Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 05:09
Static task
static1
Behavioral task
behavioral1
Sample
386c032dae7fa4793536be97de6e7361_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
386c032dae7fa4793536be97de6e7361_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
386c032dae7fa4793536be97de6e7361_JaffaCakes118.html
-
Size
24KB
-
MD5
386c032dae7fa4793536be97de6e7361
-
SHA1
8a1cb926beb2f8a887f41e70a7e61191e4f79b94
-
SHA256
518f75a4012d7365952d7075899e671826854ee62742d1aff6cca893f15e79d9
-
SHA512
c30342900326d7d5021c2e1c444e7568e7c1db357d018b44a3b9010203a5b454031e568e311d889f7bb7d734e31e4eef70d6c48d384f88181d58873a713d3204
-
SSDEEP
384:zimKnZHb74fVBD8caQ3R+FhqmL++qcfIk99hedMzVc9V:zi7b0gct3YqmmOIk9SdqqV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a9be6c2d84221352fac2ba2bd8eba13c079d528a5f89993ae2e42a16c98cf62c000000000e8000000002000020000000e30ce7ce718560a6f5b4d201745083ba7a0b8afe32d9375277c0ac7c50426cac900000006e413d7ac240671d85431efa281e99843b9a1ef0e0e6a30e96f0f1ad516d2443eb438643b68e0084e472619b08457350eba3828167e406136d12418a8d4944540b5d758c14e070585b6de4bb875b20aba7a11437cdacb6e08cf4410e55ec1887b6f02efbf814810662e4004327d288055a5b5aac1eedc1e5d836fd8ae91792601ab6f55ca106fcbc69e94e063d132d0140000000c6b94c772631428501e5e424537f2f53b0f6f569b9d4217d233182171e73e92a4c2d538e4c64696251cdf5de4746c455787a3e8f7347737ae38465ef3dfc3a5a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBF6D531-101D-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421652431" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b1f0e8a6dde3ef5abbe2782d59a94e2844b819c13c325dc06765cd9f9fe20302000000000e80000000020000200000006ebaf36ed77bc310fece68e667e140a19e5c6a3ce84f80f7cbd6a8244bdba9fa20000000860715cc3cd3b54f2d6fdbb8936e761cfe171faa821fdacbf379ba396d7c5c0940000000928908fcb50661a51c4c6ee590a8c2c6a69b355553fa958702eaab8dec1255a80adf8e756561133da46028313f2a39eafc4b149c34804c3acd1a519ffee16fb9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c9e2a02aa4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2780 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2780 iexplore.exe 2780 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28 PID 2780 wrote to memory of 2832 2780 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\386c032dae7fa4793536be97de6e7361_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a923f3879d76d35addc48396914d43e3
SHA1fd35725cc5848c2af2202149e36f411e3cd6b9f6
SHA25679c2d10fcb641193a3c8515c9cea055b9ee57b2248ce8d3875b501d804d7b58e
SHA51202f43f12a524742b2a9d9f287856da2010b5fd0ed44b7e26877848b97e9d0d068dfd2103497a65cff46f342caf1795449c6701602fe9e9bff0a0fd9f75ebb55c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586e0147db6a1c4e7b7c95e49312a1dae
SHA1fbfb7d363cde222a9b93bc31a3ae56c6a17d5dd9
SHA2565fa7c19b88806602cca16ef535b34400449a28090e89740453d82ea152e616c9
SHA512c58d5e0ea7d35218b67555e80435a54e9d4c4e3fe77bedd6dc3d9e3e4898a367c84bca6fd5ed15651cd1569c8215206a0ae32fcc7153f3e258b97ddc360c3787
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f66324543faf1c25efd13ae4a4a08b6d
SHA1519678c3cd542999327a6ffcf031b964e41c6bc7
SHA256a7b4c88051ebb0c66cc30757fb9ecc1ca905b4ef8d0c8aaeacadc68e7afbf2c6
SHA512ce1c1ccc2f6fe268d60464459f9241ba3c7cfc2642632050eb98964a01bdba9d1e63e201ab90ae681c36ae6897ad4ea396e0984b6fd3ca9b284f787c90fe030f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2e010db29fa159b3fe12e94f8763cc3
SHA1c59372f82e28c8974dedee931958e33f0378c702
SHA256536e857fa1236ef18a26fcc696da51b274850b620d0a53dd310829f26ff65441
SHA512e78d0568e2046aba35c8a12ba3d5bede72c542c718ac1311c6896e1e45ffdab3fcfd914a273b36d5c23577a6b21ab15f84fc3e145fca2659eef1e0cfe39c26e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560b63e304925b36492a44bbc2204b8f5
SHA101671d161f6801d8e2bc529de65018f2fe75269d
SHA256ab70931f8242e48c87930790d402972a515827d9fa580503de1e3cec982b2c1e
SHA5129b14a39299bae0518e40f2fbf22779cf658400851c8739b884d67a3fb1691765d607dab58411b6feec372f1bc639032222be54b0ea1706b4a941f276a437533a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59661a89d50c2ec351c076f7ef11d3651
SHA1dd7e146fbe157c84cd3e207d84894708b3e6b31b
SHA256d08755c2aa9c7e7913b8a0151e1ffa94aa59430f378cde5cf6bc39662022871e
