Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
35719c84d772650003468993f930384d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
35719c84d772650003468993f930384d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
35719c84d772650003468993f930384d_JaffaCakes118.html
-
Size
91KB
-
MD5
35719c84d772650003468993f930384d
-
SHA1
d61d3f6714a75248b6cba8435bf2f5abb696c700
-
SHA256
3fd11bf270801acc99f48c84a87b075fb381030dc405f1ac843f0de20bdf6e23
-
SHA512
021f533f7c2614aa88263c441579eb7c259b6e1024589d7a946403d48920e7267fbd6c5add1bbee97f3c5ac9542363f972ff10be5000ae611e72db0ac420e4a0
-
SSDEEP
1536:3eTQVKfMf4JdfoGzcjiQc5SGOSimKrpAbeN0SehKIEMf55wMfcK66F8O3dpVKe8D:uMohxYjK53ObmKe66SlsR5NYetpZuJKm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000bb9a314639ca29276cf4ace4e25bac6b5b8d48ab17247e5846ce24d440db22d000000000e80000000020000200000006389e827acd0e5720eb60f14562d377ac91daf7e5b84ce8334e7c86b868b4bba90000000ff4e0cb9b2613098dd5d735393114d76ee740d1784e2ab7ca15727dc48d387a09060a87f2e1115c003d4c4296457572a4a392b49e4cbd8aa88141bb8b0d95736451607abf78798ab091cf29e29a99bb1ef606a99c19477abb37bc9aa00fae93da5e31d3a86198964cf945e9b4df47d7c61d113b111d34791ecfd233fed6c41591a75d0077ab3323f29c0d53466505d6840000000919e12b77c8fc2023e9a4667bf8cdb9876b9fc9d894cb4cdfd009c12e013ef1e1b2457d0fa8775aa3e155983b1ed870a7d0813608677ad9eeab4bec81f2e7ac2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421605922" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009a1c6b9f3b6b7f86d025d2569e153ad832d7be7cf2e40403e339bbbf1a6b87fc000000000e800000000200002000000093d9fa0ab690bf26b2b5b3c8147d1dd317ae86e1c71efe6ce409c898a3b120fe20000000e1f37d45d5046d679e436778f929456fdd2586b4308553b47c03d119d4a2218b40000000739e05e08d34cd9c69189e4b1592024061ce2e365d4623209ef95285862b17f22da74552f20f8151ff29c08300185ecec78caeaefc097f196631d568b2c144cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83082D91-0FB1-11EF-AB01-4E87F544447C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7084d457bea3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1484 iexplore.exe 1484 iexplore.exe 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1484 wrote to memory of 844 1484 iexplore.exe 28 PID 1484 wrote to memory of 844 1484 iexplore.exe 28 PID 1484 wrote to memory of 844 1484 iexplore.exe 28 PID 1484 wrote to memory of 844 1484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35719c84d772650003468993f930384d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3ad4b4a9e6041e45eaaf3fc6a223da5
SHA1926ef3357d52071979e8572a399f2591f3ae822d
SHA256ca5d7958a173bb0dddd0ed369534132369230794a1ab1e0c3f6cac4777ff3e43
SHA51260179682ccb3dde6842e63ad3be300933e9f6bc8d23d63d6214bb17cbe998d2897d57e070082fe200cdd35844b3d802a2733bd4b10d2f448776fd8e869703dbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8c8ea6801dea76b032ad950f06fbfed
SHA15e8ec75f9d13aa2a055f5bbdde9bed3753cd6f9d
SHA2566ff20efb1ad3f4631330806205691dff426b4bb57c0b48e0c4b274193ecd80d5
