Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
3d36dec2200a5a27a4ba87f02e7283f0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d36dec2200a5a27a4ba87f02e7283f0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3d36dec2200a5a27a4ba87f02e7283f0_JaffaCakes118.html
-
Size
2KB
-
MD5
3d36dec2200a5a27a4ba87f02e7283f0
-
SHA1
a1a1c85bdc671cd74ee0a9db3bc7d64bf55f01af
-
SHA256
586bf276b09eb3b6ab7786eff5fe37332d98ad00c2570f85e8c806745fc226b9
-
SHA512
b629d18ba5ea75957c4d78c05a0dfb352de0787942bc72c3812d5a6cef89a5a1536a07749115b403a39fcaf74d2f92717b756a01efaa9d2a7a4333196917ca53
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000004a26716ab52cf1a1e910ca0a8cfbebf24ef01d50f0c30a98161c7ff0e9c4b46000000000e8000000002000020000000aa0b205170aa73aa3678a0d500f3ad4126bfdcbd8d7f7642350448363d865c1d900000008bb776c02cf20762954ca2d2f65d3b83fc9a9e08fac6268ae6fb578dcb7345306fcc61f4594290139f99b9110276d0634c92dd75e8ef1c562f7b1859f3a8149dc3bb7e42059eec8b20cf3b0390cbf4591f9883a729ee32af19c99bdf68924156f04324dc214d35077f9171102da3941de1940898ad8dbd378b0749b9be7c4d7ed760a29da9120c67f81982193c997e004000000094b3e2f6d068ff66f4e355f2b7454a850bfc2fbcfc00215ca3f784a9b02e5f6e47bc6b8ea8e16fc15cf61e0627aefeae340b79036681c9159ca8bce443b46502 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421730038" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d44c52dfa4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f1c0819655a32363ab7e28d3b34a30b8400e86e4175d1782f960b911a8627051000000000e8000000002000020000000ea747b2a8f5c27663028d13d0b00baf992e721c0d088ecbfbf32c2ed4a14a10b200000008f5a55a32bff2088f3175d6969361377eb5d48ec930ac181ce1c2ee4a2364dd340000000f69922619644810511d76b8cc5d1010ad96404ebabf494b23fee3cfcd678abc60f5dd327414b11a45ccf2b680fc13537c761f7885ceddf80cc0e9f1fad67e006 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DE61D01-10D2-11EF-972F-E61A8C993A67} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2968 2384 iexplore.exe 28 PID 2384 wrote to memory of 2968 2384 iexplore.exe 28 PID 2384 wrote to memory of 2968 2384 iexplore.exe 28 PID 2384 wrote to memory of 2968 2384 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d36dec2200a5a27a4ba87f02e7283f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5157bc22014b1fad510e5af310a3ba796
SHA1fae6f25e8fd1d478241dd5db560f9bd3ebc033d7
SHA256e3d7dfba4fd001bc17d7942173332689a80a264fd1c33b2a6ee74b2846636f3a
SHA512f45ccfdd8aeb493d99595e8e87a5125c1fa88617a717a4849a56cabf80c378b88246aa629df58d4f9ab6885fe686efe73afd3773e0aea16d2172147887858398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5218c931a8621d7b51e272eab5fa500be
SHA104e89b73d060604335a837c2a0710aca4d251ba9
SHA256edddb66a1045b97282343ca53ef17c59289b63f432e8266b3c34e0dbb248df02
SHA512e4846cb68e68694f48646c154aaaf87b30c0304f5ce60b623d3f8f8c9cfeae6167565e1c8bb2a7c8b7da8027faef80648821236ef57ff913c0c6d08db89d633a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb962ee8aea24fe7396f88c57145e042
SHA180e64fdab4d994fc064007413e55862833f882db
SHA2567973963bd18842525f8b73e32f9269999df482ac694523c8f86d16211a5e226c
SHA5126ba480b076fb68a38669542f2ed0c56452ebded075de1c2db9f6fc9844897f66fa029f37d4915a1385691eca641760d83af3d2dc3e900689d69794af2ffffb1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c063bb18b0cab1670abbf1b423d64e23
SHA1318b3b145b8d97eae89229a6188e44526b7cc055
SHA2561740100d47882f6fbe1f58b103860f7d5d245699854dc63511a664b0b608ecba
SHA512839ddf7772b65835a5f4cfca3284934fb67620b0423485146834899c50381dc44d7f3fcd124a46083ba3055e2b55a0cf67edd512a07ac8d1dc48687c815ca223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bbf91cb24ae0455041dcb1298450b9b
SHA126bc5d3aa4fa150e2c1ef70c13267a81842bb291
SHA2562944000676374440771d128fc72ce4cfaf7d0c5ab0ddc5c3f26a9dced65fe654
SHA51248f02b4c92acf9b768a4424a437c4896011eb5a665fc90f43902c5e7b749e58e4144916896074f1d43ba194711b7ce1298c261b091a60b4c89ddd523dd2f876a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb85fa9ca95f8f0ca96c6610f9e018f9
SHA1dfa1a84b482f794b45c1327d03d65f5c00c9b6f0
SHA256f6b74726ff586b5f9871a2e160e49c17e50a3b0f562fdd3aae18a87e5822c66e
