Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
38ce51fb93adb3be22cbc121af13a098_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
38ce51fb93adb3be22cbc121af13a098_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
38ce51fb93adb3be22cbc121af13a098_JaffaCakes118.html
-
Size
23KB
-
MD5
38ce51fb93adb3be22cbc121af13a098
-
SHA1
5b973b1530dea3b84cb56653c45c778762a07633
-
SHA256
4f707c051cb037405af5675f2cc4c2f2aa96332cdf9aedd2d00cd174078b3f68
-
SHA512
79ff47421f7c59ee4040aa32bccc8b9052a9c0aa620a3a21a44f515517dde71b046567ffac4a82c1bf977c5e9e258753acf38ab3e19487fe7d8ed865fcefbdd7
-
SSDEEP
192:uWbYb5ng6nQjxn5Q/3nQieWNnNnQOkEntR1nQTbnNnQACnQtswMB2qnYnQ7tn+Y6:xQ/BU+4
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f7966b2b4a228822547a6a1fcfad4f9b6185a12fde3dffa41470e2908add9d8b000000000e8000000002000020000000867fba9be59548f94a7b9a633dcf4855d38d9cf9fe15694001057ff631e3c3d6200000009a7308a8d1e5cc650317399a582f139a2b7818779fc4f85042271ee9c096fd52400000007763c791c424609d6506232012fff9a0e9e62b5deffb79b9ba99388ce971e143f25736a590aca9aa9c4ddc0608afa153512a464763a17314f2fb26189b543f7a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000041e525dacedd48cb2e2cdd996df53f5248113511a248e4827c3230607726373a000000000e8000000002000020000000ffbe2cbba59475a66b370e7d26fbdc67779018aae12a1f1c812308abaf27e98390000000e89ac8c0fb99e64fa0183c133226f4fc209656f2f54af03dfa716eae93085b5bc9c1a266c18797dc72283fbb7d7a7f5e7d0e6e770f18f4bedcee9815c4a47c7f23a2e8a7b27e44148adca2652845e7facb70a6eb15182edb5385db958a9f47aa6d3c15c6f96b1ccdaa7d879d8cc5c71e36e131f9d4570271b9556238c1110f23f4e1e43e9794ad59136a30acbf1c3f8c400000005beafc47691a17df90ba16e71687c89687afbc2160cab22a43b40f88830cf7cdc987af95ba94d2cefb224bae1a2bdfce31039c03367e87c3133890c70aa9cd4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fbefca38a4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421658515" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6493E01-102B-11EF-AE65-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2580 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2580 iexplore.exe 2580 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2216 2580 iexplore.exe 28 PID 2580 wrote to memory of 2216 2580 iexplore.exe 28 PID 2580 wrote to memory of 2216 2580 iexplore.exe 28 PID 2580 wrote to memory of 2216 2580 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38ce51fb93adb3be22cbc121af13a098_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a554e218456021adbee5c2ab2a0a6d04
SHA1cf08093acb07461a6776118209c34d4904f7a363
SHA256299c585e0881e056262d2701c6db48bbc3517bbc514e1021acab8d05d452eaaf
SHA512d97fd365002244c5bbd01d3a09ab6cc6ed70f52896c8a861b028663b6790c35be06eb6f4d6159cd0bc20d00a376c81fc37e6085de4d82c3020e8f20edcd60276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be5a23ace494a03e34176ca1b02931f9
SHA10e81655168a7cb149e5f2f4a95f976a4f8d092cd
SHA256049f21bdb2b9ca39ccf029e523d26d74ae81546246de890bdac0a056d0d26a66
SHA5121db293b75bbc0badc9e40649162a381e5f63a0b823638584e6ac195f2640c0bad506428181283d2125d6d638636f10d63c30d4d099826973704ef2a90a38e1b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53914a8baa08fd3f5c0d440aaa75b63f8
SHA1623923145e45e78a34c4eb5e97824e7b4906495c
SHA256052b6da071fb819bff6664b673c4267b5512107d629548cbc91253ba88c495bd
SHA512b44e008044f655f83e5f0425d0b19a2d5fb6bc551537ace9dce90dbc1f99f8fed70fe7fc1188494f0b64276894a7d3151818772d5b0af82d1ea1819f4fb1456d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc57e2c7834b34e49752ede0b45d7e7d
SHA12c2dfa6e9aab722f26ca76faf122a211586c0825
SHA256492621c896e56059aca5f329092cd9f183bf84756fd8e73ff30574d281ea637b
SHA51245e3a929ca9a3de124a04673d33cf9715247f8f80fbb8810694942b89143d9ae721cab45c289d6176cadd8d776baf694916131a17341cf1799824ac90a24ffcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53af9216f767d2efb36902477f99ed611
SHA120713107e7af675a6190b956480f8ef1b90a3616
SHA256d96925f99ee5d55b91f7f0d2fa461aaced2b635c1c7617721dcf59a8e0f21c36
SHA512f63b188fb29dc0005c5aaf4b6eda7d70b77a5c1e1453afaff58a588573937756e9a71d520b42b420c2540a4f360182187a373a96094a6889c750fbb9bfd96e93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508e2c89858dbd499f868034033a51fa6
