Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 13:17
Static task
static1
Behavioral task
behavioral1
Sample
34dfb81afcee9c850381600dab35f2d5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
34dfb81afcee9c850381600dab35f2d5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
34dfb81afcee9c850381600dab35f2d5_JaffaCakes118.html
-
Size
6KB
-
MD5
34dfb81afcee9c850381600dab35f2d5
-
SHA1
870bbd76793dc65f452a7c4860173a70f82ac9fc
-
SHA256
5b22323d59e4f7702a6e45cbb41200804c3484e003bd6598f7a6e87f2e6d029a
-
SHA512
1a529b2cf6466b99a94c6fecba191c12c7bf1d91ff6bbe8de837957ac256f8c20ef492668e6298fc0d0ae2e129eb9c34a3ed7e3df3d1c7e449cc25c76ee064e9
-
SSDEEP
96:uzVs+ux7yfLLY1k9o84d12ef7CSTU1p/6/NcEZ7ru7f:csz7yfAYS/o4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000056c4c12cec762ffdfeaef4aca0c37763d10e22881e87670d151c0d1e3639da1c000000000e8000000002000020000000086e832ca838ffb962f00e814c02bc15fcfed33e2a5f86df7f917479b3af13a8900000007657366148403946955b782ab66e91ec763bf2140aad9b1041b68afb245bb4c543634e23797b7da9e7a7053d9cc6212625628dc0b0fcd98ba96a5cde5d9681404719fbb47d460f3e4ef639f5c15a3366c0eedad0f41b22f511bf02da9b580e7c74fe7f0a2d2e0b9609bc4fcd88c03c1bcfb37f926266e7e3f7d6aa442c43fd8f4e362407dc038b1cf88d8f416e3443da400000001b1c930693721d0937e9b3537bf00357f9306987c3901356dec379759bc27510d1a487389fd39e585f8bc9dec2d9d9db7bf46dd6359f982b01adc3fb05c81bf1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{918F1DF1-3EBF-11EF-BF89-E649859EC46C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000056b6996d456185f839e2e5d615584de2b1dbf5a216ffef457c0d25daed2ac1c7000000000e8000000002000020000000919f2722cb341c84c417101a4ab0a08033c3e28df3ba5f184112af9fd3e961a920000000a09c715122dd5aa51ed0af994371fc34a5086868beac67cba555d2c5a2527c7b400000002566f7d06a0f931bcfed3fbfc1eece8ebab91c30d05ffece6137e08e3b42a6c334339e08acd0e2e38083da2568b567428a718146f7d5a613f9d46e677ffe249a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426779665" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cea180ccd2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1732 2088 iexplore.exe 31 PID 2088 wrote to memory of 1732 2088 iexplore.exe 31 PID 2088 wrote to memory of 1732 2088 iexplore.exe 31 PID 2088 wrote to memory of 1732 2088 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34dfb81afcee9c850381600dab35f2d5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fbd8cc9248c488a61ae55790cfe568a7
SHA1cb4f1120bc231dfab0a99c8aca931e2e86d63b5d
SHA256941fb8b8dfb474b51a4ca4977e427bc5f9e43aff8890f20ce32e4e886838a770
SHA512d739b3c3378c09ffdd24604ecde8a0d3304541a8f822a471a681299fe92c2cc5b351f8d0f638632a36bc5b1042e6961223d6b365aa95fd3c902c7c6d3859be98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b150d0febdbb263242dadfe6138d336b
SHA1acd7ec60343b68ec4e4b36756aca333499ce9aad
SHA256403e5dc6471e101b9a0fcacff50b7adb12123ad60c7838ce651a621372e8778d
SHA5126d1d0905e79c6dcc3fd4512399bcc9fd636e350baf5ee382501db79f5ffc342d2d336bdfc8971815f68e96c43df5c1d0d23aee984dd484e616fd9a169fe0cd9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD536f3ba55e998395da1fcb09d6b83ea3f
SHA186b8947c5d86b7a12a98299d640de359b95ed990
SHA2565497110db5cdb7e57174408787ad770f5b838ebbebe95e77ada7a62258ccb300
SHA512410cc3ac81ffb35571aba66283a6dd248851bfdd9a955a45721541b38b6d727e5e506a350b2ea690f7d2ee51e76aaab9031a28075cf67ec7dd1cdb0723c7b141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD537ead814d346e574a85f16b8987717db
SHA16f06e03b050e1924d0ad2491cc218308ecdd2135
SHA256cecea562faa6c1249aaefc8329d98963ebfc6aa521e2ae596f4fb7f722575fae
SHA512b75f698e336cb9e000812a51caec56a27270ad101096b77ad52f799191bdd636540342770b2342bd49b9dd75f7661f2acbca46484b34e8eb44f8c8135456b376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dabf46b17354a918036fc1d67a23de33
SHA1e0bcdf629d625ccd18f52ec7a83cb4ac3314f098
SHA256b9894fcc2bcc4a65d4a3036b75d83ef25c4a88f2e9a48be7b029388e6f502b6c
SHA512c85959407020d9c3788eeb7183a3898e6c838cc8f117668c04e4ff93bdbe362e737be60b5e9a70c408cddfe29871b3e08315ec6997f6c086496a08801ba21331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59654e614745babbd1cf9aaf984160835
SHA10fc5cf71e1ae49e7068d2b85708202915cd59838
SHA256015cb012bdefdb2dcc66fd58cb81adeec4154bc452fe1e79eaa9e634c36efdef
