Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
a3eb43fca841c516a1f658aa2fa0c7f0_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a3eb43fca841c516a1f658aa2fa0c7f0_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3eb43fca841c516a1f658aa2fa0c7f0_JaffaCakes118.html
-
Size
460KB
-
MD5
a3eb43fca841c516a1f658aa2fa0c7f0
-
SHA1
8464cfe3739bc348b29fd441a60a064254dfbac1
-
SHA256
d580bc555b4d8f5ae9174876fc68ab9c4ae89b0c65642afa34139b8d4ebd94c4
-
SHA512
2cbff6278cf4e3964d284cca99af91997fab9bd2d80e5bc81fbe76cc43cc203110b5b663ace42d066e04900202f1a08ad551c9d3138e64ab4273137fef135e87
-
SSDEEP
6144:S7sMYod+X3oI+YBsMYod+X3oI+Y0sMYod+X3oI+YLsMYod+X3oI+YQ:+5d+X3b5d+X3w5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3D8CD61-2942-11EF-A155-FAD28091DCF5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ba82383b93757b121673871669a2ed1c5669cf450727d22a3fa8d1fade804eb0000000000e80000000020000200000006806ebb2d196a8213ca2535398167b158ca120b05340144c1730410cbeb75d2c9000000006f4a5ca08205d8945fff3e8b3aacb7ae3c2266e0b9ba48a6c80ef682291760ba3b5cd1a47d377e9c7e10d2c25482fe42a1375916de14fdcbd7280ec36861d29d590c07a6c87273198a6e13af9ea4996bb0bfc28c2fad2497206717eaf5b9ed3dcb94aa4d6f631da087cf65c9f480f83291e74d7e43b56dc4fcebf0f1962cf8576e4152755664d00787190438c06bdc9400000002ea162e9a5e7e61c847975c7690f382c23fc50811546aea748f58dbcdcc1a74799aaeb6a31f6d716c7f46208baf68250e1e2e938567e051bc9f7be182357a812 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424417117" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000087f478c8297474554f66a8db203e6004b4f3da62c168b5884d7d92da6330d7ce000000000e8000000002000020000000376a2a405b58e68fdd453dfb4d1499f9679cc99aba9d9f4b575eb6201dd379e82000000084c0d74d8876672a3201de91ed777b4fb928b42cd45153002a75e6b3928584c14000000032c957c1f96499eab42357059239b8ecdd118c5e4f0d103f0b11894213c5e03b6fdbc46b70b6027ab1aa4baf1fad0b8ed9b5af18b2c6c10f963370c87f076d51 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603f51ad4fbdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1468 iexplore.exe 1468 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1620 1468 iexplore.exe 28 PID 1468 wrote to memory of 1620 1468 iexplore.exe 28 PID 1468 wrote to memory of 1620 1468 iexplore.exe 28 PID 1468 wrote to memory of 1620 1468 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3eb43fca841c516a1f658aa2fa0c7f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557051f2d0bffbbb57dd73f89b300d3fe
SHA1fba33550fc4d81a4b3118b6405e430d26102680d
SHA256d24b58548f53847e94de9dbd9e8b7099c1b94b9d8e29e295fb457a964e62c0a6
SHA512cd628f5c47c71638165a728fe9012977a2da74145ddbee2d0935baf7e352032432437b2931df39d2f0e121372463cf473644ab956deac938eaac2ef2f390328a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5054b5b230bdbd2f368a0c848bbe97d8f
SHA18fcad15e58f90350496792b86a00148baddc4955
SHA256d596564fa9bb0997e9df0f84e4adeb932d5c41de64b717ae86af5b8063b7f913
SHA51288e2dc1d5d29af9d7d1fbf3c3319876ca453bacf7c53eec50789a7673da3eb5dde3ecf493c52d44cc0e5af7df992a9830a63ae393091c1b715fa022012495d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5c8eb8abd8d93c81d00e3141a2d59d5
SHA14ca77d2ec55a5e55fabe10eb675c6c49bcc94d1e
SHA25637c6137201b78d707d16eee85444cd5d197551421b5000b691ecd945692df0a9
SHA5127b13690a49783b92f1096385c9b9bf009642cb7893a276a8f32359057d881efd45fa24f0511e4e507b0089159fa85635baaa4c26560292d6542195caf2f7e5e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527cc574e8c4eaa3015577f24e660c455
SHA16841f4197fbf084e8d06251bb9e27a4b2d8f484a
SHA25679e1f010d015b252ca897cb9312eedf760ccaf0b11582a8ba2e2c09968f5d8c2
SHA512dfaf8bfc70bad515b4a7fd881ad3d4e9294519c3238f544929ae3ec64400d19d8ded4f1da02cbb41f64e87bf53d7bc9b7ac9407fb40ca7fe2882eb8107f9260e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506770bc407efe1deddf76c93d50e3070
SHA16b9439546f0e53a6f904af24865f53698cc861e9
SHA256be5ab20cf1b5e5332cc9d426b5e1c11827fb7ca1611c126b4bb51f113e42a011
