Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
38b9c685cdf574fac7d774b702743e37_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38b9c685cdf574fac7d774b702743e37_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
38b9c685cdf574fac7d774b702743e37_JaffaCakes118.html
-
Size
29KB
-
MD5
38b9c685cdf574fac7d774b702743e37
-
SHA1
8e5b66efdf456594bb7b2d3259ed48e8426be73f
-
SHA256
2ec5c7bd0ef0477929002a1332ccb4d52d2849d3b5618802ac315075bb0ae690
-
SHA512
b70f4781ecdc34e76eeca5996ae57b7390708ff8a82d774319ce0d991cde5d2d7713a12e363fb33e1886a3a187357e2735918f7d8419fdfedaee3afbc233321e
-
SSDEEP
192:ykKF+6dBay0ExV7Myi+YdOnpGlq71iROt6gYaYqF92oNTZi67P9UH4uj:Hb5UpGlZWuK95fUH4uj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ba674d7cd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ddb0e3496ac1358056ad5b9989de17bdd1e4d992a147c18844511663d10fd7f7000000000e800000000200002000000085e0fabbcec5ae1f794162d7449ea8f1741050620d3dbbf940b1ce37457c1b0c20000000e2f94752cfee4a47be69b43a3dbea10121c806f6210d67cf733e61c02ebb5d6040000000f33b3bf9f0f9b25f72c687b8ebb3a0eb03fd9f448384bc05a6798be92275c88390583ce5394b5d3e77769d29397950296e0af34473faecad76a3b449f0edae0e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E06B3C1-3F6F-11EF-8A22-66D8C57E4E43} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000006eb318410dde128cb541b9bba8ac89996eda08e833a4d40d3692689ba2ef715a000000000e800000000200002000000092c04757fbd942770753a5932556406451c3349628769db35e84c3967a692dca900000001d8a074d456504cb19a3dd626c475e3b9a28558949cc69aebeafd50894899dd72a0f5b45a0b8481f96b427431c4de0a9970acf71c6507ef76f8c3c4275f5eece47854760045ebe8e8becf90d24fe75199fc7ba132fa01eef7f83275383fedd55bd6b09d79a7ebb48fdff4977ad7c78c514243d8c7be3bc033fa311244e09e286a7701606d5b045a46e5cef98b79b399940000000c977529d18e70052fa5f11109c12cd9b6be338f2f503496bde483cc5604473539011b4d4d3f37ea16b2e600aad5530ec3bbd28c61674e87b7040f723220f9a93 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426855169" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 1500 2400 iexplore.exe 30 PID 2400 wrote to memory of 1500 2400 iexplore.exe 30 PID 2400 wrote to memory of 1500 2400 iexplore.exe 30 PID 2400 wrote to memory of 1500 2400 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38b9c685cdf574fac7d774b702743e37_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594cf460f6d367ae2886b1dd84c68fabe
SHA15594826ebc3116fae39bd16fe3f746601dfe5493
SHA25656bc53d1a465e1faff71fc4879483614c2ac748037e1154883847e0bbbd36e07
SHA51203271d54b3307419da989ef1de7ad86a1b4d2d5d120c559b53d46042d1cc260213565038074fbd3aa999b15c4fb068d1e0bedd2355bcbd6b86eee309a3b42655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52881e24e0688f6a9d605e262d554f754
SHA1f47f78621e966b3db8b2f4541292fafa060a95e1
SHA2562a68345f9bba87eedfc1eba2c6673f2a4348860a177be417358b4b240d284146
