Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 06:54
Static task
static1
Behavioral task
behavioral1
Sample
38d17a47e983802623bc8a2ff6a341a2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
38d17a47e983802623bc8a2ff6a341a2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
38d17a47e983802623bc8a2ff6a341a2_JaffaCakes118.html
-
Size
2KB
-
MD5
38d17a47e983802623bc8a2ff6a341a2
-
SHA1
3b0b13053f060a0c71fc092dc2b9e3dc5afe911e
-
SHA256
9f3416705997bc182f050f39da678d85836107a8b537af36ad818e8d11cda43e
-
SHA512
d0b385204013b8543c480934314540e0921e0d3994ba1524728b8f55b7270b3763f707273232143bd6d47c57c4e4138e97bf4578dfeea0707bf094e7cd3478a9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{809B75A1-102C-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421658747" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000020b25e32b1ae77e036306f65a6621f1af194e0510b86d5493ae9fcbc0fdaa130000000000e8000000002000020000000f39f44b1142c84e6d2db6acf90b94ab69606de66e614feed9fd92e5972c7a00b9000000063788dc5f72492540d77361f2f8209c695cc9dd32f13354bd69afd1bff41c6b0dda319a0113cb0a0d28391d6d85886d94ab09f785954e8a425b7bb9e1469368fe47e52bdddbada1aeb46668ff71dfae0b73bcdd2f74123c4ebbb906747c1bde8ca5529e2d5dd83cfc376f3a0d221b9313aef6222181f2971bd1e0a4d088609239b0f01bf1b9b1113431499ad0d6825b340000000f0df726383ea0e27632aa3059156078b1914d1f0d331b7e6476eaa93862b0d8dbeecab10c4cd8e9094eaad55d26fc1cfb7be74e864bcb4bcc4f4802bf413c7f9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000efed1a8a82cb6a2e6765cd0e38d270188d1e84fef6a0aaf1726deae0a1f01d38000000000e8000000002000020000000440171f7dfe9455109bac7dc8a87b3150e2a213744eb3f42cfa40b3d1c254da7200000000c9e5a0bf09ee97a89e7150263a3ba8a492551fc4c602df6301f0ef37285088d40000000a6fdd430a66579a1b96dd90973dab9e307dc5f4f0bf84463295d9cea77f719094d803d8d65e18740f497e48ab157a0f9aa23b1c79f511d2a31a5e87e98695ce3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058455539a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2792 iexplore.exe 2792 iexplore.exe 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2796 2792 iexplore.exe 28 PID 2792 wrote to memory of 2796 2792 iexplore.exe 28 PID 2792 wrote to memory of 2796 2792 iexplore.exe 28 PID 2792 wrote to memory of 2796 2792 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38d17a47e983802623bc8a2ff6a341a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d6c40e6309773eabc6a38e08abf9816
SHA188b15dd95aba3868f18a39571df4f9ac51ab807c
SHA25604065f3287006b7b30eb61acd7b610a07713b233e9c022f3c16e75b042c92b34
SHA512aa4055969a70831ed964c3556a0a1820f4b6beba74583a7eb86a30a6c00c1ffd2c86fcf947e8f4b7a922ef94b165be098f4a1da9adc1a213da6cb9f9bdc2bd66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5c71fc3c50346cabf4137713730e531
SHA14302f7c7518066bd446517d4f3410652ec009df2
SHA25640feac48673bc439e92ce2062d84020b4f6430b1829cd5db60dc606db2e18be2
SHA5126db1fd5b3c0c99b0bb239badb2dabc647bf7b7168fb9df272fa7410eb2b73dd14041b7834f4882cf5a111ef8293b0247220456779c4d8743fee86c785b36f564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd490bb8614dee83365756a5b9eb2bd5
SHA1a20e8600fa128dddfeb70bc2706dd9241f80d715
SHA256c2fbad63a3df78ca67cc606ec3ea4a4c64720185fcdb2a8db4f2dd547a52153f
SHA5128572ade4ea70ce32e3dbf4325353d640355ead1a9935ebcc7d3d56f98696d76d69c6b6f3dfb2d7589640a18cfeffcf867ecca990425af87214479de7825baafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb65bf5707e84bdbceccdd67557e9468
SHA16cfb9db3db90a5b4758d26ae59f519906a9fcdfb
SHA256b57f0a3c12a14e427c1e53526e7fea2e429ccb4323c79dfd10a0f1d16d4804a8
SHA512c57a06111dec322e09ea0f6411b23e270260f4c18a00e6f39dac7036dc3de6e469447783249dc61573209fce4accfcad81b77b76a48daaaea695a0292d3720c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c748bde23567b6ab125625ccaf501bc3
SHA158e673157adf209cabf80b051c886c7a85a6e8ba
SHA2568167fc7c1ac825cd2932a11ccf612916bfcaf2ddf3c21086b5a0017ff3ccfa7f
SHA512423210231cfeacf0d91b7a62ec5087169a810759f686c7c91098eb08aa2801b88743d4b96e30b6469b705bce67c87f66982dd07348c47cfed02b5568a79abfc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d685134e4c603f332d2d919fb3c5132
SHA16f225c341152072d294b10dd3865e1d30433673d
SHA256397976e55caf11bc76b7e1404a1d9afcf6b4c586c8b67cc7d30c1818c6f5edcc
