Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
3af26364f090066c5c2f74f94721538f_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3af26364f090066c5c2f74f94721538f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3af26364f090066c5c2f74f94721538f_JaffaCakes118.html
-
Size
9KB
-
MD5
3af26364f090066c5c2f74f94721538f
-
SHA1
64db7f367192a5c1a376a5b364b5960ce467a8db
-
SHA256
7d492bf3a0aaf420ef39591b183f58b3b472485a823ffb38aba54b53e8b2bfb3
-
SHA512
3149837821d799a31e2a2007846ebcd3b081463cd9b88e6bfcb851f1179fe4e49af88f9d3839129d0fbbce34d64c8037afae5c9276d929431a3de60f7fcb3ab0
-
SSDEEP
192:aHst3Oefcfdma1C+cFL397NdcAGRoOQiP8G:3fclma1ChFL397TcAmoOnh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421691739" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a9892686a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51F13C11-1079-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000017c8f5fbe2e6e6b39aed4f73b0db07b3bc5991f625294190248374dae6a91e15000000000e80000000020000200000000aa72fbc3f0771e12bf6f1e26e2e95a3e6578e0457e54dc1631b77a575ab2e0e90000000c0630f28b6191637cc65ce15b21e62b42538f825b979306735fa62e2cc757f96d99d79ebfa82913b996e0af89bd8d6aaa6c8fb717f1887f46ff9dc8b7b2b4a9542bbdab103f22c359c51733de923437bc3d000d24112b0f8ec9926e8d91eecf5b31a64c498960276feef3bbd8316bb1c9af40d3067115dd9c62771097c168b121ac03f5c16b84d68379745c3b2c0b3c54000000038c337a53b79d710364892da4965f3ceeba56d2238ab4945bd9721908f0c7d7ebf27b428c2fc2771b80c984663555ec719be7e2e004e730beda91c80ce40c9f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009f1c7310553a7b8fb56dbfe44cbad5e4bb0da715bf26c49d7bc74c2fce4af95b000000000e80000000020000200000009db14cd8cfa1cdf2cc6ada2f30342cc9da1b1cb40389a4bef904d3916a183ac220000000164e9252489d6ad3f79cfeef7e1e9ebb865a18f17fe602ef914009f6626ff46940000000378947799cf0e8fe05a8865c450b289baaee32c002d3bd9aa033d757013bced17e2156b6ac1a64ba8c1d19bb2624394b7395a3f8349cea7af7e1893b26b80f7f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2420 iexplore.exe 2420 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2444 2420 iexplore.exe 28 PID 2420 wrote to memory of 2444 2420 iexplore.exe 28 PID 2420 wrote to memory of 2444 2420 iexplore.exe 28 PID 2420 wrote to memory of 2444 2420 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3af26364f090066c5c2f74f94721538f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dc92ddd1063900aff3c2d9b3a5b0933
SHA11487a34857c821b7cbed1e0658440d12de706115
SHA2569c21784859bef8e268f8de8b01cecc1122bf924580c429d6371c5b59de4e3e20
SHA512a69b65b013ec6146323fbb2171821e042660128b234993729223da7ae89a6b8f619c7b37f91829df8dcd519caa3e2bab9591099e97b0319bd748bcdd69531a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565fa88715e34576c5ca8a0376b9dcc37
SHA1ae454efe94d7dbb298466fa82143d433770548fd
SHA2566abb156bc5d311e3474e666c03beaf552c6a169929a4e4c6846e128c60c6948f