SHA5121a351c1d87f99fd5ab62f77263c06a1d54ad61a9273107ef4b797337c97fd3e4fec852e6eb53d218a50a1b337e1c4ebeaf6a278644725de97b913add52c3beb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f410312da13f4e8052834084483e59
SHA107403532998d0dadd0ffeb0c71d1d740112cf572
SHA2564fad0b5613dba7ba6305ac81cb95bb0915071b6da6d055ef5eb7434f23c24f11
SHA5125f166e732e115575e4c1447c35b6cba4c8db473cf6a8535d0bbaed55b8c9939aa55cc6ded4fe9d9138db117d016e08402801a77353d33e58546f73cf3314e08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568d5e049700b1743c37703d57910bbf4
SHA118829c42fd5c4eb9bcee535fc654661fe80028d4
SHA256428490223148f2d3db5308cb73dbc12be65d589fd36ed8af79eec74a572f9cc2
SHA5127e1c75536be20e44d4161d00bbbd9b9c04d9d78b5ce055b61bab86cc4b2400388f1994ad27b2ed3ce64fd40e1669b2c6e2db72caf54c4a0299e3c0973332d2ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b562e00cee4260746d2c345024e0bba9
SHA1c422a276f2183a8a36f87d29a0b087fe017f7dd0
SHA256057cd86d1947d9163bad0de11cc08b11f5d01c127d561fc86591c89afade74ba
SHA5127de64bcd0131990cd2d2f8391c777e1c0476878222aeddef464c1206a8e3a955d57d34d1865a18ddb70be90a087c3bd065e1f3afb0a4c904cc75be79c21be77c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce9d0deb161fc710bbc615cc41564ab8
SHA12aa93168b8a01376db5d5f719aa38cb43806cc3c
SHA2565b2435c7d9bb713d0a98f7ddd35a92268e4db84e63f83824637af7eed628d4fa
SHA512cb30923b341fe779d2f22649c0c7b9405d6bf9ceed83dad4644b41b535e4e11bae252ffb2a0004b0247bc49a2035771ab4813a00aa77c58284ba2a063d89f969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ddc02afd3a84bfd3bbba6c50a2a74ec
SHA120f4f1d284c60025db750a9f89693f3da1826acc
SHA2562123d63bd1365aaae102a12612d5ded81bce75b01f5214b2cfd7333f7a800f73
SHA51207bef0c9681ad31e22938f0e1f05dfe25e01405b8a609f4fa7322ec331611768398b0a7dc8fdd7fd94f1b04f5544e4f6dbf90a3cce12f6e2b2678ac30f2a5cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562963fe95f110c9994bd53f544f5da26
SHA17efdcd9bedffb01843a68ae649bf627474f662fc
SHA256441f9207ec61cb669b93e9d73cf2517bb7c29bcc04e6568fd6fe8300820cb118
SHA51288c8b864878484b3e3c5cec5bbc462636eeecdf2029969420cc974d422501d91c9b5ddec2e0d89d0565638c21c32546e5ed508631825042509c9b0aec639be91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5144470fead801b418f0c718da65a624d
SHA10472f5f2c3b5ea44bb27c491c39fa67bbffd0e60
SHA25637e5f5666b74912b63143fe53259a9f967b0ff6a88018e663281c9d5eac03533
SHA512138f1a4ccf95ce1e19ffdea11241e459de45973c67b4d70304cd747f3b09424792af83926633d7ac51537d6bdcc54a5ed9b1f9189ce5ccb4786bff462754aa85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7610b7f2f9dda984fd4e5db71ec2b8b
SHA1430d511d1e320956224ae59a171c040a0fb6ce87
SHA2560a0d980def366684fa9da68f32ae8ec6c3851e076f8e2f06d58e95596c11dede
SHA5127be9e29a6e7d6304515b889247017879dae282b416a9daa756bc039008d0c666e949a63967716542f5e721cc8e4254f448c371fbccf44ff7ee16fcd00d0b01d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5109d2589e6c6f19186a4e29c1cd795bb
SHA1c7fb98acdabf31d036c3b3e19cc6ab4ea3d664db
SHA256c35cb9a7d52f3428a3e94a13be7d2d2ca5181f5f52f1d3b4509636945eaf9741
