Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 14:20
Static task
static1
Behavioral task
behavioral1
Sample
3a8dfcc9cf981f28ac1597ccd9631578_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3a8dfcc9cf981f28ac1597ccd9631578_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3a8dfcc9cf981f28ac1597ccd9631578_JaffaCakes118.html
-
Size
43KB
-
MD5
3a8dfcc9cf981f28ac1597ccd9631578
-
SHA1
13c7dd11562499ac336300a30832336abd727e3d
-
SHA256
2e67c4ac9eb5a0ad7ca25877428240cf5d87df740de524200babebaed59d3452
-
SHA512
46fb1aa4d6d34b1bcca7ca98668f3541ef43f734f9a3af91af5ce2380ae053fb871a7660211f4faa7206bf641b0fda47c918d4c3686739bd837982bacd788579
-
SSDEEP
768:fOESsSH5u026C8CFCFCRCRCCCCChChC9C9Cw+n6zsn1DxBif8V0lY5UhAwjKltzq:fOESsSZu01rUUuujjEEaa9+n6a1DxBiJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405b959f77a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ed7715a5e79b685d73d1da641d95609386f2cc83fc86e64f7c93a23cea9d88ee000000000e8000000002000020000000e28680fde8e1c20bc5fe7fe2be1b60b577a2c85a27c5bd913a69d1115e174e97900000006112434eec37fa2a68f097a3a6dc749309236b8e4d41779d9dd7d4316a3347652b37fd41002fca85df1356df1e86fb71d8c27db6b68f1b5672508182a96811d6b38ddd797fa4209b679214092a3e84ec53c5179dd039750f44a09064e3056ccf14b398d9c363d2e6662490ad36e1fdbefc1a4be44b05f68a58f9169084d6e6d4ffd026e1a971c4e4136149186c44ee3e40000000e55727235c9f243b4217bf34d66909e0da4801c8bbcf7f20bcc568bf488054aa648780b0001a27d1b8a40a0a0aefeb8021f174020d43bdef2bc0e79512c91970 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000e8edc0f29428c8804c12fa69d4c3b70958da6b2bdc9b9003a8f91f4517bed16000000000e8000000002000020000000d325266abfa14ead585e59d8d28f286b28a2fdeb95324ef65a411af4b14293e3200000004bd83477a9643e6a10826a18d4c1ace3d21944e79468b2c71a451720029a43dd40000000b7d33f431cb29e8b725c6bd3fd3e7868698122ae7f84e4800c26220c0a1fe4c39d150e8f7d38b115ba0f8421ad11ff47fa8e716df24b12914bed8cea295d5fdb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421685495" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7A88A81-106A-11EF-84D8-C2F93164A635} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28 PID 2068 wrote to memory of 3008 2068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a8dfcc9cf981f28ac1597ccd9631578_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd9828f8197a483cf19cdff30e41f6d2
SHA1c0f3deb26d62b6021050afd330ff137cd6a3f434
SHA256ab0affc98e37915a6c31f1265cbe2d89188c9f37436f06d33ec85b159b9b1c90
SHA512a1f4c6a611ace9ac953991f24cd4a320372c07f6352024deb5ea4cce9571b376af6324c7af1097e6a2110d5677efcd205e121c69c7f8284321ffc5abbc296acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea47a978e3be3866ccbcd971fcedbd60
SHA18e7027ace1d2bf2ed317a76f09e35e49b16c4394
SHA25684415cc159ee1e19f79dd6da6858e313da5df971baa98fbbe400a7f7bf0d2a3d
SHA512815f4cd10e65c08df3f09fc03e8dcc630832488cb5edb7fa703ddffd0a1a0462bb34a5392735c745daf8f77b87bfa4252545ccaf6e25822c164826f7985e8d76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502cf6337f7cce06c5c888108dca68e8c
SHA1dab3f9e133c768977466f4ebb130275446a890c7
SHA256536293a8244605dc3c711c3afbac29e39ad33caf411b26c2907ec9148112deec
SHA51202dd4f2ed1051432e75dbae63abda9cd0950acff57ae30dc0a737c5db773d49aa9544da7c8adf1f5243f32d3b9922dc1577feb43141500c1126550726b31b52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd0bd67ae527784e87ac171ed2ae1922
SHA193ad4d28bdd02de11fa524f372e79fa9990c43e0
SHA256fd25f85c4ff7fae2b27846b0a971398f5f2d68376aec9ad97f6f69a168d4447a
SHA512a211d566ddd681fae76f8ccecf027671e7d96f2e2e15fe67434ff856f39892a195d36175f50d68618f776001d15810e4a67b12f32f25e050f41a69d40d98bdfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56385ea15997eaf6935000b0eba1fa295
SHA1cfd7490f4dc002e13bfbb55c2e183775d3b72850
SHA2564e599de68d19ba0e00884b78c489238262c54efec0593d520f377ea54463bf37
SHA512d413aeb8c39fa10fb353bfc1b34c742a202323b073997d18fcbe8eb8ebd392e2e326f0e9442c17938501b65eee117dfa1ae55fd483171211260b71a208b4bd85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d184effba858a0bbe6a9f81a7ed10a1
SHA1904660335a219e9be8bcd27686835cec8ff93f89
SHA256f40ecd7a3b09360adaa15fc2789a7ad10a3b0c69b2f035486d99c387d363c91f
