Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 06:11
Static task
static1
Behavioral task
behavioral1
Sample
38a84843ff83a9f054dce377e95aeb14_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
38a84843ff83a9f054dce377e95aeb14_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
38a84843ff83a9f054dce377e95aeb14_JaffaCakes118.html
-
Size
852B
-
MD5
38a84843ff83a9f054dce377e95aeb14
-
SHA1
f75a1e5171922ae0320a546b7b1e9530c8d6498f
-
SHA256
5997f356fac661b8d3f4de1a80fe9985931e75976f0d94d94200e7490c88f97e
-
SHA512
392a70dd1ad949d0bd3d9e17c677ce5c68812cd27ee7635146c1f84a8a4d92d0492a392058e2b401b11870a9686a860756895f719484f874dbab1bfb0452c2da
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421656168" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FF44011-1026-11EF-AF55-CE46FB5C4681} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000cab5e6bce193221fcac53dc0d386af659094e4a8d062c74a0e0034d2e2cc5527000000000e8000000002000020000000a201dfa755c04fa5d2a126aa474a38aaee1a81001296f066c67f74e66ddc21ca90000000ce77ee4caa21172f6ded97b73f6525edaa2e49e923e03637c0305684e7be18157238d479ab8452843724b6518aeb295e15616c1312ca693021b1fc40cda1d3dd7ff1a70cec87f3df80b80fa1c07b6ef67c61a0401bcb5f819363c67e3262ab25934ddd9c0bf6a72a7ad409bfba4bbea84cef10bf5394a40dcba26669b021a8a81e21126dbfd328da2e7addc6fb11c19c40000000c887c34f5cbaa6409590cf9732df9d81f0470fce73a30f2660435e200f389b183eb5f268faf5a1c8eb20064e1b9af5932a21a4ff2e58a9cac54b41dbdba5a10e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000c3138afe181b72781d6dbd3cb8b68cab2e2fb7e2f6f8d0cccd9623cf09a24329000000000e8000000002000020000000f785b9906784528d3bc0b4935bc00ba3608b82cd3e9044db4934fc7341d4585220000000535f0b29cbf3402651ecc110f3ff22cd5135321f09d5ccc53a2ecc3a8b70d2d140000000a2f6bf496cab7d5950376b5aa47627f5116515640aed6877985eb65e860edfdcc9cd09a4529b348642c97513d331812b4505e86ee150458b75e1d9f13c97124e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805f725433a4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2984 iexplore.exe 2984 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2664 2984 iexplore.exe 28 PID 2984 wrote to memory of 2664 2984 iexplore.exe 28 PID 2984 wrote to memory of 2664 2984 iexplore.exe 28 PID 2984 wrote to memory of 2664 2984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38a84843ff83a9f054dce377e95aeb14_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563a68ce185d7c435f2bd4e1433ca09dd
SHA1cb1caa762b67a5c7ada663159ab2c2ccfa3849fa
SHA2561686029fe647d16976ce8bd410e31cae0204dbff3cfd30b289faadb2113efae6
SHA5123633bd16f84c169aefa55dfac53d694f812a0522b112eb8db20150993e39121cddf9e5897612c24acc30816fd759ceacfd48e2d5218067a144b67733a04628e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee42ba980e0a7dd364bd465b2eec5ceb
SHA12e94716fd8850f32667480e0d03ee84abad02412
SHA256e5c8ce5f9a4ed966b0525a01108b9cf52f6bd5d88a59a502e0b4f9a09ca57342
SHA512d7b76a94c4b089b9855d5ad36031b7580d700c2031b9c15a19a1dc8f6b7e90024cdec9b73458e0b20c5fccb444b134908c1099e5fd8c9a8c86b4b5c3ab0a1002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e317684b3fe816b5f7dd57a73b90f877
SHA15a85f740fe03465edc396ac32ec5d3270edcfcc7
SHA2569c24f775894ddc4003fc7d362b783d99970d7475a05cd8a8e6f499199b81b6e9
SHA512a2c20b49b2b7ad2b915502a34c5acd3da5f3684408c7aeebb0c717b22eb5c4ac6053f81ea22a55b50a55bf388b0d4ef458ae4403edf8d203aaaeb225c433edb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5af31e15e46fc1a5350457a3f8a0f93
SHA105216416e28270b28605c1f6fa2563519e37fa3f
SHA256461a63d4f7732f345eddb4a9ceb57e9a199a9fc15bd6cc2e9a4b3913e977d626
SHA51212fdec874fcc93b1d2e721635d7efef88700aa29093fa4f34585dd73507992dc50eba19c6a881ae3ab2e9fd6112b381cd840e8e2eb37e61eb54efcf06dd8c2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553202e475bd578491e28d79dfb56157d
SHA11e8da4eadaacbde6c354cbb0e2333b78b270cc41
SHA256226537c5c0ae27632b5e796ecda9fba59cc3ffdb3e80be15065fe96e7d145c1e
SHA51278763a0b1dbcbff2dd5696a8923addf10809b7cbac5ec12342d3516583090cd2fd3b68c05bedf275aa84d67977d66fb92127ac1874a02d9b1c27bc84876737a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580dc5a6db2bf58970c05ccda78affa61
SHA11235048eeab84ff0d8115a85ffc483da91662c02
SHA25635f355fd4e62da3e32e64a4433f87b651b508c6b436094940bab847874c11d29
