Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
3847619ffa46b05956ff540937db77d9_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3847619ffa46b05956ff540937db77d9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3847619ffa46b05956ff540937db77d9_JaffaCakes118.html
-
Size
346KB
-
MD5
3847619ffa46b05956ff540937db77d9
-
SHA1
0e8d3a53e52ae7be879192b7eceaaf23beb1cfa9
-
SHA256
4d3d3431933bdee8983715afdf9b6b7e85b7f6e724dae0e4eb742a57bd17f945
-
SHA512
2212c80884cc1ebdc3da60ee69ec0cf54834c99ac26dc2f9802c3cc4a7e63d463104ea4d49780819fffff84e1e31ca6616a79eb19676ab88a72991ad5645b3c6
-
SSDEEP
6144:asMYod+X3oI+YkMF1sMYod+X3oI+Y6sMYod+X3oI+YQ:45d+X3mMFh5d+X3u5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFE4E411-1018-11EF-8962-7678A7DAE141} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008c1eb59bc83e55e50fe0803cef99d2d1961867c0e7fc3757e4707f659a2d9d6c000000000e80000000020000200000005cfdd737b630b4dfee4a489265f9be63d4ce81d27b6f5a9687beb5a5ebd995e3200000006204186fd4b5fa83a39137445ae174dd541a7af6924bb18f60af6512e2c83a5840000000a0df73c4a941f39715d48882b4aa9c11e1c58f9c6006b5d6fcf3b2ff8e353ad2af6e970d0673ec3968fdacf15dfb00404ffb4289fe2ab57a1f23aca822e5bf74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40487cb425a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421650317" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000037cc3b3c02cebe8705fb27480a362e1536db064cf39a93cf1dcbaa6b8e5b819f000000000e80000000020000200000004f65b9707c74b54efec8771643e8f8d5f4e33099155cee800abffd8c336871b690000000dc394c214756472689ff4f50d6ead7bd8d9bb5c80e984858d99917da06931273fa693a1f1d4bad19d69fffc3f55c5ec425d488817ce7086ad280becd57212b85f598c6bee49f79d79003c36d3999e2d343c6b5a3c304a3ab8270de6215076cba14a15c75e8bc53ddba7d0a2fa2000f39fd5cb43e68ff7d8f767c83c15456dcbf3a1d973cc48160e894676da42e7a3a7b40000000119b11ff182ec5a2797e740ed987deda381951fdb0ee18da6b12cf486208f3a00900aaecf81ee4aa7c108b462c2ab9311e72bb531d1f32ffd2bbdbe5e72010f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28 PID 2400 wrote to memory of 2604 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3847619ffa46b05956ff540937db77d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c2b0526a789f8d1d3dddb696e24b92a
SHA12ded9f73ac774b22f0b98d9b270661b7b8743761
SHA256eab101188b3af77853e2b3795aa2f8b2ba2d9211fa3dadfaa6c87edc844d5ab6
SHA51265f1d75dc4fd8fcc77fb6facae7833bf39cf0c2ecf508f394da0c2b456fc3a5c2703f6b1cde75acd24437df88cbcc697f1602bf94440d79c82d1d911d8d6d121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1f67fc3d49d071c6489e1eb9a4603b0
SHA179d581774a6eeec8b67ce9f373103c746c1301cc
SHA2563b2080b0134e1a246c818bb110d66f8c089ddd6afac64751ef45de7ed3b9346f
SHA5124d1539d1b541a35285337501129d4ce59e21e577cc473dec7ee7fe4b3fff20f1728d38ba54ee588f03ac05cea6e4463a2f910196dc803c51df55ad14bc226fdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f8c335b87cb848103c46a1263c37817
SHA13faa4775523c1db6677cab708df7924262442076
SHA256a0f9a45de48a66e29f6b2fbdff3321573865528f6e663bd169658c35b427d587
SHA512759b8dfef4ecd472c33e8e2a4eb356c1c48a578395b911644305025f352f4b5d0f83860ceb3f40867ce0c74e3afe751c335367aa7fdf46f021343f34bf825c8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dae05b2508f757d7d75a2cf8f8ea9c21
SHA1deefefb4101c6e13c0045f1620d875abad65f7b4
SHA256a6b1d297bafa16fe6a84f975f6b12aac5cfe03b294dd44b82468664ad2621204
SHA512b1d1c3a3f7b499407e2a38c737c8e6539ae0bcedb27f4402c08903c6fc887e66813f2a8a71bfa775f306d619e010a4482c1354f65325d4ad043905fcd34c6d23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b98b197afb06ddf694f160ac116cacd1
SHA176f5ef665b307116d0dbd9cd644c76beb8710941
SHA25610d20889aaed0fad103ec52a77021e8f1c54efd7651ce80cca527a7cdfcb87ce
SHA512e52862033244f644c8149cca57ac638a3763bb6114e2d438f5fd2b91d260335711417d8626e433c73967ef315451ace5a92ebcad2186cb29fed0ebc022f8cb5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53af2e7b7ea11eaaacd422e93d677f65e
SHA114f9f7fb277f67b3a43576d0c665508619d88e19
SHA256c0ba76fffc00a4b3cc8acc403a02b48102edb3096ea09f76911edcf008849e27