SHA5128b1d0e199eb3d0d56eb422f7210c8f11ffb4ffec87fa9a78752df1361faa5e39e2a3d88970527fc87110513dd00524b6ac23b44e8636a69852c0b281aa1074c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9c90a06ed308e38c6f30eede7cb1f4b
SHA1ddbf51f722bdd2d8087fa457f2f4bf609bd98860
SHA25651ed5ca5d322812ab559107a439b55d56fc72de05759981ad4b4fe65da33ef56
SHA512d8e327cfed1805c87efc8aa2fd894a1eaba1b5a4a9a47ed925c55271fdf675a81873ef006c52536cb8f16c8101542ec67130199db7ee4205db01dc2e5a8e5a8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b21aae3f1c7436a1e1db3571c0ca8571
SHA13e4ff279e6f87d51927d6b9739a065fa1c5ba3ea
SHA256a17c5a5b886493db63e06cf8a326ce3ca97f344916f3bae7bf0391e53083b88c
SHA51287b9850b8eecbcd62d62ddce9852eff420c1a572425a5953362a4d7ce23c63bd5829e3158007db0868726c44ba1cdab4453593bcb4725f85a142a91f42ff208c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5493b9816462bf664752d46902d6c9fdc
SHA1b1fb45a748f60782bdb2c7eb7d5f2b82435329f9
SHA256012f2dd3c65a1d912a3b24e6805ebaf5a6e37f294af4b87a7151262d198a4433
SHA5128db62b3a763f266980aae9ca06e5234c26ab8b9ff849cda0f4c47005a17925a808ad82829344de4ab047e46789969f05834b4bc7025780a0c62a207619a956c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e8d63a6605af7bfcee8212c1eb28bc6
SHA17ccd0461622cfe12029ed3b9a650b0daa6231925
SHA2560b5b114007dbf14bf833f1d55c89c3eef87b11253f43ad6dc229516889494887
SHA512ccc81705f9873e6c291de2be379ab1703ab1f9573496c9ef27f66dc33f70c591284deb34b125fd66ef73f655b4980c2231bedd262d83033c84cd38fa37549931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3908ce55f4ad196ae4af5c46d012560
SHA17f0c3d0063c8b3f13939032939cb8b11692a7faf
SHA25641edcbb95ddac49df7a6e7933016bac515b6b91134a3c7287f3997032153e35a
SHA5122b5f07422c798258cdefd187e50fb8c2e14e68e35e17b6503b64ee4101c61df3dbfe6398dea4a8a40209efe7d73fbe06af303a6cc1236a5d04d877a6c404df2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55798a7b1be65074f9c4c3edfe371e91a
SHA17751962fac0572933a1c7da8d6f69f763941e63f
SHA2566194f8ca344f131b52a1a8fa5108694138d9823f0e1c9b8e736bbdfd8a6f4e4f
SHA512edb9726fcd2671d7ea4f56dc864535fd2fdc98041b9741b00d762cb8f364a978063d34a7d3b13c6b1d8262d38c373e255445555c3d35497cf9c6bc2b12004b2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5610c4a7546cfda0d9f697de9752ec500
SHA168fcf74a6a5804150e4decc8941c22d39492e018
SHA25632dbace6798994f654ccf27336ec688a10994b11412e571b7e8cef90c389916b
SHA512083a73882490bbdf44d8d0614a920d742299211dbb9a6d32fcdba727b6a80b0d3cf272394a89032d5896d8ff2de1481490063a2affc5a4495814d138ae9a1066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534f8e2f39d9f43317b4a449f3b5044a9
SHA198f3480ee380172c121bb4fa874d30204858f4da
SHA25652370135285bfa475786807cbed5e41a5bcc15be9fe57037fa2e8da0547d955f
SHA512e1155c8820c1c132ae42f0ad9e965cab9d3245a0ae0df40ff42391fe1d1d2a38c1406d72955b80603b05894b3321c252bb4b3985c62b0357ad89231b9a4cd87e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b7b37a5c2717435910661b4170a3c64
SHA10f9483cdc18d61efabf39e715e1b2d630326b60c
SHA2560edcae37769146c53779a203579c49a81c9f9f1ac3a71b7153184198324296f7
SHA512b9ab31f510a58ce26243367fcd5b899b9951e1e35290f9809e3adfee93c2db661c0c92d7e7834fa1513df12eb93b1b497e7f0fd8e776df2e1afe505fa7a58e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51359b142e920cb3af6dca0481560e2d5
SHA1c7fab2f8f1b22647fb7186f041088c1e6ac58187
SHA25644930ba664694bfb6d9cb94c35ecc8983ba14e4cf18a9e7fdb63de7a9e63d8d0
SHA5121fff244b56913e6a6f02276a0308308345908bc5a85aa7292bbf38ac510effe87112f28402f5153d17fbc585481ee2e234ca007822c4814a91ad782ab3c56af5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f93762ccb91c55370e1dd0b313496427
SHA1f6c06c1bf6c88e7fb03ab2debbc869b77c918ed5
SHA256dfe711254a01a9660093fc55ee2ac373559161cec8c2b8721580183961b5ca2b
SHA51257f1ab48a8313eb6fe4edc3533c5e11cb318fa84f6ff739fd6b14869afd002deaa2f4310253a91d9e83b11a047fa85a0227fd10eec3017184180f7d4dd5ee1dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aff3a272291c1ee18af0e45f093a263
SHA19e3378f4c97abae65aeb44c2752b5a6741688999
SHA256e354130571be137519ff6d16095d540b045f159637d69eb5fd221cb3dcb3cae0
SHA512a10cd1801c8b88a421e0068fbf5646fc3c6b4c65a87b36014777e42b7c6b04d2e9879dd9444ec2b08157476703358a8f2dae617c3f33ba2da59593f88ddb0e18
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a