Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
3d5c286a530b42a9612a452dc9a0ef28_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3d5c286a530b42a9612a452dc9a0ef28_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3d5c286a530b42a9612a452dc9a0ef28_JaffaCakes118.html
-
Size
16KB
-
MD5
3d5c286a530b42a9612a452dc9a0ef28
-
SHA1
8854d010c961011e94c40e59e286d51f25067f3d
-
SHA256
581176b961fbcd9d1c0ca9b2d8320f27967c3f059d031c5bf0bf7808e3ed0012
-
SHA512
8077ae65fac342a09d24b57e859d989fca0334b3a80c6f6d9b970183fcaab12a37086044784277c1c5784ef28d29b52119be636f77bca56e01c2fe3b9a960cee
-
SSDEEP
192:CMMgBEOks1QTxE6av//x/pCU4Fq+fltz+flqD+fllpl+fle5+fl/j+flut+flusn:CNOkjHav/Z/AU/OlCrINbAxz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e6f4f5a7a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EAB42B1-119B-11EF-8A04-E6AC171B5DA5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421816208" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000f226d759db9b1751fb000cfcf6fd22e5d07cadc74087812165e3707014445fc000000000e80000000020000200000000ffb82fa438fec65622d247811cdc31859cb4f1e1de2a6629bb7f0bf0e3b57f020000000cdfcecc113bfff0b9bf6a3e23bef9a1719e789bafc54c3a1db89d278d99fc62740000000ef5cdd37a990ec1ab4361e4c3f3c848f6c2e62b280c790be93fc55ed0340e28d3eb4ba078f73c6cf888d201a718d26a860ca993def55f774ab4c7b2f52ebd4cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f56a3684bbbd87c90623641ec6fdadf5ca638acaa6d99f282a983a732fd3dbce000000000e8000000002000020000000208eac7a2eadb64c670ee3b86aca5113dec3ef4b6401abfb405ef6193a5d40469000000070a7ee5bffbf6674d62a94460f8885fe2be613d4f9bea0de30827a4c5b4f675061291d1cf03e00a73a31cc9f486e2816b335212c35483d0d2b19487aa7d559ca29230c04ef7e4d632fa19004f66ab25793542c72bdda3f7a0434717ac30031e7dbbe2e437c7409ed7b98dac87fe1b980f441356ee7990cd0367d95be47eaa2ea142933771382e4a54fddf1725bcaa74d40000000786aa5f4b5ed286c619624f03674c847b664b26d944ad7e0e21d2d7fba1077a527f663f197126dc3e7c48c1122338f485a71fe3b1da67361b131fe88fa2f48a6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE 2104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28 PID 2360 wrote to memory of 2104 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d5c286a530b42a9612a452dc9a0ef28_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7f19307b5ab005c3f5219f3bbdb3920
SHA1cf8fc5441bae66326912e55204c3e36b3ea637f4
SHA256d68408d32b6544a3ecc276123fc59b28077e18cbcc25a58fcea119f6f0467996
SHA512529f39ec5e07c96bf55fd69ba0f6a420af3c26a2a208176ce6bd1be20fc62651a503daf2afd64cd1671d71767ec1ceb144a7d1b02ab1dce91056dc3fad571603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b82c869b55d8c26806d38d7279da8ae
SHA1a76a751f2b2793afdd564f2066a491af62f8f4da
SHA256d65ddbbede3c2c8d93da5e132429e8b65e6ecc4ef98b885107ba8b7dd1a19e70
SHA51296e1d4f46122098650332532e1ee1afc54367f14b12dbf8c89f414af747e4e2884e4731444b2e1fee2a3b38811b940ad52c255036d9ef48a704d6d2099857b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5921daffce0acc022098a99b75c8c37a4
SHA14e94a0b01b9030eead16a8485df99bdc01d75b5e
SHA256617112bdd24b2e99112f38ed6659c365ae9a90d608a24ca147af2d0281d4ddca
SHA512839fe805b2566a58e62075f45ca3241717763f46e62b929cada49a84a00356d2d4c9a8c1bcdd969aed8eb8a592e4842b2a31184b64da16375847cdd49024714f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d769a3993c75df8c7371ba1eb1c8e385
SHA170337e3f22fc61a3c8dcfa85de93fd5e88bb3ab0
SHA25601671bd8210294855aacbbaff2821209653437125aa41f80a2fbfe0bbe059f82
SHA512b2a904ba4b1ade42b58374e47b11e843c27b06dbdb59bfecefd2014541fa71f123027d81c0b89273ea2932b98ac9cb7fa750f65fdbc76275f518604d61705528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53618f54ac65d045818f085aa3dc54154
SHA176a71f9f18b432e40cb72af4e8507559ce65e092
SHA256e80ccc1879a4326e77a2d436d6fb6cd99241dc67626585c4f20f48784a217274
SHA5125f6f6ae4131f57b83ec817db1760d3d63e6267dee9b1d7975faa75695eb7ac90306c7c28f1206ff3ffd3cc2aa58174c9a410d924ad8eb1cc1cfe174297998265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563b0885970c28b7b463e2058cf8840a8
SHA1c4c4bb90478f9a751872f65ed3be32b28328be27
SHA256c2629d81d4231dba53857e0f70332e3d0a5eaf5eb690ac7a4ec80d7afa77c205