SHA51221118c2f8d6c0b3d8b6ef338f2d235d34becfa16ba8b9228c4267cefa2a127e5d0cbf4b2f62194f9778198d94f32437f424365c88c04fd496c81c19e964a32de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef19188aa58b436248e27e4a7a8b2abd
SHA19cca8ea189c88a8e23bb5ad25b39ca4e3d015054
SHA256b315e6ddbc61f501b9581a7c32ca2867fcd0c77750fcd98ed191c04041452ad3
SHA512bfa9a3320a2bae879ef779ff75ffd5188176052187f74242aff972fec1c949d0d6701580e07c34ded05b809c632e5cd903d0d30448980704a1d41d6a438192af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582c4c39074c8afc9dfda7ad34dbe57da
SHA18724b7b03afdb284b0c3458101de633935a51334
SHA2563324ca3acaa7e91a9a961874a1362a91fa5d21676556b4414a9aa58920b170fd
SHA51295afb9ff5f21641cb3d6afd55f828f8bc77f8fc51f40174608d831f823507b6154ef7fd8cbf4dc766ea454c17e0e242293af9535f1f9c52d6d9d230bf5c7cf92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4a706c3b75a14e66ea768dab1e83687
SHA185a913a05a0f176369b365f1853556be22f55a6d
SHA2560d890e999bb5a0d4529d30472e57d4db1f7944b9bc11303d771ba7b9c7e06004
SHA512d54c0d8af08194cba7e528ec38d516a43e26c6421c338e638ad7a8972acf0a1e61f4e4d75ce48df44be9319cf68b79b731a38599ba91642bb30914d4109b2f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57362886aef6add4de1d383e47ab21740
SHA194d6e9d20ffe40bebf3327cd21d9f028a2614ce5
SHA25684efe0dbf88bf1cd54c41030528569b54b3454573354e96d017a6c84bb3c98fe
SHA5124b287d7c53bddba8f1cf333d0d5f2f29bc9f586e726b64e244ff9f0802e6f18a173a54ae3898f4cab8a7a8c7ea22086ece7f0b0d15c74228dce3509a4674a0e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5238926e2b55aab449b4c4863fc9f3b2f
SHA1826c30f16aed56e8b18e3397e0a4b2223bc3baef
SHA25663243ad9b08b04136c5108e5ebdb665e01d9a9507754c4d49b78b41220be5671
SHA512e653f9ba36010f72dd76592c8c920b6adaab7f9659074739b9e0669d69becc964268380ab991a4e321e73b72ceae02e4cf1ea70ea19fe22946b13d8eda71bced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0ba8b2dde50a2dd17a517dbef552ea3
SHA14eadbdfb9bd4c2d288096f39cd0c5313622fc4b2
SHA25666169b5e58dae0c777a930e88caaa43625f0fb9edbf4e4519e9c427e0b200540
SHA5123f88c348a9ebfc3f527d5526d585d8c66a04e885784efb495eb2f8537c92369a9c2e913bc57e8cc32b03cddfdcf53878b31b9e5de3d6483dc96d929a244efd88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57376dfe15f0209b34b3770de2858416e
SHA1721e984f2f7a75977e34837c25bc7a493b7ae088
SHA2562c9dddb559445cf73286cf46d057a08a9309df8bc0966daa7a5258354b850151
SHA512ea408cbc955bc68a855d11ea3523d5bbb233194db6c103bceca1485fa51c4757225cebd1630eaefdadfffd11b4727daaf55aa0d0d23897df5419883040a454cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e900b4816e8d6a25e3e30c358a316b1b
SHA1176ebac8fa97eaae45229c13119b2deb1564241b
SHA25608526b00fe9508530fa626e6a7c57d43288a25a0c5b5c49010a8c33c59cdd47d
SHA51232c3fe529f70309e796e160cdb21258bde3fcfaeb542750d9c1af0fe9e36120d506ecbe3f53937388689070f4f5f48e8e60c395be24dd75360524aafdd4b1a4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0d0a9a1a012b042f7d7ddf8dcc475ff
SHA1ba9088dd0d81706144875165c38df4d07f92fa00
