Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 09:42
Static task
static1
Behavioral task
behavioral1
Sample
2fddba3a92ff077382f9c99d02c0b2e1_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fddba3a92ff077382f9c99d02c0b2e1_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
2fddba3a92ff077382f9c99d02c0b2e1_JaffaCakes118.html
-
Size
71KB
-
MD5
2fddba3a92ff077382f9c99d02c0b2e1
-
SHA1
e4299f714b50075d749ca87426b71797c6737f0b
-
SHA256
1be500f3358ac7feeba5f436afcb57798e1dbfa2427b52b76de0b9a5391ed677
-
SHA512
426336e7790d91433e4c7c1716883b247980c7e90b4d55feea3f679ad120453be67ebd5746e674378a07d7792d4f1363319adaf1ec9f4728b4e1297a4d623968
-
SSDEEP
768:SJ50hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/0:SJqAIk/N0tnwOHHpB1RvWD94zqduc5
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CCD35A1-3DEF-11EF-8CC8-424588269AE0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426690107" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000001df6a86292c7db9861694303b4f8ca4abaeb368d48cd1edbb7d09b8fc00ac4ec000000000e8000000002000020000000f6d918925ba16bb5a64d00ba250a78da452fb807b11e4939a1c19d7028e7111b200000005f25fb09417af1685dd3bbdd5b23e8f58eb32fcba0280ad8de80e36a7e1ac5734000000070a1b7ea998fe2a0ec95ef87414c8e6f6b9b11e335a92acc417e9c58b80db693f8322619eef1565c68318d70418f3b1a8fc08c46a31ef20d2900259a37dc35e1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005e4ca613ffff06813297f27601fe3b0eeb3379e92dcfc3162e3bf32eeaceb4dd000000000e80000000020000200000003777981ed0959e5e96b6227d5c239a6234b3efd17183819a899f7b028a44a4cf90000000b93a7bb677dae3117ba6e7d4aea451672ad0164be1c7ae1aca2068413a1b0fbdc0b311563a950bef07c0d143edecfc3c21cd4edf49310818b1f69a7f207f3aece25b99755ad3908b89bab76385669d63c7177c7b40ca0eb9a08b5711647013624c3dea2f49d10590254485a900f6f94033b4f3b094e51b022477abb9db686cc055a0a65a4314d98503c3e0759831e0fe40000000eac49e7f5334bf9a6e43a2d0e92624b7477fa95864589e92fea5a1ca7a1ff39f8ce08d50e73d61cb9af75ce5f2dd14e891cc71fb546a7b90e273176a4026948a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06543fdfbd1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2648 iexplore.exe 2648 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2836 2648 iexplore.exe 30 PID 2648 wrote to memory of 2836 2648 iexplore.exe 30 PID 2648 wrote to memory of 2836 2648 iexplore.exe 30 PID 2648 wrote to memory of 2836 2648 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fddba3a92ff077382f9c99d02c0b2e1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f4ef8e7c411b7c33db29bcbe6fc9666
SHA16e9df2b0ede6e8a8041b1901eae04f5870d15504
SHA2568d0b2a993674dc5902959b7bb64787e8dd9a0917e6ac8379b10e4befa8ad7cf3
SHA51270cc43655cdde91eba44bc7129ece140868ebce1ec71e83aa50d285086e6015e60fa9b7673ab7694c90e8d274820b91dc30662609f3afabe9edeba94fb678b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522e0f8f41194b4fb518f7b14d4094c81
SHA128201d6ad0a6fc267cd2cd16e70d0c6b544f166e
SHA256e5826ca66b671c8e86ef02e3efee41e6eadd738156df6894d234aaa71f1f6c92
SHA512ac1c917b74b2a5057d636542119e752d28e29b9634919618c5c8959a528272fa3b641617b37cac70f67f9ca2715ec6ef2fd401e7fcc8733befa7b1018433f197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0b839d2e93abca66a7b0cdb34ab759b
SHA1667e390ba60b0a6f07e923820de307c8158af7c2
SHA256a77c482c7085eddab65fc42a252533446fd1b16984858fb5f85c567694f2c38a
SHA512bc4418d5b9efc24547549349a80c91aa4975b35512c401b62a3d338771c768baf51354f32e62dc062ff7456e96288e3268b04afe2e71fa5c889f2f1211451a8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc9088b4e8931c90196d6156f3502cd
SHA1b69eb7d37a38f8f9d2b67b062fcd29583f3e6573
SHA256cc8eeb5e4fdddf193e725a3d9f1f788a09806bb5ae7917bed0e26b0725fbdb0b
SHA5124bad85860b132a4f8f5972a5beaa29ca0c9d80815823c53f5bebc03570b2e9905d1e5784265c4ca6e1272818c6d850cfd0e7bbe523835f5dee6d8cacb5d4482e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50affa63fb38f6ca10519edc8cd595077