SHA132a12e45fabfeb50c535c708d8ebf16ab4b65bd7
SHA25676e38cb24b002261a43be8ba39192f2aa0381c7c5073643a371637fa636cae04
SHA51260bc867b98c5df8065f5cac9ca6a91955777393c5b93be06cf92a20532ac151b76a6f00ce5a93be50f6492336de4b0a00aa7fef53b442c306dba20661c16e17c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594bedc307e6e726e2d8debed795c61e0
SHA17835aa790127c9cabc48168157858be060f75e36
SHA2565abed4de2c3a58fb78bc4a394f4107077a1bb3d0a4732f10b2a6f2b4c02f9d51
SHA512d27cbf3cd00b2f6536489879c68f27def1816d8cb6812d0ac43ef7a26609be85c59f3c15cdbad06ef4b6f513cba140e5ad87062cccfee31d6991596194ba7bc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f87dbd4916dd064b1d3c3ba6666630e6
SHA137b858af59d6b31e8a3a185c9e29e657ca21253b
SHA256a651c1fddc7f0a6822181f8529b1f97d96360e20075f9a118f7b484d3fd3f7eb
SHA512663c4a6bca6611914cda420934ea68369971d01b193df0c1ad5e71dd3a4cc3b0f05130604ae48bde1f17efbd248626fb999eda3e69f78a11e8a7885349549dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b4fc63a2e0c496062296d2a845248ed
SHA1767ecc948e28948c356cc227668a5e891f3b9b8c
SHA2563bd8e9b5ce205ce310920ac0c9a335afcfefab23c783080e8204dd8b57fd790f
SHA5128829b08f434001342934df39fffad64c06315308517d62b1e71a94e26437628875a6191520ce8e407ac0dc24691655891cdefae8485bc58eebec5039f4ad6ee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577667c0a07e4cd2053b1c8a532d996ed
SHA16befce72b564d23d038f12cb427bfce8658b3fb3
SHA25657228c726db57a3f0b05ed6170c79f92d2111baf5f435f5d408cda21d413f09d
SHA51251ab42f627985fc797281d97aab3a376b3291f0cc4fc3453f7e7a1752172055c2f3f243ce54e160b44a8faab1246c97008edc8182eddba5f4bbedbe0dea0127f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e73b42d6e45370fb084d7a0245ef6e67
SHA1f144192630a5e82041d438d10ccc2d454d74294a
SHA2566c704396f574c5a63a526c10f50654ae87860bb2646b3eabb5db5c62c1debb74
SHA51281b0327ce68ed4f15bd29df667bd681e1c0544f7ac48a1230ce68a0e1b517e83ae56dfac482f440eb46eb1be1c4b9c4ee9e1fd068508573b4b4ed3981d76e23b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb22739d190aecf714d46517f77ad1a3
SHA1deb07d0bf2f287a2c5833e661de8ffd560743a19
SHA25687dab3b61fa582814709e08e0febdf47fe8f01ab12cd3206d0e5e2ce449dd77d
SHA5128b78309db08bfcb81185add245a3e5a88014c6736c7428ce44c72acda52b73b15a517701d24dc30bea70c25a7d811f0ad3228d688776ca012f54140d9851b8f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a13fac874c0b956fa2993f512ebc6b3
SHA159c41c9a3dfff170227fe4d7591e9749e5ed3f87
SHA25632696f86ec5a4b2df061c8e24ab076598a22f19acd833abf7cfc0d5841228299
SHA51206ddfcc54604531f99cd64142700e6c4f987ebe14b7513b34c0113782a4d3819d01f69839d4f984627709e591794bd31e17ce059dd6ed5c24aba0dddebfcb638
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d109572891576f74e330148c6ce6896a
SHA1ad862db7fa4c071517e0eaf1c907a33eb39bbca2
SHA256d929e4def25dcd60709bbc5e1d115e64255eecaf5e478706bb1841b7061bd84f
SHA512e5eb80cb71dc00bc0be04e39d79ff435b7dd483804611f8ab15f5c7204f05c2b38ed1d642523213f5ec674a94aab8a8f21cf47f8c848ddf0d572c187197d0abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1780bf63538968c847bf7a649fcbfd5
SHA180f9b31218d84118368cd6832964ff0ddc0ba546
SHA25651f9e7b73a4f0c895a62108d6f39a243a849c140dcb4536b053a07cb9c2657a8
SHA512e5fa6c9cba970c4ca2d040e6ba944f553464b10ef8177e21b32ab8f6ad9d6d720943008f14ae7b14d4c6b7ab3ec4697a99404e0eda49afd4bb7a71aaf91495fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a263d0839e8405eef01945b4ac68212c
SHA1f6efaa5bb872c5a2d8955cf0727a78fe7606d63f
SHA2563a4b7e378f6f6773c1d2b3547bf7356606e615fd7402274ee61b858808010b76
SHA512e6e25043be440ff7128b68138c46e9aa490630e8c1cfbca3c88fc3f9a977ca0b718fa4afb43d486df17d9d56cef95b10b831547517db96cd776ce1f645e764b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509ce84883416d6aa74719f47ee40c7d8
SHA1154b724a2eb496cbdfc3738b22c3a80166a1d587
SHA2560c3dc9e3f1b36689e4e957d773e3766d00e24ee23408d5c0240e2a5ae29f82d3
SHA512f8ec3499fbf5c286466d987e336691aea8dc529a6c65aba84b24712e534d4a11d56b1b0ef357905c55f87ebce7bac2e3408146b4427628805640e9eb255a7e47
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a