Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:12
Static task
static1
Behavioral task
behavioral1
Sample
366667d4719dce2687668ab6362be75f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
366667d4719dce2687668ab6362be75f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
366667d4719dce2687668ab6362be75f_JaffaCakes118.html
-
Size
53KB
-
MD5
366667d4719dce2687668ab6362be75f
-
SHA1
b39d2b62711bd18ccc6702841c1fcadc19b3ced3
-
SHA256
c61dc0b2fe59aa0fb5ccdf0b5d9ec3ab1456f8e41a70064442c7a8d4388a0efe
-
SHA512
aed6c26c00f3887f3a086fe17fc135ede971ffecfb4e725599aac8f1980173c4024b268494c21738681b48b322daf59f96ffb7e303fb1ed2194d8dda13a02ce8
-
SSDEEP
1536:CkgUiIakTqGivi+PyUzrunlYH63Nj+q5VyvR0w2AzTICbb5o4/t9M/dNwIUTDmDc:CkgUiIakTqGivi+PyUzrunlYH63Nj+qQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000379e8ef7e3c9b206a1936366f7e7f549baf7acbeeef7b3524edbbb2af228a15d000000000e80000000020000200000006a2d0e243da0f5d8dd70c48ae52a7be8712a178cc231dc7b224e6c7db69a70cf20000000f84c932b62611c9ebe40a33aa335de977458e14127616951f59207294803d91a400000007382b34dded1bc3b3e3b2e53e516e0032c8000e001271bc8c7c6083861e443eb06a71a6e15be32ad3c71479c9f20c594c6fe8a2aeb7131070c99be05a6dd9068 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A70F3F1-3F01-11EF-BB9C-566676D6F1CF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000005a55ab11c6dd3ac0cf8eeae9cb75a20d9483144183253625f6fa658bac64023d000000000e8000000002000020000000367c087fd1631c85767120662a9aa906f0ce5ed359e43471e9a4fdf0e76de15590000000c941efd943b7240d6610d124aa55be9d21a99dd32d7a5cab6d3f246afacfaef85b3f6c9b7cfb88cabcc95312b9a65834a7dc655100c00cc16c4181d4d54f8b457171673eec04056f0c22f03248c45fe3fba5ebed2cb2839d0e4b34abf5ea475e744c13fa693c8fd6a71defd05a05a49c23e97140a789751db152d802e1a049ad6f884bf8876924536c26173e26ab545040000000837bb425ffe693224d435a5de0fd6a9f1ddec4b0b759a187f36444d4d4c2924f332d7d6a9f25f4000759c942982842cc7516c7ee55db32c2170fed81440f8b26 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807812" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bcc6f10dd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2268 iexplore.exe 2268 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2268 wrote to memory of 2404 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 2404 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 2404 2268 iexplore.exe IEXPLORE.EXE PID 2268 wrote to memory of 2404 2268 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\366667d4719dce2687668ab6362be75f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51a8ca3b4c50b6c9759f25a24162cb25a
SHA1c28e14a61cc4adf6745f5815aafb3dbc8132acc8
SHA25625f41ee044c2d21b508f5ecade93c2fe34c4528017f7d16f98627e443c626a09
SHA512e48bbb48b099dc7f39715d8e2229ece3db84193fd966265e1ca1ac4153917fb58f2fcf09e508060a5e4b006425ff40567fe181007aa3b0e44c11f20d4b5a94e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59339d9e14bcdc8c23e988e5f2eed09fc
SHA1346ecd65f4bf467a34a9baea8fd1b876ff9c0968
SHA25633ae949a8a97750b743c5878927a6138c53ec0ae87ff4282950cd2f23f1ec557
SHA5123c6dc4ae03306c551d9da04c2d7d0560b1d3b6af5776a699efd0a4cb1c3d28404b6d3b7a5bc9191f6d0c8e4ecf45763cf77310042f25491e0d17d30d58e9c7f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5318d0475ba2f77ead09ac569077710fb
SHA17b3ea169aecd3ea4de5f14b117961e0bb5d5599b
SHA25623679e8e3bc004d6e7835385e09a6cafe968dd88ccac9b602e7021b9df9f257f
SHA512b7dc042e0aa490d40ffe79f01e4f5e408f1b1453af45412aeb6a1c675e938c246c9b76351b8becfcaad27b085559bac55ad304f8cb11d572e95f372ba3a34839
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5362b5f47775b8769cf4e5dd789b50d9a
SHA16c624b989bf8d7f2482d9a9bae1b164da937d304
