Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 20:52
Static task
static1
Behavioral task
behavioral1
Sample
3100f1ce33e160e3e797158bacdb3180_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3100f1ce33e160e3e797158bacdb3180_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3100f1ce33e160e3e797158bacdb3180_JaffaCakes118.html
-
Size
2KB
-
MD5
3100f1ce33e160e3e797158bacdb3180
-
SHA1
d17a05f0308865b1cb1d1fc0c253bc7d3a0ceaeb
-
SHA256
bc212e30c3691710bae0d7508d6e0a694ce79b03d247390f53482609d601ad45
-
SHA512
3016c24407352d009dce66b3fdea8d5a5497faee3f84e900fb92ad5b9446504c004a459533a7a9b0cd29a2771faebe39b976f1a33b280a6c08a4c2b1e2b6d083
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0395c181ca3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000241a0876ad88dcd80a13a04d78d2db3449c94c1e872f5b95377e8c95f5e5e7e7000000000e8000000002000020000000f753e881195b5ab9718a0488add6d68159ce31b978073e6e1b71a202fe1000ab2000000023c7a8395e84995a7ccd5f3b17d7d0699ce73e012837774b0f2a292f8ce90527400000000868ba86fde2e306d3769f825a38f729988f150f169f084da6aa2d26aa807166ea274ad99681d23788deae56f6c5084bf2ff7f952da70a152c3ebb5fa9e45447 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43893BC1-0F0F-11EF-83C2-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421536238" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000342e51b2c69b9876140cc9745745d8dd5a0d1e8012904f0bc13ea10a47b69a2d000000000e8000000002000020000000c7fe0b17f0844ea2070904ed81d8de627dc6d40fa8984e980b45c38613d41f329000000028aa54e056b038edff59c4689338a42f39501a41e5db8d55874102bf1029dc0b8d1930e3119724849aaa2a607c45ecb2cc86358873060b3b13bbed9e2468aa35d2859a6d7c893d8a6e58f12baa62a3880a93ad75918cff05824fbbe6ee7b71131521b131e96d8ebe84733e9a28734868e46fe9f3495f02578d82d934baf7dd4d5966fe57f640044fb4aeb7cfa422e44640000000c92169785883b6313b4dc931df602bf1c36189af6705962cd812eae90e99ca4a37cdc9b2fbc78bdd7731aab5f37af137b35796ad430c90433966020c038ddceb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28 PID 2212 wrote to memory of 3004 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3100f1ce33e160e3e797158bacdb3180_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57326431ae789a2fa57cdf62b20cf26ac
SHA10548101669904ecc4c2dfc2a1305a4ba14239207
SHA256b409cabae8688baa8bb5755cbed7cc4fc0f84ace4c54dfbaa04b948aedc42748
SHA51202d6f1b3ceb7786ba588ee2d71aef7e01b3955339fb16b9f0034e0311ca412770192077c6ed7de79872ea98617a7c41039c0198548675fb07449de244031f3f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506ddb1e6094043b56a3c487ca2b5fd6a
SHA1de3596c8bb51bb7a1c09a1c71ab0288adcf287a9
SHA25602e7ff15e93a3fdf4adba4bd95c9b7e23e2e5f3b350a3a844bbbc0da5033a97e
SHA51296331195c02114e55725ad2c894aa4633f407bd5f64afb53988fdede3bda06bf5536ea4ad46dff9608191474ba299b0b18214b05f326cda01720e1628a1ee328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f8235ef4f42795fdef9ad6d8aefaae9
SHA1443554e6431e793af3039d98a992a6aec47c8a3d
SHA2562707764b418a5eb166e526af1848bedb0261b3f9317bb233b7939e1179dcd10d
SHA5121405134dd36f07aa4fcfe60697731d080e19ff933d6a1afaedafca0382c059d3559327c85dd45035bcee039d1d773207b16dbd4fa9a9bdc254094719a47b0dc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe974825e7567c9e98ca5a1541da4a70
SHA15c3112fbb563ec6ad8c8d8287aa973ea4ff49538
SHA2569f9423c0b1556f8ed7530bcb7fbb740fb0f9bd470789a19e5ccaf9b739ae67a0
SHA512e3e96ee1ea91c6494c66c9fc126a260e66756dd59def584f1b48725025cea10c3bea7a5318a9ba70ebd8eeaaf48839d8e4884347a7210f9fcf8e53cdf84bfeed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58222d3b3008355ebe5fb7e9e484c04a8
SHA1b52a7d3c80be1ccdd05c56d395d64b01434b6f61
SHA2566873d2d51ecc32f7482377ae217673349d04f6c8ebf274c81a575793f1a03501
SHA512d1cb2a8700001b67037f149adbfa9acc71e9d5a981559886b0f224cb5f6b171dfbcd80194ee491ad4cd3f543ffdcc072278604c05aeb169637879f8dff5671f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea26079a783c5f66e3d834b6379f59eb
SHA115ce05255f925f887bc01eb9db821fb4796b4095
SHA2561f8b55dc17d3bd9deffe6bcc67dc6802601d96c09eae9de2efceb14a50765bfc
SHA5123156549ebade835549970d06b4dec83ab61d125f9ed1513415d4632d093fca391b603ed6084099ef51c786dbf59fb883cde6f7891ca81c307dcbb217de087f1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d3317d0034fe134948e0b4bd5a74a0d
SHA1de47544d60c7067044037692fa15106784ce4ad8
