Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 05:22
Static task
static1
Behavioral task
behavioral1
Sample
3de2b5ee5797fe3d74476368fbd2fff2_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3de2b5ee5797fe3d74476368fbd2fff2_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3de2b5ee5797fe3d74476368fbd2fff2_JaffaCakes118.html
-
Size
4KB
-
MD5
3de2b5ee5797fe3d74476368fbd2fff2
-
SHA1
2002f6b2c1104b4fdd4f68feec94ac1bf6b4791e
-
SHA256
da3d5df0ed10cd84547190d3c78077a91f542efa5d53c2e2f90fece193e2b165
-
SHA512
019193fd580c186d4bcead3909fef0a307e2750070cb76adf1ef8765947bbb7bc3231f8fb2c99253814f7b68c27cb8a483323f68bc9df15517e2ae8358bfa008
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o01+Ruuj:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000ff9d87ac40b1ee0689a60cab2cc0e026520b9731cef9dae2909b58da502f53e000000000e800000000200002000000091c16ec06489a557dc53ebce6f54241dcb2ecabf85a55872420905cbb417625a900000000f7c6bf5eda555ccf99401aa882c408785bf645efd7c76d218978a1ffc85f4e0c6746f9b6b08a4fdc41bbf9daf974a52de27ba0d7ea14fcb86744c52776f4ce950a23558631a6385f106dcaeeac2aa1cf27d914d5b67fa7fd7b14d6f3cb423e5b50831458ff3fe9df7af79aae238049fca9a7e26b81a4ae6ff8806111c019662fa841a8caf964a0ad80ef5b65584825840000000af94d9913e75fde6969c9c66c3952590c6884c35cbd2ad7d533f595b17a43da8a13b2fd4d98862255ef1a98e07294cea92b3aea24b97b433f64dabd3a55383bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d105a7f5a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D291E301-10E8-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fa640b8f69f853c1e54237fa493e364713f3aef552b93a5be4ffd3cddc63816a000000000e8000000002000020000000e0ea2264fa54bd8eabb37d0a86ea451f155db72a4df8642f2ce613f046288c0320000000499492f7e4af575435bca46afa958772a61d09afef3e8e47e11d9e8c9bcf0be1400000002b3285f02d56cc537c608516a74456b9b3aafc11afb536c9511c9e72c94f66bd302d976cbedc179f153516a7dea9fe74a9724e6a83818852ebd33eb47607088f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421739629" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3024 2976 iexplore.exe 28 PID 2976 wrote to memory of 3024 2976 iexplore.exe 28 PID 2976 wrote to memory of 3024 2976 iexplore.exe 28 PID 2976 wrote to memory of 3024 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3de2b5ee5797fe3d74476368fbd2fff2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f7261c4beb7fc915da91370bc9abd06
SHA179a8f5ac96784f176daee7959931fa2b938fe224
SHA256509d7d17be0f2e2e9b573eb8f843361b2047b341fd03594a27e90be6b13066a4
SHA51298c29cd5e319c279b17d6cc1a1948f817e531b074e2ae7dc4b32e5aa745e1c4effe41b59199fb1eda95933e51dbbbbda145f53648c1016f65cb42ebdccf5e39a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6b2a05833469f7e411fec9d0da8ade0
SHA1ecef7caa76a4b61bfd4ad6e7d836d5457aed7dbe
SHA25681dde1e1991d18d47cf8653d0dfe7a6d516ecbe6850672eb9cea98506293c6fe
SHA512e1cbecd986a14897ddba3e4a832e8d6eb68652e099d6c88e4cd9bff848f34ee79595f056d452e982c26e78fdc139d9f0ff128feaca743cb8c1fb761e56f0fd6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d921bb2c39140953a0b661a0f71e986
SHA15892fc51431148012b3f5b1e94ce248639cdb38b
SHA2568d9e8c3190fcaa5f59883a8a2fdf5978de3f5212503c9bd80df21c4833f52163
SHA5129f7d9b0ac3fb20909a3a12836abeb8876deb1884a763bb805988b1a757c0db75351ea61055bcbc8772b0fdc94f57d1d70a62151fee4e6a027086a9abf7f437b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592cd1ff45b403e549d0c55183c4555f5
SHA11313859829c0540e8290b08a1d313abc193d3e6d
SHA25613e43318c6b93d7b268a131eb6a7da6be87ba26096f369472df6f543add4ba9b
SHA5128c7855831f89982840db2574b665e4f6fed6d9f5e47cba71e7572bec8dc07f15ef5f537f28998c0f7c584c70209946c358aefb22e67791c8d6efc90bf2222ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556337e293ace01c3593215c166319cd2
SHA11992ebc4db48da0c7113cb6a82ef59441e6d9bcd
SHA256770ada89eb098746d498d32d42a54f38c4e66286444a9af810468ab89f21beae
SHA51209ee28c28e8f00458034dd336bdbecaaa4123690c09373baf4a964184b1e505592aa711acda7c8c0fbdc5b8a8147e0ee2e36683cc0f216b4f23513fb3f153aaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52db869716726269b6ad65ad4585cd4ae
SHA170d5f5e814c517ead68c6bfc25d08f2b5dd1cde8
SHA256dfc1fca95b19691ccfcd1be7fab41955fa74019bcf34ebaf7d9dadcdcbbd1326
