Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:39
Static task
static1
Behavioral task
behavioral1
Sample
367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html
-
Size
58KB
-
MD5
367e45a0fba6c863dbcee083eebaa4d7
-
SHA1
df85dc4d926c014deeb08fc1e000ea682c820b7d
-
SHA256
2ec2b8587ced27d4a9ab0c69826567a83c842a6315b26cc77239d733e6e4f976
-
SHA512
db70ebebfdba046d8ec0e26dee9195d2f224fc511c5bf55bd87b5159480a693951c55644e6aa78fabe0a4c0bfeeaf01fbb055dfce9bf01a41a687dace85049fb
-
SSDEEP
1536:gQZBCCOdL0IxCDxVSf0f6f+fmfSf6fuflfbfRf/fSfufrfJfXfhf0fsfDf11f+fZ:gk2F0Ixl8Cm+6SmNjJXKWzB/pskbXWoE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809442" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E611B551-3F04-11EF-9BD3-424588269AE0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000026326fb7ee6e26897c4a1351a13fa6774b4a97b96b7406e955ab4f6ebb3e8ccd000000000e800000000200002000000086e5327498f45c08f167ca941e72353a9c43bd42f8c57dd158a4a0938c5154be20000000a06431f485c888b467ccb9ac6e547a9f26f90e3e23ce27c672fa50be68dc313340000000b41435208e2ec8c362bce6ec515d3c3a602af76dccc6f3349bc98cc9017f357d574422a64adaed8fe7713dd77c8e370247320f540e0bf5f963c714130955b60c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f073f4bd11d3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000063b5e2ecfed5bc8a7652a651ae6552eabac2c3217803fde584b4ca36c08c4b5b000000000e80000000020000200000007d3d9d6e8ed1f416e3d6424ff1b547dc326415493c2885ab64f5c7853a5df39c900000006635643559c39861a7078984f6b27166f3ab7297d0a641e16f674e56151132a96a403a23d367dc3f4adcb648781f833391a2d58491090c85f611a3d110da0d3956a84e7ed80aab01872e3a4b5817676f01a5b04070322f5c6653f876fee298d48b0052b3dc9ff19494306b0a334ee60905e2674608e54afc3e8f32aa55fb0d123f7de842fc9ae9b4941f4deaf096737640000000d32fe9d47132764f4de60f10f342c6701baf7d91d4d14074e7ba03e1425a6163ac09b3acc4c03f0827d6077f13f0bf8369283a04063b389f976da856a4bd634a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2552 3032 iexplore.exe 30 PID 3032 wrote to memory of 2552 3032 iexplore.exe 30 PID 3032 wrote to memory of 2552 3032 iexplore.exe 30 PID 3032 wrote to memory of 2552 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51713e5264667a4acfa66506e7ae3f0a0
SHA15f8fe7af9792a127f987e7494a8cbb96d16fd264
SHA256b00027db54b77344347b72ea7eb9b1cc07b4252379daab7bfaf848b275f138e1
SHA5128fd59bb6e70ed1af017ba2cff5580250a06b6f0f83a5b300c21cb68d81927a6fcf55dd09e95d51aac7a354c1d63037dfc7f307a3144e84b7b456563737aae17d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51680a115a0d05887968086d65e654194
SHA112de8019460d498f8cd1c60872a276b0dc7b9d3b
SHA2568e698ded6f6c965deb17085d81cd1e34d73f4b2a4e7e676bfcf0121f969777b4
SHA51293aff62e0383c1e1d49055c5ea125404d99bacb2b6bb3314d62a8d10b11467a5155e1a573852c77bc8704be62ec15cd394b7f3db8d9df88c051af8e7c99979a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7c7ae1041bcace19be32c5d271fcaf4
SHA193a72c73a7301480872bc6b56a2817a9c79a12d3
SHA2566fbe19447401968a8ac92bea3df9bfa53f1feca0e0ee210b82a002c5543c0779
SHA51206c63409690f509a844de60e56f7e821b1f61007d5c327722e00e2e98092156d813ea80ec80160e32617d671b5a91e323a9d82d71cc2c368b80b1b527a447689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51be54a441e37b93507508d394755e27c
SHA1378cdd53041eed799142370c97450493eabb9b22
SHA2569531a6ec788935554c271a8caba84d1ca0f28ff7d09d7ddee64a8a44cc824ca2
SHA512e4b1272647934df5f50e38f057726d32b5ad57dd10591a35e954c485a238f2c5e3aeb259001a2793c1619de2ce4541100a559c77393b47527d48f82aecdd90df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d624fef7b00d40903c49c118618140e
SHA14b9b5244758d750568460ebc78fda9e45b0d54dd
SHA25687749f1f154f34cf503b2889afa3a9abedde85788aaf0e2762f02cbc7bb024fa
SHA512c46e564b2a5878d8a53943b467081396136ef144f199919733702f6c4231ed71945e7d0d4aa45c52e20661c9042cb5552583ebbc7430b84df1dd7e60752e72ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507fef9bd3a619d4d6402874f7fdb5fba
SHA1eb9bedd7de3ccc893f32ce4eba950b283133a277