SHA5126b1898b31f42b0952a90f876a1f2b4152051bd5faf921ee082412e00bcec77c7231bf41b8cd30e866f527eba939c764ce863f606393a1b2994d4795f3e8e2df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542c5347ba9268cef02b3231102565dbf
SHA18181528b684e708dbf18d5144a376540225291c7
SHA256ba25785f12c1a7e82d676a273f93cf7616020815e9a22e67ac5e57a83e98e50c
SHA512eba64a5ed2e0b4478571345da1eed350b62d542596413b0b902f63167e3b7220a3ee2248ee73c15d41ecfc1c8d9499f7c18c74c718010d9d5e4a647e0cf382f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cc786b68181743ab03d65e963a5716a
SHA178f8972610f359f2cb2792fbcacccdb85b749e59
SHA256e1e906db6fb4bea84e0574f15a1a35bc00ffa5e7ec0a6b932502cbf42e3cf622
SHA512419a3fe5cfe363d9b2264b2db9fd1ecf5666108ecc096c85689cf7efff24d1ada3e4eba64620b5977fd7664debb42bdca679a346d9a5ec2601d2517a87489a23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f6adbb7191dfdddad29cff905d0683
SHA154eb662d6fae9d69084ae4f39fe254b17675724e
SHA2563bd5fd8d2fab9b15c31aab861eb493063d1d3760e4df69f5261c9e1977556643
SHA512d108ece70febd53522bbc3d5a7c9ba1dbd954aa2ebb76b83fc0c3a3099071bc6e5d5b6d6c7bfc30ced18c76cfaace6c8d043197781f6d4f79873f8f64bcda7a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b737ae00f1d7b08c881aa1168a64d6bf
SHA19a20ec8831ed9d913579bd8746435352d0ed1413
SHA25634b24325dee9e29a10354b187a1f4355215c9531c72e1b5f1b2e6385f94a19b4
SHA512392211d07dd61af62e42d1ace707b815c6e90cdf7fcacd11c5181ce1f7690d43ab9c68b51e8397efb02b855688b6f8dee6e645cda99385096c3541eb4133dc13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa5d368603a1f11c857cd59e283ce03
SHA12f80b4d13a237e8e80a3ee1362455c5f8d246c53
SHA25641dcc16db0d9d01df82a14d9bd31f3323d3a84dc094f98c29337ae6e93e585d4
SHA51211307843f83d6f6ad34905ba23e5b64f64c7fe44033a2bb50f1b156bfe7f60a6606d46f6f0c031a7b87b4c556da52c3e14f1fb8df1796533fa57207f926bc110
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b7412e53cc7770f04e9bddbd7b3ad6
SHA12cfbe498dee19cf3438eae34ccbf96d23fbc8e9b
SHA2563a359adc4f68976961449843d7e3c146b6f49f502bdb996835a59dc0811b55be
SHA51296f27471878abac6087e27270859627f34b8c33bd6b2b21c27e2a3e4d9ad19cd8d728256dbb250b724e822cfe617ee11e1806f993840345ba242685c0aa53d10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e05d7fb193d1f1d4846147aa1ccd5fb
SHA1f71816afb677eaee6dd02dc3b898965be71c185a
SHA25623e4944364d6ab93b6a3fe5385e536164d70ad417903a5acf149abf54920f424
SHA512d3673c7fea1c060a69c506d2570c2ea39e1d719d6928b7f8b04af355c6ba413b74e3e77f17a74500406eb92278c46fba10837be95a75b98236e47ca6dae0578a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55060a6044ccb3606b5ac963ae4f4842e
SHA1a568778097dc9b92ad347bcba91c7493e3648ae9
SHA25600ac2054b642c18ca26225ff7d706cd4df0089d654927b37920f9490749a015f
SHA5126f32d58dc996573b769b9cf42d8752cc23f354f2a125f2df883762eed9d33afcb7b23ee5a05ea7f64a63d6af97d06905f42f250ecb6357498d050036a69b48cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571827dbef7bc0d99b3cce80b33efadf0
SHA14314fd102476d639c35498cd2d0cffe5810be0ab
SHA25683aff8550e0b2ccdc2312439d92dbd4e73f19d2d715ef04d37d157c4147f2805
SHA51225b7c8c0b2ee34ebe560c8ed2607a2a8d83168fe3cdde88aa99d7659f0280353c3c413a12b2b90cbb824ccc0e0eb3640f7a5af87b3f5c1205e0d6856b1022d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9372c7cd863232ed76d7440863dd00
SHA18b9062b1062f5535c108ba4d20328f23e904927f
SHA2565699074cedcd957f277e5857974ed8fbeb5b95db8a9ba4c88b497ef25d835761
SHA51287cc334953908983417dbc6bb957dca8cf87000813f48614feaba0b8f8838aee44401768b738245152795d0e03e372d812b4fb52688db99226af1c4955b60ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d832344b4ee7ee3b08d86570c0cd817
SHA10ebb13b36583141c986582a8e34dfdbd0bdf9983
SHA25694a45daa1067b217570f12e91107c1df5989aea3603efe882e45bce69662e0ca
SHA512f6d9234dddc15af2b37192aa0d1bce1e05974442486000abfc3065006ccf5a4f07842af149985706978a49dc30fac924f0deabe7c25da1b4781da2a1e76ac087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5159b8bad8b0d89760c40f343e9a8cbe6
SHA16e5621e241c2ae478df809319f7f0ca9443549ac
SHA2562ab3eda2be8515ebc282f60b57c278362c8802caf20a21890dfd4fdde8242ba6
SHA5126af13c8532f755378c710f3900857e9c43f60640d2506a58dfc30889fb86aba860592fccc376cdc15ef535b7cf2f5ea214b611aafe66d32d701f86e8971d58f9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a