Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
2c8f12a70f2fbdd4dacd29ad375dc35a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c8f12a70f2fbdd4dacd29ad375dc35a_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c8f12a70f2fbdd4dacd29ad375dc35a_JaffaCakes118.html
-
Size
29KB
-
MD5
2c8f12a70f2fbdd4dacd29ad375dc35a
-
SHA1
a4816efa19969ec603aa20e59e53bed141ce4ee7
-
SHA256
a01f2bdc113f793c4f17f408d79f407d965bbd86b2fcc5a574d2b6396a4d9110
-
SHA512
20b0d646a0ce56e09685403bc499e6baa270baab14ee9e1ed91e582a15049e2b324e132bd4e42bc8dac93e4b872888ac77f847109014e0fbeb51b414d6f03a62
-
SSDEEP
768:W2/Wcg/1+2A5smHedF3l7ZJpJjTpfP6JlZaqD:PWcg/1+2AeMMNRbDVHGlZaqD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F5A0081-3D74-11EF-90E9-F64010A3169C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426637283" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000008b417710f24e8821fcf3a292333214e85aa62ef836ff3fb2ff73c01bf49b931a000000000e80000000020000200000009b2035cd5e8083318963aed37169ba7b54b27c59f9cfa87b4c1ec4233b6d4023200000008c8ccb95d63f944305436228bb7f7992e430f98fc64c7ee817a67e8e05932dfa40000000ed3dde0d237eb9ff63641c8dd31244e313960c16a83c784d121c7e3b40e83a9eb2630d2f61e4b7641274b51c6883c1d64a1e9acc5ac6b75e49c2a2e7aed842d2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ad1db1f96d1287b275d42fe8bdbfec333692ae1657d47f744cfb9ad6d3b11be4000000000e80000000020000200000009d892487508beb7baa60101e080c2bf357a813d43b7d54abe14d787a7eb62eb5900000005153789f134bcce287df8adbec857191f7309292ae59517a2da83b2a8c371a5b27f8d21b219e7599fe80d6c439a28550f9e31f5b5620340eed19e1172d2a3ecd3d902f73cbefadc717fbefdf2e5a9acfeb150333ed7f26d8920dc32c8429be27667c5b02ee5578348dfd7f67aba1462d0084398ec2e78d8cd031341d6cf96a6092ee97174de4cbed4623ccc9ba3cbe9c40000000505a45e56edf003ddc64a5c9cf9f3779a6a940b6912108b17ac105ab16de6e5881322c7d1373c19ab8d01d580ad49d99d962dbbfb50c1865b797a84b9e468e71 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f9d5e780d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2632 iexplore.exe 2632 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2488 2632 iexplore.exe 31 PID 2632 wrote to memory of 2488 2632 iexplore.exe 31 PID 2632 wrote to memory of 2488 2632 iexplore.exe 31 PID 2632 wrote to memory of 2488 2632 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c8f12a70f2fbdd4dacd29ad375dc35a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503c1f11225e559344a82c474e0d03341
SHA1e8b47a1c2d4692d64673541b9c26c2ba0cbfd867
SHA256e1abc8180f58613ab2c7e065498547ed65dcb5b45c3d45489434522b0b53ee6b
SHA5128480f2faa38b3f5ac781559ceb2f97c74af7814ea856523ef46911467366ec6ff1001c33a7d7a3c207a60376ad9b419a8339e90fdd9d860154e6f092b4019add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54a0bb224deee5ae2b1a655e47bd66b
SHA1036d0f9a79499cc45eacdcd73736d66e8602f59b
SHA256cd2342e2fff0ffeb1506ae54e11500cd35cb30d380724d0944357aa95244059d
SHA5124225afe42cbbe05972fd62ef6444f9172126b09c00ac1a1bbb20777df8e93dd1c8e5d2d85a9d58c5f8a6a82bb94a06c17441ee949cb6950a8ed3739d1433dfbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065d6531b298184a93aede8418602536
SHA1078bd18d2e0bd9c085cd4a1345452bfa6ef134c7
SHA2568fcd7f8064ff55ee3f023ef3c1f4bf446e2466a60aa1bd8133d18e659a99c47b
SHA512db26d1d2257302617c150914a46ef15037290d9646baa7c7e397ec00c815b45fb54854717454086b9222e750d2f394624c22898ded8c3ab8784b1deb4b099480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac0a4a986a8cf60ed2fb53fe42918bec
SHA1056a32554907a66ee481b5e9495f3a4c38332161
SHA2565d398b120882e9ff3de1db053c334f7e2a090edbb7a8f4e68116c3e3c7383bab
SHA512e63f826759835aeb64e25ce18fecf9921f6b10378fc29f74ac250053e7b04e40f52f0a50b16030671e9fc601ac848c1cf67e40dcae4498e5ee8c4b36b9b9a9ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558be8bbc62213a4aec687b3778131dd5
SHA14a406ac7d6f531f324c8220ab6fa2cfde7839f78
SHA2565854ec67fee89a4b08743d698f24ef4b3324f735394da11fd1dc8887e6ece3d4
SHA5123a224c2af74f5176b868a791f387e1d9f8fbbbaad9b4394ac5eabc170971ff7e36bd666bda82fc94ca263afd4bd703e3815eaaf3dc332233e20da399c70be111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c76660a9771114e532c848b5b253e42
SHA14a3ab603a98e8f78ea9bdf0180b321c5cd42f503
SHA2564382b601c037ac4bcd66417c0d94e0d229aefa877e2c6dede214764d2d0af4a5
