Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
3d027ef8b841863385e031d2122874ac_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3d027ef8b841863385e031d2122874ac_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3d027ef8b841863385e031d2122874ac_JaffaCakes118.html
-
Size
4KB
-
MD5
3d027ef8b841863385e031d2122874ac
-
SHA1
23bd2bea5bbf4c66b4506a30616232d679c8db94
-
SHA256
490d3831573ada510272b14dfe17b0bda9c244cffb35679bfc8e46eb2729398d
-
SHA512
ba04d180e3713e7d990e2dd46fd7621cd456e9bdf80c85307529e2f59b8ee0e4a0d662f07baa02ca4b3a883d717935ebb9ab23098c172c2c1d4e6a8e2f48c0b6
-
SSDEEP
96:aQeCLKOjQbbeMl75o3/3fsYoTVVI9aW+VZ0GOFNmqHQh13vc6Gz9:aQXWOjqbeMl+8Hs9ntNmqHQhJcTz9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004dbb6327f346713e7b3ead5810fad014cf71110ebfa779a686ff9c8a491bb9f4000000000e80000000020000200000002e671c6443984519eccaf3c73c84d44fe42e0523672ef29c9671662c7f9f241120000000c3716b1de63a96e8697660967ac9a2c51bf2b26bacd8f591a4254f720e96b60e40000000a9f2ae6309aac47c2c182d3c90b7eacc927ca7f161732a36ed8e9dc6aad81a59a9382f12dfc83330582188b05d8c1e38e393f7e7198e73ce54088078155c8c9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e7e5310726e7e4ffb5a2855cf84dd9e8b0c999db0d2652c2cbe695f361cbb1d9000000000e80000000020000200000000c7d6faa76ae6d880bf512eb1f6f7f6d4b8b434e2a5fefe8b0c7ad875cc3e07990000000814b897f0b81f02251f51afb82a7428fe5b27f16812e27b95e6203ab6be48c24bbb9db19370389b559a70c1c5616aa0cf3941c10598d45ce1ef6fb9b471fa110399e6dc5d2399c8a5669c08d4260c08b576ce0e0b69eb0150a18b0a6928cdd351ff5e7070b5c537e4b1729750fea39cf112f581e1437513b03743b67e3ea4914aae2bb485dc45ab483dc8b90ef2ebce84000000071502dccf55ddb5bc3a5e41f0795db206b85a9df11e573fd5698092d8500bd6b86d20c14c935dacd3332cbd4f7ddcef1b0fae8a7bd30826f49f082d221e3c264 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20be907dd8a4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421727104" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A91CB0D1-10CB-11EF-85C1-E69D59618A5A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2384 1640 iexplore.exe 28 PID 1640 wrote to memory of 2384 1640 iexplore.exe 28 PID 1640 wrote to memory of 2384 1640 iexplore.exe 28 PID 1640 wrote to memory of 2384 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d027ef8b841863385e031d2122874ac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51682c5991f089aa1f9f472e111f064aa
SHA1f0793c18761fa94e1a5421b1692ab936c8d56cd9
SHA256efdbd1db5c6e2a072d0fd70105f6c05fcc24db34a99d52042328822bfa526037
SHA512d8a53a3661e96af65d0f86fc17d2667c59f67cf83c0645b04211afc62d1547b82842cafc605a5831967444a3b0c65ba9870392b425255f2b5c8a4ff55cfe80ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afdf8ba4528259d83e7aa48baf0024cb
SHA1266cb14856100916c49f9f96ef514d1270b88bbe
SHA256f2e981469d651531e22ec10839f670cb23c1e277679b5d9dc976851fe0a3f38c
SHA51293fdc164a67b8c4e09c61ba80e0be4d742ffc81ebe16b77696347b6505750f116d4a36491914419fd9f92f4672f025d278bb3b695a55b752764b764ffaf48837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5ea0ca68206bbb361511979da17d292
SHA131d60f4088633986c89e224fd44464314325e1fa
SHA256d9e92b9a2b9846249639383ad728ecb510c172c26e9adb30b276c80382337c02
SHA512277d7ec5033417e9b39bc526c4e4b99ec19840d34bc66e24f2b50b19027e1416665e10f1f2512472e214fdf540ee2e69cea9b340e899fd1a2d0ef64ccea75c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511195f77d7673c37094f8b1b71465000
SHA1684fbdcd8e365adab4f72a6b215f5542a34ca403
SHA256319b7523f962abe7660e879006cdade6984cda4ae413e0b1a60618a8550264e1
SHA51227f7af085d6880358fc304169c134ba8e3a94e7f37db39909a4ae20679a50d97d47b71f4a1fd9b1bcc2cebbc12d1ebc1a90e137d5359ccc62aeb3f5b27a77f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db168cb1bb23ddb4a515c152d726e0fb
SHA189a57172f657f0c762f5703d22bc11f21c84e153
SHA256208f10013329a057a404ad0d1091ebf22566bf61efd13b5d6d8d980ce88a66df
SHA512ac041fb07f742290b1d088f04eb78622f3f32b84ad489b6c5ba8d7df1cf0dc673a39c6ad69e008a2b9ee83f3c5c0b49a820670decba760dd25bc2ba8f59167a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5499283eee3be735d16ca81ee1c97c02f
SHA1f8f75e9c2ba8917c2e5b9312a5c2954ece62d054
SHA25681848a6cfb6da19986b85cde9a05da661f1a9ef466972de766f1fb979085bc62