SHA25604b12acf5f1b6e96d2b167b78e4c8e31cc61a32ee21e373f3091e09de9aecdf9
SHA512160b29e46168f0a36f311480b31d6ebc2e03c5e244cd7f13894a5669feee2b4d88a48c46117a4a7bf3b77b39fd00dfbdd34a3347bf17de3e87eb90d77ac1fcc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56da47ee237fdc3d079f5ee29a708df6d
SHA133b7ae88f7949cda4db581da51a9e66a01c9cccc
SHA25649b31144dbbdba0007cc5c4227d14b1196cc857eb421a2ae00391370d06182eb
SHA51236312c1bb36142d0150925073ea5b041fadcc71bf5fe40cfdc7995938c5b4d0e31ccba10a8cf834128898bd13df42f772c6ac408604bcfe5f3edf0afdbf8e884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51da498d00d5f52ee9e92065661a4f938
SHA17bdce686bdfcbecfdd19a13036b3b7578d5a6633
SHA2569f74ee1d34fc4461efe2877c866c6d1460afa7e41dca55507b699003c134ec0d
SHA5129358afc47d557c8093ad94ef525b21cd128889b95e9ee7f62e44ed98eeeefd5e9e603a26b67bf8cef6790b0b0bcf6fe3989b1b27891d4271cc4f77f411ba44d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb23336cdfccdbbbdf1c2852f1c23c36
SHA16ac33ad289d46ba09ca68dc5ccbea79a2bc18190
SHA2565139d57db5d04d1e835c303712ca751bd4adaa28677a3d1899da77d64c1a2f83
SHA51287481bc376661588d4be5e7e6011b18727803a8917ee06f53a1861fb2ae9c1d92e897c4a00682b8df7d02aba8560816ee54471ee3e05ca116f2932ab740b3d13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522134744209be3a3d5c041c3fd7750a5
SHA11af1295b9e7e17ee5a25af82ac6c697326b01dbc
SHA256388a4177b6c6d8d149aa5c1c739a7022f55c7f08aacc2ff0f787a20ca6b241b1
SHA512c9ed887d9a41e45771ca5005bd5b52448256c08c046fd7befe78a29e51f8c8ce97499076624ab0aff9b424404b2355eceb4f7d5007197e01e797ee8a76bac44b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572332045ded6c18ed00648438666fa9a
SHA1ebce061bbc3369a723026bbe8626dd6fff911e4f
SHA2565b74919383a8c1580b44b757b131575c47440d301e28b6ab1ed3be289b6aed96
SHA5124bacbc27e1ff0060286b9e4534dbca20b8842312aa8465cb8bc359b2a5fbd916dcd2003bb3ba825c625c559659fa7d1b23da168ae9eb8689345c10783160f80d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa3a8b2d239f800cc0f116a582b8841e
SHA1f337886c6dcda337d08c6a56199bd7587617a3ac
SHA25650f51ed6df880caab1bcd2f27b098f51b72f629595ec9bcd99a5145aad4be0d4
SHA512dcb9b49d0e533f68a8c8f6498e3bf011ab9f0a3cd2ba5135be613da77a50d57671c39b89020a19d9854603b1813d3fa8c3ba99715bef3e5a079c0750c9220cc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5280a6c9337ed209b993b40da5d3b1f46
SHA19576b9ab656cb6760b60ea5b7df2459c0ff6d331
SHA25694f1d578cff7e294e1c57a979212f552d2f5b80340bed1fcf56bbc43f2dbd3b0
SHA5128c624ea129d82870c57cbb6bf0306db34fdb833f9329059f22ff46641f217945e5bad843f5ef6314de9f410a6e9ba0f4c6f184cc3896590757246135b9128e93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae93e70e5ad73bb9082697ead4c5f6c1
SHA1ce5499e039ce30a673580495275bd46d6a15719c
SHA2563f3875a67c02e3aec83ee2cffd556e6ed0d321c986d53da2d70c8256e5f167a2
SHA512aa382e6e9a43752f7c8384c98daf1efadf4fa850e409212ac3c8725aa92b955cbbb7d2f169300df5ff3516ad404ddc1219701632abf8e645c04451ea290ecc86
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a