SHA51299389be776703f4aaa8a41d90f3ccadaae651ccdf47fa50f9bc368fd1e6c31ec0e9679abe5398d41aeadb666868875ae057c1a4857cc66cccb117a9a152dc79a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b9c08ad14268097d4783ef4fb658598
SHA1862be064d4433505d52f37bd6065db6e79dc6bd3
SHA25659fd9f8d01db5fc7038e3f31ca4d4c75afc4cfc7f63f35656981d2673a78285b
SHA5124e9e88f0ab8e59bf9aeb740d2a8397343ddaad0c8103c6978f2e2d65105117fcc7d96f1239c848705860e9f023092e96b675fc3312af91e85b698cfef43dc713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f1f90a87c5ce49da8d5e913823233fa
SHA183a62a4d7c78010f45e01495a3cd023a754c0741
SHA2562472ced33c571aff014df33bd6c3f707d12884ddec0eca9caea6b02a5ef5511b
SHA5129fe0e1e10bbb74bfc14e85d1e9a81feefb0748a55489ca7e3510ad95208b11552d40f4d980672935d7616063f8bfdfe67f18b37d43f4e51c5dfebb4d558713d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c0923bf6c23563829c1375fde4388aa
SHA15925d7545cf6499fa04273c0039b0315020c9a9f
SHA256e707d35c2b7d8558e1553b351d418d615ba4f909b543000b733cecb64681e82e
SHA5121e74e0359c1949a624bf77761535fca55312649dae326d33b34c2e64c4f9b1cc2e25422908722c52543885fcd1d59fcbdea5e40be649a8dd5065d498aba545ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b789dc319012862b335ecca7aa4e6277
SHA1a774bd35c3004a40c033497060bfdf93d3c001a8
SHA256faf409f25e8f11890cef054283e9ecd44903cf24d53ccd3e216977f6a3467817
SHA5120ba8054c5dd069a095fd5d19a3034c2abae9c974ea090d42100566efef32fef699cc0d6330894fc50ed8028005ceb2376c3264a2cdd5f162bfbdc42d2f894382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf35d0643aacf559c45e169658990069
SHA1b6b392a1a7600bd492b8108c94b38d2d3f9eae56
SHA256574eef2be6ae98a9eccf52ddf64395b141d07c55c6d48cf220dc7ee5b2813c16
SHA512540619bd9ec0d6196eb62114a35416ce0e9e5556c16b95ea290035048d51b240b5b3b5c7b459d0912ab4ff5922550b425a56273b36bc04b21a40878a0fe65670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c969346e09881f13d20dd23f17a08168
SHA15b8dfc1d9aca6910f30af93c1a40b27c1cd55d1f
SHA256332339eca15e03d212c75482211a2d53fc1718a7c44bd3f75aa02489da00d6e2
SHA512e2cb4ec95267ba7586c705997e61d4744549cad65a1aae3bb91fe3711ea6be57835ce30ad2568bc217687a7aecd6d035d6c243a44841f7af1d28b7d587f6138d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558001db1724d448634fa199f2f3f996c
SHA1a2dacc48293a2efe3c8a03add1526a7ec8b58c32
SHA2564d25e6434e7869c2c824fad2698671b376154535026a300ba5e31530e796742a
SHA5124fcafd1a47f4a5590430d4cd7e11b8c50fbf7b872ae5595a996b3c6ffb540b2a67c6bed5647f1add6cbbeb34f1c7b81eca868ad7cfa2ae378e84e9fa7d4e19cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d7e978ff900d204feeed275ef97bd06
SHA1c49a2763070c6f1bb3d120b3cfa87b63d4818657
SHA2561968068a60e1f21445da767a7942ce6ba1dd285b3ccb267a85af2d38016587e6
SHA512680905b4506ece77c65ba9c949a23a7744ac2ed6c24562a6955f9631f468006ec5d3dbdf161c31c11b5d8d0f449ee0325eafcb2a40f3b18237cd27b67a7731b0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b