Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 18:17
Static task
static1
Behavioral task
behavioral1
Sample
35d778d681c109ba53034b7081758bf8_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
35d778d681c109ba53034b7081758bf8_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35d778d681c109ba53034b7081758bf8_JaffaCakes118.html
-
Size
116KB
-
MD5
35d778d681c109ba53034b7081758bf8
-
SHA1
0a3824b88d4af16670b8bbac0934c36fbde63f63
-
SHA256
d743f378e14b0ca0dba5145d386335f92033291ffca3e1772143f23ff0b00dd2
-
SHA512
fddfa251427a2baf6f7dec41f2a95712623e57b7597ba78521983ac74dd2e7c163c406a031ddb806f9047392ea66849e632f10e48da552f885e7bb0a5b359509
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fc22nHAeuLAQeFx8vOtcZDK+4mp:safuLK8i6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0507181-3EE8-11EF-B9F0-E28DDE128E91} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e0b84d0cf844ffaba3a4ce7ab662ee37306fca66dacc14d1188cd03966aa8fd3000000000e80000000020000200000008291a5f24b80f95bb7b69584e4f685d5201b7ffa0fcba64b77b0b4d464455fc020000000ba7be0a8d7719a4bc1097edf9435ed1f14b54bb2c26f7c27f26384fd26848adf400000001215188fed009f3be0ede80d400a37ce036cbf6bc48b6b12bf5907588262a8b9dcd345902c8387b6b742564e77e276e4385943b821a889f14610bfc9429d3442 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006c4a6a0ffa331fc8d823b5053c17fb0be3d51a988110e44e2209d382d7d434b1000000000e8000000002000020000000917d426d65b7452eaa3223416aa463c32c6051523bc8d2cf9a9df6ea6f22696a900000004d3f257bbd5c1807a3a7cc75a3921616c7b1102633e2f4121c54017dcd14fb4caa99352832ad3279ed7ec9f6de516176bb96d3303e522970c46068bee1f3da9feda2404b35806d4e9dfc791d60e29247112c10aefe1a2e682dc78316bc2aeb5c636db2097fa20c92cff6c7b91b8f485f434753ef2139e1458e1f25e75e42d873a40eff7a58ea29aadfa0b99f1e545a414000000020fdb2301b62534df707cd19e5d330f835e56664682cf2c1d4d6c6f93a83fb49564e288d20941fb18a21547c7fc556991ee3c69a1ec44c622843f174aa4ade00 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301e6e8ff5d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426797299" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2432 2168 iexplore.exe 28 PID 2168 wrote to memory of 2432 2168 iexplore.exe 28 PID 2168 wrote to memory of 2432 2168 iexplore.exe 28 PID 2168 wrote to memory of 2432 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35d778d681c109ba53034b7081758bf8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52216c0effd8ab901411317785f0fc65f
SHA11a85ce294e854c6b6ddbeef0b9b3b79b70f6b2be
SHA256877515fda434b4a5f67b5ee12317eb36b199a813ac4bbcf0e1506f5540310637
SHA5129b6340c9526e22532c9a0111c61610b654247223d28da61e4a83583df2eeaef619279487e306e1b6b9981e91b1c8a0e62da1460c229452300948694c7cbf9ce1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537af8e1d49ed9f03b90700fcf8d7909b
SHA1a83632f9697ee8628dcd3617c9a490f981bfc78d
SHA256a7292612e91c1461578c369f1121e1c4c63ecd7f1178663a61fc4606661bd502