SHA512075dfd0a478c08c9110d6125ea1dbc7ad98e7b5b9e3e8903d4b0abbc5c88cbf20fc12b0e2f15494c4ff8a18e9210ebae19e66a6d241bec2695c64d14ba512dae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbe868ec2d6da7cbfde207bcdadc8132
SHA112a689401112324c952fda832ae80d2cac1ffb82
SHA2569dbafb295a64ec4eb457e0203c48a9979159232100c3d670580e3ec05f64fe46
SHA51274d8b2736efe6c9fb633f412a849c03b66507b14f7d019680802db9f0d59b7e99fe3c4747627b879c70fc4f3d54a27ec17ff635cb5aa6919b81f0a75a28d5a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b908ae926367dd45e1ebf97a0d71f67
SHA11edda3016d58a9a704092d2b0ce21893cd9a5b78
SHA256977b45f724a20858cfe4e2c4259395276a5fb9a74c40ad3ff6f76dc5c68d925e
SHA51201ff57fc4a1abdaf6777cd9a69714426c0bd0a37d45a9fe3cf6e3ad000117c55d7337b15d0e32a1ec080449229592d70a767c3494e38fdad3c7e647992e059eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7f5398e006d1afd81d5977fdd0b2489
SHA1af0934dd016b0f4b3fe323c7b1d562e83f26c9b8
SHA256d9ca588628cc575172279824722ab03c09fd52842dce96842466d0649ae55f55
SHA512d1fe276a2df51508ea4f03835fa7e3279ef11961060a95a09e010bf7e803d2b666cfce5d7c6dc7003b331557dfe9b77d7280d63bb382189000a0efc19e967be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d255a7d24a6f90b5dee7add3228854
SHA16b36e11f7d103f9b0c769d5076fd68942079a1fe
SHA2561accae9c284c680ad69f1cec53b1bae4591e8e41a1bc3d191b7599880e4a7b38
SHA512a874ccfcad82b2e580fd0d061acc2dcc0786823059503299984b17efcab034622e306b3f71f83c6af6d93e70939953edbdef1a371255fa82c3c407869cc89607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0e8569e08ad010c9c864bf2c6268c31
SHA17e92cbb3608e6ffd573df8a4fe325808b4d13330
SHA256f49d7ec5f8a4e76ca0c8f8237882063f77383819335781477cfde2fa1ad7b44d
SHA512750a3882797b7719b44a4acb3554d32fb313f02c03a0508594760f9fc3ebc8798c8eba831127969469ed4381cf2ad290ebf3dac9ac586ae2afb9db649921d457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da9800576e99b5dd7aea4378d126d22c
SHA1cc496c04e35bba2da2ba899570f3e83bf6eb4d39
SHA256cb80d89a6ae3bea591c621bbeba232f5ccd93db9d79b35c2715ec4216fc99e08
SHA512816fe9d832ddf9b5b3d0962f577a7fb483941d53cf9a7fea5e8b9acd44943fa98f330e566300e090c21c354c76d2d1e6992e49994e0a72f284b2f5eba73d69fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1ffa9a4aa3585bcea7074d77bd61947
SHA10c007dbd974013506b84761a5bcc1b486d03a1d4
SHA256bf278a269267290c2d2ebc45cb75db4883624abfb095fa4a4483f4f41bf7892b
SHA512d67eedb3c9d157f83dfea0f3148f0f3044d8a6cb600ca2e4bde7aaad8168c91bd580a6b0853a5137ed6df012fb0923aa9ef440fb717c89eed89cc6a03235035d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0f7429f69a484159c61aa584756ce3b
SHA1c16cd20cc0674e0dfde57ef9383bc4f8af2b88e7
SHA25690fb15fbd488ddaaa0d96afd35889150c3e7993c8836e42901c4430f44a942e3
SHA512b4330844e9914dd25388ac9d5188972f72cb3e9023ba737942cd4f54c790b5e5871ac09807b831bf459dabad491ec540a4b4d8876b4bc4cddd99c0d609a7cf2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b410b9b03ecf728cfe3d7f1407de6124
SHA16140c2f35dafb2f277afcb4739d923811d2150d3
SHA256db019573cfaf6b8b0fc3b0957b63c51a5ef1fc23f4e29d353cbe1dd9e660545d
SHA51287cddcc82d1719933d54632cb049e6f279b4b6d3f33923b29ac75484888c28ba0990f82867606bcb68cc01ce7b47150f954faccdd28c6067fd9f4fc98dc7d4c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b524b25c6c5e90c09de4b1523d05940
SHA1528c0f393b430d0f5355e63739ba21793f58437d
SHA2564adc3241c78fa0fc07b94f5540497e45cb93e877d3489b7a9b15d59ad05717ca
SHA5125df7b214693ac7c08c2bebe07e9dca1ef79d26d4d632a4bb720691127600ea0ae63da79a07c05fd805ec33ff6585a2bba67ebc0984944aba2adde69f16e8ba83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573cbe2c44ea4b40af6d6443d43a7129e
SHA1caa10292a897e3a9ac31f00c55209c9b5dd79d0f
SHA2561f8d4010695a6aa0a3af12411cec37a0137a41e43200a09dacf71a911fd1d1b6
SHA51208dd25ae40acef6c2e7ced725fa7da8f48604f04017fb870175c14f0d47af50ae2c2d3f8897bcbd2e68af540c9c6ee5eb706b90ad52d7c33dbd11ca2eaae9777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55669aae624179cf0e0086a02d19a38a4
SHA175e9664ff9014151390cb51fad8e0ab8b29d9d0e
SHA25654992e292934350bee5fe3e4e54e59c96e05cc498fc2886b6f6dd92b729adb2f
SHA512e7cec1c9f555c960eb60989b9fa62f13794811986b5b17ec217597d4fb08b63605a4db2c82fa17c3fde1b3f1ceadbb5c9184a2ffaae3ada458bc4c13e5490efc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a