Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
3ad2fa4d4ec8a26f9857a42ba0f2c8ba_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3ad2fa4d4ec8a26f9857a42ba0f2c8ba_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3ad2fa4d4ec8a26f9857a42ba0f2c8ba_JaffaCakes118.html
-
Size
254B
-
MD5
3ad2fa4d4ec8a26f9857a42ba0f2c8ba
-
SHA1
204f58f30255394c10c2e6584a0f32b535954732
-
SHA256
c98a597d7601dc885b4b6ac4495a47ae9991572ab480366591eb52a44781b872
-
SHA512
823f63e741b5c68f7b38c695ede034063d11cdb1882fd0cb0b69108de3f4d00841e10f3e34ce83a68969dfbc7084ca9bce141427a8935cf7120b573f671c7d8e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000025ed7dd7e156e3a7216686daabb7c4876ffc43dd8ff85d2759df4b1cf917808b000000000e8000000002000020000000c62b0011adfe61a50feb92f617867deaaf56396acb287f32a4b35b9b5b977c5590000000694e116c1515897f4d0d9265d7b9d3c71bf93dd827d6d78828a676f86160e3eae0dc3556a6343537f5e77fdbd63dc0d8a1d4e41dce621f356e21b742ff7c16613a2d4bf02e13e793cee51bee1cbe252950786ee2767407af48b8f0d0cd5390c3fc0b439e13d3200296641c0ec36caf10d31823b27ab1096529a481d41f36eac08c992f5e18f5fac26452948919b0eda2400000000d4b1862e4665ca1bce2698481168f189aa046a052be0bf3cc806172c36b4b9a7191ec9a2a5fe6700085a6484b190af6240e2628f0ca69c98da3a378d56ab64d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421689806" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D07574C1-1074-11EF-A1FB-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806883a581a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e80eda8d73cfda70d8dc5c7d2caf0192bc610f2fabea779404cbabff845108ac000000000e8000000002000020000000d7646f62c4fd3f053a6a13f2a140ac46fd60580b1eb6a6b49f2b769042ba53f9200000009747e3e167de232dc9b26de519ff4374f6fc68ba55b5524b422a85b9b70890e940000000a40b8a4112d8e5bc7f6a563c99f21af35b5d0dced744695496bc96d8f69a611b695e4b380823df19e580d3387b1b7b9fd0475b6067edb45e5fe5ec8f39f99b42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2744 iexplore.exe 2744 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2744 wrote to memory of 3016 2744 iexplore.exe 28 PID 2744 wrote to memory of 3016 2744 iexplore.exe 28 PID 2744 wrote to memory of 3016 2744 iexplore.exe 28 PID 2744 wrote to memory of 3016 2744 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ad2fa4d4ec8a26f9857a42ba0f2c8ba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0f07d9b2eb00f5ff61ec3e3c6339b24
SHA13a9cb26728887748c5515b3cf477415408071e03
SHA256ace26a9ca5999ccb29f4a70efeed1efff24eb747e09a3c1ab4f996aee6f0c676
SHA51272f72c5e6c298297af69c0513f46f8b249a3376848ff28728f88f693ccbafb0ab0044c391203197beaa2f8e98f7aecc4793f4550776d6a3ddbad5c889723b239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a09019c029409e2e174152a67d5d35b3
SHA1ea320f9f09c3d7a65490f34b840aba162a78a9a3
SHA2564d99b2f8bf7ec4dbae39ea4304082d483c5541f6975b21e333fcf68e0e381c04
SHA512813070dae315a6559c5555c49726747235fde62a33f0dffd244973218bdf42eac9f7abde245e6b89b7fb13c8320e2693f7aaf1e9db7b6aab13f630fd04a1f618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7d0178743c08ee8a8055b96f18433b6
SHA1305b25b540bc92dbc0a7aa708de77729053ce134
SHA256914b3f33a62a116e4dd54ca8aec1344295418c6118a3b271f620a1a31330424e
SHA5123a1dc96d5cb9855ab5cdb6cb7504112435c1a74d74e6aafe64e2965c75a18e2ef82d2f8d3c88c10c55c6f0f1265c91729b5d66d435c9eb1a613e129282b15dae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d63c4a478f1b71cdb03aae32b8fe41bb
SHA17729b828c366856774228e309bbcb50cc4255c14
SHA25674aeac08eb593d945e2916478216352c7b90b84e3532f3b283342a04ef862aca
SHA5122ac99a275a7d908998ba77314180d2702676b5b5572395f1bfc7469ab973808af8082de0456c32c5341d6d315b8f7f3534ebb6001756a180a17ff261d5354a5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da7b17723ba27edeb4e5b6f65af47b68
SHA13fe2ec9981df3fb871341141230e615f94abe2a0
SHA256dd41aa727a975694f10e13969be0383372d49811c54114dd2d308e96e3c1caea
SHA5129f4041a637ade0146521a07716f7c2b4f2644be7e56364924e48cb0add3e9d77e8477acd4d32a8f07eff3b7cf0741dd2b3f871932c6aa9bfed22a8a62d24438c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501eb51aa95a8ad8c7186188bbf9c89f4
SHA1796bcc5d1c9f7584f50908db38bfe9c81e22430a
SHA2562cbd6c4595906cd47c027a74d40675959c628e071e336400b053d125ace46a80
