Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
388cb2fc095674446b9287987cc2b05c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
388cb2fc095674446b9287987cc2b05c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
388cb2fc095674446b9287987cc2b05c_JaffaCakes118.html
-
Size
70KB
-
MD5
388cb2fc095674446b9287987cc2b05c
-
SHA1
7d9a6cc36e64a9ef83d749c0a64cd4b27e32f260
-
SHA256
03b91b3002090ab37d1cb92bd6855eba5a479afd17c0c468c0f746ee5aca63b8
-
SHA512
7fa8afdbef3e49354455d0c4436a627e294fbeaf886839adc46ac893dc6956204f24f1c0759df53b16d922c41cfbbaf93a6f6d9550621c6c5de7ec3f64be8d3c
-
SSDEEP
768:JipgcMWR3sI2PDDnd0g6kmqsoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8sM:JxBTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307e1b902fa4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f86bd3916bcce1bca3dc60d7aa92305764c940cac78204af8fc4ce0780731f11000000000e80000000020000200000001bea8d5ee14608826fd5eb4257ed2d4e0e6d86d059bf7ae9fc26f27b17ae038390000000d91bbfd23f4e289db1f36e1395835d42f6231e73025b8a322763b76cdd46b50e0b4c52284de5e219f7a14fc09b05ec8a551330c548a2d8b64c5b980fd2e40e46696335f878ca6ddf9efa2cc6d526ed7ef9ebc117a5f1b5038ea0e993b2a057bdf405e64128721b3d03af9229179fce1f5e29fdad4d169528473ff739e1fbaa2422c6c4675ab09a2cbdea4b786142e288400000001c37c2ee23b6f0fd80908965838d1f5fdbf03ae2a4c4b02e1a6bcbe53e0bbfb23f39a63edbe6fad53dd76c0baf5aa93aa3bdb73643361c3920285f8126d6bd3f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421654550" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000fcd2acd1177557aa4c3cb38c08574b92d569306612218a94ad17b5514c4ac922000000000e80000000020000200000007f3b7e00c3d8b2babbc8c058594c9dba2d805bee644205361aded7b9acf1aa2620000000d360266c42486a10e2e10734aadd387969924acf71fd56f5ffc3cdbbc70bb44840000000f01c282a81c46c1c528805efb177f041607260347989f40851ef8e901c5a4df88fea44505bdf1a1e7856d166aef3f4363a04e4eed9aa2240de96d49ae3f39d09 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB87BBB1-1022-11EF-9591-6A83D32C515E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2968 iexplore.exe 2968 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 1580 2968 iexplore.exe 28 PID 2968 wrote to memory of 1580 2968 iexplore.exe 28 PID 2968 wrote to memory of 1580 2968 iexplore.exe 28 PID 2968 wrote to memory of 1580 2968 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\388cb2fc095674446b9287987cc2b05c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e0e9834d3ca2b71ebe93c66fdf24dfc
SHA1dd336572c9a3c40147f854d54c01b3dd1234f993
SHA256f9107448571777ceee2fa670ff681793e154895f266c77873275ec5bfaaaeb93
SHA512e6a85db93c2fff5ab94c8bdb7bd0cebd60c0ab89fa8229268c2bbdab9a64188dad4936438b31503f8ae35d89e60b4390decb0dc835c74c6896961bfd95738ee5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2d2b44db6060d7ccb8299ed87939496
SHA1d56288a56e77e7f4f43e0bdb0952646f35c9aa3e
SHA256c3434970c8070f000acab18fa003d0b55e7b6c4cdc9fdecf93ce518039f57080
SHA51242ffdd1adfc9b220897eae29d91d26fc8b54304a880ade6d4633abdaa89534f06d2a8c05c8ef7f269352b06dea96e59501e901273ea4d88c972be47d92f70391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ceaaa332f844d27ef919cf69cbc7572
SHA18e329273067b5f6ee3c829a18b1dc53d888e1063
SHA256cd2ab1aeb8489dedcf0591f285da5ce58a2fb8b5fef60d34d22888dc4b5dc7ab
SHA512398848098dc1572d6687fbb27c70d421e41a47708c8a898222139026ad8c9203138c74721896ee2449f05994ec747050ba824ebe0e70e09a6239ec05fdf4c9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5223c31a53bfea5dd19dca833e62eaa2a
SHA1431a60cb2cc158fe30c9791c7cd751b9d8058460
SHA256f5aa8b73041c954ac01a4ab1de3dbdfcba7b96966fec7633826c0fda6a78536d
SHA512c0fca7b091cb631039c097e52e80ca23f1991d598cb410c6884038e774c6ba6b3c0c47d77b917f97356693d16f2cdb84090a2b2ce34963dbfcc91950f0f05fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980d0e6a9e7a0f5013277893e7090f8b
SHA15aab58a422defb3fccc8d2283c7b8fe27ea56515
SHA256d6325d38ebe98d795a11feb58727664d70e5e67989dd28de08b18e3ad4cb9c1a
SHA51264097a74a09a85da4acc87aac890be64a278288885eb1b53b7da781034f229c897b4cdbaf902750a26500e146af88f2602849470be65c5001c0ceff34640e721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6877643fb17f85d51f24bba839fae42
SHA19e328e068aa686b929d184c4f6a1dca8270c3430
SHA256646ab0c19dd152c1156d1dd4bdd79059aa535835acfc0813b04e853967b11cde
