Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
3e9cada750d9e895929ddb1266425941_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3e9cada750d9e895929ddb1266425941_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3e9cada750d9e895929ddb1266425941_JaffaCakes118.html
-
Size
82KB
-
MD5
3e9cada750d9e895929ddb1266425941
-
SHA1
b896f7d4754a66c3ad429f3b9a41e8081260e584
-
SHA256
2bd88833b919721189518f06ffb537f9d8ca7150b7cb3b14b90cf62afb094e9b
-
SHA512
e166edea0a889608120554f78eae4c9023ea09103527bf846568610f4e8fdeac2f3e40aa6779fa13c3ae70d188bb2f2844984e4a4da256d86c898d1e5cc58298
-
SSDEEP
768:SG/gaBgtYTSxmTzClvfkS089Nz5ylWRi73z5ylWRi7il+4xCqlS3ZpMGR:SGYUD895U9vx4pMGR
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421751510" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000cf8fd983992f91c9dcd5539c0e9b61be9cc852701ad4b228f51013b977c0e681000000000e800000000200002000000066756d32d5a9a442852133cb211767395a4fac675dc1e65cd965ebbd2b7b240390000000326203f46701f421cb2567606cffaf85c1a5971f696779abccb43ee9ea09097d4247665a062713508238351ac32319225f0dfcb2c00a2ad5da951e7791eeda2e12c055b631ebd3ff40ca80822e4274b5a870921b1994a2add7946e2f9b4171c5b47218d1ab1fae154be518a674f49160a4615b9a8e8c9b3d9722f6f5ceb98b597b248d7c6f733fd8a87faa59a7a09d7d4000000046a3d97ab26edb14faca9927c9927f12aaf8a1f709d9058579412f2528fbfbf664584d6bae8b2e9b60d254f01d6ce8ad11eb40d581cfbd3c67f4ad92c4ce1624 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009f6170b40334aff9bcdd2e42e1cfdc0c6b312f7446ab850ff203e5a81d1a8561000000000e80000000020000200000006e61a5d7b438bf0b1165ce6dd5428fec200c979090361fcea90ad4ff692f721d20000000e20735dfb2da5894f8291101ca368f79c65b490483765d8f6a235a68216899a940000000592f2e756eb6f054d5b4cdd612f9b630de4280b889c1b1f2481ec4dab39255365fea30dcb96207ea75635aa8990778bcdcf61e4b1b11b526dd1b199e3e1c456e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e018fd5811a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C3F7E61-1104-11EF-A4C2-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28 PID 1640 wrote to memory of 2800 1640 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e9cada750d9e895929ddb1266425941_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541a27a01603a79f5fc6dd7724fc1839f
SHA1ebbd6edae4af50bec15f2ad98fa18c80cb38f7be
SHA2560e4892d24c836378104a3e5fad8c28be979e7c252b69b10b7655bcb4dffcb103
SHA512f864871b707e75a302184a1fc3d9824bcaed6751b6859e4b7df0e99232a4a47425e5e71a7df39cd9e9e2612f1ce4979add3e1524e875d177df373f191c476c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5724e53d47639ba48912085e83237c606
SHA14d6ec8d04851a15edd90a612b4a35c1dfd0c32a1
SHA2569232b40ea99b3f4ef3e3720d86b0ea3531bdede5dedbeb0cf00155fdec2e4079
SHA5125c6bddc9a93e2fb87e34cf09c9e9f1ab2ba48d759e020d018194b4783e5c8f8059a797df2c43917923324f5dbc14488dd495e78e8d3ac69fca50184763b1b040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8abe14244cd5f267719c4a4773e395b
SHA10f12cb3d53955e4865f3e530dd39c8bad517915b
SHA25688a6c425d1aa42a5c0532211cb998cb3c2a81d1029d02dd99e2f83e62949aab9
SHA51225e97a260ce3b022c18e80edae3c6d88f699070047b8088cf640e72ea4fc4a290849dfdd55ec4160b431cba857ed59e7cff1da145279593bbb51dc4a68e72d46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534a53dea9395ba57f24c811c0d8b3767
SHA1443c9c24bfc988581f80bac38402e089a1ddda09
SHA2569077d701198f442e41164da9244cf87f5059ab9ea207839371da35953aa1a93a
SHA5127138b5a691703fcaa0dc9cefe0063038f31388a639911270cbcc016adf532728d46d725457b8843e9a9dc789248531db654e9e1283c7ecac3bbff2924e4cb4d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cbaa7c804c1425db8c3ee0ce8b5876c
SHA1ce5113485d49089f5d90e209fed3d12af96e9c59
SHA2567481e4dc37524e26e2cfd773cc70b6a92b6b7d16d309f6088157e498f37b4547
SHA512d052e9009e756383a180a55a709a8e60113f772dfbbba8976749816d6a4d31cf5d8d84a22010ee510eafa78f8e2bb81bbd963282969a67b8581fe8cad0a7a9f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bed767fedf296dc2099fe8cebcf16fae
SHA17533fea4c565a6b112905ba74319debcb9bce0dd
SHA256864a9ccbc4d3a6b652ecb586f27c40c61182c2359495ef247610ed2d4ba698e1
SHA512c13ed2325d89d0f3264bc68e194b24d6534128efc11c27329952d06c6782592f0c49d20da1fb402c1b030c70b70b9258d0c030956f4a8e2e0315b1b22fdb17fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c826b2d0dc611718cce62d8acbf460ee
SHA173769a10cf2b1a446ff639851c39ac91e958cdc7
