Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
32677b7d504ce47743ac1b93e47d7b8b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32677b7d504ce47743ac1b93e47d7b8b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
32677b7d504ce47743ac1b93e47d7b8b_JaffaCakes118.html
-
Size
56KB
-
MD5
32677b7d504ce47743ac1b93e47d7b8b
-
SHA1
9073459d8e6c9a8d06ea04838a4f725ef1e3a36f
-
SHA256
d63e78162f7db4c99622d64fc2bbf055af49501f443b16a89ec3b208c16c9c43
-
SHA512
434f91dd0534856a62354e69a47f42915861a4cea45aa669445dd1381b3a037b23ca72ad681765fb9ff3e1bb94ba019024108797556aa3de1189fced8766453e
-
SSDEEP
768:Zcd9QZBC7mOdMgHpC5I9nC430obKVi/HUo1Pd:gQZBCCOdr0IxC01x/t1Pd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000025fbe0668dfed38fdea7ef90aa1b5b027cefc25704bbafaa15bdb913c63dc16e000000000e8000000002000020000000cdfe09ab2756aa1d92cf2a75bed45eecf93ef18147b21f39436c4fe333fbb45020000000f9004e3a54bfdf1b2037080d52a8669531c3c7748734ecc1102050f9e314eb3840000000ba0affeea49ef3137a67b656663df3de7b58593f3938e9ffef8719ab775320753d18dd22d0ae78decf4683990cf8114853000c41cc6f10a9adf176ea5aa22d89 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bd225157d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426729377" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B927301-3E4A-11EF-BD1D-D238DC34531D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000dac3e413caa6b24bfde3ef8e436fb38bda59774554228533a8b43680ead54862000000000e8000000002000020000000b05afd6452de64efd785d7798c85d96750eeb64d2ace1f115fe7bb96ab35310590000000c54b1e7ee298f10a4ccd8f2e52acad4e71a5d32532d44de9524aa7ac4965f8f01088ba379c36313a0f7eaf949b549fdd1b1a22fb0449b02dd6b8a6d9813770fd822e30759fd0e61a3365cee9aea3bfa2d113dc2d5f41100f2b92724d9395e03d84b58fa49fca1a2a944833e6bcbe6a86f432c1f7adc7a1a3273882b5e8a764a39508e1673cf88a77c7aac44955725cdc40000000e87043f81d6a9f367016ec09c5eb649471cb1bac819017d7da65cb235f912c734eee426cd096ee2a6153129b642da78dae1f04213db68ff560ee4c1eacf78bff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2900 2876 iexplore.exe 30 PID 2876 wrote to memory of 2900 2876 iexplore.exe 30 PID 2876 wrote to memory of 2900 2876 iexplore.exe 30 PID 2876 wrote to memory of 2900 2876 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32677b7d504ce47743ac1b93e47d7b8b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7be4e1983a8a83592ac49a9c9e30577
SHA1b23d64279a804bbb9cc257d4b560572fbae72032
SHA256056ec6ced82b42d68298c22ad2353d0b7192da9ae6c72b48eaa8df49bddd8618
SHA512a3b00c704b3c6548a7b6c7dfb33afd93a189ae943894f7dfe88b7638dafcc071866cb2a2eea16e5e78339b2acd04e96c8eda87b0d0a4c9406defa8697b1b28cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d532e8c6f42fd97d6049882d78fe4cfd
SHA164029b288cd3c9810051a373ff2c76aac42621fb
SHA256822d1b49d7f23c639f9b713e12d4783db4955ae0469b3d344ba1dccda0482d9c
SHA51237bf38fa0eacd3758a93b51c050c1fab93993f4c35cc06086f40d00d13a2f3fc86704a76bdcb41a987728d4f522afaaf172617c6aaedbdacca754d34391198ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5635564f2de1ef9b18bd76dd21278b3cd
SHA1e96618d5e3c56e43e1b7b56e0ee986388d48ae33
SHA25676353c942e58f10fbf59ffa3cb0f3093063a4ca99fe9629df492116ea2fbbbaa
SHA51281c6886066a1d9228cc4ae3f03a5305f33b40a87573e14f9a5520b2ecf144b9ba780771e4579bf84e5e1377ce0cc0f5f4102caff92f2e04f6102c8b5a2b4b30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cce45bb26fd829d44dbf580f86176ac8
SHA114b6ffaea307f72e86e8126842005026387c1539
SHA2563f9cd4bde9b5af378d0f6990caf569f0a05a599119486cfbf4fae4b4aef888ab
SHA512ca27d27f2faaed40ec923fbe54d765e01ac104ab9fa17a5fddcb15ed2bc1b58cf20d2213b567defe0a4e776c260ef49c685ff4dcd35aa3bd79133fd822b647a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5479c172e37be9018c66df7e18252899b
SHA10a8cffe47e7254478d0137e0b88612cd846741d0
SHA256e9bbfe75e981f5b6162214628163329ce9adc2cf2fbb9d5ae991816164582614
SHA51201adbc5417522d20a458e46f51efe7ff13369e58104f2a149d7c88dd1d87da4f2b181b57fb8d122c82e83f2009c57881fa13056682b3e86398d15a2238053803
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0bdf8c531b5028d3b5ecdde76324ae2
SHA14a6c674cfab17c3bed9f7f77fcf78d28ef56a506
SHA25691ed9e999d22ee47184274d0e6efc080ab857da91c38f1a585fbbf5def9d8331
