Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
3b72715fc2191f1ba3ab8852b6b03e7a_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3b72715fc2191f1ba3ab8852b6b03e7a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3b72715fc2191f1ba3ab8852b6b03e7a_JaffaCakes118.html
-
Size
4KB
-
MD5
3b72715fc2191f1ba3ab8852b6b03e7a
-
SHA1
40b3848eb4dbbbf3b8f31156a072f56231ebbb6e
-
SHA256
cfd20e873bcb47e2a777073e723fd0757ba2ecb2097d53bf4525ef83c3397437
-
SHA512
fd578d05b43294ca3e05c06132ba9737e67d473585e626a15e2581b114ab4a043703f89061b81bed0587a979068d2c09ca92e4050bdc349f0272d625d747a13a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ovd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000a9331163e76c22ab9bc3bfb9df1ec06e3951e9c01f6d530e64dfe197200461ba000000000e8000000002000020000000f9e5a2eb31ca5e3343f333b539ba448d5faf73c3a380e77e6aff390529bd863d90000000ffeb9cedb62e7a30b667a59ad8ae3a7dd82679ce8bcc865b84c4237ec47d98a25ef842b755a93e06f235f39a86e175f787710c5b6b97094f55fbde7708a41a52cc33c8eac4995f9bff8da2553309acbb49189e74197bbd47aa49e59ec91033b40b3d52aa62a69dc35390aae1258ad2a4dea7c5acd382a328d1b83a3540691c07e4279411318300b650c651e98e05ffcd40000000b65fcbd1b7b31a96d2846c3ca2345aeb309a0c4902d77f3d893dfde6f77dd52cc3500c4fecda1fb70b4e99efc6439271495043f2c821aab790568ce192445ef8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421699745" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5455151-108B-11EF-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000af70191444f6665e028a68db7305ede995d7c793dd6a4319a0eac55bcef16da4000000000e800000000200002000000014b5b581aeafd3f7da59a31455eca882b0fe05cdd5d761a3f50d939e81689d20200000007eb86eb6ab1e5152a6e33514537eb5a358e6c8707784a387553cd47d202a48224000000025e7fb386603c6335eb39061386afa972c473ba6a96b6deaa062d428dc64ce5c98d466f93436deb8427a1730b208d5ca580f49f53be3767af9601fbfa5a8409e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901fbdc998a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 384 iexplore.exe 384 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 384 wrote to memory of 2380 384 iexplore.exe 28 PID 384 wrote to memory of 2380 384 iexplore.exe 28 PID 384 wrote to memory of 2380 384 iexplore.exe 28 PID 384 wrote to memory of 2380 384 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b72715fc2191f1ba3ab8852b6b03e7a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5099a0d617c53ac42ebd3df35b211c1e3
SHA1a0b961a3556237e393da4b5e10c213440f31d8f6
SHA25609d80c54052a07b3210f2ffdcc5efdd145f35cf674ee79c5f1118454f934f830
SHA5126c5014f337126cc7042d487fe5a93cfa6b5d1bab0eccf96c26342749665507a8ec5c442fe5eacc7ffb03b787fc519118ac8fffab45919892c03f3fe0173e5152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f707caec7051d2aeed91309e4fd0e08
SHA1bf2e33a8226cf77b5b0c8ebd19e96c4f1abf9695
SHA256da8fdfea1c630c85ea8397a1b943a7c278ab7dc1d85e24f57a7225e4ff458144
SHA51276d52d1765922c08a067223879871bc569b41d204e7989045bb09ff5aef67e9e190f0c9fbc4446cba2c3fba0fd70b9655241faec39740ac157d89c7b660d19c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f81e1d7e2062ddc0982629cc4c64e3ed
SHA13ae8125c1f55f0cd3ce22ed13ee8e98552c036d3
SHA2560122faf478a9062e414d339163ad9457353d631baa0a8783e5255e9dd8beb38a
SHA5123324659ba1345225403ed73915c6b81f77f5f439a37499292abaceadf30b14a0f96108d3c6b3c4abc761e4d992bf18c8b83fbd25571a2ebb55b9459aa2dcb877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caec75b66a521e0547fbd5c97918c554
SHA1d32b7d2e57bab325a24b4932aaa622a8c54b59d5
SHA256a06fd5a539d07a8fd549564a9743a270b68d2ae6f170ba9c1ea57dbb1f32bcd0
SHA5128a42422bf958feb8e0ac3c11b3dfa06cca551b1d472def81d20eb9bb1771afc0918ad5173601a5d50adf5d278ca4271b3854028a28a11f3aebfc81a44033eb2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5140ae1679e206327bc16f1c5a3192afa
SHA1a71b771e7d6fb3c81fefa1921b7883ccfef584b7
SHA25675d015b4bd57ebe92ffb96cef1a0934cb99209dfeecf0a91a5c2943ea85f5976
SHA512d09f31e6c8b31d3b63ca75d366d77d4cedc052def869a02bc2f113556feb332eef296b61dfb347e26c1246b1f1ed7d69092b6c4ac82897facae4e8291a9ab3ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d0cf12b30289cbc1b08cb9640666275
SHA1068811df26598934e90e3bbb938a4f8a0dcacd6f
SHA256e72506af3cf079f839a30122a0ef712e2e6b7500406db17a609a4ae823714eb1