SHA256cc75dcacc00efce929c686d98646485d74fad04aeda9ed5086c8931f9bbbd841
SHA512992af2bfe83180c33bee0986c99749587d9118338428c10b8762df06689d503326c845349292e0b638c70eb6b23c32c864b20ef817998fe12d1a438cad490e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc7e590b569b1ce273520ba7bb891afc
SHA11537ba2cea26dd70bcd6424502027deaed442d0f
SHA2568d45d10ed7b84fd07dcd4bb9176daf033622eec90752f189f1111a58b3424ee8
SHA5125b931622a0b1f8cc93abcb941377544f04dd3cab05c0f799ebce23b978c1cd6908308aba51dc8ac7710910232a6a4d8f1d60423b5f389b22261960be2740790c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5284b3983831f75308845141e1c14c6cb
SHA12c19f7e84e4bf5d535ef6bdf77cd03c215f2e304
SHA2562ff586d0fd784b3e0ff641bef328c06788c78afb6afcaf36915bc668fcd28cda
SHA512937106687db7936e666e2972144cf62e2a279ee3e418b63ab2890ca7d9260aa518bf37a6492c2e9e6c08c8680fef030d1c821211527d9c0d50752a651b08b184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548092ffd59b255d506acaa435971cb32
SHA1f3d0a7757ed7b4852b82d22b138aba37a8ef8174
SHA256538534b834dc44d91c2437da5553644933758c1f7cf5aabc8c87e78299923f0b
SHA512987f394da104a223e295e4cf2ae4314ed4a40fa8d7aefe5663f7b5b6e08e67787f0aa3b552e5f0b59d0c0f444676a1dcc3d09bf83b235e0864c8e5936042bfe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51185302d9abdeb08003126eda85be27e
SHA1ac23e8f756016a183a343f3bcd9e0ec8c535d59d
SHA25629a7860fbdfa3041ef0d8bdef1c4e2d68d7213444417a6af70da672a1b2b00e0
SHA51247d9dcea3c2c962c301f3b4d42ba889be4887ae872967a0c1aab07d0558cbca3e54e6573015c2bf67b721d8fcf765f32e5ba1871bc8c1339c5bcb76f50de8257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b367c203727d92a88ff8d59cb445665
SHA1caf8c2ece3f81ee9b06c40fd92265c3fea196d31
SHA2567960fdb473e15634ba54ac674dcd18a6f1763c5d1f7abbef1afc43ed389aa8cb
SHA5123b144f1f159a771a585a69ece11c6855e43044d0525e4a5ceb95f7431962253d19ca2c4387e1de07905d5bc0bf46c2c842150e9a42d431b9e9f31cd028ce4136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55802f07f7c7bd174d540e4bf72204473
SHA18aec8acfa01123050c97ecee21757aad4e0385ca
SHA2561126130d736ba9962de36381388ad290a34a82fb8bd095911c0ef7f3a797d05c
SHA5120765d6e1aeb51484c33df06f46160de5079abf8536109fca8441149838a1306ac05f0ab261eb25cbd9d984f1978064be12f333b028664badc915cafedf717cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e048948b6ea0da7311bfb66e4e7b713a
SHA11db9134e9d5da38fd4282b013a090b0f8c38f542
SHA256dccd5ea0cbe4bcf1a10b40b61361c928e99bee56ac727a38f0a336d401d132ff
SHA51242de54a6eb11aa44a0c6b8db455ea08ae175fda7da098910718a7aacd6980cb6c50ffb97bef9ddc0f7b52e3f40d73587e8bc1f1127f67c744ec8cde6e6376364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d922f92c3f23da6bbad385cef77d649d
SHA17806308325d90a9e34b121e9c1138ba55178f060
SHA25608deb2b215ca1591073067825bf2afebbd056e2f08f570db87e807f04b80a895
SHA51210babe321cb3fed14a18e179b94988fc491b18017527a3e96288b252b6bbaf224b251668f1f751f87cca7838828874514ff7cc213072c90bc7f0af9b3e964ecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bdd2801b2b5bf007debea217959224b
SHA19debfc129b1c9d15f2a83ec97b5963ae7bf06d4c
SHA256bf2128fcf76ff8522f40b8f3d17c297bb894aeb106965b1d3aaafcb501a38b8d
SHA512a62e84d881eefbf04e2043a134be1c7646eb52e32cab6039fcf40f1d92af20142ab204d9acaf98dcb8eba2af10b3194f09216048773735b05a669d6d024cee9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51352ce235975811fcac392b432edaf9a
SHA1dc3aa24fa8603c5b1db6d7ab793463636f12d675
SHA256fe27292bfbe0621fa8a26548d2ab76e513fb6aa8525c2392716e195642cb4bdd
SHA512423f731c92b0ea4dbd20decf6a25a489d938f023f2c04606149af62dfad2c318ec3b0dc92832e6f8149f30fea80ed65ff34c8f5c8afe03fce8e3a8f2edda18e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dd2807292a5965aa085e1567d623ef8
SHA1bbfef8b2eb3d26c7e3fe8cafbec1c3736600be57
SHA256335d8491e852390e166fbe86636da7b53299b26d526fd807570af88b84e2ab39
SHA512c6fcd11e5d054608e1f92ae0fc1c73efa324f1d07761ce50766d7c8eaf66c82e398e7a4c2aa3d08c6362b03ca5788c16bc5ec30947d07badc018ba63bbfed1ae
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b