Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
38aab2d404fe6dc563c0dafd82f0e6a6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38aab2d404fe6dc563c0dafd82f0e6a6_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
38aab2d404fe6dc563c0dafd82f0e6a6_JaffaCakes118.html
-
Size
2KB
-
MD5
38aab2d404fe6dc563c0dafd82f0e6a6
-
SHA1
101c1bbfc4d867b684017c57a2dd9dbde96450bb
-
SHA256
7a207829f7f54bcdff0ccff821fc62c4a801f883323baa8443f72d68d53c8eb7
-
SHA512
85ac36236c46e1add29a65fbf2cf2354792e27d4e2e7b468cc79428e997accee3802db34bb834d98b1d9029f46bc139e2a646ee35c997c731639869f09fd9f41
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FBE79B1-3F6C-11EF-8470-C2007F0630F3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000003a3de0d9f3ea922cd42e9682dda316575fffe144eddef37263c6e27672f3df98000000000e80000000020000200000004541e3b449a68a37d85235f7dedc6c3abb002452b6497bd2e15103e4f7d1217f900000002fafa50501760da138a154614255584c003a41abc105c84ea5a6d5bb02d08ad4ae513d30c6aa242e4d11e2d73bcc10ea2b21c1fd483bf488ff9b8e75ca9a3b1d209becb20f93196392b6208106d441ac3d5a109fe81d82fb13ecfa2539be9c93ff0e69ff1a190dfae20cee4abd079921ecd6218a790c2144bf3f1b0064010fc00c2da91529afd111d6f3a2d31010bd75400000004cd722293a333999444b08f81af9d58f58369f6edd397ebe5495c6663e1c14d4d35334461fbde6df27de731aa235ea10dc7cee72915bb4e8b607095ba85eb495 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000e9bd969f3b53c96fcb8dc135f666d4cebb6e7eb09850850310fb2b1c9b914406000000000e8000000002000020000000dc4eff7b25fd6e5b0f995431eb682f15ba6dfacac8671b2ed0f4e0c11541ff0a200000001b1909b6a685eb863582293b6adcdbb63f33262fd648a8b5aaa28dda3829fbc8400000002095289bc97ecc4a18386524984cfad6370ad1e63339df5bbec22a72013fcfd41c9a99f16ad13c6836c35d7984233b3b81a44083899b39fa4b887d0d34c1d49e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20db1f5779d3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426853938" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2708 iexplore.exe 2708 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2772 2708 iexplore.exe 30 PID 2708 wrote to memory of 2772 2708 iexplore.exe 30 PID 2708 wrote to memory of 2772 2708 iexplore.exe 30 PID 2708 wrote to memory of 2772 2708 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38aab2d404fe6dc563c0dafd82f0e6a6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58369b4a500bb841ee1c312667736c885
SHA1568fbfdddf8198bf9469afac9b519713f2ca93b3
SHA256b8bbd1c7a0ec15865d098a3bd64f69ff587f64dfa22213a13c64fd18c2f88173
SHA51213a0cb45e783de91d4dc338d191fd842d206c974db73584961de132ae93fe212993c45cebbaea54d207f880420adcb2fe5adbd020ad979a25056283564a0978f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a134ec700f8fb3ce99c7e3bfdf6b8bd
SHA1b8c6a3d1d1ca7d41169247a9053bc2064a2e09bb
SHA256ed362d765bda0939d919c922296c8b9cf11bc949495ae741d4aa58df71737cf5