SHA512246c413bb41707aaa2f35f2e68f02a171f3de7a9c7a6aadd8f499cd4844d4d3ad46d80f6b8955d38dc24e6994b36ec30d148513ba42b489fa652449388e5c1e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52969f807a42443477d368f904177b75a
SHA1ca0ffc05e1823f1bcf1efb153de69509ac2be646
SHA256fd6f645d57f6f8484f2eda5fcc2922612830f5a3feeaf78df83ae9ca19bfde66
SHA51228ba9ee6e1af849e117bd72cb2bdc40f6677e7b9d9c0b42aad74818eafaac6578eaccf1cf3d43cd98524778a03426936393279b91f7c75ebcea5c64dd06b3ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572fadc4d05c9c40167aac71a7f492495
SHA1e33498c029724daf0c940a72cace5b4b2c8415c4
SHA2567606b1e33c7353acd7aa6fc539cb902ed96599ca52752ec49860d0858bb6521e
SHA512c7c82d3e4dba8b43a9333ee515769ed89a0bb6f00d4f4ebfff1de58f1b350e34a831af3d82f59a11ca7389bc4605653bde3bacbea72efe90f6d4e7334da9fcd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2cded59e7923c0ecb855a1aa75ebd51
SHA100f9f66914ce0788398c1597eb99432f0120c752
SHA25600c02b807f3faab7d9c094008e581c412a8b02759c728fa35722d190da48f807
SHA51272be73aa2217b7e199f301a81989c45e83e35a724c8451ef61c7075f3bb8e9489520893b3466c38eb852eda92decae4b8f6283686da0c0aaee9f85b20f66bc9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8f537f64516d79e8f304fab9330e613
SHA1a8dcea428a8e10daaa2b285328f545eae64edc1b
SHA256c764cd1bd6a647b17ffebb96df6d4d6cef493faa6c40139969ba370c7f5b5712
SHA5122f0e74a6f1e5583a39155cfd27ccf99ae15b9fdb99e3d7ee57e86f2688e22ca66da23fe8587fa117fac7f43e88b57a6796040e255dbf85544c8c6819ca181c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd38148bdd9d27d8c8a10504ad70668f
SHA1eb28c9b31d0efbb98dd636b9044f8ec236c10b8f
SHA25606c346f13d3e6d2d4ae5c2fbbd8cb205337d81fc3f883b97a4313764869d824a
SHA512c5e622b7c42c139721834078a9186fdb2daafe9bb2288a4c7f2c084949fc6d7101cf1305212deb3ebbd838c551f384e55099dbb291cc3a4babe600a340a873be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33d425686c5a3efd0d85f676c0e2e35
SHA1a5d0ec145d6903928c61835a013e49320c8baa18
SHA25648120953d545c141b8095d1073650cc813d173eb21f2799c288043786fcf3828
SHA512fbb111bed0cc9601b4af2f66267e90725467e9817e1d47138066b45cfaf60f5edd348314cbc3802e394f3393d239878a81035c8f13b2ee3a86806ab78c3ae7db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57777d663d83c9573e851275c84c9548f
SHA13caf70834c1144e71c9e7b23c521957f2f6dc086
SHA25639cbb37859315429226074ed9dfc8d4bd3161248c93851b4caf2a16559ef08c0
SHA5121d97813c1922504cc7c49cdc1371bf89b7a3007b117b3db56bb88b27704bf94746e92f7544eda38e37ff1f1e65dc0a1459a984180a3ef97565f364b705959be2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505def8cb52bdbb3761e5ca4be03156cb
SHA18f1d14919424248a335f34c99c6ed6ac7174a98e
SHA256679d1fbbdd314f8327e135512f872630e5b06f3559b2fbb40cfb11c4b1050de2
SHA5123687d6dac29b75bc96dd772f4c40989dad70a097c02c13df8b086ac1215f1da291031f34f87634367155a8da33a4af25ffe0c38067496dc2be206322bd2f426b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567f89409f894e78d0d7c2b1f83b4f64e
SHA11e91ffcaa2d4227917dffa6df600d74baf5a1866
SHA256603992fe61d25856d89a0d956eb9a8f0b10decab68040608603f1af694bd8450
SHA5125bb96fea22f1c42e9f767fbc75a4356781bce2fe759975df16d1169ae1ef2dfd555aec0eebaff2e386905963a901a54d5def57766e0b49af986ab58bf0ca6b06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5460ee6d591ab48e4361c5ac5dee587be
SHA1513a6e402423e47b7272c66c374c250f6033fe29
SHA25649c802709ca6e014e88f0c75ef8568a7723f2b5fd0a23044f4b372e86d71c184
SHA5127b32dd04aca5eb60d590cc8a2285ddb242412b218fd2bbf15cde01137b692992808a8e5fee86b646e8fd885b38381b9faa8fed5f23bb2a84c17d9f795eea5464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5589f4474083cccdd13f77e2e42890a1d
SHA18204e4cfebfdacf08e73ab53fdec53eeb11b3caa
SHA256e32e3eb064879ce37a2b0f6517911953c48af73a502aae6f1466d5a201177ad4
SHA51248807d1ebe51941ef716059c74695687ed5e24e04e0f1b98466c33663443d79730d44fd636fa9ac02b96fb1f1be6434b3b10f850e6cc479301d20f5014fc71aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593b2a1a9ddc62b589d3c92feb5d71ca1
SHA188594c43477f2c403e3c151af0efc93c5148f29a
SHA256c1d8d49c22624fbeeec3a6ff2a76d56feb738cc1c312c5212cd5b4d27e3a688e
SHA5121b8e33c6d41b7d224bf638e6cf7c0907973e92c443bb1ced0c7557f29ccdffc543149ae63c240a5753ff823a7f18eac9f09a70ed36e99d32a6caebd52150da5e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b