SHA15191d5b9d357700cef875e6631080cedce92ec90
SHA256c61e96aaef1dcfc7198ea2d8111a367ba9b302dddf06c58a8cf938a1fb02e967
SHA512d79b3e699f85330424df52cb24b921fa604d21521838dc926b0b7261f541906a9099db2c32f080bb00cc65597c4168986a44991dbd3f89cb5045f0e40c93e3f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad93d0d7194a2eb6f988b18167a6c916
SHA1476f708068620ad2c526482f991059c97b6c85fe
SHA256295f91247a55712775b8fcfeb183d7241eba2848ce994cb02951b03031711475
SHA512516a9e1b32860090984ac9ffc712d4df3fd0d7a949a30eef0ecb70ff873e45f91ab3909f6dacd9f4d17ab8f2ef80bed2c34c7c6be3fa34a439878305d999fbdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac60201441691f7868a6201b1c06f80c
SHA1463953cda2612d74f7ebf8377ad0f219e8bca2be
SHA256589c922d1d26c267c7ed10a9f89b9e0c815dae1dcec311354f9bce75466cd6de
SHA5127ff9d6c6eeb5764f7231a403599f41223aa22494f3949505c1b1c22602d39a8945ae622e3cfd741e1eb46ecb338298b75231d6faeae0999b5d656dd8a5cb49ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbf9d6ebc0b1a9aab1a09e2e231f9413
SHA1273bb81793c1769bc2c97322f9e17027ef2a93af
SHA2566844a284ade9d517863005fc67b4d1e062fa79cbebc62f40994fa6fc43a686f4
SHA512619059e284af7d287a7010b007300bc6f950883cdb0b6d566c277f5e2622885c15cb88206e0244e3dfecce164e0390f8b95887fb04f089f2df40e0dad8cb57ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a5d6d93bd61cbbca97a4f5bbbb3a667
SHA12994e009eddc883c3d50daaf188b1d8877d18117
SHA256fe7f8a37ebe20c38cf044c3f1eee6bb39047d58c23f029b461f350432a32961c
SHA512116ca12ed0f1e746820ff54dea2c11807b9b97dc52e56b17094421bd1bee1203b7de0a52104a5a0040fd405c2ba7410f3f44e226c7189315a6ae2fd05810bb32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dddbe0d2ba42d6b23eac82e34bef94e1
SHA16abaafb495b660373c1f97c9c2b6b341222c1435
SHA256d0582fc4fe4d22d1736ba24023579c611c0a5266eacfefc5365777f24cea959d
SHA5128fd558f80b90df808cfe0be46b20ae40eaa88a78ab4c8f9a9aa9c1f5238ad58c78490d2707e5474c4d61377b95dc8f802f147a127fe855fe4b90bec525bb2faf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560c8a64c9b45ce3836704e37cfd462d2
SHA13c9342a641f9ec3d36de729451384c6bc660913f
SHA256d45264704e3c2ce6cb553b5d4968ab441613d2570ddf17e75368021921b9c806
SHA5121b17dcf28c564b3193b8b1e7c6d1dd365d0c3ee2276e78c9a3e0d89776928ef155e90e51e90f7ea67ce8a5e01f4d3ae197cfee0d6bed6bc8547f04520a3adf6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db2fc11179927d633b25a556e3926bae
SHA1c1397e87ecdfd533d39732c0f1b6156ec644a480
SHA2563178f48b14c9df0ea26cee1ba1fd737eb22ad3f46b703e148baf0e8f25515b6b
SHA51233d9716ae60846c9452e724fd0f788243b9a0da14f60dfb33602fb3ce7ff31dda4ab1b4b0491f4fcc5089622b258c5aa8ad267f3f39b321329f381ce3d1ce27c
-
Filesize
99B
MD517d4dbf5f8ac1b16f83f164e66ee1aed
SHA1b67cc73b20ca71f07ae639a89637dc9f44acb1bf
SHA256839efbafc6f45dee3b7b9c8ae956111eaaae450484309c59a44c7819e3865616
SHA5120d7c61ff834862ba16316bb6b10021a362845d3266509967903d6869926dc99874249536e89132cbe8614298db3c396ea99fe25a0d36d546ad2b3059c2feff89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\ga[1].js
Filesize45KB
MD5e9372f0ebbcf71f851e3d321ef2a8e5a
SHA12c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA2561259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\styles__ltr[1].css
Filesize55KB
MD54adccf70587477c74e2fcd636e4ec895
SHA1af63034901c98e2d93faa7737f9c8f52e302d88b
SHA2560e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d
SHA512d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\recaptcha__en[1].js
Filesize533KB
MD593e3f7248853ea26232278a54613f93c
SHA116100c397972a415bfcfce1a470acad68c173375
SHA2560ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a
SHA51226aca30de753823a247916a9418aa8bce24059d80ec35af6e1a08a6e931dcf3119e326ec7239a1f8f83439979f39460b1f74c1a6d448e2f0702e91f5ad081df9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b