SHA512ab7fd5ef9d1bf0db12ab7753831fc68ed48910e921b0e3f9854195265f68dfae235639ca285421d09ada8b2e02136aa38ec6d539865f58b861e132f7d22f8047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fdbd29cd02bb846ee631eaba2d2bf49
SHA17cd2c38304d6dc82ef6aa281757d242b6e55ceee
SHA2565ebd14d2b4c8e988c094e01e673183c70cf341901f5d45282f6500073d1a71a3
SHA51248783c16728e03d2bdd2c654344e71ec9939340dc574f009a0b154db9e772b27c956432dc97bb69a6ca2818760b96c87648175b4cfd31e1a4936e7794c2ee640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513a3e3b1461a517f49afcb480f7cd48a
SHA17e686fda16f0ca886db05edae435fbc1a6e0f6d0
SHA25600ebaebf36714db6010984fbf4ffe5b605b3e3aca052b979b754ef999500d1d0
SHA5122a5896f89c1f50b61126352c695483f6a5b8a570cc0998759c608f2cc33e2f7d200e9fbdf5bf363728b28ddf3b05a94d20f8c6aa51f174271989dca235cf18de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebb89243d9e4d57ea048d573978088e7
SHA16a26740b2d4e2888230e2aad95e43a41e11e97b4
SHA2562a9ba2aaae184eecb6c0fde5d4e189eadede26240cdc00430ad6092bf9cb5287
SHA5125ab7f8a295ebfa8446b1fc7f96cf71e70f31356ffdab07bcfa1d07a1a2fa2aac69601ee518ecec3292bda55f291718319b514ca30c2fd9735c915de35ad9e19f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f238a556403fa22a78a0d5226c3172
SHA1a2f51e288ccadd08dd2b887ddde59e9b4c998801
SHA2569adf632f675647bcf4ba7f15899aa9f4252d64f12a518eefa39836b0679bd8c7
SHA5122285b79f67872f52089412620e730a2634fbba652882b7445919f0236857af880c572bba1c84ca8702bb27c3788fb3aa440dbd0a70dc86e31083a06ce21014a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bf2ede0aaa975ba520f4de3acb9f627
SHA16818f1d638cad39416957d6c78f089cf6c998136
SHA256fbfae7e4179b4ce05643f22deab064e1199fb898dfb8851488c79c1aebd75b46
SHA51293000aeb1710ee5d4b8537e25408c8fae71204a93214e6a15ad9493fe802630d452fc04172752113499d4077b0b439461405213b2c2cbcd7abec774fdf1e0090
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e738b010d3e5e257c72d7b5f70e8277
SHA11384f8803352ff56e8598bb8298d8f89a315d384
SHA25699760da665e1ffe6daacce3fde9876dca03920e307919a2501ff07f7c93e143b
SHA5124240138c72c58d8533c54f7646015da6b5b396619bb3658861b8147b182a36fa2345f4fa7234015db51532e7fa20eadd58ea5ab7e09e530329d1161af1cedff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5536aaed159e1bf26d805d756db469fce
SHA1b4382fc3664f616ca046aed88b58272d2852be17
SHA25668c477c9ea7933c3f24cbd062a6cd6f7d5623dcd7e5fd46277ad590d91a4106b
SHA512375f4acf798565efb82405f624c245fca1e2d91312a41353c90d82ff6b80c57420e567192e337b2cf7695eb506a406d674c5f0390e3f090e8145c1d75cddbf7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f0ad278c6ba1616ac322930f9d4580
SHA105dc87b9aaf918ff1cf0ed4e44e74efcbe414765
SHA2561a79b8497bc017a87e93e55d5c37af43c44683add01ed7f380c8dce05aa83fa1
SHA51275ec2ed8d746ed2caa0b6ea288c90135fcddd0c4be27953e34e0219a1d0b69b6787d5db2b90fd4b281010cc2e2f34d892c920731783e2000d112ddc51da2af83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5047320275db7391ee6dc12b11511c48e
SHA15e89b1441f09222b2080e9c3fc44525ed83b69b2
SHA256951d04a8723ec81e6fcb4d96dd1e83ff2ecbbb86bc8ceee1c4b7592883d848e0
SHA5121e3fc3776ec36ef45a4b27e60aa5d27f52e45268620a134c5c5dc6d5bea586c2a700e1abb1aa0fecfc639d5a065e760ea9593e8f6632c16215e1298f0244ef55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed2e3599b325e9ffee5d5ff089175be8
SHA1d633d13f43ef358d467c87a0ed1b70d7121229be
SHA2562294b1ab8772408486ad9b726ee2db1e8d05468469b88b2438174687de7c3f9e
SHA512a2b9c24be6b79f74e50b76275faf715f305685e79a9e15fd67d63141e18a36b70328113314d0b688d115f2e7648d35e6db9d09996c58df2b8dc2b2bcf3da2113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5748e032848ae415b664e174822227220
SHA10887d4cde82f000ae9d55c502ce2292519bfd897
SHA2561081304c6aa1bda9654a158ef87d0b164aedd9b48bc3be37e7dd259f8a41ea2d
SHA5120206c5db3a20b340d443543703c551693cb48d5a324edaf4c6e9778403bbd1affbe22e216d17cb9fceb4e896eaa79e994f74f415b6717b89c6355785f64399c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c89c52d64a434fb4df148d975ec27a54
SHA13b5a743c51730eccf688ffd248b882781e218dde
SHA2568df4e4cd10c26f48cad1392aac3c1d79d74980f897d3e9dc52d11f4cd147394e
SHA512173d848bc7f971af47431d7bf0b3e76db971079b15be431f0e232c71b4cac7632032ac1196df73056596cd2cb149d48aa1b532f1d9dcda9ef59986631f0a3ead
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a