SHA51288332b7f08f61c626fe6be40dd45e790c3e35fbad9d0f8fa814f035c23f989a2b8b0779f72c7fe73a498b76c9635fabf611b67550214c8e62aa612d43ef94c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac54c3925e81ecdf00bd2bc1b0829926
SHA1c7fb78b7b79ab6a9a7c68fc2f4c73600a949d235
SHA256df1cb74e397b0867329cc8411f11cda8ae2e51e3f28d4ea3be3a93da0282ddc9
SHA5124d97e7241b7a854a1f1affe9ffa9a5dc00b2e98955aa0ac8dac27d062581f6917df94a0943d4ea0b387a985389526f317895b21e77b8f2ed91c3fd51806ecac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bad2a83a531a884ccca416031eeb7ec1
SHA199a7070c99a0aa5f488bd3331507fb2a33b4c847
SHA2568042e026e5f14cbd8a2d8a01d9c3e4c8a677aa12e43a372402a054fdc2fb4ae1
SHA5120b3d08aacc15c57fda8e2bdf30489c27aa34642dd246e25a77b92582e33d8c169f76b11bfb3f9d5896ebd96e147af597037fa0d074ca872618e10760863fa958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5938a814894bf34093c71144e128c61c1
SHA1290f2d8a90e62f8ba3ad54aa9a9b233a934229b9
SHA256fc999a764b67f379cac4a88c3927749d58d08cd888bf7bc0542f3e029a1741cc
SHA512029abf1b0bdce3cdcf29ba5606d304fe7e4f4903fda671389d010ace0baecf9d675040eddb6e36459ce425df6c99f5b5c29994d63e802f723b42a441a06e18a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d24ecf15e703a40b5f86078f437de6b5
SHA1717d8d198b5d853827e3df9166c17e2e555afe6b
SHA256e96d6cfe19fcb2bafc0d8f73ef6f7b05e460b4426838fdd7c94811f6595a8e43
SHA5129c480360a7db8eb18c293d4f1f35110d4568063a436675f733983913c25214f7750d60ce0d93affb13b30e8f816b163593943a812e90231337f2ce9cf8ccc52c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac1a31369958e86305fc6a3c24afdf75
SHA13b73a8d0dc819a28af4cf097447349ff775d4ca2
SHA25669b1e4f251d0492f7448de2249b19f072ff48fda448c0c627ccc8815cb62cea4
SHA51223ef079a05d8c81e3e25bf67ee792f415a0777625694b0597741b5e62feb279d449c72163afb1928148778291e82bc607199b883d8e69cd1f3937dfb18a53b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fab69fa06bdd247ebbf4b9b35fb06737
SHA1c73cd57774b162e24489b58046852264394ed2d3
SHA256027876943def3893f955d2148354152b2f391c2a5b748f085b7aa123a9851baf
SHA5120c6394a8da7947387bacd2132681ff9c492e40acf9c7739c29fcf954409e2899a89063f93fc954bb39febdb17396a708dd5a9bf3786e234c22bcd41ae47cafd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b0fbd9a80bf4fdd385b5c0d11fe50f9
SHA1666ea904e875c6206f745a380c88e4883e85ff2d
SHA2564e460b5e746f28d319c8ede5603bf6bbd83b85aa3d1466d1d7507559c10c8582
SHA51273fd17500df464c5de0a68b7a4ac1154d87048ca7d2a57080e1e17efde0d4a03fc2933cdded26cbfd7cfe26ae52aeb52502cfaeccadaab7450e5f052be1acb8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51026c29fe15b11b1e756b322dd0ac2bf
SHA1dd640ecb7e33d6f2a60a20482e798f4a2a102fc1
SHA256e5666f2b70982de0607b266dbf42d6b94f8a23b64a313d21015139f52c0f978f
SHA512ee842cb4757d01e87bdcdb44cccf7ee6475c0150407c471beab873c4d941e5c2b674fdb4ed6e0bf10099f29f9773cdd5745e90726457a1ec56dcbf810f4a84d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc3843898c600aadb489fb7567910d68
SHA19fcd3ef3666853fac35e3cfe0d2acba56e9949b5
SHA2566bb427708f72457c7a610a2f1986efac9db8d63b15611b1ff9be95fe44e1c020
