Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
3e1dfb5c1c602d85e9ab78e6c82cad57_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3e1dfb5c1c602d85e9ab78e6c82cad57_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3e1dfb5c1c602d85e9ab78e6c82cad57_JaffaCakes118.html
-
Size
27KB
-
MD5
3e1dfb5c1c602d85e9ab78e6c82cad57
-
SHA1
e0d443fcd3da82dc8ae30969401080e8a8ce213c
-
SHA256
ccfb546299cd16b76f802a800d07006ce1342bd3e9db0b609917a3160e4141fa
-
SHA512
b6220c84ac98914fd39fa83d48e4bdb3ae5fb7d4724d6de50485737bfd7a8fd370835b3cb17b196195215219bbb1117a50f997cef587f4151260c0aad76a014d
-
SSDEEP
768:UKCdzIhVgpqmOSFIpri5lQ1r+m5zYAH6Z+0BFM50w0HeK4lYrABRGGhE61L1x4Fn:UKCdzIhVgpqmOSFIpri5lQ1r+m5zYAHS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b48c6bc3a5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005558b438e55b4dc8a97c83e7b1aedcfabf9dbef4bd1e41c9a20bbbf69b1958e1000000000e8000000002000020000000624c24018da303fa0a692ef9ab1fcf7796577296fd6e06bbe663af7c3bf9d3389000000048bc74cea0b41a145d0258afd196b5f72afbdb710815b218843cc8ae472d9c66a138bdcbae389c552b052d9840cc0ebb92c55bec4053eca70bae5629d9ae3905ca222af6f8490191bc85cebe3d9c67230b7837c372e9c30ad5aa9380447309438301220581e62377700376881e1b191f18517e9d086f05789c3d22a2f63a3925992933424718eb1ea8650ecc505efc6a40000000cfa7dd73bf1eb1182121d872ab2ea0e348f1bdcd5e8d35ea5baf1a31db4d88898b54d4e1597b049f1acedf37d70b03eb3d802cfd6defef252d89658b05c03f7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001ebb48079cf185d35637f5b0ec6195bbb620138a8e96a831a10b4772f2414bdb000000000e800000000200002000000098574294193b42c1fd541817d6626d9f3a342ce7424cee8d230cf5645c826d17200000008959b175b3a34788a8bd10e8ff4fcd580a95f2fad5de37c34058c58edd00e70f40000000f94ec396f6931c62aee154c30f8e7be0b367140ee75203659a111a63f95b22e597f383e40616ae84ebb4b28dd8fbd4e311ad5b541ad07653e7f834935f23f68d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96C47441-11B6-11EF-A304-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421828006" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2552 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2552 1796 iexplore.exe 28 PID 1796 wrote to memory of 2552 1796 iexplore.exe 28 PID 1796 wrote to memory of 2552 1796 iexplore.exe 28 PID 1796 wrote to memory of 2552 1796 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e1dfb5c1c602d85e9ab78e6c82cad57_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af4fdcc9d179b38b17ce758a25229f7a
SHA1572e3faab86276c581d31949b8dc04037b637d88
SHA256bfeda95169b32b916f909abecf586b6e0739b61d80b005fe7c0f5cd49efdcb1c
SHA51270a72f99a193cacc1600175c9b157807d8f60105edb2d1dc40cad906bb9879279c5e63e3bdd14da40b7002dd20de353c1aa944604e61fae92518c4fc4c38b79f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f0c1f026644720f10332c6ecc41247
SHA1b33c4fcd7346cacc085fcdea73b0a0a012fae023
SHA25617c8c2adc3e1f216cbc391f9f47d008ff23d2084ab613769321987d0b9672b0d
SHA512d1f5e54529eda66b411467f9b5ad362f09e5c204291ea07ccc80ac776105babad042967dd8f91a0cb841c14dc648b509bf70460c19e2d67f068aa8ca9a19d9d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592e3761c0ce47fcc0bb0547914b4ae45
SHA18ede36f7889454d3d92f3f6e20b3d013277de088
SHA256ad314d9a23b7bd6a551d4ce6a726eba974799432222bea8f36ceb032ddee80a8
SHA51281f831a0a243700194e520a691484cff491db6a1988dd54b911b43bb3ee235f9c6c101d6e50b9516bdb65874939956cfc85d1f8ffcdff87e0f9e794ab4a47c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5228822d234ed5ec2cd97c450facee4bd
SHA11722fa8bbfd755225e9954a5b674d42e783fe48d
SHA256c2ad3b80ef5dcbce08ed4d30bec6af9d81f49c9bcda427dd0711b28879420c52
SHA5124568a88756bfb629a19cca37b64610d14f38d2ca398489d36d8b4329e80603819db13c0b32db4d9ae60d7d2403f7260ec297a2ba4b22d1563c88eb8f594c63ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1ba6b20594ddfe23262b4910754c7e