SHA512df99647e1e2c2b9c95c9dbc377d933f8ccb05c149ee8b5a3a7e6cd33c692334d015c0a57580fa3d318bcd87376c8933a6c46deed39812bf7f0266ca1cbcac23a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4274f8097c1373962ff17a09cf1df55
SHA1fd767e1dc197830a999fb556062e1864aaf88059
SHA256347db759ed5adda1a4d6bbcefd784d99789777ab658f7813d3bfceac77c56a63
SHA5127114fb7f6916c7cfc3b57abaa78868467c457b0faf484ca136e7adf70a7b9781f3b79c3262ef11f122210b5b74f7bd5aa43cf195b5bc9b562c70c921e6f0c1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a774f3e9900d441e83f26ea0b84d9a
SHA11fc8817cf8889093ea657d2fe1d034d57abed423
SHA256325ec13c5d613f1428fae07ff65f5191b9d1a081d13e6fb68d966800d162bd8e
SHA5129b89c8cb97beab64a847b6700ceae051d2b2eacd2410a2881c009907e566bf43dd2776cf8a1befa3354ea9e9c678fbf8b15b1cc8742b1c74815cc7b31bff9a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555e3c32de25246192171cb5dac1ba8f4
SHA13213581db3c81ae3549ee59f545bf30f93f093dd
SHA2560c08c4fababf205db4d0a5a55898cb04316a6caeab3a7dcdfe4cb7b1d95cbb6f
SHA51288b7dbb5239ba7a720215afeed9d01c508abda1a4c7d37ccc8a7e5bc94aa54a75cb0bcfe45ef7422cb9cad6535a3449bcfac425e0df017d32611dbea29b58cb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dff0559b13dda01be4008c456c69f3c
SHA116788268676320dbeff7268c9e0488f6d40424ec
SHA2560002c15a36d6ecbd3c8e01addbc0c8b153cc2bf8dd0563655877dde578739ea1
SHA512a933b14b3b2d8f20fee664a39dfb6127fae40ef0e0eae6590785db9f57eeb787cebc158ade86e85a9873546b240ea02fd4b95bf9c6559e712f3ac75026493a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52956251bd846d236d188267e74c7a941
SHA12e0d29d07794fbc290e0ec32e56abe0928489e76
SHA256262ba755007132e3876466ba0b0cdaa7c0fd216d38c8cd2d371c7aaf5044aa51
SHA51271e855b1ea759fc4d911cace21f2fa72b85347e3198d97e47758d7f06225f208abc954f1f7bf178943f09e0253748f13068b20fc6342095904b63c42bfab5911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550d329e8bf63274a7b64d3a814347481
SHA1b271798afa446acbcdd2cd06643efd0d96103b13
SHA256d72f59e1767ee0a365fe65f598a2ba87b74cc043dbfec11bef9067e161166538
SHA512e3f7b694dfaa2f23f6ca2a9f80b7ee2fd9446cb5cb0b8be7f8cec99ae241c33040e738711c311bd29711c27c78777560a6cf72bca3a02be92edc864d5b3d4a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537755200c096223e393daa4a033595bd
SHA1d4488035b087f9f38022ebd9fa286a037d11a578
SHA2569174911f54412da44b86e91740ae7cc2a005c1e8111fc4b5ba87f4f858914787
SHA512d0e1ef252984ef907c036d0a03d3fce99acb2345f238f2a9198b78cd5b6b0c934e067f3ffd4d39fd54819bc379734d96fdaea479fbb4d9befbecb5252610efcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dd964f4a487a6b029948e55919a688b
SHA1b1881cec0d595e84b8c24d217af6494176b7c454
SHA2565aa9abe13b3e3476fed0033690b8942e48fd11fa308720db0d0234af139d1df4
SHA5125e75549bbe375a0224baed4322d2a8d151ae37185c8d481f7d089054781543d818a1c051c41faa47ca5c5797180845102bf741802a0d402a88d034fae282b4a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511fb74da20d8e106e0a40b1170dd4f67
SHA1a9637ba1dc7d5ab14d0760bece96a86705ea9244
SHA2566090117a98e82f40dd4456cb35cf3df9a7db7958addd23235e95c7f888639912
SHA51236c4eeac099b1ced96522a14242e6eb5409d8feab394b7787d8179f037de771d786248286e8253351672ea305c1e073f886ee3bb9349752cdd88e815ccb1842a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b17981774bd1af3e1dc9e8efb6bacc6e
SHA103d3b6dd6696efbc5c17f654b52ef1a3b3c01f79
SHA2565ea23044785a7504ccf9b62736f268057250910cf1202a91ed3089f35209f387
SHA512764a8bee4ca8a6d0107ae9c96c716154f5556dea14b2194afaa6eb838ddf2b462f9721a0b188a851dd135ab831b3b828e0848ba99ba0d042b3b2df87000b3add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5619dee5522f4e2437c5ee47d9179abcd
SHA15dd946e31b135a287d44d7fd0ac15748496d4a3c
SHA25666f5d1eb34ceadb83b3359357dcf6b6e5c0a041ebad001c67b6dd320dd3b9508
SHA5126e9db32bcf786038270c90a731ddc69de6206b3161f65335e037c71b1ef57f0725537b76b859a3a3a10da24e77fdc7b5375d828739a14c712a2434a3006bc9ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce5c372621660ab371468abfc0b26dbd
SHA10ea0e67715b4554cc833450b6aecb59c32497d63
SHA2565b489e4d9cdc26eb83fb97a4ec5ee7c3f06e9259248c023158c95514f4a9f568
SHA5123ebab2d31ef0eb2b24199fef5cc5420d6a9be3ec8dbc60c418b4e10294f84b20563121bf4a50f51258466cf08c2a2c0fd49fadbd12795009b0ad9fc65e598613
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a