Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 16:29
Static task
static1
Behavioral task
behavioral1
Sample
3b0a939e6fdf7cfa4933ac43107cfea3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3b0a939e6fdf7cfa4933ac43107cfea3_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3b0a939e6fdf7cfa4933ac43107cfea3_JaffaCakes118.html
-
Size
42KB
-
MD5
3b0a939e6fdf7cfa4933ac43107cfea3
-
SHA1
dfd1f4cdfc03ba04c1ee28e44667b358468efaa2
-
SHA256
cd986bf51f8e82c5fedd1038e0516d914ba6017c522d84996f7babee3d2f4d2b
-
SHA512
e1cc4b1cf7701d5edca0e86a1a9d3a4acd1190cfcabf9543991e2f1fdfdf0146cf0346a08e8824c61f4e0110bea6cb50a8bfeb317e2a0d4f10eeab0756de00ce
-
SSDEEP
768:SNVbxbbDZO4N1Ct1b5BKIKGWsmhU0fScFd6I6vnO:SNBBbDZ71mb566I6vnO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f2fc34912f17bb1d8cb8713e6cca53149fbd39b103ffa595b0cbc0dc3b1e175e000000000e800000000200002000000088dc049c4c47749ac1c0f34cd9a84c705aceb966c0f726a1725fd228150ff62290000000cc50454e4590e9714ba3246a18d8633ad57fb665d4af322a9763c8bb18c92e2f73540b230603134d97afff1e6dfe190e7eb27fd0886c94979a23f6fd6fe39688488a84477dcd016188547ee0035de251fe1aca4e1dff892a66fffcafec8b6563d1f16061c2fe18264bee0d40789a7e87168f6fbd7664f206542f409fd3b4b5c69f708f2c5f0e3fab7de5f3c1e91d904b400000001b82b9bf0ec6323f28f1c06b383909d971de6d901aaa490fba5f7305b183796e54307d20bc3b5a0b83fc3cdc686122e9e52b52347c7d04258a05b30a8a76d8c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707f23a689a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d7651b6e47fc4a9ddafdda002a52eb1879c8aeaba10df47e2897c649325c12a3000000000e8000000002000020000000a88bdd07fdecc6e13d38e6e82b253cfea2e5b9079ababc440281ed3318a5a7af200000000218e32cf0cb89f310df551e8a2c74f3f69107a191d3d90ef562feec448f55fd400000002aee9501c87e5b3bebeba4b10cd013e1e1318c7c3ceaa785bcb620c203ba1ae5d186fd26149c3ba7c6b86d4fc63c9fbb1f91e023066012cc84679f1348e9d07d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421693236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD9A8621-107C-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2500 2340 iexplore.exe 28 PID 2340 wrote to memory of 2500 2340 iexplore.exe 28 PID 2340 wrote to memory of 2500 2340 iexplore.exe 28 PID 2340 wrote to memory of 2500 2340 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b0a939e6fdf7cfa4933ac43107cfea3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a282bd218b7fc08e79ef3377ae9356a
SHA1a1f2b562840c391239645231e8aaa8253fd43bd1
SHA256972c171130f6980cf295d548b9001b6b9a6d83530f1f9e3da359fa45837e4480
SHA512fac719d352cf6e4c6c10f74e1168d7eb69678a8b8725fd4f1a15ae5307fc2a72929f33ab6774eca4187cec76eb25473b36410fd55d85215950bbbda1d9dc1ef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa8727087c9a7408ddc858aa6c0fa7ee
SHA1c1c3f7ebf29754de9f058325f0f0769a6eb5ffdb
SHA2560f09705bffd5f2f4f67e1c527977478b2f70363aea9dafd4e82bf5ae620aed7a
SHA5121767e3d441e8dcf25b27fe1709c617c1bccac7caad065b621383c08bbea4f4256d5f932ed3e5b6edb1b4cbd381c3c5924388747e309e428ddb11950beba7a417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d390ca2c54c61ac6067f8370ebb6b111
SHA19a2b9665a455b13fe617c99e7b1d6064a8a63136
SHA25690a9e6b9c6b595d72ee60ce6b763dfae89712d339027b81fc1d1045f4f680bc0
SHA51222cc47182033686e99610d95fe925a3bb77d4e64845e956e3d327407ed67d5233c10c701751af527156b936942eede77d57468ee3595ca735df6db058f86f7aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0f8c5d36b5ba667f55cf71bedf25940
SHA1f9b6b4e5169608bd928c0a0d03003ab932eda174
SHA256a957153957e4cf6ae912123a2901cf4b1a2ba2b00161520150282d56dd96dbe4
SHA512652082c63b8014ba4d1ac59e65e4a05e6ffb39f1bc4605c08dad4e382ccb48064afdce7338f31fd16291afccb7f61c0e62db167d706ed9a430f4c0298e8973e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fa4ff9736e10c46ad1e74f9405bf763
SHA1125e238bab3af1e2a05b62466138431e74aa9d1a
SHA2567523b460b1e2a3502fcdba24575e7844a605f6e5ef4007e24f9277ed685b8295
SHA512c1fa5de46dec8740c9860430c84b3fe590d02fefe6926061c3e674885ed6259758a719caa47a1b7f6fe9d25ea978f3d2b144ecb8200218edaf24cdc7c748e4a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d36b25de94f5b07a130b7073a2039433
SHA1e1d05c4e8674a55637f6f6bafb777fadbaa64227
SHA256466b86204eda703c2cc0cd6db5be11b5c9419a70c3860a26889b2747a2a0b5f4