SHA512fb515516179c67309bc96a656c67c423c41d3eeee751f01429ff934405ad727b9b3d39247e725d94d796fa14530c6cfac2f647a15e7461184492f05eb79b3ab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed28f876106736ad8f46c1696446c69b
SHA1bf52bc9841e3e188aa5161e1c526fbdb1b3602dd
SHA2563feed752d86d7bf124c6dae23d45a63feba751aa45521edefc8e30e109f4067c
SHA51256309c4525d4e7b082db65b72796390ba0e99e32575d5b1add33abd94969939ff86107682a786c6a36e2de2334ed43597fb44a04c4d0274bcd1ed80549b78513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e77054898519833d34cfc3dc9e08e27c
SHA17d10c4a2e5e91e03fa7171abd4ba40dc110c0202
SHA256656622cc7790960dec328f5d9dbd9c5cb0b87e544563bd3b17fb5c39efd1d43b
SHA5129455c4d307b781413cb96ca1cb398e974728d3d680ea32ddccfe66948c2a472c15464c901387070c679da1ed0ab950faeb02975689aca5b477aa12c1edff30ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54963be0fd9260e96348526202d5d4de8
SHA1a7c41f333daa33bbecd4a75d47bee3e4b66a3582
SHA25616b7b4d447aac1a22324a811aaca903a131177fabc2e5dff81f612340dc1db47
SHA512a4eb9b15a561b14499129590b9659749c1e237dbd8c679c6481e6df2178f1fb7e78ccc428187c0e75304a311b9a1e84cd664fe94612c170404a4701f143773f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5357e5a33bdcb0c7b0e8f56caf6cd624a
SHA17a49e4dffa8e873a0f6ff35cfdc72ee402f2cb9e
SHA256b42c560cb5df75544e5a33d994752e88a9900b29cb1641dcb0d9561b85b6cdb2
SHA512681c8c23d73b78e85680f107a2e99357cf8b66f5be3bdca5cd41230425446b1091284f23bd309d232e7060cd98a1295d02c013894f35692a67ab3fbc2c291b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57abec03bcd30257e0868acb18825cb33
SHA1a4ea19658c0479cb62b612968d1580b0030ace19
SHA2563c4b6553521904935e7f44425f25bfcf8c784287e0c9d79761a1d2b8fd668f15
SHA512ef555e9cf285206ed9aae5390d83fc5bd794c8fdac3183858167e28a5900076b2e9dc51b91ee2c0162ca8da60e09af1376d7fb5dac58602ff67cf97467c60c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a5cefc1152ff8c117dd54a8be714d84
SHA11a6ba66af0d3b31b1ad9c1799752629050edb9f7
SHA2560e18a8141fdb44538f56fb254dfd69d96f8bef937ef108ea009cf9cdd3793bfb
SHA5120770f49fda97a5c75020447f4fd8a6d60ea2cc7d27f96c521f20cb0d58902479b9ddcd1ddffa9b73cb8026faa7963295a40b65b5ce20c0252e843a2b71b84169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d3bd481dab098e7882b95980f418974
SHA10be9c062d936dc668779a64a979c25071c60b526
SHA2561ba9776c0881f6db40d8ec588c5321e8b052ee90b71dbd626df5e00dc6c7bd7e
SHA5124e30ee3e1c7b9ccd4a753cab87018bc470b50119b5413b991247c6ba10e74488d33aa99944cc600ef918baaf4e5f51a1d5e7d86e1257aea5f562b8c47416366d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb0a6da2363f751075bf8f01b7483bd
SHA1928f10c1fbfbc4513c0fbab9a0be3592941357f7
SHA25679278623b37cc7b1ef0f7815796df82e5f1eb1e7094cff80a7b6ecfc99132ce8
SHA512002b07f81350ae2421f1c9a73112cf4cf2bf187f9b74e2ef96c6a254772b9843aaedc52a13f2d7c5bf5ffff11c26ea75da223b98ee7a99acb51b73ae8df1dbf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599770eeda769a39e4ebed0fa4ac77c3b
SHA18cb7418b55c9ade93b6edc58f7464e845c956c77
SHA2565691de8d3d87bff0e54b261d2d9427db85a48796871af923dfae1d822f9f172e
SHA5122331a79e332ad3312dbfa028db81dd7d6d7220f2da90ac76fa870e14f08593918453c6f7d7a65ec72e78035801fe452d69f71d05119dfa14965a96a615003491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52384584e43821ca409e95ec93623ce53
SHA1a4047ea39393eeca908e8cd148b89de0c06336fd
SHA256ff9d7dbaae2f7eb3c0430e625900a4f545f5132c4b781ce4504865a082c8f512
SHA512448611be003a7f578699b10deb5bd597e2ec9f70fba74313571f8b3a30ed8744cf5fd1cef92f04e2974cfc7b687c28811be74ae90b083f59236b3ad38a9e897a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e12a9d910643c9849e0c8e2369d84c34
SHA1cda69d38def317c553165a0a4183d40f9c80f3fd
SHA2561a0fa54067c6d317f30351004010288d787b23a307085297bade48c1509cb55f
SHA512e67ea41679434c03de52237067941288bd12ffc920095772a0d4e1e9e42b351f466cea9c186426b14218b79a3bd176ee524fef94a38f73f7b1925855893ec1e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e75deda8c6fb2ce7de1e385632cb1ed5
SHA1337dbec139f44df79ced3985562c63c4c2fa46cc
SHA25689599c3504a8ef091a4c8863f5b62c68e53697a8db69ff5637aaee483ad94f79
SHA5129b4b25fc1173fabf4b5c1825fecb2f6f1883c87d2e2cfdf09cf7f9f56bdcbe4e442ae0d18875207832f3cdda55499f131346403cffbe5545a43fe83958a986ed
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a