SHA157d9892bdb382b44b5d376b07b52754c3b6a42d6
SHA256c5b881ce0b93b9cbfd9abcdcd4ac66c6e9d891d48bf4cea8d5faacbc367083bc
SHA512d6acab93e5833bcf450bbd04ef8f0edc465a42ac9339aed205c9446df1190b3452c4473ce72988d7caad9ce0ec50116758b36ebdd48f5c533f4322ad251415fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b82a686418f13fa3a044ccab8a6d3eaa
SHA169e2997fabb3139f1ae68b96c2b0272ab930a837
SHA25636a18490717830b425355995e5e69428560d1ed3292dc9d0cb1136ab0f7fd36a
SHA5121841bfdaaecc8283e8a76cef24fd03c1f8338b22d38c717db32be06729bfcd4854162ba6f9d80f81b6767ac4f62d7daaa33f693421506e1d0bfbf18812ea2091
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556f3dcc54d273b82359386fc6e203cd1
SHA102131efce8e829fde183d19f836f613cd0ae986d
SHA25611476127445ae101d3b647f7723ff3e8d0f24d21e99ae121a564b5c2d572ca8c
SHA5126e54fe4767c6de0b4c353d4698cb1701fd30afe7ddb0bbe6a66c725c261d90b0c7777c3ea49df354c62c912fa6a437c8abaa3dddb7d173740b3d8ab4aeda82cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557c64bc0698cb4342e2d968b32a71227
SHA16748f47ea0dd8851618b36301e1a7035245c73af
SHA256173b62898df1934c136fc5ca28413066d0b2d0ab4948e5c52bd756c2434a642a
SHA51209abe484f4ba248ae0a2af20754098474d61b14156bd9ac3c3db5bec17929ebc6b828fb42e7f5243a169458dd8d1328d94ac32c6ae2b516410c16f77fbb9abd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56206aaa37bb54dc985b3fba92531d587
SHA12b670b69dc2992a7cc8b4c346f8bf67cc82f0b83
SHA256f89e6463f86d623e08720691a4568c779561cb80f5f262474700f03d3f2a0762
SHA51255ec4f81f4ea7e8a3d27d93099abaf95e2698e126209b10e5bcfd61e78ac4fcbbce6814c3bdf9726564e31798561509492d964ff71717e7012d025fbf8a152fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f43d6f3f25dbf4bc0a18b3f953a91fee
SHA117fb303ac8725cd0e59411dd44b8b4fe2a6f24e2
SHA256668d3bb2ee47d70e74c4dc2b43aa2cfd0cf971346b0412bbe4c8e284746b6c39
SHA5124644e6fbecdd9031769574b257fc006171f943a84998decab3a9edf783d72b1c39bc29b0e714643c1036ea2243f6e04cd1d862e5fab371b35a45d4ebc682d39a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef429f146ecc845d173044ad06894413
SHA180b5add63ca72af4ca7479e738b5b6e698a95645
SHA25685c9549281aa857de66d4d59bdbff039beccfea9640e2891902a1f3f852de02d
SHA512e5e5f8708a01cd61f4f0ecf3bf9ac68c9499d2548b9f2892e62eeb27926b1dc1e4f27cd887129d704c8e683990a61c7aa393bdaddc15b67778cc7f4ea0737169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4658d598903ce749856e39e14ce0c8e
SHA17e76f188b25c99d005d6b2805cf9c69bbfb1d6b6
SHA25622ad29a3052039fdbf3f7c78c9bdafe9f75f29425af431c22941632980d8a2eb
SHA512949f7f4d7b13309400a80516f0572c78916e1facaf9ff0a7ef3cf382b01bb0c1bbc8b30b0f1bdd0e1a833b8830f7a4b6294efcb56fad2bbf4d18e061b7207f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505c753c5f5ee2742c2a2da2ffbcf0ffa
SHA1a1ead714fd3df3d338593e637acf3c100e055814
SHA2569618308340027116b22f71b3cca0d3b2700741b07a431425b4fb2364a34ffd1b
SHA5127d30a98b00f0d88e40ca10165f1a5b8005b9e2676ae3f3d309189f71f48b2a75f11de7fdb88fb8052017a0d62753e9835c57ead920d88eec151b24de4c3580d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bbe1d84ca58d0d5290aab8d11b5c695
SHA1e8389f7352a508ceab87f659d87e4b1ae9af9a5f
SHA2564836a88f9945afd98d4a5dc478bf307f15918216e096c8a11692daf0bd3afd92
SHA512f17db02eedaa2496496a8a9f587618845932acd270b291ea7a87384f946b00e0c9e9d8c3cc903b8d79f65196fb64d41cc5d7edea9fbae7c6cf5963f669f0f0d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cccf01f524a08023a7f7b17ede516fe
SHA1cecd5dbd1e6154543af77e7a502d7c0243b50e34
SHA256fd2a544141e6553cbb120cc918490c146e8c1f5610388861cd933a635ac94474
SHA5127de4d72ec4a9a78c7fed5b5ce9bd175ef63bee49bde20408d935a2325c507442d61cbae0d093ac3cd34358ff6ca982ea1357e44064815cd6eae11a3e21c67c75
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a