Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 17:14
Static task
static1
Behavioral task
behavioral1
Sample
3b3745c03cf8c9e23303a23aea70d614_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3b3745c03cf8c9e23303a23aea70d614_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3b3745c03cf8c9e23303a23aea70d614_JaffaCakes118.html
-
Size
4KB
-
MD5
3b3745c03cf8c9e23303a23aea70d614
-
SHA1
53f4799ea248a083560c66f2c0ac1e3a00cc8540
-
SHA256
a0daa542909675702d5a76065d0845bcf781f56ed2016f34278853fa896d7ae2
-
SHA512
3bea6dde3a33b323edf2bf49939eee227970093dcb603e0891e5f32766ba4fb5ab19effa9412dca5d80265f2ec65110ebcfbc6affe7b0a1bdfefc9dc0b59987e
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8opFAUKzd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005b44d6e681ec9381e3989b30f2eab3da97ada233976e215f9e6ee3cf708d3568000000000e80000000020000200000003434db15522fb7f695a1b3cb94934af31aaf95c6a89cbd213bd3e9ca72e862bb20000000545a7249d8d256c89aee3762ef90ebb29cf170121e96a94613504d2b7e5356f5400000001f7cde007a9aca13c1bd8540d32d35608d587942fc3c7064c6e60dc47e06a19d9f44f4cc357517683e88dcfa73ca32a6e1966ae0920b2faedad747f5e1059695 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fb09f28fa4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421695946" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004a72719ad4faaab8e1d4ef9edfb8b3925aa43f90674ed5efabe08f9480cfc7cf000000000e80000000020000200000001e9ca047808c516fda696c4ea0a254c8eabb62e3a11809dfb05d15bdab73784f9000000077bd03a7d50ccc4730d72bd481393815cad4da2d8ec93c0ea0ae77f99115164f019981a045259de859c2e9734d66359107d4609529c5eba3373f63aa17cd627b54e4901bbf77b4ef17b16f111792b22263df8a7c3fccaef96fab04d864232aed3ac5a95ce478d33fc6e6dcd86c9a46b4cd7f0bbcb3bf97226ab43266faa9d32afe14cb3a21175bbb2059892fe4ef40de400000004d9d7aa7199870d97632f5ce976e7a8acedc78dcdd91da31202583144f92d68a68f074b8b93a8de9f9e087cb04eb17b2fb4a3c48a8ab7ccc853d33b4cfb76875 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D799451-1083-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b3745c03cf8c9e23303a23aea70d614_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57310a427ca54f4d59c0bcba16438d423
SHA1a406d13c99403f8512d392364670079dfaf6c446
SHA2565eeca9aff71ae50e49aa459b946e98818545658f169d7c92ccd0c49093eb233e
SHA5125ce27ae4cb8d1d592fe00f96d096d4783975105d2bc09a6eabb586a1d42c5bc9a9c80df81054bbfaaf843941b6d89f042597e0a972c0bc61896c6f4d89f352e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52628c414b624a513e0370e03ae5f4b21
SHA103fe4d9b0d45b7c80bf1895663d6c01420b4e401
SHA2561001ae525de25c970568aa7992989c9a74e1fee26a67bb40909c2666c6156213
SHA5126aa25f958de124a56dec5b841c20d12accb3da706a7bd75cb0287f7a72209e12af53b9f3e485f5da366e551fea949b020906ee348716d6d9cc10c400194a7f5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f213186a05f84f89b2e8ced33b8dae51
SHA1d7dba1fc59cfbbd49b0c4207bb20f32f04390685
SHA2564de7ca9617382334be6353e669ea3e969cbe33ea96daf57d70b30e64423fd1f1
SHA512a977afb84b2c50f2a6fabe7572fe86c40e53e25fc66ba39856e8bd8878bc8f922e8f184126e00333a5c5748515dcb42afbaa15fb86885926745470c1274a2bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d6c5cf0583c86bc68cca4ab19351b9c
SHA1dd3b03b6402fffd58d7c3fc4df7bbafc1c6f97cb
SHA2562c77145575788397ffa7f9efa3798ad4505243c705d34e426867a1c45d4d93e4
SHA51228f256180934dd5c2d2a6562f1faa9ca91152e3c507a13ab1fcf88b59c9a14eef9df225584055a38cd88a4620fc82df25013fc030a0b3dec7ee9420de3705372
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f16ef0784396222927b08d5dbbb1614c
SHA13244f07422e0c59ca565102fd0cf632256433055
SHA25623a45da50e10154bfe99b12a32197803d0bc413afbc9b0176843ea7b789c05db
SHA512ebe460c6132e20b15bffd3d160731671768fa6077357dd2f083a78b95eba95b5d6a326ef0bbf86a001b78c3a51e49241873f9daa5f6e1a87f9a964854c6dff61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b26e82823d434c0ff6467f63ec94c89
SHA15bb84b741909ac1bf7e7a1627d2d249a5144a80b
SHA2563c31f53ca6618f0c14320d9ab7b7bb9629b7690c9a0cb9273684cbffd237959c
SHA512dd9dafc0ba4e7478e1099c65d2a61f365f347bae4ef925bb7a1bb020dd70dac2ad7bc691a3df960acb4944b178349e909506fde3b4e4704274726b58e155d587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c0128f216f940538ba9d5cb75db8952
