Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
39def3a44559830923b6b285156eb6b9_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
39def3a44559830923b6b285156eb6b9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
39def3a44559830923b6b285156eb6b9_JaffaCakes118.html
-
Size
20KB
-
MD5
39def3a44559830923b6b285156eb6b9
-
SHA1
689f5fd483a3502596cfab2719d434a7b4e8b9bc
-
SHA256
a2e40325bbf8d46abbf942b0407b839d0ce02306d5afcf6a6ea81b9155238a32
-
SHA512
9b882e6f57b022ddb6520e92d6f24b9c9aea6ef4bc2536adf94ea2276853e7751ae38338032199357ec1386d5727b60df08b10dbf41262ba1c35202799e9958a
-
SSDEEP
384:kPMquA0hJAkk9ug6tCcOjAbKuZlMT+sgLu9HIt2ZlmbzL7qrNmZHdjB:8FubhA6dOjAbK+s+Re4qBGt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004fd33c4de119fc6e798eed47caa28b3804bda436f0fd3a9cb7a4ba7dd7e20de8000000000e8000000002000020000000e17ce9fea7a7120ff66330b0b0de40190baa21bb5eeaa69ca5bb3322142a5db890000000ad3b20a6956b554599341ee0ce4805a57b6c65a98a5b7257210ef6e9fc7bdecffe1b8c7b4af832c21b5bf7e0985bcd6bb680c160301402c93c26014b13a7d4ab0324e25fa3596c349d60cf27c3f0cbbc246e722ffc220a3de2c98248b3d28bd7c6af6870394b216a1987a825a011e2e0e063e05e3dbcf510ca4fe93ff2152f44f20969d7baf1f246bf47314b10a30e9a4000000055fb7691297a3159ba4b3c013fa8634e4b73754e3a504b24af37624b4cd7f83c9d7ddab0ebf5ccf2016c3d8cb3c765e72a8c116aefb67db265c171767b213b65 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421675260" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3A072A1-1052-11EF-B411-768C8F534424} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707b0acf5fa4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003fdf8461532b1adc390eb1541e75418864856591bcdd79a9783556cd4a6a1b33000000000e80000000020000200000004660d1b28209b0fc2ea07d75be6c86f66cd2e892c6f41bd09b004eb439d8f58920000000ef5d38abfaebc128b3334517a45ab716f2b0c7403e9f0dee49ba3ab23a2448f3400000002055d7941568041538dc1b864a207701565fffc66708c89b1ed1dd257896f50f6bd8eb0739516fc109e5ae462af20439ad465d53f4d41def9cc372aabb1db9f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39def3a44559830923b6b285156eb6b9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c9d9f9028cdc05a4c2ba1209c3706338
SHA1d3dd599bf57fdf558dffa405756142987d711bb3
SHA25604bed435910fe798bb30f4e266e5a66cc13016f46e195a8c2357319e8e1e7dc0
SHA5120ef860a12ef708a4f5fe79f1754354ded937cf5148e539e9944d3b004e00b2350e1b9593864a4908fb45a95288ad3ed85291a046dc309b4bd71dc470d4e0914d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ceb0837b4bc9960dc854a3e12cb3762
SHA1442bc9d30c398a99871711df768942ac5896bbdd
SHA2564ed8887acca59f648b94a6da57978b7cf8facd9ec390e37268accb6b8478076b
SHA512e66de89e397cdddb0693ff78948b22cc6385808e9678201d236303d6b2a5c4ec0fa966406644747cce68746940f22c1d74d50dd8ec2535e1cb815e5ba68c450b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cbc8a64a209910a404d27a7c0926a85a
SHA105f61a9dbf91c7252eec76862c06396cbf7191ac
SHA2566651bf6fc8229dc9ab9396d03919c9b0002cf2d3615a1195c52e3b087458baba
SHA512900c858b40e33718556670e82dd2cfff43afc5d4fc5bfae9a58edece96b5fddffd2ca991ed6a768f60b124976772c0c25104ddaf3df95657bccf13b268292f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5efb3a7f4b3d8ed958712ccff5f64b3b1
SHA1b62475d921725ecc596fceceb3d6daeb688e1233
SHA256d178c1b6a8c09782644f086c7a16a11538267cb1742e006e077b89be86cce00d
SHA5126fb6f1a76189e4e410fda9ef62f009c6659f13c341dc1213d65882b3d8505e0e6f37ef724470c99344a47454fa4d12260829b06288b2d849cd7fe1d52b9f654f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ed2086b47a491dc39403b67cd132d81f
SHA1979df88ddb873bf56e4b476202e4cf35187cb8de
SHA25682d50d9186d5d35c4d1cb5e316403df240aaceb77c1872d1ee00c7056b961652
SHA512138542a8fdcda506e5ec0a56ed769a7b2f6f007b56522b1e720ee338283be495af6dc21e84a851b25f6a9d07d80e0e9094db4286be8f8c651cccf1df08da3ecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57059b1467f5778e9b5c5f8fb2b1eade3
SHA1beef76b28a96a63e19891d81a512c8e3be84a4f8
SHA25687337bccfd36f41ce5a4add6f9a5fd62718246728f066309c45632d33ef7ad66
SHA512ed82d6f081e73bd2069ed6819428d6fd6690505a885b70fbd0fb835edcac2e05acc4f05ae4cddbe0484dbdd7117ea9d69c869cc8f301c6fb61d24ef04cd911a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD551e66dd6fbff585b99acea49f641d247