SHA51271ca26875ba7c47d0a5221040412da75a06cc96385da34a8e19324cfb3250639fa44394a2e9745be1e09b1c46e3ce1c449c6f938dc985a7afc1065e50a290364
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559d2e951a4394816b2a75dafe9b52da6
SHA150395035f6b6e41063a6abf4927534b462a4e88c
SHA25605d69c8ac9f74f7279e282837388e421ca9e2f17f35b92f5453eecebaee577c3
SHA5123aee5e3741f12fc611d09218781f27af25de7d8c738dbec5e4b22b2b497612d8e8666ac865358fbac31bd930ee54da5899c70fdcba733f54ae4defd030fdd51f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc3b768b3eaad46b552f8c8bb4e8d301
SHA11a5975b3da640d2c8d861cd57855a0a545ea3f56
SHA25652c93091bd4cf01d5b277c8db22b97d5a7dd419beb255ad232867c5c49ad9670
SHA5120fdb757fc49271443f36c075f35ed23ee38616ae227c53b6c067dc5f2701542e4c6b169dce2448aed296a29b51bb2aa416f4429664f4b3232378404f147dff20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd7594f668d0c62089105b32f09c8fc8
SHA1459b49e1a1aa73549952a3691e9a3a3cf537cff9
SHA2564f316414aabfa8aa176a780172352bbacf762ffe114e40a208bf7ee0a5f7735b
SHA512f0377435e7cb75242c9911a8263fad6f918c6582fbca7cbbb5eb1bfd211bc60bb1a825510ee7541f5b02ce9ec2935c73ead2e2e6cc68df3c5543f06d1929d404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568691f97e6796904dad4a302f0d1a8fe
SHA1894a9f759bd4d84eadb4c6c14c21b951f2d99c93
SHA2564ff21a053556c955fcd7449a09003ba137c6bf3f0955465d344d0254e20ff448
SHA512b4f8d34dae602bd085d71d3578a2e599b9d3df1f219b98301847edf7d86e433e142cff8eff8b31e8c48c5c7966f4da5a0329d4179f213244f7fd3bfc5dfbf5b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d8dfa4542be10e5354f221977ab5eac
SHA12f82926b8e9a2cc343455c19319b45a21b5a9784
SHA2561c50947a5d7baabbef6ccd7e70082e72732dd7736ec0d3754aef084dfeaeede9
SHA51222376d27d273c0550e997e30c85f424780c5cb86dba4f55fa6d23b7285b5861b858d2fac6ea23e230696c004711f27c878f43f95ec5275be7d362e98ff06a0d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e9d191e63c4b77a9710bce39247806f
SHA11f071153669919d5b68d398baa89d14a25956afd
SHA25645f44c2f9d66ef9c2868d61d089ab8cad076f4c520caeb3ddde2f473958a821b
SHA512f81c9dc42cda3a16e18ec6d624e93fc6b75eb9999ba07495f526625562ead8114a44ad715ec0320b53c05f1a318102eef82f0dbe67459fe5b9770412d3904d5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4766640ce025b92a220249727ced388
SHA1805d507bcf413649272b1829573b49fe3582cb45
SHA2565aaeca4e14b7390303765c9a96f4236c26fca0c1237f658351babe9417aef55f
SHA512390704925e717ecdbae84d12d5db26b602732ba118e2350f38e86f39aafd60fe3af547858aa4f3c5158559d2881d60c5303a8254614d3f814f1ff0d7698b9caf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bad8fd7fc77c3444cb4d9da04f3364ee
SHA1a62fbcff35b46392ea202cba6d158b921dfbeaaa
SHA256e7e6b4e0c7cc822ec1e4a7964399f14cc8d3d7f807cd2c63c71019252e041f45
SHA51284935a351e26b73a3bb85ca653aa961e0c33a92d9f0ac687fbb80df7d2bfe715204307ddf6c3adcc8ea35df3f682fba76c15828fddaf3e83a46033fd01723c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542d4410181868c5b559479f77dadd424
SHA1a6a665fd78a0084bafa019c4da661b5545d4761e
