Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
3bd3c83ee0204b60b68b8908a1a90f21_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3bd3c83ee0204b60b68b8908a1a90f21_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3bd3c83ee0204b60b68b8908a1a90f21_JaffaCakes118.html
-
Size
27KB
-
MD5
3bd3c83ee0204b60b68b8908a1a90f21
-
SHA1
259f71fea2cee562f073a6fcb8190bd55f6b174a
-
SHA256
eddd2ac5165e783c09fdaaa614bc7168652e4d1b569ef983de160568cbb7bc21
-
SHA512
b48a0018dc393b927e27f5ec5febded80f2733983f6c9c0d3d9562f4916783012ee07243e2c6ca4fa4e1738895820103027bd38a3cfdfc1319ef662d39b2a1e6
-
SSDEEP
192:uwz4b5nf6nQjxn5Q/2nQielNnrunQOkEnty0nQTbnFnQ9e9Zm6uf/xQl7MBFqnYV:6Q/4YTq/YSTF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F0988E1-114D-11EF-BD10-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000725ee401b1d79fe1d3f3c4b8556ee951d2452fded97f77ef0b2400fc71bedb39000000000e8000000002000020000000134e8b859b155dd42d4ac598e1ae38218ce7e0f25b6f795d05f4bac484688da52000000086afc61117bfcda72653d3d6c67ae5ce1a9a6ad508e492404e413f37761d78074000000069a428078fad9106083b4287143778b9ef7549b7643ab8d8b355d53d5f486bd1aa71b25ea73d4c3018f42e6d7ed4d7b95281a3c0cf010823e41033386612ce19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421782869" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700118545aa5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001d73adcdfe4d11d26dcab6493dc818a732d73af5f2b232e97944d94961647fe5000000000e8000000002000020000000ca7520a2fbf60d652839ba39fe0302027628f86617cca5d9d831fc30537c57a390000000d0d63dfd07ebbe4aa160e342a4994f4c460680ed65aa697570cf1bac21119c0ee84b0a2663324368bd21a9d05943e7cca34443c4d7a88c27716ecbf9e9186086defb57f892c80e45c326eefb626ac8467f756e0441f97a80e730db4ae0f8b8b1cd02fdbd4bcd132c09a78a52e1bc188bc6c34e1e25b8a3dc6e8979f69f3e3af1d7889f0f2c63d596dd66a69dc3a15151400000003f0a7812535d21098f4ae69b9f4935ec940dbaa24304c48f0431a190f1887907e1b53378ea22dd44cfcdceb3ba84086a63fb6f862e89f7f64eee60b44889cd9c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1624 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 1624 2084 iexplore.exe 28 PID 2084 wrote to memory of 1624 2084 iexplore.exe 28 PID 2084 wrote to memory of 1624 2084 iexplore.exe 28 PID 2084 wrote to memory of 1624 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bd3c83ee0204b60b68b8908a1a90f21_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a40b32b990abd783f712edb2d32834e
SHA13b2dfc5d9b82db7296f5a06cfd77c1893629dd55
SHA256456dc2a7969982aad1cb40945b10591f7850a16face22fe57d634bb3f11040cc
SHA51221f98b7b5869a02625e771b8f92fa645c5c036442a2ca952d562a1976d174543ddcfd1cb88b1890424d833dea96739cf74d91a88b43645c977b778053c949b50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503a984dcca41841ec35628aefededb18
SHA16b7847e64a2eca2e5bd865d2d17027fff68039db
SHA25674bac8d6cd4d67554c8331d1d30fb9bde2b8673ac4bf2aa7de2a870f81fdfbe2
SHA5128023a634c8c60c98585cdd4b390c00d86bee78011bd34354bfb1a188ea208ebad23cf810294f8e1cfd4890f539bee314a1dbf7de78acc0a3fc9fde7a6ec443fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed7d9d9aa76626ce243dd3c0b5c20795
SHA18f5f0a2b3a22e00fe047e57acef131b15c9f6cdb
SHA2561616f12fd00bf4a7afa045bde39c366969f15f4841c5062590970d8918c2ac3a
SHA5120def5fd1b5bc7b2f6e872647d3e16ba07a7db1eab4f89e7ef10b56c92f33314b95292f798c72ddacf20ecd5c88babe86bed8d5960507388816f0bf0fd49d0cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a46c6a4c47bb6f60120b4df2e9ee0192
SHA12af5bc65feacd92873338494ca0214de47ab9946
SHA256914a90ed64b5fd0b666f1c649d9af74fc2087d3ffb73989ad02860d608a53c43
SHA512b9ada8cf2803d7fd78d4996bbd920220b8f50eca7a753e018a765d639d35c22801c34106e003c0d2f6d6fe42cc484b070271927e99a86179ffbf442ff16efda6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a02f347b4b80ad73d989ddc2eadd199e
SHA10e3231b938e19f7018cb4aef051e33a0d7bf75d5
SHA256b52f72e7915750661fe21c8ffb09293bfa249b64298319f4ef2c749473aa65ba