SHA51291bacd2f197ef7b59abffbc3949e662a013d404778c0da6e3e3af6cbe9e1447034ef6862fb029c3c06cf161ddb52e6187936a3e886e19ded8480fbc41999dac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56adde62f1a434a98081c85e4ef86b7b3
SHA10024b65fc8a3fe43b880eb1f6ae255aef2b44136
SHA25626fa677afe141b183031379a4f7e321eb1ffdc1b84f5783e472f839910fef7c8
SHA51239adf8594894ee3d40f085e9f6dcb32be09f35afea986e0f17769a777474fe6664c1af2d4e3dfa21223696e4a9e7db9d8a7608cb80d90fb7b49e6891de6b5e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fbfb8ec9ad2665462f1d7d4acefe201
SHA1179526a0185152346f58ae85506209751f15f0f9
SHA25677ef882bc4466b13d29c84dc7c2ff84ffba7026faca7fdaf753860522058c0f0
SHA512abaf9b9ca1cd3684659f5360c50733ec884c92faf1a174869e80365c4af795e5cd2019badc074f2b006b1923392ea57680831305718324b0277ea7aa42073a7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ec4ac0a6a7bc635de8e4147929b6d38
SHA150d554d1491db543c864c46a22becba86f32869e
SHA2569d21038e3d0a346fe93e4a6e60ca8942469bae0993d7da266568c0a04ab55d80
SHA512e3d463d82694a66e49cd4fcfab415a751abddb456905f3847d39fbcabc408a3a501249791d6192fb371f56afa20cb96385b3d39fd2eaed606af323077a2abc2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528a7890917ac2e8307a7d539ae3b3f8b
SHA1588a51f3f8975c1e9215d406fa1d680b09e1700d
SHA25613a0f2eb87151958b380fd82db97bcebc931c827748ad77997c958ec8425689f
SHA512410d8026953068db923e69b567ac9448a01731a9a82125094dc5756047f1551db7292c505dfb8249b865d084fc7f89f6593f986953ecc7e7e9d7d318e42e1f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dfe5a30b9cec34d9810a29fcadf1695
SHA11a93795379bf61eb0d4793ca580c3b1415397659
SHA2565358c84104a0539bdb1c66327c829c20832a28e0080b93a439e435054ce4f4a0
SHA512cecbb6197f9fd3d787919fea82192b9408206b45ce57ce1ff012fc5dafdd92073db81ac8d84eb2e56f3226eedbceba11c9817aa797df769946064412ef227212
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5843f67a232ebdf6e7113109061f5389d
SHA1ba9438a13bb3fef82d1d47f1b469f0ee08f83532
SHA256a558b16e760a1f55be3ce62788b54c09b987517a2c243b4f246dd2fae16d102d
SHA5126b52387fc9125d0aafab3f021682c650a0b2a0cda3663fc43d6b209cc34b0f3b9fb8af5e6b870d0362e2c5788a5b295676fa2b99e69b8fd83b4b5ee8086f4bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5433482b1f7d48ab3495cb61eccdc667b
SHA1f2f2f897379c3da7de77a248709581420009d120
SHA256ed8bc37dbd3363a0a3d51dc75a4aa827a1c9b794eb2f5b522aab6ac2a55c8354
SHA512d08708c4baec0b8c5443e61a27d130a0bd5c4f2452ce3b343ca9d8f8430bf0f7a82088a613aed17b644ae05c5c830b843402057c25bfc38e7414226056aa3640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539387eec0f98c10c2ce3cada5440cab4
SHA1e8f2d28b18a8da9c58da491902e966a0bcb04c7f
SHA256bdb32d5c137bf7d48fba6071b699523479e2d2eb2a0463b726f2a9c0915251ec
SHA51253fdb8f2b963a028f4b2deff632c96061b30c76a5609760e7c774051a86fababc1070434c66965ffddccb2da33c6b2dfdf9a6f159fd25716720f058ac9fb60c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b85754b7ddc6949d9c108a70c31e272
SHA1ed90a396136998420e3664d8a220f97e1eb6b3d0
SHA25679e07856e288ae6b251f372acdd7168b7fd9c82817f8db70d16441c71e804fc4
SHA512b8d426dce0d056fcda652b6b3918f3ef29dec5e53efdd7d8894d71c90a8a4fa76fb04037b095d105e5e49db87010e225dd4a0f566bff1ff05a017e524cd90d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5dc8feb83d569a4950e7cd7f6241e51
SHA16b75823e18d70b50558757ebbf5788cc350dfd17
SHA256d8d990f0ffa59e3ba5a4b31cf87b61659a3c9437d9bb900c901c57937f0507a1
SHA512565e56a4f13645802a64d20380a6028937a21f95144a6f773301a34907c615fb0c8e849819b053a1a6e3329eb8328e6a29af71858522256ff2b0afe34b4450d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56612f6077dd04205719fdcf026763a0c
SHA1987b338d300cf680af285fe2783ca6620ee2b60b
SHA256160af375c1c3548f0f73966b802ded40b253122bf0999b0ecba93fb96ba8ed3e
SHA5129b890a10993ef1d8cede156a28edba8a20663b9a68bfa6b2af5fb0a4b92af69f6d16fc207ab52eb6a68d9b9baf9e3e1243a11f6503316956aa904aa11750d37b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b