SHA256f85dc4c1e6dec7c852eb496a6bc23d6e6b0e9dc3338c2ad1c8a11d99c66cabc6
SHA512e8b15560103e3c6013397ac270dc120613d93c7b2dda2a90c533f5896309131643851eb8d80208d36923e019fe5ac6b12c6040e64553d11ed8a96c6d051a12f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59172493af22009e0e8388246745126a3
SHA12e42812b946a1ee65a51180ae162a545c8422981
SHA2565c1fbb1865af23b8973f9e37280be331ea0ef3fc269b1f07bc48e11550431e4d
SHA512c084ab59fe26d0a8b1234805ee577a7fe6cca587667f452334713f6b8dae436667ca0f195de1f51f5ade8487f46cd4577891a763ea78436e42d4b218e466d896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5531ddea91cfdfb678a3f45f2d8dc8b65
SHA1f94df9d30bd5b56d0e80475829d5b2c3aa717396
SHA256591ff86cc1e7122e32d4bcb1d230f2b19afb34f3a984ff90ef00c152a1196033
SHA512647c0ce67ec7e5f94d02ac5d1de7efb88a6fd1a24ab806627ee49230b34ab7987fd688c982b77857014490a3316068efb58c77ce1f85195f410635dddfa51c30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4efc6d6815dc8e25cb8fd1f87c59603
SHA1c04bf7b2fc5a14642d760f7036811e1ef3d41afd
SHA2566989235a075906d2bd4444c1522445a5524b48d84132c8e6f1c48639e82a6ccf
SHA51269fab4d5781e50f5ba18698f7719bc01f76d0b6248b11b756f3aa00376a54b243117a13b5423c438422a17775fb36e85c0789ca597056c3de8372b5ba5b70590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6df9b23696e5e8fba22c2775f47cd52
SHA159393677c3eb606dcbe4914c88b05856495391ad
SHA2561c40e6e6f8e3f9df8310c4d5ce8669755e88f9c211b1fa5be0c69e87dd7585b8
SHA51218e9a4407945892ee460a637786212ca56307d0475a9c1ddd95b2603aa2c3b8eb99fd75cadb92c582076ac2cbf3c3a6c5a65206cb698f47314b29d94bcff0624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553284f8c02ba0bc5cc9f79e3f0cdc099
SHA14afdde88981f9ce9916201e871099d4b89a5219e
SHA25651824282daf53d1eb3fbd112554329537fb725d8d4b845b07afd9411f5f18be0
SHA512da88f7968f946d5e10055737485b04d85ed3d3ff38ccff494934c7301c0412f3a2af531fddfc1f7a5a2ab7870c12be855970246f337327c2d89d990598a35d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3c69bf40d76e0f9fdd74a6d2d091cc6
SHA163f578f4c6ee5d8cb998557fb2f5e467356733ea
SHA25601b2f34ec2ac7dfa080420e00d8ca2e80f70fe12277207364ae5c639a66d54eb
SHA5128724f7f4f55e41fea32d24e5c5145830d4e1a21e70bda7af1130d27a2f95d3ad3f38b78993b26ddddd82dfcd374ee626fda7c7aa4ac2d597478a93629045601a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517beea4125f272e0b57f3d14d0055af1
SHA1d36af772599bd051f7b38846269cad4b0f8cd14b
SHA2569657a0c122e669f2e3e4cc04f80cf28955c1958e6c482558fe7746561411a6f5
SHA512337aa1f799862c7926f3e9ad8c90ab224c73b200cea6b4f6d10d4f67e9cb945a9651553e79601a6df2c917aa3b84af6c199874f86ff48f00da586539d9848025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c46f64fa2bf5b53f5c44178d73909652
SHA1e057c9d34a8fbc05cb453e02b7e087e038fba6c0
SHA256ad3108e9bf0233c47fa5624ef44198af83ddee9b41dfd0bedc095582fc97b79f
SHA5127f2b9421e0a378e4cd078023c5a6bd90650bba8d9ef344f919ca295a8697815dc499fbcc79e1944f707f8cbbc3991b7bf47f5d417dec4a8e1400e5ded1c79105
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b