SHA512f3ac57be0e1922c87b104d38aa0cb54c550f738bb1e798ca15f6cfe4d58a9dd15bd8774d9345d88b26efe074a3cc8289f15a1152b08f2875b4813b39fd129e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511ff372b210d80a49699b0e30a036296
SHA1cdffcb9130300b5f51f9dff070c442d577ae5617
SHA256cd29865694ee45b2f2f5b901636a195a7eb0a0e6d12aa4b12b82ff15c45c1b55
SHA51211becb5716723336cd4a529e93c76334ce147dde3156453baa67bf996aca8c9eab92f88e7c3bdd8424963cb39e070f8f731ba9ef2726db6a94a86b8c97f996e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e9e1fc6646941b5344ac3ed61097b82
SHA17438bdc96825b8415e3ca31c32701469e41024db
SHA256500da7da6d18af4dace484188bb112c0ec26e52d4a4e702aa0555c5aedc83e09
SHA512f9aca7e0a569a13fea5c7b398a30b59df5aada9bbdd26eae22f93f9f392cd6232f02b11b9f411a6a7af16bcc3078576197d62b70716a5a0afe65d7c0c9b6530c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bf8d5d86ef3ddaf01945f9b5c672b55
SHA1a22c20bcec6fa15948d5c63d1fc60ef42b08117d
SHA256127c45ee7df9dcb0c926bd974d8a6e4be186dc2ec0edc2ddcf71fb7527669dd8
SHA512fc193d0c7f93c1a36a3d96276ef0b533a8a01740f28761ef74251f102214e633f01dc07df920b7e9955193832af332212ea787e19ca2f4aae42b315bc6a9644b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520fd29e5422bc233f0f426ab8e44bdac
SHA1e43a23b15c8a57cbeb6ca16fccb40347b83e1f41
SHA256b8804ed4e12510759b776afa67b229d1731d687b538b740ee3badc3a738c26b6
SHA51256b3a46b787ce6a877ce5583f1c3e23a8bc40441b446694d4dd2cb9c7d54621a41ae1515a35fbc9ba37121012e5a1986b41cb20dc212ed40078602b65876c7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c53e8fa9452bb9b0254d1ea8ce9f1c8b
SHA1d59f5fc13475562df3834976dc2691db76283698
SHA25605b1123322d4ddeee17bbfbc7bc33b8a1062053a4af4c198d0b70622b0838240
SHA5126bafeb48ea0cfc7fba1d39b25b274ea19508d24610a0521a7a768dcd1dcee945c6d75e8f67384e25994f641956ac661513d9a0ce10d6903013ee7459d79ba0e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e43ab5c372d905643d62f50acb899710
SHA1928d367512713a527dfed02a323197d1c7828a69
SHA2562b2b7fed034cbfdb05cc8fc341811e7e937c4a77cc936cf9a4b6f7ff86f8d667
SHA512d74ea392d4c1768ae102a6037d5c7ce162c98cf1d4a9ea41067a1cbb0d6a74041a1b317abee87867fa0d88236982b9b9827abdde06481a508a3d910c1d3362c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529c2b0e7d4b41098fff77a36ccd7c6d6
SHA123147f27e250375c704559ed32ae1fdc76cc2f0e
SHA2566e6d74f46c439e211ae1c4be97dd4511ad811d220beb2aa49d263df20cfbf57e
SHA5120ab04da906924dce3590ae841476fb249c9bd4e96cd01ddfacca6429a433a8955d5a4a494a8b5b628fee0119909206f23cf9a70c3ec3e536b0993606bb9e8ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d0f9ec8234a9f3e1e5a6e2185b13a76
SHA114cccb8462ba7d4de466856e6f78a877ab2e57de
SHA2565783c70dd795978c872c195cc4f43a542cbff9d52637fb07a56bb375d83ea4c3
SHA51275487fb66fa4c8e3f7b909db4954d7d85f18356c9cc68359f36c9a5077bcb914ab612e380e0d62324481f450d1e229eb7791c333a8e6dcc6d53bc05ed7188a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e1dce7b695aab6dde3d91bd6e3260ba
SHA174e6de2d36c3664852b832466ee31a74dfb4d069
SHA2563c8d63f6cc0db5918f80e8c4844b30a54152601f7d4546ce8138b3d7286b3dcc
SHA512ee41220951a16fdfe0b615dbae950d4bea9151929a44260545e1877f3e0e0433550db4e95a016efa3bed37a879fa9faec7dbc6fe72d97ea9d14725a6e0724089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52777324a46778de0da20831e3d41c99b
SHA1543aa20870ee868f308c1cf571b780587c635569
SHA2564a2016d4074c49c20c9778122e3763eb8a420db39d67327675a93dfeb483b296
SHA5128998c622c7ff795e5ad02b283427a565e0b6893a2e75c51e1db2f7e89d65456077316ab2a14a578355d9a1ddb15137fb0aaf8e865d57fb6a0dbbda0d1a316967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535db6fbd97aec58d61f4477598eaeac8
SHA1d7adfb67160ba0c804ca8f47bb3fa3735bde7844
SHA256c9104f0dc98679a68a4a87ff4c76eb5774ff32444b611aa06ed30868db3086bd
SHA512d55a53625d15d92e9fc0250cbd915fd43ad5a46538875c2e5051fd6fac959ec81a0afa2be994b6533adf94c77eeb56c6aa8c973e8cedf7bad331c76383feea96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588aef8b9e0aef6807c321caa466395ea
SHA17f1cca92656ff3f99934b5a9ebe018c4ab274d86
SHA25607e0556e0f5c5b6b63e6e13b6d9baf440e15e7b43eedd5d768310daf24cef8e1
SHA51212b24cd288717e5847527e5d4ac7aabbc9b94e22a84b64ab6aa89a298e32ad66bc2c661810a5a33cb2e4280475dbf2133797f83fad64dbb589ef03dca07fca5f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b