ff5694428629d205acd85a453cee5cd75cbd3335b02c145bd1063fab34988a06b47de78ba800d8
-
SSDEEP
6144:SssMYod+X3oI+YksMYod+X3oI+Y8sMYod+X3oI+YLsMYod+X3oI+YQ:f5d+X3U5d+X305d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000001db953446a5dc4e53782271beea2e1364f54089b9035d6f9662b4d4be9626fed000000000e80000000020000200000000ef277af1cf07fb071e5a942958ee609087a952e930574002fe376fa7d3707b5200000008bff7c42770958876c813b729bf7e8ef798b34efebed5d5bbcbdba892ad3cccd400000003a8ee2e8b446ecb91e380a1f1a81ce91f57154844ee81165dc60ee97fd5f0dcf0aad334728f0344e64b4b7212443c81e10e9951bd046600f12af61594ef205ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008cd5adcfac371c8aa7359fd49cd427bd4bc3fb3a8b74cdb1697d014faf50236d000000000e8000000002000020000000cc086d4032eea80cf6584e243f3a24f9ee91702e1a6221b061776863376438f09000000011beedded7e58ed821adc38eb574877955054e2549bec7044a8fc800a552a3f1394ca97717c07e9b22ad21930816e8a696e2d93bcff3d355aba6b132dfc52c6689f191f98e706fd75996c09d0bd08f41729ddc152ca32e13726c2a90f3893a7ac76e3d9d081a6ff6f70bddc32afd4a9e8ad04457766eff68eb44c30c56f2b2b57fa014e73f4b35343c91c3a948b94a2b40000000ec84f802f5c9105c0375ba60a4fe0fb6b90454fa3a0abef99ecea209b805726505138cf5134c03ef7b83bcb952677ae5c544d6f215cb4a6069b26d4d45dbba95 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08a12e217a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421644374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{098D42C1-100B-11EF-8547-E6D98B7EB028} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37e1dd89f66d257f7881d4291e5aadb4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf476c64059235fa9694eba8fe037a3
SHA142756c7cf6cf3fe3599bef39660d50cbd8a5fee6
SHA256e88ac99964c969099a11f660f39c22204a84b0eeb11158ea086f7bea5d68998a
SHA512d77a47162729ce8e6b3bcbdfa5b3a997dad866fd4c9d180862b814e849316ac78df4203f256ff636939c22be206cd5f9f3e04f8dd2e74bd7246733c9fc34d601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cceb5939c28905a5a9e3b74b22f7cc3e
SHA14ff6ffbaff1ab15131e55d6ffc6a0a2fe214fa66
SHA25673b30fbc94095b0d730aa453791a1116ec6e6a855301dc8a7bc4ea4b519bca06
SHA5122729e430d855fcb658c75725946db2b7bfbf0f47fc3fa2a2994b4a97bc91d2f3fca70f81aebe65d311c7421f974f69d17e4f9a8ca44abe7fc2e06ddaa2bc4ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc413b80dca1dc47a8cb9b009b8484df
SHA1bcfe84e59424af692180cbe163325afdd030fab6
SHA256c31e85c8a40009ac275a523942f8ef76199d258a9ae2633d2241f625181c1b3f
SHA5125c1b78d1a010cd03fc1dccd87ddc011e5f563871315a39786d933c97c0a7dde9ff07e60bad76e6b2b478ec375ff02160078d83369bf2b53394650487ce291be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ccb251642520a8dafa906820506b2b5
SHA18eab26c867d1ecf4b6a5696a8afe6f8e4b43b4d9
SHA25651bf2f96deae8add7236a846dd5251fb5980eede44f7d695260222998fcdb54b
SHA512ae99d01b6e00d1c3c4fd1adcdaaa0bf3a1d71bdcdf8e4c1052dc56d6a37c1bd72ad19ed7201eff86ee60c81fbbc870a2041bfe4e73afb5d07aba5f8d863d4091
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f95bda544dba9fa55a98ee9d8d96eb94
SHA17198475b2588ac01d3d83b05f86f40a2b7c0bb46
SHA25636c34f5d1d2b3fb3d347c9075b6ec8a31db1591882ea3e0d87053a6b4cb33fa9
SHA51202856032b7d3522770deb49d5945f066adab56ddf8be4712bf2687659f923fba502ff853ff8d97be8d344bccb36474adc25ea2019d7062544cf33f48003bc33d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e6239bda3f9f59262ddb29db07ca5f
SHA10dced193e83d11656c0c62961195fde1429cb96f
SHA25699209d86ef6791d5d115f3c27e29a23ac353bd046c957dbc16a4466bb3c46fd2
SHA512b96edb5df751912219e5a4c468b20d35b42ad0b3b835f73f4644508bda36c0d87494d7f07246d4c6991022c3b7d2f17831db2b29b1097c73fac692c05c8485b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a02d75ba622d0e2a3a344ad43e2b7ab1
SHA1d934006f403f3d85e53df467336eb1f354e8deb9
SHA25638982da5db2ddd7485c088e152813d205009ff50e24e084bda8456143782d80a