SHA51239b6c3a236ab7d658d10d3bc07dc47440c9b475e35881c436d53211993575e4e71a37c0e07de338292d255cb3e3173e641a1f232b4dc56abd8fe167ab29d1c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5151c91a95762c3846709694e9adb03fd
SHA1788fe061f60c4f0d6bab25ce0ab3030949bd3ede
SHA256e995b6d8d9a1006d355d748bd4a274d8a616dbede4a410191a4f3c5ff2c21cbd
SHA512f7d84ea2ffbb50a921c0a9e23e05f7511440cdc8d6cbe3425b44f617e0f9c7787e428a0347c80bf61825d2307a0058f87083a1b829aaaa638fc9e1e4e424378f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5534eb6a0bf7e33b3309c3711b1be3af6
SHA1169765aa285a3c65f9df254d5460b81962acee69
SHA2565c0e4c169a34db89e51ea4c268c46f44e6a90ebe140a59f99c0bbec6cb8a4fc2
SHA51262130d12740db395a0184101a525b4aeb08074c31a1fbe0f4926f51646dcc495e576c03370f468bd08040ea3312a95048ea7f3b1ee56719b25e2e0739bd1ab92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de08c992d1107428dbf6942c9fdc2527
SHA12ac286e4ae75d1dadb89b7aac5d5f390d22de3fa
SHA256180099a304dbae940cac798bc1d756b9ce4d76705fcd939635a0e151ea5b2d14
SHA51230f5240d19f52ad11c2dea8dd62da56f9a049501987064488112d93d8a6eb2bb78220923f04e2ad1a9b914432251923a76b617a6bcc687c1227c39f5a4a89c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8314439a17c7f77dd136b41a37a26a
SHA1312ed90354c358fefc191615caa646965a5c79ee
SHA2560781e8aa4f85ef6136f0d64edc41c65debbe5890ab1a4676214e4f6385edeb69
SHA5126adebc7e8de89c3f34051bba41a4b0182babffefb39d0997e0d3ceb145d9d33839b78530d74b4fea26d51b9c9bc4b3f373fb1e1ed2d426d58d6d48119f8f74c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5317676569334362e79abc7ef54673648
SHA1a5eab8ca37cc06097fe8960da4c55ac5b3b3ffd5
SHA256b4ae66612ea62f5ec4558a532f458ccc084359bc0b00f61065cf6b7713bf94de
SHA5128f6126a0c0477d359d04f6faf31ac3c5cdc4858711d88391773596c771c623996bc931e33759dc60e2d0fc227be40b1e77929c42863d2b8f78d1b09aa31ebd3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e37b87f7139bb0347f8662420df70c2
SHA1805d751bd0c059ea8f1e024c922f2a16463dfa2b
SHA2567d7178532405747caf4676eaa3cda1e625d05f9605a7f5cb0a6e89896c7a1a2a
SHA51298bdf1093acafa7406c9c040c88e2a2b8fa9e5b81a5ad29525d8ac197fd211b11f556068a19939ede40c0a8cd017c831ed13abdb14307d5ff913f0ec3ce4f9fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3285a2e077a07f6d27f5469a5a1ec7a
SHA19eb6ae4e00a6a335bedcb126a90824941133adf2
SHA25611a30ccea71e4b31b060a634b76ac54e84087739c7c450ebe59465fdd8c4fde2
SHA512cb9aaf84a846f0d15ecd9a3f3f7ef906fddc8c080793a833de2f80cc68d41cfa9db738ecc0c13f6a411c220487830201ca00a6b6361c08f388085f126ca9b65d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa874d71f0b137c923fdd4fa9cd4406b
SHA151d1e1cb2070dee014f5233b33c004d1e5fa6444
SHA25655ad94c6295f035b3c2563c2f06334a0e2658936eca0b026bebe6428bc78ace4
SHA512cff6fbf2f7cd423efc9e068f938ff6a7d96688d3eefa5f9c0912193f0978ad38af28a7aa4466e49a99026c06034b40e9c834f777069c925e677f2b496b4fa2a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527079da1d06d254906482286649d6ff5
SHA192e1df7c9cee670cd23b8840b09f2a67d25b0153
SHA2564f79c15bfa1fded9fa7b410979c7a210d190b273748387b1a2fd5539451afecd
SHA5122b6f2bcd04c09dc2db12bacc2c06f8cd36b18c4d7255fb788afa5bbd7c4f26f45bf1b386963557eb7a8515edfbc819f648fa3d7ff8c208c1f004f71b6b632063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505c48c3470e221b89c3c913dd5094a38
SHA1094d4e0a8382b151a6846b9d486a897b58c5cfa1
SHA256152a3a0aac61ba43a4dd7074e58a75a159f49e35db178e9f64fb0a959ee3f179
SHA512f7e0d6f825ad68184df6b1b4aff87322a00f9de5617806a90358e6a7d3c820b4bf56fb41ec240b49111bdfaa6a5e0f57532ed53cbc7f4192998280ab0e4cd7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594ba5e98d23667dba8a3996ce45ad4e5
SHA1194b4974b67b1c494b6e6a3bcabbddb55190206b
SHA2563c1b2f48e710431ed46f479c267055955da375113537fe6a581829696dd614dc
SHA512b3ba54fd6d33d9e55ee1611ae8ed8659e30ea4699338dcc0a3efde95a4b02c28b2f9bbf3f254e3d7ba6c78235d15b4842e4e3cab90e5e61f519b45fc20432a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565fa32f5555f087ac1a16ad3476e7dca
SHA1148ee7771ad332c85f912967555cfb345cc58844
SHA25683a86f82b6ebf8a47a5dae23d944d8d9058a96438b018dabfe666ca30d25f5d2
SHA512c1cc3820c1861cd9177e314e505b32be96fbbbb956af9056e468412d7bc6252efc9300f310348ae162400520f68026416521bfc8ed68eda3c51d11a5a1ce9091
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a