SHA5128a79e7dbcff27fcc4d70052d235d7ff96a6a8554c737c740dc1c2c21695d503a1efbd963f11663830217e7f3dc6ffee12a730750d0df559a6ec9055c1a673693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57098f1b26911d9750439a22298961270
SHA154211aaa4a6b1e67068a98f41977efa8c4deb30b
SHA256194a80e23b8631f41171b11e0818c0ee53535e97e4631a8c881935b7e20122b7
SHA512de9b20aefe3f9b0a3e1eebe8fd6c67763f46257aac520303bc021948acbcd21ae92fe5ea87733d78009e345e7474afcdb794cbc356bf39f398948d386ae6f90a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa2635904dc07f6d345650bfdfb81f74
SHA123e4d74643f12c715aa10a3434498cfe97f8a735
SHA2560a783abd91074b536f0dfa80421f685a8b4def1a4be6b74c08936a6d6b460f34
SHA512b5dea1f177869636a1ea452f62b4e235267b24b248d3827f854f665dac4e033544a5a8d20a8d9cfae19ae7b1a6b1b610db105eff0df6fa1886d8109c6060b6cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc7613fd7cd8929e4b7bdc664cfc64ef
SHA13d1d250546d105720b741e871f17681aa835b9a6
SHA256976f1a56c0a7680e02544b44ef83a54ed1f380fe40d66b71477586ea37931042
SHA512aec64d5486c845578508a5506ecdb90813508a571bb7f1a30d63ac3b52e1a1502fe154f1da3ef19ee7c7399ce96dfe0928d3455594efe1565f77bfa99d5cf6d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db6be28afd436b98be0941d6a1c521dc
SHA1681899893f704186fba2c307bf7556d4b4f4fe72
SHA256b59b5d105879475c3dc49341a4b5f9f90801ee29f8ada43bd51be0db7f9e81d0
SHA512d0d5bc2393943102191292c063270aa5d87780c6badfe9919d2354b1549c7460601e18406c048a18b1b7fb3017a9a81d6d18d1821852a391a658fe7540d361e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a45ef757517b229cdc532323c5f9877
SHA11703a35d89fc5462660e8b0947165cdf0146a585
SHA256d2ee17ac588d12439328ceacb5c3d2f7839f0839dfc13d3cf2080b64465bc044
SHA5127818facbbdfe389627520c17d14bc5c30dcf87088f4610eb07a5a9ca0383e8bbe9fd0018be495b2dca6e27b2ddcbc09bae5a23ddf00b770372d8dba32000277c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a613564e8da6d721f5717d14d95aae2
SHA151518592e63d47315e62c9953b1b1b3b7c223b06
SHA256023b1588dfe30ec949fd29493fe9ab637a81323b04764fdc0247d8420573892c
SHA5122837a8da16550bcbca56efbd32b4f36c051d457736f41f9db827f8a83d6d2c698684041695868bf953929936dd029b85d7d1178470150baea1467f3b3c2d1f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594150e8939dd828a6b581ae4b2630b7e
SHA1b5ae672aff9b7ee79bf9a8a4b4e899cf6ae43b91
SHA256581b1fa7cc68da0ba44e2fd4ebb910cc8046ec9b33a3da2063ae2649a3650c8a
SHA5121a4b0f84941f773e23588e68b20416dca619540f73b113236051d15bb2925f2c22eaa8dc2b1494adefe4e834d936ebd6a4aa2ffb3a89d845440754c38fa14548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509228421336fd860aab494b7d934e1fd
SHA11efedbd70248f63156d5221ab37a6afa0eb45e51
SHA2560855c4f7ce22ac083b7c944e0e035c8d37654f933c3469070d9a1216b9e0ca66
SHA5129cb9873229673a7d8073c9a9f27f12da1b9ba0f001079244cfbfb4c30724ace966029b04953197690289784b0304ac6c4cb9d031e2722f01c59ef5e80bfdc909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c69790d6fdb137d7957dedbc7a3dac
SHA1921204599214730d45adb6e01b137b47aac0f92b
SHA2566c374bd6736d60fae57d63acf8df16a7f5f70b1599c99d514441e0e18b683e7e
SHA512e351febef98e443d6c225dd1e9c768af8a8197b6763d2cb753749581ae2fcd4e0a4766fb5beec581e694c1dcac0637cf51b4b9dc666f6e27fcd57359010d52f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d5544152651e7d4a5778b9b805b3524
SHA15179c6ba4537e71f4e5ba037109b7fe248708be1
SHA2562b670ab9511e7ec87be6030171cb5b3b14285569888bc51e146066f20da7d4d9
SHA51220a3ac4ad3e69f261ccdd8555fc9a212faf9710e3345aca1b2dd16fb2e71fabcd278e5d75bab6b1199359550efb34f650b4da3fa35fc786847f0fec305369718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556605b9cbf9997d641c4f36a48cd9052
SHA1a5a42d6a2b2ce8083a55f699503671f9c8ba89a2
SHA2567b79a7c4e24c62facaf68785d05ae7f15ad39574b8a022999f55bc57327e18f3
SHA5121ff38598a7533a6e8a4e478d017f6f173db62619a8bfd5308b927c9636240e66bba74a247a7daea5b562c03d40ef01cd181561657999c9bd7f86c94d1f161c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5588f3c3f8ea4c9830e00d4e2bf614e7f
SHA16e87560cba3746255f1c2482b98c355d64fd19f4
SHA2568d30d2f39c674bf8400d481a4297c05887d92e8c9d1e26e27079e7d8933010c1
SHA51261caeed32f7b29412067ed81a7a158230ec282838f75886419ef79a13acf3e786c72c223cdc2763f05e7fa1eb14843d2b68ffef1ad965ed53ea826956c28eec5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a