SHA5120e0abd5455a540cd3b240373f737fe56e45d715f6dd9ed3beec26074eb27cbb430769e0d2ed19334ffe3ad04ecc7176555e6edb7bc530ffdb4c38a8c8817829d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c6638671a31bfacf9958a2af2ce30e0
SHA18bcf463e9738149762c99e1155445c9171ef3a81
SHA25678f97649c32e6f41a2e9c0f7345524bf1b97d74b5ad136b1be5a69bfb71d1f46
SHA512b682e520bbf3d7c1861c0700f5d5006235c4854d0fe428486049de6adf20d734599a01e642228e0c0c4511de0f465e05ca608598b253f8a35a2eb24c93d6c89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f23155875d511b0e15c8c68e8d368693
SHA121a0b2f23fc293be6af6b1300a1b1719efd5512c
SHA256ebbc63222d783c01f004e70febc7c1929f5fbc67c97a702e495cc7f861c14cb6
SHA512c96fcafb9b1ab6a2dacedaa8814505a441702a08335d8005ff7bed134c04ae7be1d846588ab3a1166dc6f235df5c222ad5bc900a79bd3388536d2334176eb232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520d48dc4c7adc65c958810c93b1cde68
SHA145af10568d290d9279ccdb12aafbd66c0afce0d0
SHA2560b23a7c591da30abdcbe5586d7cffdf39a040a2117d82ad3186ee129877ea0bd
SHA51245b1bffbd04cac2f17cd375e4acd6d3f4108250017a3abfa5f805826762b6f2a864d8af4be1f27494c8a9d960ac86e58b744fd64678d0c3e7bcc2c8dd5acbb67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561d481daa73b2dcaebe93cbe84677120
SHA16ef78683ff8ac1f5a2b7e8d81e1545098768678f
SHA2560f0f36b85edd1f8096cebc6ea3a74342576733de021d182f755adcc84d867073
SHA512288a7707cd68c6ca0616eefb3fee0038daf5d86dd8da8fc1d0587524564d0860f5f5e76ecd2499e231ac750fbe89eab712db57b24ea26f1984c38d13b7a44987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f588821c1e7c1abe15d82d156f4a4a3a
SHA12bd299f754c5c5c48739f0ba9effd450d41e4cd9
SHA2566c493cf098c36dec1b4ee309908f6bb311d32361b242915e7667d2b7b35652b0
SHA5127b69cfec483da95853ad7418fa09bbf3277cc610af77412a9cb47a25c624ca2de3cbacdb5df89e8883d7c59d8000dae2def64a9e78e0ae5a19300b61b5992d7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5345393d78c06738b08533014ae919c83
SHA171dbb56b64be72d7efff459a903e4709a8f496a3
SHA256678bd2946c9c7c000357ef533dc0f3e0056ef1e95b2a86795f374456dcde5c33
SHA512e47c2e3a6729a48c562e32b60c10c80dc5290303aa182f043c05005f8952a35511e47f3fceb62fb903d04e769be40282533ff4890d17d79cc13c5ef64a83da01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547ce10ea023816624f0e012745a3055f
SHA18b18c48c9f06de7734adab38ffdcb43b40da5a1e
SHA256524c47226b57b22ca397d1be2f0216b82a0fbfe1143782a990d9e352f3bee07d
SHA512598c7225f8d715cdc15a748290c2308c982f189972f935f5433a9a80daefcd5d0a69ece347092b970f91ac871080fddb37c8ef18a45ab6199adbe54e7a4e240a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9bfaa3a1e533f7ef61b9a18fb7fef2f
SHA11bfa77c1a240afbf3b1b64591b9b402d5c35b618
SHA256f0303f1819f7710c9901b1ae1141a616934d3e1f1b77edfe7c9f49849cc488f0
SHA51232f1e9911c474c48d8d13f75749e7b65e9e8ec39452ce514eadbe286c4a892b6e0169f9cf4e591bd121abd9a41d95e0e77879e8deda399ccaa251a507dcf6873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f8680530adac243c158b2af8b15862d
SHA150c7f4ee38ec5495e060fb0cdd92de0f00c325cc
SHA256e95af2aa019a373eadb5ca743bbe9da3b82da94abff38cab318e42858aaa3ecd
SHA5128020393dc0b88662bc7668800d8bcbd1d9a7ccaa9dbd9455b772ac93e72a1009409d7d16b8da448262a043b850aaa03f72721cb245dcceeed1f9920bb19aab2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be0e7936fb20f1dabe668e14ecf15371
SHA191b1c0364f712740fd2e8cde2f05e92743dfe5a2
SHA25670112455e11202b3ca87d9c0145f53d3880363a47bead76da635fe64edbfd7f4
SHA512b9d5cfcf6152d25cfe3f56595a3b786738ce5153077b427396ae294155800b378e74ae78d2249f90e4e7bebeb06d757964bfe8c1ef19b7c1619fa329a121cda3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aef6d302fa4d2226e81e1959f3cdf89f
SHA19ff404e5e3fe69a3cd044d948bcad1e1dd2a8251
SHA256d54677863c706ad292b446b90892de8fdb36cf42ca8a4ec356355c5d6afdf662
SHA51233c40069e9c011ee4a0d861b992b10b6f1d18977421d88f20d7fb771ee8d827a4767a33ca90f1e46795a04d0304c71e3053f544b22a8742163dbe919eb5471fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a