SHA5126dfb1018a2e72ff3c1172803623334ff8f9f7f0783dc761a0c7ff7c0f6813b4413f9861c2151e27abbf5ff126b1212d093c122348f7515700671df056714f48e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a13eeeccb144192d63d5da44573a15a7
SHA111d853c1e2d9d6fc250185a8e023f0584e6b14f5
SHA2568f1b9426bf0d40886d58dab163afb80c98cac1d4bb175abfcf3d1c7a7974ec65
SHA5124f7d6370734a4876bba872c2d882d3ca534f197da6097770cb3bc5de4d25c74a46281bc7add2ef5b1489e6861b22c0150e1705cdfb8d1a7c13354861442883c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5823e2194d42720aed8fd0fcf4a6e3db6
SHA156895546f3691b38ab3104bff7d1d8567ee8ecba
SHA2567c859b8d8869bb3a0624a604dc51bb40e6a5847418d4627695dca2cadb59b875
SHA5129242760263f975e56089b35c2dc3283b92105bfa1b846a859e589773f1303a72804280804591c5d842aa01533fc6154334e62bdc33f2bd15fe91f43c625bb8b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5024e99f5b840629f6f5a21e2e53e9309
SHA156891b2c822e3db3e9e77b2f71df7ca0449ac989
SHA256700ddb4197f2d097a5cffb7a13fec3050f9f36c644b9e92d67dccc8961dc864d
SHA51221862c0f5ee4b60f15d41b78cbf65c354292993fa53a4ffc09dc2c9186663e9fc5a29044aa275ca8509992fe5353d46360d6248828e182d1a6672eb895408da7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569f671463d7bcef079ec99c7f6e1745b
SHA13a3c609a3402f436240e9fc4166589790d65faa5
SHA256f35bcf41559a9756dee7e6dca07f2f99d7fe83f279cd2af93e7ff1f7123e14c1
SHA512a656c2b866fd0eca94ef462de020e3a35f489ebfa1b1fb98cd95386d5aba44c317610398c557600b91eaa31bb18101492e3929726d34dd60b01f65926d50160b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7390d1d6a0dba4a2b9ccb887f6bd5bf
SHA1d66a4f92c62cd56afce466175e4640fc99d5bf1a
SHA256c1d50dbaf5830b5437a4834c5709f91e9f05035b3352c0896ed77cdeccb287ca
SHA5122d6d29c82b3540fd95ef5dbbe5c30f90f62f64aeafc2daf8eb297794c3937bd88007cd1119ac1001b92b98f2489598a0e35ca2f891aeac12f76f50a09e45d851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568f6b683494422fcf3dec60a0af55b25
SHA10a7fa29c9b7033074faaab44fd3736b8c95222a8
SHA256905248d643dc67f2da4c12db92027a19b4dda63fac23ce5bfe2c589052fbcdfd
SHA512553a38d95acc7d2f6ae819f4efa8acee20d125ff63559762856280dd1b8977a57d67088e1abcb7bb76e5e1cce2924b2ed36efec1cfb4536ce43eed1a3c056bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50487b77d1f9d88d58a35d07113342736
SHA1516b216ea89b6ddfcd9ad4a61b150158ae470591
SHA2567fe6e3265ca1a5001643bfa2f25be71800967a6c5fc8923af56047790a01096d
SHA512f0b3d8451d122688738cff878e1e1cc7930853a954e3c0579569c14d08707fe8a1d5aa18df1c1e1178bccb2b357e182759e8253f2ac43c90edb2ffeee1f46d9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543fc4a6eb384b244278490f230ec7e60
SHA10c9b920a0c190115363efc8b79b845f256c4f04a
SHA256953e728d8dea0bd1ffb62cca9b06220a3348c41280e300a8c73d471a437631d3
SHA512f958c302a72f4cdb1876df0ce4290b56a6eafcef4843fa38b4d2a4bb53964ffc6571674493b48b5a76ad573f73be7d9d20ac8853d134a5c0a885d5665421c083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5820f761fe7483634bccb7e72d4717bce
SHA13d629ca58a779d818f298c69669060d7b5334a7d
SHA2562ef1b6600c7535e41fcb61e8749505c028ee6ab796833dcef8567aabac089839
SHA5124aaa5609d43c0c369dc4eb85167d421b372030c8d9885f157301d87946988f6cd46010817dc22760f7c3a0d16f55b750767a35c0f9549084ecb6a3aff90f631c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd24463c4f224a2bacfa1824aac046c0
SHA197ecd21e7f621dd63e827323cc951e508eaedb08
SHA2567c77307967cdff5cc56da7e0a5e74055ea1be29bd9bdb5daab707a2ff1c5a76b
SHA512b6968984d75af334ec68db8e8333fbc3db9c79095a71dba858acd56fb71f1ee7e0b2372b5e3d0e3988518ee6b8e550e77ee3dbbfe54b3dd73c452af3737a20c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b65fde1203670b9c08dd4b380ba60b04
SHA1c4ea8b23540d40a42f8f15b59d879c2a0b04ff99
SHA2568d6007aaf0640e29b906ee59dc5be67b27c76b56732a2faef07084dda807a58a
SHA51237dcac6db229f0ff582400d397c74b2fd649ddadd3b9d9ca2172a5d7c64f606770ed9d9bc259580bb205502ff6817f0469e5890ccffc676e972db224ae25f771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adcab57a977b60bcf51ace466c71ecee
SHA1c833c65925610c059d19852643507e2f405959bf
SHA256db27e09b4298f4fb1180b038026d2d040193fd925eb4a8adc567297dd08e4c92
SHA512a41e7318eb9f55f2582ed6dc206c69f950c40aaf735d9081f6f2a4df92bef9dfdcf8d40809911a2aa1bc1715c66d478880f1375c65e5d13577f2bb757dd999f5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a