Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
379740b0317b51adb398eb587050dd2c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
379740b0317b51adb398eb587050dd2c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
379740b0317b51adb398eb587050dd2c_JaffaCakes118.html
-
Size
6KB
-
MD5
379740b0317b51adb398eb587050dd2c
-
SHA1
b7b43239bcfc0eea37c7dddfdf71667a98177df8
-
SHA256
8c44b356a37eb058f0b56baf925535941da133c60c132161212a1a4a06babc92
-
SHA512
0e389edab115e172ab96c6175259503f9a249bfe51d39babe3e1419d607a48d615933b989a829ca422413a4fdf58d1dc2077ad29cbe7e9ebbca8275d44e9281b
-
SSDEEP
96:pe5WY3BJis4mAx9KMb38rLRMRfBHGvD+Yfk:pe5HLi/uJmHx2k
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FD532F1-3F38-11EF-8AE7-D6CBE06212A9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426831497" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508e811445d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000099249fc2bd72627c5eba33bf6f1366b60acfc8d5227feace390c90ee8544acf2000000000e8000000002000020000000730935da9cd7fe8ec23fcbb364f3f64a814ecf7db26bb2fc58a220a8db7c1e4790000000df01546952b67602740f2699fcf820471f2eabe0795b8cb807c66a9ab584f618044251e6b1a111749658097ca53a1c03e5e0bfe21f23e616151064f8c3e15a7d86505665416c67301377be9b67c14d134999c71f1531419d5a1075040d189b71b6b3735a7f032fbd29ee75a0e890376fe0036bbe91c40e7ece64557d1d011136809ead3cc70c22da660813a54fb50a1c400000000103b60cd73da9b7cdf4bb5911b081c689e9385cb056916d7d8b6332d0f6c6e4bad5db2e6e43c2334afad68ee55dae3d508090181ebfaefa270b173d8b3a5663 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008f3255485fb27b72da70acdb3fc7ba826c2ba4a3887a09865a9b3ac858185546000000000e80000000020000200000000ede5b978215ce2e6408b6048f9359fa94449198da8012b8fb788f5a214f916820000000b37209835f6ba2ec7ee4c756bc4dfe5ec88e98f193821f6447b2340450cb913540000000eef2c281752d18ff8d7ce40c828a2b8ffe3cd97ff6304fc01bbae5eb452fdba54caa2988a92737e8c085bf3e29742a2297bbae087e579f14624bb2522042a1bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2764 2184 iexplore.exe 30 PID 2184 wrote to memory of 2764 2184 iexplore.exe 30 PID 2184 wrote to memory of 2764 2184 iexplore.exe 30 PID 2184 wrote to memory of 2764 2184 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\379740b0317b51adb398eb587050dd2c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e7691242064ef7bdec0440867c199c2
SHA12ab1dd222bb7d015422b0849ef9fb30311308a87
SHA2569c1ea472411f654785b09a94fd88800404a97a7f5fc09de2abbf713b93d8fa8f
SHA51278c4387c91ec79894b847628aa59210254ffec5d58a232b74e0701a2d987503b9e14d295a09fcfcce697610109690c909d481428e05a5072407a3b7e19c1ede0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c288c9a5a0743f8c3d3cf27e9fe1473
SHA1036c41fe14dc69563e50c2b0bbed84236476bfc4
SHA25635c601ced10cb0119efc29aca2a80ebd2445a8ccde6f914a0d020840baf9e3cc
SHA512afc221319dc1f84409d3da95ec753e114935cc059cd9f3a53e34c4ed67465ef5d3988c026e7f982ad47792fe7abd3cbc6bceb64401de2db2528d27a359434218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5799937eaf62e313ea8e5bf8cbdfeb405
SHA14c1ded031596f29897162457d1d76224a8638182
SHA2563f4ef873b8005548974dc2ce830e4f136173e7921ff39ecadbb43df83c68614c
SHA5120e1549a728b6a46d7c449679c0ea7ec1412ea39e44facdbc5398ea238aae04bc1607c6f35dc3ad1d7657fcc7dd89a3039f7b85e4fe8b3dbb1c400b97a0ddbe51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e11cc7fa1391cad0a4f3f410e90869a1
SHA1e886341a66269627b3f3403178bdc35ff0b8131c
SHA2564af090aa42367f8caca1a3a2a4663393079cfa638dbc31e38ea24ecf2ffddb99
SHA5123fec59abbf4bd47b15f57007df617d3956b7f11028b265ea0bb7897c678ec7458e3fbf39a6423219b797fd9d17ca41ccfc54a13d25f8415d0037ba32f0147f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5387d9cede1d33ca6711da7cc5c3007
SHA1a7d8481ac92136282068118462b7c962f3139f0e
SHA256c46467571734777014b38da43e6d9faf0990e5395819dddde259274f5ca17d82
SHA512efdf75dc93ef1e6107b67899a8233f8144dd91525b5a6c9f999defae44c092f6c30ed6fdfbf32306cb8219baaf1d23c64d7f9c46a01219391e77cb0e4208cf55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510f44ad36f89b5949373386b45b2cb67
SHA110ba8b9754d0b78e105ee75886c2caa56c2da93c
SHA256154c25db7a2045b29a0a78b8c2e5865b349a6bfbfd1b8fc83454fc6304af8280
SHA5123f61f20c59d93543555e878c0d1c5d7c0df8736515dd2d735475dc25d0a6432d3db7d074a783f93d4c0006c585a26cf64f20ba5e6bf70982ba3fbfeb4486c853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ecb8042ccf91af10539bb31ba38c117