SHA12dec58ed46b4f2e98b6dddd594da1935946a5754
SHA256803fd8490e50afd100f253500b36174cd4194fdb2dc9c5046bb4379afca2ae69
SHA512602e9ff087cd157423abc7af13eff98fb98827e993df71a465c9e8f3514e9bf2add5ddf93dbd4be34430b84c67897cc38ea164eed360bc1125562867b3adcc2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd5ba4dcf0055c24d3ea2a3e3b245821
SHA143a8928c59b9c7fa10c21899a3513aeb90513265
SHA25636a6ed2b9abefdb5ddac1ae998c11dd47c8dcecd629b29c15b740e4265f58fc4
SHA5125757c11f543458aecb4dda821aaa7545a8346d7c75562f7d0c9e8399c567193cbdc5e94a2db5551b2849c41f180c34be8a6925eefa08910bc47ba3dee4613272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f7efb7cab35c7c420ed476b118bddeb
SHA11072ef69a35080d5d217f6fd1917b55c29b1f4d1
SHA256792f368221524c1223bbddd326cd6fe054de73cbda85b4c61cb8306258c6f8c7
SHA51296f475059d0a187d60e09eb417cc112ab37bdda9da82f8a120153ea31359f3947246adb94aab1ee7c30efd715faf4e070775f86216c04c3e754b822fe5040db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d4210bdc6f1d6da50359959ac83aea2
SHA16133887cdd71c3564b3e0c8b56ba0681620fa9f3
SHA256cc2c3e53c150fa7b7eeee9af159a4bb8764806bd25dd409a338344f192ae9353
SHA51211d8fd38d52abf2d94ca470ed4d5b42be5dacab4f6918068c8cd531d0773f1025d1000ee7778cafe9ae7baf9100e2298af066d0ec448fa75e2a418ba0247772f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51106043de57a0fab88900a8f98d24ea9
SHA1e0351d84d7e98ac8b5659ffa9a54e5f450606643
SHA2561f76d437954e399080b6e6d87f276e45fae20fd8ce45708d1f96872a3b44cec4
SHA5123314b577a5daa25adc3e9bfca9e40f05e9b7afec0a59e0d453ed68cf48beae17a4eff2956d4f745ecc31536c94a760a2929968766c6bb557a4def035719aec98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3141cdc0bfd3587c9cc68c058c099a7
SHA1d8436687fca5d4932ee89561d6172e4410cf5fac
SHA2566824c366ab8394da865c8d7c46e132429e6fa6d12e229ae9f069dd82252be49a
SHA51229718168a3fd6bf555e50cebd9a77251c02bf0a0bd91322a58c17cce7b5818d70391933d9417e14a18d554afa5c195bffdd59e3ffb478bd48b9776ffd0d9b030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550b1902d31c5435f915e54826a91c020
SHA19292ae752523cbe566579f397d8affadf3a89476
SHA2569eff52aee3dea2a2ee9ea60fdae0fb8737360570d5ebff40f001c699455e9cab
SHA512c5f20f641bc5eca1491f93c59f2758fbd5ade9bed02956dfd55e5b060b74c892d4a0065b9396d605632b26713ab00f62c43d6f8799b060b6d238570fa4d05c26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d8a70129a8101a547b72712d9ddbb1
SHA1fed56273f27b8baa65a09f9e38a8c06b51729551
SHA2564a6c18676d07d5ff64c853a877e2f47bdbb5824d920929b327ed36b57355e9e8
SHA512e9bc06e63946a9b31b149d8a0977c3b2ed5e61991fcea72d57f9f99f7a394cd2ad73237bf5098993998e0dd1b0e5a5fb50f4e21ce6278071d70c6bb4872a2ad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525b11678bb957bfeacc1db36d2cc1d88
SHA15bc18147ee81352577b4fea8f71746d03eab9503
SHA256bbee69cfe32571b9f0b4b035116f8bf081f02e8267dabc54e059999b7693e8e6
SHA5125059bae29eb227783f50481a640ac7d5cbf278a7af5a30cfb8e88b630dd3fb78b724aece89d439d951502a8d27865db31aa4567e24d423a35a5f4716229b88e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe3b63b874fe02b578da6a4e58511d4e
SHA1536f4d56fb7497c82e819750a8875ac984cdf8c5
SHA2564d8bc61794f90b11fda7bbf6348d6a2c3c9bd00b247f27921e5b6ee2261cc823
SHA512afdb296bc9cd7195555e8f2acbb546df83b68722834146229a34193a3d7ba7530e3de5dd76a615ea0606912a76f643227de88a354e66742b9030b363aac4a285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5560eb3ccbb31d64ffe0a87ec120c8abe
SHA1263dc82e2dbd5b73be62dbe984cac9b160266255
SHA256e29098b412d76f72642af4c714adf6b47d0537efad20fdd45d927092f8f342ac
SHA51248aaa195503cb6165ca738f0f76bc3f34075a9dae621a6df3102ab48c12787f2ac7c365bdad1ea61e0cd531ea281f63e810572530a22de8b84e70bbd8a930714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b898905ce6c233b195ab8984ca119ac
SHA1af0857c1791aac46230932fdd86c3bb169301658
SHA2560fa961450d4a6fc3f5bfcdc4c42c8ef67db2ff97e2ed9714852868ac91a05fe9
SHA5126f635ad22639a104fa2a1743d0c95f9aa472b49d1eb732b403c8b70782d2d2bfcea0fe211f910e2a12fafdfdfa5d2fc8a9d154360ab1514c271dbcbe1c27bbfa
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a