SHA512e7b4e982177e42f16921dba2984da47c775f7b2a8a30ae89cd77c51a7f56c814ff280b7e063fda331b303b2fbb79c1fb4dc62da587a9a712df0e5c5f46df7bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533384b31f4801e84ebd93d51ef78524d
SHA1fc365a748c2cca5954a7d2ea6c4db134163ad6d8
SHA25675ef01746912f55ef867928a6847fdc918ab1d97f2bc4670a25cdbe0e3d062dc
SHA5122bbffcbe337ee487226f59147270de0c8e53f5f927c27c3e7e503ea2c17c9a804bb53dd379787c3af57811105954660c5fbb2da82e6178ae70113f2e59e8d421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e925aa3fbee287606c15ec6a0e3e85b
SHA13497a29ebe42d29cc5b963d464555b29bd2803d3
SHA256969608d503a74d94b55e998fd053dcc3d651a1c6cb48fc04ee93a6b22ac57ad6
SHA51298622cc830a2549a8ad8ab8f287081242d123e599d62e09596e5005b9ddce18af4b6147aa188114fcd00351d43350ba3e6415ea8d3db207b0404dea2b5bc98dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c318e529b465d75553c92e1fb0b5c8
SHA130ca5bb636d3d6e1ba84f79af16d0826582d19f3
SHA2568302695b9edea9c3b6561cb2e75cf70275c6e18368a2fd7c78f314184e104b77
SHA51292ecb40dd9826a402104471c5c5bf56c74007379d0dd156e7e0e8dc64b11ecbbc75d7e52a677e30ab0d5ffb4c8af7f7db28898d3851816c1630ff4186e653c4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7b39805aba0b842f66b70fbd7a9aa03
SHA1a4586d05709730410588ae39d5a4d2935586e770
SHA256dd209dae7f888a5c37f9169d33779501f2a5c8b724042a3ce2ffb2599dff10ae
SHA5126d612afb9c6ae8e5049d0312f0a930fb1950697e3dfd9844ffeaac454d3cf323ebfe630af3643028bc2715f0f7cf73e2ce16654af3e668dba3dbb4943e5786b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc5aa8ac622d11e9313f6242a1c64f3d
SHA1110cfbd71c43fcb2c4b4ee9730e6ad2c0952c20c
SHA256e1ebf99872531741694b966aced9c1a6f3b23394f88c1f31316d5f3d0447463e
SHA51221ca1bde8357def190bf5f968af7d2f4ee27661524ac43f8a48d19cbd3696715911a0e62f889bf2eeccbbe5fedbd1b0643b2bb24fa8163f1e798083d34566140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501467e0205fb2bb40bb2ca1a5596baba
SHA1d443dc8432af6a4da12caae08756b52d10bd8551
SHA2563186010c025b043569f1de6d5b6d09963663066e2bf66a5dd4cc499aea9a1a42
SHA51204fa66ed833566e1e2f0b261adc5dbaa755a183589c0678669cd96e5af2f3e37a603800debc01ce0923015fd54be0496008fd35580c49795cf23948b5a0077d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5581a51f404af760977c903131f604464
SHA1b0b875075acb1088ee60d5282e3169c48404592a
SHA256c1be2dca6e2e910e3035ea4482ca3f112e5eff8e564cb1bed915f9093c1ae8e7
SHA512867879168bfa00430c11180a74399c3580e7035e724cd4c8c26d04e226998ed0c0a706594ac419e199bf80f1a373d1235633545d8810f6bb1d4f6d279a4133ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f8e59d98d0b9b58fd44bc4b3d395f4f
SHA19b80184f2cf0a9ec8160f013e4164c409e3d772a
SHA2562f4ca9596364d15aae21c702151524bbb287faee693b8e433275d45ea558c1b0
SHA51255cf5076dca1c4183afc16b141076e7d4cdc8d11c1624482c26e29d556d31ac63b557aebb083d0af66fcda5851b54e0d1bc0c8073b0e66c716dd9337efc19508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562d30ea9203cd38e45e3d9be71903f5d
SHA10979474185b3e95daaadee025f32b331a8274ab6
SHA256f1e67840560197d0f5a84db965b663fd77674ed87a277922e00eb8197b064042
SHA5127cc0b92dd7c9a66033d4965aeec90c167c9669685d832e775784428bcbe57b4f2221c1f10ef5a0617ca7a49ee24e03ba4eb65f7ffc8c94991068597e4a716334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bdc5893b5cc575a389932af6f518a3c
SHA1e32208904a24c6c23ceb8826e867386ead3fdaf1
SHA256a50320bbb0106876d0e604924dcd99b1410a0727d2748455430958197a20946f
SHA512861996adff5ada01c2e3b1127f84a16a718831bc7577d6d3c78aeeafca6dcf0bfcf29a6dadf91546e5cbc4a44b3eacccaf74185bcff85ebb437c915739377383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f38c7c545dc2509032350dfe1bdde57f
SHA15ff4d583ef7fc30366db5ee22e4721471ada8c90
SHA256953ff812dda0ae93d4818cdc636426c90695c5bed987ae39a414b4ac4717813a
SHA512e2939631037356b721b2caab7feddc99cfe77e9622b8d4dbaf3edc2518ecc7d94a3812060274b83f516b0c41b18d8c38724a0da4e94947d5263ebb84c6510646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bedec6332005f3637cee2016b8ab48f
SHA1af9bfbb8ed46cc11d64596bbec19771bdcfbd699
SHA256ebdced9a52100e24ee2089244b3330148f0fb01c64ef4a9156eee11380d6bcff
SHA512f880b901ef5b630b37b57e2a732a52b9e7e97223cb1f56c9c60223240f5b68c88ab781570243133a0b6790676234c13b4b6fa3d0850994e5bcb5a997a45a3edd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a