SHA5122a546a29b993f35edd13413321246ff0df2ba6df586faa1e8fe8a70ef427bd8081c8f33a2faad049d11d082edb38527cb2c64bc1b533b596ed0d0c47d9274403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea4af85ebddd5f16cca8334fcd01bb15
SHA1434b36412a9b8e5c9532897027e5f26e60ba9566
SHA2561ca3ced4362c4b83dbdca6798ae63c864e6053b9f0a58e070facd34238c9abf1
SHA5126f47ee979bfee6abe4bc644732dd56cb1c22f973e5a67412ecd7f92f441c03b599808df0eceaf1259ebadd45acdddb9dc317aa317aa9d4a6f17114fee5f62e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562aaaf1be4ff05fc928a84d8e856773e
SHA14e0975becd57d8fa253c4d729b4394f5cbc60f4d
SHA25615b4d2f265e006eff911a740c41f2a4c8fb492db8ac3374b5fdc8d6d96836c0f
SHA512150c74d7d0be60a0f6cff69c27498eac32e1c2729e5f1dfdaa987ad7b0176e00087012d85c7e24a895b98e23d28a75574f660dcb7b355ef9b3d3c8e2bd3f9aa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554da371da5a4b3b23c260ec3c5dd530f
SHA1815c58233c7f6adcc106ff8d2581cb76e5f06be1
SHA256eb0d14fad8c193ab3c56728f9aed6003705c82ed089c1c27e2173da10e28e642
SHA5121818f91170d9ac8e82f6c4b695dbc5afa32a73f014e3fd589a7e27af07299c3dbf4be1d026f0be5a313e259f2174b8b318ada47d66d8250cb5ad575514259c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52942496904584fbd24849a9af8c566bf
SHA141ebaf656022cb0f9a7b2414ef7c80b48a9d5134
SHA256619db4efcb643cc1d87733e5d153ef05b54986de187a8abc2797c47e8c0b13c1
SHA512e31f2f05df426b515421dea0c8515c19e90993373d79a41b56c97cfc54b671cccfedca563e42a19151165ea54006711ea130c3fd21378b49b946243c99731f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b015de89b1535280c07c8002bd20ab4
SHA1651b38df9a989db3be16bc938c002960c8c8a940
SHA256939cc93504459acaea49d44a5452b09baed708000b734ce4f88f16929064efa9
SHA512cb10a6b231318079755d42e7f128f8766269234f44198de29a05f2adf849bd95a06af7a148a87b594c87a8edb5709b84ab1f5331239d315ae1216332be815ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f82a3118951688632562ef1b62ea76a0
SHA1e384a55581e6d253e26122f04cebbf9ba81ebb6e
SHA256b366267eb8536cdf774f47e169ce5e86c77b0bc4bef06e71f1457b118165074c
SHA512d5d6b00db907561e3db0cf398b170dde1b225112fea5d11ac06668c259618bbc0530d5432dc5884f229f372e78083019b5092f0a812f24687511928f8cc7ead6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f01bd93946ac05773f0e16713c59040
SHA1b8a47fa2a638035f217a17a2116b7a25fe9d9f0f
SHA25694a12dc29da8cd40b5b02f1413b2433301578ae042d5b03f622e1a4b1a28b1f2
SHA512f012474b5a029a8df7312d06da7cabd2d9543670b96f6926be02aad31aea27fcd7a21c0c99497aa82da69bfba2fd19e24ef227c36634863def00368c27fa7d6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564460fae6ee7a5494279326ad9f896c0
SHA1b2ef18d79f54fa23bdb75b8501e51d5f4ea2beaa
SHA256991024ec9af061ceb9d5d3faa835aa140d5ea7d911321be2ce7681b379dc636b
SHA5126ff381b5aa40d2aba3e24c34e5f21f4fb8fa1e148979d84950f74a51d2589762397703276ddefc00257a0efbfd6ce090b9003c0350b97cd1c87fac92078daf31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c57a27f3809c1149f71cd8eeea325be
SHA12ae142e2a20063b984952f0f12682512cea15365
SHA256f2782114b31e938020654013e7835ab570718f809e7a0339a25d869802dc9f03
SHA51272315f65636d04548f01b227da45ea1e26c439ab2565626ac6582de922ce8a2bec0ac231ecaff6cf7ea6c21884aad47d4db880438502bb5d5cecbfce66f63452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e4f9e0e9e94af7dbda1815ef5cf43ec
SHA16ff255cbed6fcea0d4fb3e443851a4ed727e804a
SHA2561b9e85f0687148e3fb5d8b94c184748ba0ed758c66bde9cd5e42d6580c6ee03a
SHA512e3661b7f79e68a23894109aba16d9a6d07fc4505fae7ab46be8c8a0f85f111d81b2fd6ece81d203807d049a4e7affaf5675a14cc72d1f27d4c312ab506f9e947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b0ddd7960929b12f0f0e5f12a2c17b7
SHA1f3088e5af66a58a72082cf1a6d535bb82f40a78e
SHA25618997aa037771a1c44f7b34e80f4a441ff2a205c0374a578e32c58dd69cc55b4
SHA5127137f32d5feafb96ebdc75ec147504d4d58d0c7ab085c390306f695b649e8f6c9f85b1bfa295d598964b5673015500c1f9eb84119d1680d1f743ecd2fba2c9b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53658d4c1d948f958933868b7861c7a88
SHA1d4f61ded84379c5cdc6a2959c340d28b7caf1d53
SHA256cf1fa819d9620fbe115b0d7c99f59a836d369374e12aa23cf23755a9186a7722
SHA512c9cbca5cf86825b035d02d956ad1625a331af090eed13792c65bea97caf439f413c5483e9ca11d565c029b79e3bd79faef96edbe11bd46c4ca6ceaec888f0f50
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a