SHA512b3fea2614ed24063b6ef7207dd121b6c9a45112e8871b2e2065ae44f04af6125bbe6249f7ae15061e4ee42f4559a535c929397985cb1e79ee0a38661d8bd4539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59ca2f643f8359462b0f6a7ae6a4c3a12
SHA1280adf7008845a63809827bc6b2bde76700724cb
SHA2567d848a9fd4be2008b1ba186d275eebf9f6fa8ecf6596db204cb7d0eb7ae5df76
SHA51219477e2294afe2e9ec5cc90f1909da2f7ce8b1ffbfe23779da46340326ab88be749db4607a47df4deae1269f0ab5991bf1491227e2569388a1e7a1b49a21ccf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bcaca2bc49bc53300311a6ccd4564714
SHA171c8942eb2447ec3d787723a70475475bfb5f327
SHA2565ca27f81d8e334668406b6e447bf7053c810d0fe183e4d85f52f46aff6ecadc1
SHA5126a5688e371e30949c2682749191574fd617af44669f21b96a01f62209022775a27efbfa6e7716e3ec1997d768c96267cfc30be7dd0a6da8c6d586b626e5ef992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54a694f67b6f5ef8ec20a5a3d93db5b0a
SHA140184de4d8b045b283566fa20286550d6f4474b2
SHA25611d1d32ca74d93293ee1be152ee36664e1ecd013c029c4bd1fda0570d70989e1
SHA5123b8fab22668f23d36f025b6032b431b470d3c60a2da6f63a7ed9b57ec338889e1c85449fc1775e20541b0d14da8a074b095c87e8ed5defabbe7f1c1644a716e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5530cf14c79d6c63a6f899302a9db7a63
SHA138522e12a00998c504c5ed2fa7efdad7cdf181fb
SHA2563a285f2ece653eb243aa60d53198bb065477d49c83efd02939713eb05a07150c
SHA51216e9c3e469002f646e5a27b88be9b47f3001e2a571fd14aeede69ca927ae9e5c20ab7a399bb67cc2006b8405daed8231ff93dc617f01fc6507fe59c3d170283a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f8c09e6d900f6bf6bde6f1c482b2f613
SHA19d381bcde7803767d4ff4d6e18e80d77a43b089f
SHA2562f23560a3dfbe928bca32fb69adecadfd2d93667f76f393e071d5e78317fc92a
SHA51217cb6b636a2d60c859a27ececc725d8f03efd36d671697b4a3631ab3117e55b3da7b5bd03db9c37c883112b96886f6bf976bd45ef3d88041f9a467702d4ffe32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f7fd623a3d9fb167b19a311b75f403b6
SHA101bdfe91cf86b2032a90d57a261b62d218481eeb
SHA25650172be5ee812b036c378865d28b2499de0095be062a48e54b16a9bd120804c0
SHA512343ce75ef216412c07256f0704152c25772feb5f5cd3c97fa3fe131a4a64e3dd7a6a9c490fd8869e98eacbbb4a7a42ef87103e7f25b31ea82b6cca2818254bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53b456647eee8ddd1a7925176cf39e049
SHA1b7d40f907a1a49ee2a13e1573325b0a284048e45
SHA256639783e43980bcb4103fd9140cfeaaa6cae28cd1112d058dc9927d73d71cc1e2
SHA5123358e48130e2df86cc1d7bd918abac673e28683ce8bd3327ba380fa39fbfd51171efbb970e1dd2503aa3ac7cd9992b40ff2c5db235d52f3ebc996365d1e804a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD566a5a4899dd1eee72d6c23e3a2c316d0
SHA19f432ab854106a14886b6286279920abcc21b4f7
SHA25632ddc7288d219f1db3f4174d62d894a8171e1873e90412f454ac9481e1ed696d
SHA5123e8d8a52f0944ed641a9b82d832ed8cbbf837c9ab55dd58d284bdb3604a14fcdb8dc56628b97ab8002cedb036cf80868adfc5d21dbb1c86ca272a4a9a2409d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52582e3103f259f7e2e7112898b734acc
SHA1a51b362d879299e2ac9090ffa2e108117696d352
SHA25679dfaa7bc1bf667fcec28f0d5de8cfdd7485f6963bcacdcdfa025cde8c6c3f76
SHA512f81c93ba32cf17fbb554fa1f281d7eba0e61bc1c074ff58e3d4697c676bbbf8c4b27db3003349a1baf1c532242593dce062757be326997639c547826537d90c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b02303ef8713db92902717cc51ac6788
SHA1ffe493db9c0ddfce16d40344a81c498d0d24fb03
SHA256cd701281961b8b755aea10d7d1560604bb9dbcbe3f95ed1d241fa7196c79943e
SHA512bc624af0ff09e5f100b051efe3bcfad8494bda420ab84152245d8713a916c09716b7335c4289a96a7b92edda0b329a5e28f2ea872e5419efcdb8d84f6238ad42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf1024d7e30548d758e01a2e4f00b9a2
SHA1766e4896079560853a11e4ce9580e50cb02a235e
SHA256d51edd510d3569bbfc4fdf06fb9def6711492f27465fb310efb368fb57fdc525
SHA5128383cdff9ca7cffea71da92f13879f55592483952049d5d7a47aaafdc11e821cf69bc9016d1c55f6a2aea60780b4c0cb8e5119193384bf117b365e9cfa902935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ae26aab2670e38097f47204dbd40482
SHA106744ff87cf103df71dd1354212bd3be9d402c1f
SHA2569723fec4285ce8a5b5a4c7a8eeb5c1a39c5b1db38216ca95e64e4f1eabfee874
SHA51271f6a87f17c2f31199390a553a2ddd7209260be4b4ae0aeb26afc10e2851385e604413912429b7d942ba706a3a0de47bafd91e9dae742e0e6fcb4cb3f4d35bf8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b