SHA512deb1fd66a9ef75456cd541900fbae9e769ca94c5564beae8482c202f981582d532575f6d2e9c749275d7c76598d9c2ebbe893dbfc98967b85b5937365d0ad3ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2773bd0e9fac618ee6910cc67ab455c
SHA1ed7317766653021ae77582e86eeecae00b0b37e5
SHA2564eb9b665a9d4d2cbcbdb8d73465865a4dc6de14ae46a5a34f93a80465cd33e08
SHA51247ceab90a6721cfdd34324cd8580014d0ada2bdadbffbd4f4754f63d99a16617bdf94cbb343d7c9facc46a488fbaef1fae4ed567d3767ba51da0207e4d1d50db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed030c53cdf503da8881e2ada3955793
SHA16d39c6fba9c2d2b813568977b21435f259fac6a7
SHA256cb50f04d14af3a28bc1303dfce2cfec29c55ea8fc8dca41faecc754204584758
SHA512799f19a7522c9a7091d317e6930361b4839e8d8df9e174eb6fe5decba8919008d46bff02f03135e2b339e68001572858f0e27112725a66e75eb8db72e261fad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2d5176e708f59f9a5b74ebd1ab62aea
SHA1fbf2ad8e7453d3f4e9f21b09d619c9c097976ad1
SHA25624e593ec5f750044261e80c65b08b6df489e3cadd536ae751eb53db7befa6288
SHA512509fe934d5272ba9af6cf83cfd1718098932be07044eb66322dbaf94636964909322fdd2d6789e8d5df3a6ebeb2beddc7745c9b08f9007aba3d317214c2e4cea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8db924989c65ce1603df64d136953d2
SHA1f5b3cafd2207ac92e6c5e3b8bf1458c28dadf23f
SHA256574e5e7158d0e4924df55cb71c73b5f719f84b37b31a4056930a24001e078727
SHA5128955601b56dc5da2b43a6f69ef37f72fea83f045764564a73f3a084a31e735cd4c8adc3dd21afde63068a705406bebcfc1ba045177a3583ca5534d09b1c47976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5521d5b1db3579e1f5b3a6f7a5cf77822
SHA154ad8c046bda0351a171f78d16ecd505f3bbb866
SHA2563c16ddedcedb9c346610592958f6406308f9b57b8cad562b57988ac830ecd2e0
SHA512d81051ee0e8dbcd2fca3fdffa5e374155c0cd9b646fd84309a575ddfe30f46d8eefbe466a5b23eaf2a1c3b3922edc873319c1bdffd6b08e05e6af876ba2ef383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be64aa54f6e78d27214e0cdf08302d59
SHA1a58b38bdfc2d642247787c8c2259a3b88ce9ac12
SHA256c7031deca979439c7a73a0303179e134b2ca1c2f628c68e141f9259cfc3d5454
SHA512be0e183a14e6d49e56cc9082233ef1d351804631db7661897f4482739dfa57273ab49e6a32d5ea90c26b99dc1092b1ee9f1265d0a0e6fe2d8721ac4f9b9c85c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c727b590ca7782c622f36d3532e4b2ac
SHA154c6e4f2e046a507763210ac1749f62dac0a9650
SHA2562977568636a2886e78d572cb0bd5758f25e3ce523c8fa2fb663f71bf324f6c1b
SHA5127e97115a14da24a7e2b67ce7a1c20810e6a4076673a0aa087b03033cde7251d1363ada951d6e216ae99260484db1cada22e19a7b73bdc12d9adba1892d06190f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52361e252b914472671d0eb1c9822079b
SHA111b8b17d32bd883ff74648444dfba15f21026e8e
SHA25652817c5d394b37fe5b415591db34feaf7af5a2c5332728a33f4a924e68b79d6d
SHA512e41a380f3e25a91b71526ba7fadcb7fe616ca5fe150c3d6d2763fd2dae4b3bc2a5ac153007c06eeb06e5139242569356689946a8abde876f10ad1faac7f799b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e51e182f813c8e5a9c26b99c1a634b9b
SHA13799774bf0a781b27aff5b8b4da820c19f67359d
SHA256e66fad8ea1674793fa4cd00412d4f8941d7dba6b6e0c8b857ba9693a130f174a
SHA512c44bce69545f0ff6ecbc634b54f24c462c853f539950d85e2fbab2a73e111ba450f29a8fcba7c63c0a1e216ac5d4607714bb66d8bde0d175a2fa81125c40e129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5552e40fb8afeb0c9d4bad000e3e27321
SHA1ce01e8f821e0c6f4069a31d5e021f6d5d2e127c1
SHA256f98c407e51016d8e980dc765c66f7ff8f304702832075dcd83d9b01b5ba9974c
SHA5128de3dceebd7ea9f1ffc0381bf7e52c88289bd726524e83e19001c85676ce9b6533a259f2ad7b61120fea3f5a299cec950c6a6a56929996c520a9e89baaa19ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512fa42d1d0a9cb33c3a45fedbe623db7
SHA179caa2908dc8b9ce0971bf67c01362328e50a503
SHA25625a9416b135b526c42ca8bfccc8b78ffa4ab15aff91068453f8a7d5f4bdd0f97
SHA5120c63f105c1bd59120fb3125275bdcf777eafa3f93382720a8029f501a8946a908a6d9b19be8b8987b6895f1276d5e5158412a3e563b9d9e477c0a542b89291c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbac3406e192ea115640d00c37b21025
SHA1ff1163960feb5c1daaebabe7e11ad60fad3a23b1
SHA256a4c1b69198154b172a66811cfe251e0ca66ea7036d5c45d8aa21e9951f24deb5
SHA512cfc29eedc640fc9f6215a2503cf6a52af7c1fc99ae0efd40acc1e7981fbee22e4d1a3b1a93217b759cad4e1e5609c373d6047b6578bc4645c3b1160dfeb79a93
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a