SHA512334d8c0cea5a346e7928d6941ea6eb3afe5f72228791ae1683a5bb3a5692598348f9e5deb8dd3cc92ef8384f022f17c283127ee8061a30239f36039ac1a373d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b120db476951bfc8cffff82047959f8
SHA165f049654143e58625bb1d44849340c7c47ceb16
SHA256035c4116bb82e172a4594e145f95fdcbcb83d564ba47c0cf183add9324834c38
SHA512aeb7ff707930466f02d149685a6432a51e61ad8c592999563ba2d4c5073404f360a0c7d1edb67256c0565ac0d68a5ee6e37474fcf7e9eb43096ff0fec5e92879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ecb6a423f5e6bf480e81e0fbb0ae667
SHA15d4c17efe5297c5ad65e85aed7723dc13e0753ab
SHA256bfe81cd3b5023e9a00382c306f1f5b47586fad22a502da9461a18f4cc3e94760
SHA5122f36fbdbfe9f652a8313a057cd12701705ed3941946100f857185e9a6d8b8297c8a1be674d8677e6666b3e36140f99a93844d1c7048c908b23480f739ba07f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a05bd381419dd2de12873907d16ab305
SHA193ad367fbc2176ce528e8fd0f97487199c056a37
SHA25672ac947c38f360e4966f54c5e40189147cbbc92eb28ae11e42800dce4b5236dd
SHA512e1f5f8a2dca5304802e158a4c1f8a8eb5096b92576399b5f1c876cd4fe119658d60eea325a17320967c81b37d888c1637dc05408ada3b6b676428fe2bbe0e004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe66398f4a40a72ce893a51c33405584
SHA1f8f6135614379a9f2881758d7ec5e4ee300e991c
SHA256c02cbd665696dc10d898c2e3b9b67b15d15924fa83e6dd68f7d8eedd2fd1d8cb
SHA51291c94d56b70b74eaf80dd4104b761087ccedf56fb33ab5ed170d59dfeea70bf1b94929c6179846690a4a7ce404da958e7e6a8ed63c255ac6ad17f8697593cb86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564574885974792eb535302cc001dab17
SHA1316eb8008a3d5829489b543ed86cf856389e4f44
SHA2562749682058657b1bd802e0e31fcca6ab4ab01759b4bbf9c07edaf5bce862700c
SHA5127b3d58c9ddb3441656fb1322191432c4926c53aa70fd0f4338a4a5b27bdfdff565c959fbc1baca0b96b7198e61dc1d3f71c756f53f19e54c9e118d2acbac8bba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac5eb49644c6eaaeec93e72765e9298b
SHA1f56428f773b484314992b5fa83ec34f8547c7c78
SHA256d89210c32a527fb9ac43acd2a21be54cd6fa29ca575c489efe6e4cbd7df6ba64
SHA512885f7b3b1571466d4f9a3e556c49fe74609c60bde61f4e298c662ac0c3b696ab38ef6af6be56c68fb213fae95cf4c157a5fff1b2057234c10e8d5272287f040b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6a7baaa62ddd68e30f629be9b5a297
SHA1afb3922c8194d9895bfe13ab9011be53319f2d20
SHA256ad0c708088917723acc6f67ffce4ba49122ae50f768d2428d564e63ea81a5c5a
SHA5127a0cf98e5ab938689af37f369eaf6be48cdf903cb2ed7a13e56bff4e95620991e1bd95784a7a7327edec500623ae486451c9711ea6d84a28f7f480cbf7275b50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4bebfd67620ddb12548211b0a651d53
SHA1c16499717146319778b2ec8e63d155428b70ec9e
SHA256bff65d2ec76fcb6f4377e14d0410a6fa097d12b4f8f0e39750b827b02b19f471
SHA51292430ce9122702cd6977f666608650cb51bd978f2d908f9ee5b5e67667e46a002fbed197ec2f37363de2d0b4180924533b77136449c8ad277144a2e48bcd6b36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57601f8acaa13760edaa4e13d8eb9da84
SHA1b49cc6970724ba04116f363d38d9bef32f515718