SHA256f65c9e091b4ccf558044acab04e60bee8ee6639b99d86a842f1c65cb9ef3eda9
SHA5121ba55e07b4fc2082a7576136c2d95e5eb9233b6ca4037e1e5ce34ad010d5f608ffeeb4c63c96034d1edc568f417616358ceea81ad814fb6f50902ab45f5158b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549dd168a7a5c93d7f50d4b0bbe15a28d
SHA1d05c43b615c14e8d352da8e47063aa48a971a442
SHA25610a4fe3c0d41a49b9847a1d123a039c124ffc1f841ecf9855c593cab27ccf5ae
SHA512a263e2d1863c633ba6fd3bf9176457d4f0470fd5633254c9555186f0fa80c4ec1427b7a54efa8bc7fa60567fa9232f98996cc9356fcf360348af7360d73d6543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5469950ddffa3684eefd08925462a6d1c
SHA1dbe7e72a37559623357f3206bd99c4be79d55aaf
SHA2562d0f7df891fa1517134e79e853f92f308a8ac9a13b9c8fdce5174541cb51c831
SHA51208c709898f5916104ac28ed86a48089132810a19100c6fdedc0d6ac18832590927d4a8ae2a4e1d3c6c3f756dec4908e476ef1c4fa51082a5bea3174edda35c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe8921430485ccf0f8f8fcd5c1f5423
SHA170ef80b3e283fb007ed2087a08440cc4814a45d8
SHA256c565e30bef2bad600e9b685e893f21c233ef90b41355e58cf9d3bc54a8be0dc3
SHA512198a4b89aa802c26bd0d72d2287ff9140c4ac125d236ecf0e9fd1535e697d467c65c9050e5771495271a6decc011a7254a26d5b757c638390981b5d46c271b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d2d0f5a4927f08e969f7e7061d687ab
SHA1b4ba44408209cca9d2d7cd0f2a779bd3b7cf71f2
SHA2566c2928e1b44b347abce5ff12fcb2d42a5f24f0eb3b320733000d9f672a6fd2c8
SHA512682d3aff881fc42455040f40f0ab9ada4dd7a1cb4c5817a88e862cec9349840f964bac6212d2fceb7aa3975e34d92e870f5c1052323c64ff78efe9966b5826b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56720adb5181c2f2665d418bef54dd2a7
SHA1a150a2053cb105d8539bbc2e49a9f8fa6cc5fce2
SHA256722531463c26ffd351780b29284fb3a9e696296eeea364af0cc9b8a11413c962
SHA51215236d8012f0aab18e877a6697d73d0186c892f1604036819d212d60c756e739aee69bc081c5b1b12781547f95be5e04c76a9476412e09a9b4a34b4add24ba23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1400b7b70baea29727387270ed54c14
SHA119da2b119ccf96c0e3d6fb0bac7999c6bc446ae5
SHA2560e057743ec5288b0f3b4f598f06353a3ae9c5bf856182caa248dbef16e468f61
SHA51265516095a9823cb1a922bea55c517e7e8d67c1e8c66908136614983dd1a2681f9ceab0a58262b9e0479291e11807139c398eb491a195a0f89a49905e6f250cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b851cbbe9d0032bf77a3bd9ab116a65
SHA13acc9f120783ea59562cd5156f9f81055dc39df5
SHA256666d8091ba502b5bf989848bd46cf71bc334f5f1d99767b956325e990e71f3ad
SHA51202762f334d3048db313bd087a1fa059ada39dc4c9db123bb0d09e7e630982f906a73373295a8229dd17280ee3cba7487d4bf725e82aa01f30420d854d7cf2799
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529c44699d81da740b9523aba1e4b97c6
SHA1e5589e941dddc03c509c9f1d04dba60a927c8f5a
SHA256131135efd8eb8b368421f1274a858433814031630bedf2b8bd4d0d634810186d
SHA51210a529a5902e808e164e3eac451ac0349cdd03e828ce647efe29668688255be07eb516f6cf51de29443da043170dd6e78a6a976498c0e4fee1b97dbadcf35046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3be30f4c1ae8b0a8b2bc890ac417f1c
SHA19d1f52745d39a31b0013d5e06653b8b62b9419ef
SHA2561b984cd7bde4b678e64f13fbfbebe57408e511d073297fa2659da646f92518c4
SHA51286857bc142fc891e35da6ddd04ff2dc2ee7cab8c69a5f9195d7fa28a8edf43b504a5ae01410694f5ebdcd3b3d5cab0f7c1adc620447e241f615cb1507ff85f08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599497c4810ce672b73385ce3d5e5118d
SHA1074916660d2fa3d175e269662f974e4e557c11d9
SHA2567c344a2ac9a6520e1f0c3c263ed8040c0624945b00a3fd57045db6a89a6165a5
SHA512d85e8feca32495ca11815b808ec33db10250720c6ed781c2120fa51c401cdf34c75ccebfc3d162752a89f2627412150a783d878d86dae965f0452ef29c468c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c424bb58fea3ed1e1d0551da09b9b6f
SHA1a6da4c86f2c2fdf549876efdbc5b343d289a0d81
SHA2560e9cfe28474ad83d7e01afb2f8df4e508c6122e438b0f72965f50957b9234cf3
SHA51249d32845f6015a668c53a3e9c1c8b9037d7978001169d2c6df2acb4fb77d3c22b8fda3d31a32b38cd22643f2bf571d1d8df96dc28aeda93b14ac9d348a8be940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ea2d1fcd0f9d503c511e11c33f9da3
SHA190c7e6d198dfe453f7fe89773867f08d3c07b73e
SHA2561b1430aa5b1d7e6026d2e657b7ccf865a93a7ce47e685b50a07cc7234ed173ff
SHA512fc4b537cc8459724edf6ec8eb58c2127926b3df08bd627cac98bc82a7f9cb069389abd536bacdd330243a3738de03e92c9131a98936ffb85c607c3c79ff0c7b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a