SHA5122355a902e060f7ab690a6e9cbb3ad879b0ded75514cc65ce50ea84ab3b8da7dc091322dc9d67d6effd18dd319a4b973de19bf80d99fc9cbd574ba4c90ecdf196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f61e4082f55cfb267604f53ccd00c629
SHA1cfa6542584f32cdbc16771603dae4a7896d42c7f
SHA256f93bef3501376eb61d3ceb29cd51afa81df8b0d9508c04ce5060e49357346808
SHA5120744940460bde80740cab51ba0fafd83ccdb5ebc40531d42b4f0fc0316c828a412015dd54abc5d2655ba0e110a0dff09859eab67b1ba67e3ab40fa18208c9edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588b0114cca186e774a9c6284ccd9b91b
SHA12e2a02bd4bd4fe67ecb12df28cb6d91c015aa502
SHA256221a36da590d6cf563eb354ed024607419d7c53987fb9e5d22a7d9981a4cf5f6
SHA5122cd483e3fbab78f742247eee57aa9a8d7d0f03ff02fa776968b7bbe9bfee977f44c086dbb73d40798c7ebeba3f1c2f3d08b003b6c29396d97f1957fbe4f0d12e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52453216b89b6b5a7580ff856d07d067b
SHA1804a53bd733d130f8a6e4537ea82c10a8210ab90
SHA25652322767df7dbf30aae069039df6ff9896b084e8c7e19e0795000b93874d9499
SHA5124e48b5402ea3198a3f389d3b4f303abc39d5b4d7b9e74d4fa9643ee167fac7ff71f21978fc2fcdc5aa30f2123808f83aae50ce4522f8a99cf1ab17bc073b97c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58943a044d911df7c74a5d2ec21863683
SHA1229ef24587fa9b6733b5a8d86ae96f10bc5ead33
SHA25663c68546624d2d70cff05256349f5607d1363f2a31155901598b4f62030ef419
SHA5124762e8604b9594dfeee303a9654aad4bb5e1cdb509f5f72c673c8d40c1a3462269bb1124b9bd0234ef1b62c37802efe8314a67ebc575522a0c5fa47e7882ec54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf35031442a9106ec199a05d4d44b0e4
SHA13ffd20b649bec46163868118fc46c0736b3a253c
SHA256de3a859f9fda06c7ab2a189a2a0e8ca2ada4b22046f22cf2e9048fee25ab5f71
SHA5129926a0d4b4c5dbd17149451d60aefaf01e0a6c6b9e18d085cf0e31c2b79e953183919d14c6e497c79d09440c0bc1ad685ae4074d65804058ac092a1e2b3af6c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5316b6568e2ef408a1850abedb08f8cc5
SHA1fa84345ef9c8a66dd86f56ae7b68cca2bcf5bed0
SHA2568a4403b017007951de519b7deda6120f833fe7b900e2b26a9c7b10f8c1a53b4b
SHA512d7236d33e314ba477bead0390f7ba5e61ec80500e806e172604d01682717e024acf13e7723c1a6d4598d0d2eab97ad1e380a55552f7ae36856a8c1d085988950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d3718653bff41864b82ecfad329ae7d
SHA1554caf9f818bd6e7b56e818f3399ed00dbf17a90
SHA256e612d396be96332e2a6a4643a9eec95bfbaefacac2bf1a5d9a780b51f4a1e9bc
SHA512476e11dab5bfd4eaef306623179a5a8b66992e7d4ac3dc6ffcdfc5e41f1c293e85b5ee1b84321c5cb482893209464fb8499453b8d20039d2ebdca39c4485fca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8b901804040249c1ec358e65ddefcd
SHA18bb79c98b26221fdc39f688bf236be29041fe53b
SHA256574ef1ae4fa916ce4c8951ab2e4d5e90855fdfc1c3d2a4e9f1e3bca15fb31b52
SHA512a37d2864f66b20194d6f747ee2152ef55f5b3f711c3bb724a97e943a9ae0d7f38335d3760c1093b36b7771c3b38bff33716b1191f376529e4302c1b1513dd30a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd30a2e634c1377d1c45be3996c571f7
SHA13c9fa93211d5b26fac9f4b4e19f7504f3daf501c
SHA256a94d7d7c95c382de7174633809007a8e09f10db3788f20f708da8816b1f6b351
SHA5128cb071758ddc16a0b44b44d9ac648f6683ecd6d7d8b8942e8b0a6a6ad46e93b2b1d33cc5467e3b89618845cb733e7347897ef70d84bfad1df93dcf39cde55c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51981dc040bb9d63716a9d99f6c0d8f93
SHA1612eeab11d662f6e8c81a98b182010708c8aedd3
SHA256a65d02b7fdd3908cfa96d919d9c67ca8e5bb2a3db4ea72e0402e4e8e54508cf4
SHA51290734b6f6f1682b4a9ed512f9c12fdd548de542579b4475ead8e3d5128d4dd52afac28996cb9bc90354ee2df57d2d215e05365f3e32fb2658e94507db191166a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578afbd74cf1368ae856f1b95377d79d4
SHA156b37dc8f8c0a6a5c62de11331ad1133b20f7dc2
SHA256e8b86dec824f0fa9d618c8ea36f620d5a1d1f647a2f3bb2894103040ca70c9b5
SHA5120f823d4aa4de38e14dac6b593e17d6f9645388e6db4fe1ab431ee8c67d368a831c4a309067c38e0bb541d9c3e3a3690b708cffafd9f3b5d01c1730c84a0850ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4813bdf9bc29151e532851360f4edf1
SHA102e3445aa238aa6ee0e544215e8829ef1492528d
SHA256ac9c8af62e7ed4b863899c619b3b9ddbb398b2057722669087b89b8951baaca7
SHA5124045654b110647e40edd98b650e3af110388415809fed52adbce9a394ea9cefad0a21c22d99d3606a258bd911d923b542fd05cfb04d34e11d6c1045ace9e3056
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a