SHA2568fe78b32d419ee25420ea8c9729d04ecd374f776bf7c5d3260206f3b33a9c2ea
SHA51222b1b605e64c55c236bb76c4507c9e453c0206b0a8d7b11f688fc90db8a711ba5aa5a5865ab886cba1cf99cb0fe503d87b22fa5014ca1c772f6118fe79d4ce64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f2894c55493e0be32b8a3dd46180c9b
SHA115c2c6d9998bea2237fbef12157e4e3e1ca25e8b
SHA256f4fcf1b2c58c0eebc70c41f5fc244f29b9aa7d053ad58711e1d3ec78802a3ea0
SHA5125e9c52111feea74df7cf899dc793026d2a56406c96de91ee52e76ccf68236ceb28f94afd53f5372e56d8d07749382ede721de7d8555774e134cb2aaebe333055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52033b34cd2d9ddd1f1099bb709b878e3
SHA156e46a501f31eb8f17bb3175376a2f18e5babf88
SHA256b4052fcd07d698c00d75b86e76cfbf2dfeae8cd6d35f9cfae6ad6505e5f36daa
SHA5120a95a1d37372289f9d63247a200e5a529615b7999bb8e1823931ec274cb23ff4ea989c3646c3be48d235376cceeb3179e42e49e7b343b5573924e66f782f9587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fefcb14d1e97c208aad134fd9a78298f
SHA1cc89168a6aa6ccc2e9d67317893556d3b4a5862c
SHA256b0a3cb45c3b76d0ed150959840aa6c0225656d6b685da0cfd7c2d11664d0bb62
SHA51287db5367b8066596d6e210b7581df9be86ab9879c09ba8b016a02f34aaec9fd2c28ca6149eb8a00b92eb37a66e40dbcac3791ed3b61ae3699c3b306614c7b50b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b8adb24bb08fc8f388c3eed542dc0ae
SHA1379a8ece84619112bbf711efe20eed60889d3745
SHA25668da89ae9233d7e2d522a48ed53c8c09d706182fa715fe615957315b4407c9a5
SHA51271b40f31f23f0ed16766d66e0543e8a227cc5124e10a7fc21faaa75d104d501bfc435997a8aebac298041df6cd9b8e400f70cd9c68a49120dc5ed869fd7a40c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dd80ebd74ffbdbd9607db0dc790dae9
SHA1dbbcb7dc3d9c00b5a3d9aaefc80138616e47f057
SHA256966d774e93fc4e4c878e90391e006a4c413836a6d1e18e7ebee9960a52fed716
SHA512ebf01d943191c8522c8b25871e0e94349f43583b842cb3b8a05b7c75ac104a22c428f54ed505dea5344e3aee15b82f212819ea9ba694240fb942fe440ee75d1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5916e7781ba34686acc2a7b9e19e5e4ed
SHA181ac6ab884e14d6d852b815e0317b41e676be21a
SHA256d6e828da87cd82687786553e61ad20e82acec09e43b0ece9cc5f74b18c04acf4
SHA512b8636f26424d49de0549d9ab4fa519201c4488d844aa0dbe1238492d82baaa98a503f51c5d0ab61ddab6d21ac7531c788e4860254fd3f4856c706ca9d08c045f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b7fcb513de4297e23080d9eb7a7ad26
SHA1a8a4c3ff670b53c2d59b05b28b4c89030204fcb6
SHA25646e3922ebf4d007c52fa0f890757613fcdc3912e79d947db6fa7570ffea047d6
SHA512e5c381102724887446a6f015f7533ae3e6445da3fe92f6fb4a4a41a6cd9c2dd39ce1cabce1bc35b95d1752763dacceee634828cc0cee9aa8d7c248d1952b4fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e11b64fcef75d6820513c72c7d445f9
SHA1cf3e86e2a3aba54098981b873a3d893821556ea8
SHA256a88ee4e6a85170594b5a720ac65e8d78b032beb53fed061311fb6a43931092e0
SHA5128a70fdd3578fac1de6df489e4c43791cd020b3636a0594a40f1745a06fb2d1a88c05e2fdb4a1d3b22e6c6e326d1f77abc484266ddb600860d36d34612aaea6ca
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a