SHA512dcc5741d4b2666226f9e4ef0764cd1432a5194997b11b3aae669ac8df615e15b834a7067fad88a1dc6f3226577880dc475c2d207064a438d72cc8604a6461cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab40e1054b5eef2c9105c18364805cf
SHA19ff15d2c79e3a19b2299dff403ed72660ea28c33
SHA2560c78044b22680dbb8a32628189bbe8960e7c1faf42fea9c6957eb1276b306886
SHA5124fe4b14fdfca90821479d1e56d06e83053ad5018846c0ac7c5ab9099ac1b2e01f0aa64333793987a26db035a57f3eaf67fe0f310b387c068f67a0c5be467fa60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e0dc4731e83770cfc99c99ff0a1f50e
SHA19f42dd5c6840583d7455d2bb6d6f89f06ae2359a
SHA2565670835e316e681c41fbb42982a531949bc22e0c50d4e1816a741971c4a889d3
SHA5123535469dadfa4f534e821384f3f8bc80b8ba8a61f4d8351b94a087c7db096c88c4114c902cb1339a8ed7f04ca6268a2bfe6b0c17faec6bc913beac584926b4dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5631f8387f4c7c5c8600ed1ba2b785061
SHA1181c4eb2aa395604b701de0a2c221c081ce585d1
SHA2564ad5434f34bc6219af9a7e1f4988b245362e9190c344f7cba81fb65dc2bf9dc2
SHA512fb005b2f322036bc31dfd7eca1391f017410ea201a40add80999bc2eaa4c29319019c9cbdb5b2ebea3acd7effa4a187e6d72a03158322b54906d89a1f23e5969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c1e1879f5c134cac793fe60a17a3b92
SHA1e3ae9f0c5a08ad25899f7c42181ebfa466ccd443
SHA2560d0c1f25ccea38ca673f8d1ca245d88b86d534ad4b3db7d72370eae98cea35c7
SHA5122528e3a6b07adfcf775eee77cb04f9936a804efa297f1703a54d3271dfb352a222255be5884c089c142a6cac50fc2761da67b6d66df2a003adcd3acabcc98083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dc9ce802bb28b54ffdbfe00e6eeeae3
SHA1c317311285005bcaafdc85899163b014108a4e55
SHA25631ba00aee022a59eba62f7e85fe4e29fa5b477e150c1413aaadda2d4c46a8764
SHA512c5486cff2d545ae2d7d841e8df1bfe93ce03d9cf589efa44d1bc223bb5f49c1ac520beb055ddf57bc30e7b1d102f90f99e1a48b1c72591e5031285bb8d323cc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3ea733f8d016b58792e0652a48e6de0
SHA147bca28679f64caeaadac4c9a2fd894e34a2ede4
SHA256315b676a6257e497ec1867aa1936fc428b3ca3e72cc2d251f4d9bfc1a551602c
SHA51216ce4c50231deb72c5c699826f3eeeacf4ec7b11918b6ad6998978b8b0e15fe02d596907791c10ded7968efd92af27068122da62e1bcd8befce9de0b8fefd763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555fbcfea67753fa226ad37f8639ca872
SHA1b313b6f841f35a89a67bb1ffa0f0dafc1eda950f
SHA2561c06dcc1a324d9d509bf0b553a29d168ac37c9c58e741ff958f36aea2dd9011d
SHA512eba70e4a07bdf12e9fda56a3920f177d81833676ddb8ff236490ffa6175ab1678b58392577fc8872300a377f07c487cabeeeb1ddcb77e42a1f2900fadfd762a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5173405ed31735fe9744afdf4a6354b02
SHA1338e63aca50dbe6b3c28e590f436c40e3a7a71b8
SHA2561b9e24b46913604617a07be63d97c3cf507dffab54ad31ec2f32ca00d6b1d829
SHA512c447f7624b38a55669b4041a58e457890838231777f04f49eca254293b7a3a24db35402febb0af03d1013d6f45d2efe282e95f8f608201317266ce65a8bf0f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5143113eaf67638386c13994838337891
SHA1bbbe170828d9aec1297a07cf074cba6199bbec98
SHA256e520232c10118a6c036aed7dbe6e706bfe4d156b1cf8c435d5ecf5b147516043
SHA5122648bfef6eebf328cb0e8a4b44560a81f8636f065163fecdf471d3f80b173111d29ad4989d0b50061b5d16134b54d7e6de10aa7a5fa3659fb47e4ddff9815a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b1c8e389233264fd861b3dfd9fb9dfb
SHA19e6ddcffa175192b382fe0f799ab047d786c0a24
SHA2563d894454f6506a7e9b7f76c8c87b585e3eae228eec8a15b20222291ccbe446f6
SHA5120f77f2c111661ca610072834b8ad69b3eeaed4e657db4891745377dbd036b28ede28d9bdb7008a4a948b464efc2bc0839058b7296802340ff672efb1a5421e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5781ef975fdab1cb845aea5fd0a073b2b
SHA1fbb65614f57d46c2a4fdc69fcd6f4ac507b3a75d
SHA2560f6c452b7edb5c46310277a0404412affd6c593eeb83de148237d7d1e8379a85
SHA512b43997a26964cc736933aaa6eb6c56f04b242af1618a0da540004009626312247201dd8e25d461bba0de1ec2a112de3f4d8281f918b18fdae397bfe16ab7b67e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a