SHA1686ed1dca03ed4535b0074f892de1939132b707d
SHA256d3a76130c09b0a9c128340e32018fe85e0236352881c4694ece2b4ff8d58aabf
SHA51226318e6c6647def9ea332259f5db6f8374a5697afd31f5e4e8e20fd249ed31ce40ab383bf5c4141c768bfc7421338d90114d723b00cf2dac6ff7502f66e2684c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca955e51acbf99c1aede52d3a563dcb5
SHA1b31c7b53111c79ad9bc2e73418cb65064b21cc8c
SHA2567fcbe334bccd31e1cd9e6aab148475bb594802ab8e4c3491d8b33d4c76885b2a
SHA5123fdb78c759ca13d11c54eccb2ddd88cdb5d89f211e523e5ac97002ef7aa7c5442b7fc61d09c6caf848cc175047aa903991d74e90eca81d31116c12f736bad4eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50126df931bb4e459092386be9466a0c2
SHA1c303756f90ca8d0749ead64d4240b1d31686d925
SHA256ae3786bb1350719c373b445f18eb5958c66985420972cf8d12844874e5d91fd0
SHA5122129f0e4dd91e27be399553771206a2488e50d109f4f7a4517f7a4ab0318fb18b98a405d04a67ca42427e6e94ab806477eb5767a0bdf7fef5ef69ba4e3075f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d1ae14b3ecb1953b60f91ec27235047
SHA14eb92ca6e725ce269642be1a900e0e16c24a7a2b
SHA256e84a7ad24d37e6793db62148479cec2f7891d48ac7e1b8cc3f8cb44c76bd6526
SHA5126b68b66a1e31d044d27fd4313cb28031631dceab224cf15c7d838a214a7b3e9dc5e84e54d478496f02b0a44eea5ce03d5f792e6f962204e45c5f4af8df21f6f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc7fd26805f9464f6791115473770cda
SHA17d735e4e2d0911809801b4bbd2ba73fb59a5599f
SHA256d8aa70c842bd0830449006fa010fd59eb3642f8c2b3933365156248c426a1360
SHA512de22c919d587fae19d2029ed087cc0385acc3fc25ca2f2afde63b8eab89c122ed7b0f69eaff0bb1a1805a16832842d667a238f9c9cddaedddae0355014358e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fef53913154311755dcd8804875711f7
SHA19599b206d940a08a00ad5c25401de7583e279225
SHA256a6f06008497735d815a4ab23a5832477d603b6230da052c5f036639b10f06b39
SHA5124065f8e24653f4576ab0358abd6afa718b631cf994f2f8788b4b6f8380569545c0fbabeee5e99e63505f73e4d443bb5c5f481937002115f55f5a5d052ed0ae28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503b19638c2aa5ed1dcd4aff287ba77af
SHA1eb192d50db82e505e9252384c7005c8ef398b6cd
SHA25608f1ec522d59644f56c3e1e90dee4670188bb2205b1fa5f6461a61df3094506d
SHA5128240dcf445a45f444bc155a2b9b34ecf83fdf93ab84db962380e3bc0b79e57a64a97c5a6f748f9a41d4ce0cc28b2ab718014ba734668e88fe6b55b8897630a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3c26953465b2036ec6021842b3efa97
SHA1142f5239418f8ba2c0de7dcacb8716f55b1ee91c
SHA256323dcb74e2f6cff63f63b548392fab330c9ee853d734dcde5424898bb47a9c2a
SHA512e6716f4d2158cf71c9072173fdc7362ead82348b3730f46e251b2dfd38f74c49fa1a670f5e8a5c903e81c2775b74fc67e5b75df82566e16d52b6d82046db5542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520969b1fef43b8d380ede5d96b50368e
SHA13b76d8aea05ff94b5af7a9080c0af7fb4c85f40f
SHA25671d979b41f4f5ee50385fdebcec9133808bb9b685b077d3411ad0fffaac0d138
SHA51283c7517bc541b0ffa3d5ba32c92cf4a49e19e163cd8c46fbd322ba20fc052ad09238bfc55c5f198fff08fe1cb20235d350a4284861780383de31acd9b77fe34d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dde01e3d4e070c4263e15bce36290bed
SHA1805e901aa41c9e768e481f869f340cfba532003f
SHA2560f7560b5f6055f442e9c586d56fc94b009cc57cb160a965f790c79fa610d159c
SHA512d40fa32ef4834be2389e08944b4a3794dc4db6af4ec63a13544b9d8963c2cbc580eb8ee33cc64059bee119193396d6065134d18643afeb7fc33cbe52e8373794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56aa551ba1b2dbb31d54c2f1fd26593fb
SHA16b25484644606e1af1b06fe917705b47542feae9
SHA2563604ad5fe78a8baf739efe4804f38818d9a05a79c2e749ed62b90df2beddf7e5
SHA51267c725be7c2afcc704914757a6428c62a24cd19a229e609cd99300736dba50f0ac47a1610c55705136b5b2ab26ab938c9a7b50d98bc27f63763557e67d62256c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a2a037ff0de8dbd54fa9d13023997b4
SHA16284dce1ab773b3ad701384d69fb5f2d7debe701
SHA256e76fc13a1f44558f578d9da94d109b969162ad54fe87496119c61c53562027c0
SHA512ee44033caff3fd0e400f21ca153a931e9a0019f03c7ca9624addd64169f5ed774acad14c3b39fd99142644e1906600ed2af4327d2045f56ed17a4854b856f2e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e926131238837336842d67393be4e86
SHA1f9ca3c474c86f073b9e88bfc3115f6f03888e2f4
SHA25613f14637c5f6ebefb3abf968dcddb805d363897ef0fc08bf934078405fde81f2
SHA512a3733e51d96eccd9f91983a98b48e03f58200be5376793b4970f8e6385627d9738c15fb0337f2f4041b3a659741f7e47f23a0a43647e109ceafd7a1bd1841d3e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b