SHA25670217cdb09b944f421187cd8662a55346b81b1b867a985ca49e037e560aa7fda
SHA51257858d8f0ce5ca531439e2b70a7c10bef4b407ac8e6dc78d1e5c87ed5e6ae91b954e1c60c9c842f4bc4448505ec16824e5b827fc37aa46d94f226e6f882118f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5478565e50667024c6d72a5c9403fd17f
SHA123baaaffb389ec1830251843d164408801da4eb2
SHA2560324ef3f8f92d3a8a6c7bc522c88615d6ad8355f31096c712c124a69952719f3
SHA51234b468622290a67a4c5b4aad2ffec972ec9bacfe489e610d5bb4b9ef99814195daef781d6226cff87fe5ce504b420ab345e9427a6b62acdddcce642abd28f7b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58aa5c309bfda06a06ce968286fa9a40f
SHA152a4728727909b4d7061f84e1a3693025e9f94fe
SHA256302200dc1e9ce43dd88fdd9b68f87654a55b9db39a31c000eb16efcf0f496d91
SHA512eecd9db2bd24571b03b5e9932660468cac69653d6ad55928adcc3feaca6879308f49919f88dd140eab2e5fb48a48855ead71cbaa6fa1e1a40bddfbf6615d26f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5290845773cdc34d03b2671826d030acc
SHA16e2441136d499bb4b77f3d9a1180d6325877420f
SHA256fa257f2b3aa71e7739cf0264c7e62889dfa8ed04d0f00333960a1132b2c94c96
SHA512d87e727437e38ff32877ef3c78034570f1a54e2e24d09aba2f43c35c47686a15f3bbb41c3b8bda4bde97a8027dcb2f005c30a64bc41b25c774223d4fe26e789e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5769ca54f00b2b1a4b1932f640a2f6605
SHA14214c112bb6fde1db86911a622e8c01ec52fe337
SHA2563f2d9208619c208c630275bb44eb9e55069c3c1cf522253fcfefb7ececee7bc3
SHA512645a34b8be75730958bd64a1d49fa30ea51c73c3ab094bfdb8a605cbc30f930247bb063a285e7bb83a676597a670a75c7449fc30076923e6a07ec276a5757fc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55cfb6049bce8fc3f61ad7683b8256aef
SHA1d8007a58545fc7c5ffacff1f95cb5da0c4dacf24
SHA256763a05d31b450286044a5ef2a76a3e7657b1123e10d3a8d0762d097c7165ee4a
SHA512f8c6a1edcc809d8ae5b530db96003a19b497ea91b328f915f259d5abb9974e3589493944d8295d8bafb8d32ac19fe91eeda6945c9790a21d57acd6ff12842bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53e1e4b34b124b6008f4c35d28ba0a98a
SHA174b9e0196b1f901b23113d236906d97db02df651
SHA2569b7a9a0b16db1f0bb0bd5815bc1b75f00fad7bf42912069c1bbfab5a9608a127
SHA512b0c1f6d704145383f7bd295a0e3b99214640fc221307de7c81039f40855a8b8a7b4d52c6e37325d40194d2d5f3154e2daae97838517b9f8650ab3a53c5558084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59288d2c08b9405b13d3494b6a5d47704
SHA13672bd00c82c553e73b5919056b391447151bc99
SHA25631a55d405b7eb1f79e07dacb6be9404baa81b5a223ade94bfbef2ea1774bdbd9
SHA5123b3423d69a5af62802ce7fab0dd86024631b4cc8e50029c9d45df7f91d2ac5ff661e6ac4d08efa179b86db898798fc2727923d7909e6603016e46115d6ffd0e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52bd62c1025adb6f593d63e4b5d0e43da
SHA1c19d01ad360d3253444059bc49e9d780e2770c33
SHA256d4b489cbfa0e957966bbb37e4a737b6e3ba18e1a71a7bac58e7d9be9e9b0c3c2
SHA5126e70b3672c40b9f3c3290549ca5c9e2bf446ddf458ba01c3bfef8a30c22404ae56cfcd66b5ff094c7fc12c7507e85963cbee68ca212b847d5e372dcd11c43744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58293811941db11026146d3c4cda173a4
SHA1896cbac844d5dfada5f5f4c72a491360268c3752
SHA256016ad9dd7d0f94b858d5a315fafbe8a9d89058bf55bf5957cfe13d4c33933499
SHA512457755b777be026e4272f9102d3a759dbc0f93fb81715c03b0adf40c5557f512c5919c9072339a52d72b17e9ef5e4e6744cc854466f792e84fd66121aa2cc0b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ae8c101e6a18698100f679a033552330
SHA185acf0b58501363c66a6feb643a75c044d808339
SHA25679fb187b87c6cd54a19418e9552ce949d1df2b2e6208de86623bcb417cc29bc5
SHA51293ce6caabcff01736118627fe3afe0fbd03cdb4bfdd1ab75150f955c0b0fb17ae2b4955186471abba5d5c68b6710d407474430bae152819ccbca3a366302af9b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b