SHA1c2d42c745f95ac25645a9eb54cad94b9b8e70c2d
SHA25691de11247d0b2fe5970f54069a6590ce689846ea04048cddcdd7c16be9a0cc2e
SHA51267a0827aec37fd4d506ce01c03b93a12df8af70380c45eaf08aebe8463953ad64cc28f872c0056fd83a8fa810b26dae496175f550c38e71689719c74deb8ff03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c77beb4a76c60cb041892a8e45afce1b
SHA1a71fc4b05b1b6720340e008ac062e9dfac848d33
SHA256ae72b6e25740c81268a7faf5847cfff3715d774046c8c0c75c0e163da8074202
SHA5121e38e8fb6cc7348ca16bafc0a694fcb04af874b61cc145a828316202233266d7822dea9d67d1904154b758e348aeed73d9d7dcd2cef6694e3f6d902b2a2be294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ffbbb4d5a96fd716de58f3fc79e8ddd3
SHA12b5785b8ab4a0e9fdb6c900f11e2a4886995b0df
SHA256463f5d089a4bff1a949989c0b94dc559e4807272437572be959c1598c18d9d30
SHA512d9f940c4991141c2be382d9950129e2fab0c3211f0b1a0585e4301b300218f06713ac68ebc9ff260a58d5317d494d51bad9dcd124a9811c633a7387bc3eb153d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD507b2f7150de24ca462ab3b97b6fe1c3d
SHA13434e59bc55697cddf6d5b93e26bbcf99be08484
SHA2564c9f8c2ef23e401109d491aae8ec9b846d50d05ad03baddf33e81cbee7f1d044
SHA51220ffecc04a88a38120eda588f332d2c64240494b9d0207dfee16960987cb3952b119e9540045fe7a1d71a4dcbe0c143ea52a18a2ca9211ddc34f5a284eb6da29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50330cbfadbffd723e54b3bc31349232d
SHA120bd7fd3ec6fee8c9bdb65b64f864ef019de8b0c
SHA25615fba7dddc937070b2ec9005ae9d53bd4226c54567e913c80c0a9bc958d2b454
SHA512cf621e54dfd073479f71794d92061f9ca94d779606a9983c419251f669d20a1f613d995ecdede1c51cfebb36deec1312eb4cbdb3d1cdc8f81882a80a70f57ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ccbbd8b0e7b4b3f35e55cc12b1a5c99d
SHA1de9534d4aeaa97782e70b7fd00fb134007c18dfd
SHA256066e2b1115054f236605c6ea1599d6f7d25b7960a13907328973642a95afad43
SHA512416af0352eebb24a469f4ed58ce63ce5d007655aec8d825d614797097620b75584300da89758016156f7d122e0d1556c22b5ddd3c93058198ef453f921282fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57d4501a2e3d58224d9f01aca79f25a23
SHA1307b9c021a8b9e1dd1e5855ddded47549bda2dcc
SHA2562d73299ca6c5d121a5c7cdb4427ac5260b9a2d2204c76feeecdb69b7daab42b6
SHA5129cc44bbae72667f704f31674ae96cff6f8186b0d171e6669ec15984351bc556ed950f3603e5358c2adc92d9404aa730e85cf722b03b25c9bbe8a7b74f625e3b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e6543f94c1ffc82680487eb0d16b7f4d
SHA1e3f46483ccfba3da686e54a66a8ac859f8436653
SHA25622330bf108a1d5e8566c872466b052fd243a871662f184d910e8c366a645cc8b
SHA5128bb5edcc4f88b829d2051a03ef0df4413cc44641aa4dca536a7b87696c840e26b5727f5552db27dc67dcb56eb6b7c6d6a95a8f63c9d5525897085c660ecebf90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59d0d13fb74164d9026f08b23eb2f8efb
SHA15665512054a8f8713eb3f1447673e5ed313d732a
SHA25659c0668700ce8b5db7db2caba8f79661c34fa48741706689fd1c68ff1c16dec1
SHA512dea90ee87d15847dc235788d645868e238e63f9bde365507ad9fbeb296bdaf991362a02ac1f0c128560899be4a79d80bf66eab33988cb885c942173361252841
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c900344030dcc3cbda130686da6c7623
SHA1528d670e829d5480def1db9388ca1026ecb4fa8e
SHA256600d5b753c2a2f64fae5fb23bec332838b991fae05ff262f740c65ebda51ec20
SHA512f472d69b240a35070993b29b87bc7ccb666c2e0cca2f9db1b07a0205ebd0b731d49c1297c4080e2e74e2c42393f63a51287a8cb6b260eecc667c74b1e6a2292d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56efc43e9e5b98f3eb0b5a8df4fcde04d
SHA1bea98b3f0766460ce54643645aceae63dd84986f
SHA256bd0f64466964d1a1dceee6a3666f61c40b2d055055c3c959784ac0f4d0fda738
SHA512a7c52fc4872742e11555d02b347f5ee239d190f35224c5bb37671e0d9113953dc0fd9bb0e08133a334bc4c371c360f7f01c47cfaef1b73a009fc5539fa62dda5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53f187da70c87a4e349fb425245cef9d4
SHA1d620a5e64584128d6e9633ea5e7589c8cd707e51
SHA2560ed055a8ee95d66ec2ff73e762a861eb175474122cd5cb03398fba6b2dc93855
SHA512452923cfa7a43f5b4017649e6a4b9b5030979f735a4d5063479f18938e9f60428c70c70b56cfecbd4aa1937040e0b8a899ddf5194c81841f207da0fd6a402f15
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a