SHA51258f1d4e2fec80b3ee17573e71615d0acee6711c30f9bda854a3ed4eb9e4a7d0f1dbbe44c5b224cc95338183216aacebb455a17b7b9cf08598cfb403e88bd2aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf1346b933698c3674bc512219197c5
SHA165f6437530281ac1f9e4eca0976603b7237dc3f7
SHA2567f8c3e91eaa702f12ba5c0ba5cca415f69ceced9947cb5699e5e31fe87c67432
SHA5126fc53c0422c5777d15573fc36b3f50d515d4c97b19818cb423d27e8170e23bd894d8f99701e72b2d573e783a21e468cb1775100d151ce0458d810f2df8f2fec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce9f7b9b2db2660f2dbd6e9e545e3630
SHA1df5d4256e521b31d97466b5153b6751efc0d4c57
SHA256b904ab11d41b98bb196d73c21f6acdee6003b80325999cd5ea5b06b57f94f2aa
SHA512678ee5ef8fc40f6c2de8286dd982b3aa00ae3545d21ab76e5dc5fba03b1a1132c9e7aa84a621b235e05d4d3c9d8a8d496e66e492095cf038fe1fa0983b94f6da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54182e789816b645bca03e299f50ece0a
SHA133d6818c4d7eafeb601e05c309f58b72328a087e
SHA256f7c09ddebab31b1fc42ee6dcfa6233bb051da1c349fbeab0876d3290cb9a79d6
SHA51297a91989925b848e82c17c39936d28c828d6e217a7408cde786a52ef155c7810ced07423a62076a80aac72e0dc4c3ed14a4d186b21afa8cbb99abe28a4b8bdf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a9e7a3d240541bdde04b756fda6148
SHA181ac83e7f9cd6e22a2ca3b2e5e8568e665fcd669
SHA2563762f67293339e62d7abb94fd4778bb6854c2f29449504ff6140ba4b1b489541
SHA51254d0835ce61665ea79c98493e04d07ee2eb4a5d82051dd0acd6fedd64e67d0cab5207b42a94b2d9f348d0778dc4ab197dfc2e482adc108b4f4aff649bdfcf3ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d195a58b82fd9c37fa653670f5761380
SHA11e4874d48d9114e6bac8c4f42f9ff4bb3addacae
SHA2563acde5bfd63ab5ff0e79ed733bbb5d4d733cbe9af873b90bef5a8898e592d657
SHA5122bcccd0ac1fc66ed0c62026939aa9fab528092318d10a7be8df1b12fa6504be8198bfe197ebf766df08ce67fe0eb54af8ef22aed9b892e35f0eb9d45494e844c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1cfdbc3a76df0c52907e7f8d5a185e
SHA10a7a788522d6e48d2bcbf8316953647373940ded
SHA2563576fff9eb1765f856f9eaffb20d3e921bbfda835b48ac8d48872de833523157
SHA51230fc694adf20c91ba68477937b2c340e7edeafd734bd07c6582a88ee3f10284ffdc93c01e5cd8daa88ce1971ba72ec7416b4f81bbe5011f9906655c1f3c53280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c52b0c9c3e1fecc500b142e510c063
SHA1fec7a00c50b40b699cd01bff06c350b38ca1ddd5
SHA256238ecc7168e504f0308434a6160aad775774bb70e1a1d938ae82279e5aa219b8
SHA512c6816456ebbc3835bfc4bfadc9a72c419552d7911af70923ea667607ef5fd229f92886bbb9d716ff8b2c3e7552ad408df5e54d03b217fff4ab9e60acdec7485a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d814e7e437fe525fd182c862371ed21a
SHA1b6da6e4bc78eaba785058ba2ac9afc6ceac06a5b
SHA256a50624df2e9b0466f105dc40f9de2bcb3377f88683df1d6ce921f9e5bb48da1b
SHA51201add9c9ccbeeb7750cf074fcc2d3ff000f38d3f3ee75ea9b601ec0d29815a4467a1b98c2eb56c242dd93f57ea1f4f1e2a5fccb993477702936dbc60c2ba0dd8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b