SHA256740db6b7f791aa87065f8168ee5c43531aca240a9b104895ed25ad7b7bf26d56
SHA5129ae3ad4cf3ae76481703a2f543bdb8477ed44e1b60984fe5806520a35f9f8ca81ce99ea9f2417d281bfda01086ccc7ec3746f2d92663af6fbfbbd63ea5b46762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e07b7c5e4fa261cdce4eaee69b0c1f07
SHA10e4fd1b886d509efca50de59cf47860d144bec12
SHA256830aca43492474b15c4a791e1a55c0322578f075f5161bcd0d74c353e4c2c335
SHA51265d2a44ada39e423830ca5021a25732819de826a586f3305edc49a0bb419dc101d424d4e9edaa241725574a763e1ca1ba60a37db775cbf9de61dbc7914056444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c78c2f7656c4156e61f8e7e9647d45b
SHA14db53f7b1736a0d74995b2f3a981ec9ae0778125
SHA2565c88425112481679a230bcf5e4bbc0062d259bfe98843e8e3fd44724f49c1e77
SHA5121269d659086d700b1717d053bb5d49d97930b02c2c0f168848caeefd1f9ec0b33ca2ced572421c7c34b9841fccc9bb342506f3c7e78782ac71e3d7201fe278c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561de9f3be5bc69c141fba5e4441968c4
SHA1d687552ffd62681fcf59f05eb905a9e96f478826
SHA256e729cacf7bc9aba2d21c3c497f69038ea407f5656af1cdef3d376ba6e1a5df07
SHA512bc0a097fe5a451c19fe203c654304209c291f8d7afb4dc664884dae92e3d6b0a3f2b9d93beb44ec720e12ce273fe95fe310d5429d8a04541069c6968e4c49edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537376457d449eae2fe60506037e216fe
SHA1493df3f17515a8bd83c8d5e4f199d13eb178f099
SHA256a01db483f7eb3ef56e1066cf4f56f4262c37aa0ec21f748626edf3e1d28c7e1c
SHA512b49394a1d0c68021c71e512ff82732b4d0ab7333635df8803763571730c7570452607760f9ecd5f5144aa3a69f35c4ce6210611627e737cd85471ac77be0f623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fa3080d19c08d96f6cb6e68509b2ebc
SHA1dd3775cb613a00b5c5531ef9275d2978b2493a78
SHA256e3c15970ab97c2de19087f31c2eccaa9a3b4f89e57967f8f896d6f2f269182f8
SHA51203ea3dec03c02cb130f4b3df2e54ce2317cdc8229199edb8f5896a2c2c3aef38fc0f78485857b7eac209ffe540ee65790abf4ca39809cb4220d5b597c163108e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d16b0effb3dadca43a03013d1ad8ace
SHA17e59f4463a4066f975c3b4bd7fa561b9d4e5b756
SHA25644a31864efae08db7d370bafa5e4c80e84234c08e1de265a8d9f2de6fb3e753d
SHA51273b5d316741379bbe4bd09dc2b9c50cc733c3f77d1d20f015359938cdf8c262fd9826fef5859e51d680b797b812417b23c938d8116f868633928a9552ffb9c3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2ffb16644ef45997afaa36a8dfb2be8
SHA1deceb4d19a6e1bb7db9cce7f200b0ba3052243a4
SHA2560d2a678d6f448b3c75862ff9831cc1bbc33a0b84da3916f750d1ebd4af3a173c
SHA512b4f59385929e2a53a6b63a45aa413c4226ee069451aa52b7b86b39f39d9218d4028e99034df8947eec33d289f40b6116b93000b3ee49e2610b1c82ee2dc4d611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531d2bf6b71a76856f47028620919390f
SHA11eab53085a2e93ccac9f45cab826e33ac24fc5ff
SHA2564f4b6091bb8d6b368d2114463867f4c132e9daced822eed024e930c19bc7f3d4
SHA512776ba3912b68843945a6054af70a4ce968cb42bc4a9f9097c7b10f10dbd4da23455c56af0f2363a90fac9e72c7344846b83883c0d3671f1984161d4e7f6c8b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3523fcdffa42febf86230ff6599797
SHA1a338dfc9ed9cfe332467273dc4a6d67e14fb115f
SHA2566fe55bef0c6e135977ac19f8debc599a96e765f26d37fcec213c540def11c97a
SHA5121a01733fdbdfa62b2f1c7a89493a23faa907e041de8bac043fc131b25d35f9628b327cde6957b9b90b99b4e53c5c937133c1263f3cc8fc2656683eb4caf6d13f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804b62636ea4d7a351706c6703b32659
SHA109e38207902b7b38b97b340f34d9d7bcaf05fe83
SHA25650abd214fb0751d7aa201460eaca36e9e109fb419205e16975eff585297d1647
SHA512be76f54c64813ca54762a279c93e547e2106986d5caafc62c3275436d8d375777cd3d3eac59bdc40626c20abe21355fb5d923589aed6a9b332870ba98900b0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c363271347dc00355903fb0f2747f16
SHA113342eb6be7909ed1d7f42364a41365c692198d7
SHA256c83d86fe7b562db60e945b26472f549a295c54855a7115500dcfe9b9ce0c5395
SHA51279c814585418eaabf1649423b88ab8d682776ef5f71ce43bf24516697811d2919145a6cf398fe57a2da5367936e22072c8e6902bc6deacfd6536f7cd1af701c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bd5368f1ee0648d1058660032e156e0
SHA14b6ffcc6b5bce7a8d49a6c23aa57422ee71a4863
SHA25699209403634b030f69edd5a9a13ef2f1e569bb5e8022d407baa658b509c68377
SHA512b30cc1d2bf847c0f2eea1b34a6f04702cb642c70be1e046c6b660d7719fd08574881559663442a4fe51bb22ebdcd39b4ec416256bb4741e9081fb34841714b30
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a