Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
3eff2418875f8948f38546f0298049eb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3eff2418875f8948f38546f0298049eb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3eff2418875f8948f38546f0298049eb_JaffaCakes118.html
-
Size
27KB
-
MD5
3eff2418875f8948f38546f0298049eb
-
SHA1
c89c783ecbff36d7fd66295e1cc1d1f2b6f99685
-
SHA256
dc82a5548ae00aa34589a3176ee678be60ceb8b6ef6727d42aec96aadc9410e7
-
SHA512
eb5cd00e76925d5a3665814af641a815a37f37b7cb4b8c825de44e84c1cf0af7bf67cae239c022d76fc1e05760dd6ea7e3063c3aeb4d6c4e46e6193f52a1efbe
-
SSDEEP
192:uwnEb5nry7nQjxn5Q/inQieJNn2HInQOkEntGknQTbnBnQ9eFpm6u3HxQl7MBpq4:+Q/sHwMjCHYSjkM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205785ea1ea5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e5e34d62051d77b916d8cb742a3b6a31162ae5df73b180c0507f8a51d68bac34000000000e8000000002000020000000ccfc7926216ba780369a4cbc9fb77739bb71776d7d48f185d9a6a200bc0de54920000000b1878f89b873f15f0a09587fb1c645d7539d1d258a466cffc3338651ca90aca140000000ecfe6e94958c5dd05e26ba2d0dd0e755cc1012e001449abffc4f3ebc777d4e8e8bec29c147e15e7d1813d3777d0e4211179eabe2a1bf0c35715b369f14b3eac2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b2ec2a5cb9684d0394ae554f717643ddda3f73c218a252f2d306a9128d2487a9000000000e8000000002000020000000c243a63e2c089d941f340b046becd22987cd0919fe8e7b8eecfaf7bbb5ac674690000000e2a80e50276bf54cbe63c1a4cdccf84ffbddceec8697db29c17940492cf08cb421541cd40d88982861782da872f6cb9cbb998a11ecb69b7f35befcbef593c0b3ee22774157b25b34fc4687adf91584317296cea1ed632692784c245078981fb2276d6e56e18dc32d80dd4df469c01c777a00fd89348bab68ae21afd510cc492fa710dedd279842ce9be78fea0f774df0400000007ea7bb05c0e95a936c2e6a21afbe2e3ea0b011875fe8eab0bdd28470b81ce5bc496af3e09183187ffe52bf7cf8b80cca6279debf0ee209e37361763d64d81f26 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421757352" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15C544E1-1112-11EF-805B-F637117826CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2372 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3eff2418875f8948f38546f0298049eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc2c3d1d63edeccb7f7082f59edefc5c
SHA14ae7c3a1f1160de05338f00d769818568b77c071
SHA256272205245d0a90114e0aab6d9effcadd6d16b1d5a5564c003d679ba2fe00d11f
SHA512f934932acc7991f52d896541f4683770f4ca5265a6359e477a25969ebc770956501d664c4f14ad4421ec2bbce803b5a0f244b96677911ece40463e21ef5f2ce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b8600ca85d545634c072a35e563826
SHA11c977db043dde92aa9f599b1d9ef7a9f7b9c7ae0
SHA256543c1ca15531187e638c39b0be00a1b8e3e02cc3d438a539e4a799f73964538c
SHA512eaa50dccb8328be8e6cddb2101eeccbe5bd66d623161abbbef77cd5636acc6ac2fb894e407b00b0d0f1db76ff7d1c08cb83dca00ec01bf91d13a4e2272c33570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ab226c0538b707def74d18085821221
SHA144a519cb0fc99c7b77d0e45b7857558f1b2cf93f
SHA2567d23e6a0a96789ee46504fbb4769e3db442d58aab0a5dc8d0742b6398e782907
SHA5127239bf392a2d005fe47a5fcff9c2ead1287f6f61bf60df15d499bfa777b0cd744fd1247952b81fec7a4e80773a1defeea1dc7f5846d8ac78c3e9bec5ee0493b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0dad3812cc0744175a2e5b13b5ac3ce
SHA1366d6492a51b4b4e57527cf0975b3e2aea0491ab
SHA256b46e0c1478be854c47bd2146da6ea9946f4001782b9fc823f001ba0d0bb3be67
SHA5124a2563b75f7d4951e0691a364a9de240af7abbcbf4d1d72d5e013577f535811d077c0b34743f042814007905f96a7b2d8ffbb14b8ae5c4daedb132a1e3e889f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5742442a0f2c3f1c6421a475e9b4d3e7a
SHA1e38d6c1f37f60c41a2d922cfc532e44b1cf68439
SHA256eb719d05a80ae9ab0190a0894dcf6f5678df84853af2c392033c2c787807cd47
SHA5129616ab4ceb6f145d732a8662584029149756016fde189686c2a05b23ae3f3e0f47fb7ebe0f3952f74996a6c88c1684841301a5ea6dded404ad3645a464e166f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f2be6298194e440a59e50af62e75746
SHA1f222f549e61c0d6f53f52d69425158315e7ffba2
SHA25619c05ae84a8839fb4d21de3d3e1ccbabb199c52f847a59cd664df5f1f57f143e
SHA512062b21de1622d8ece0b218c97f315c282ab9f203134ab9d395422a71560e7e8346a143813e399c39b575a6b8dd7b319a4d2ae0917c63d2eae46c6adf20c5359d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e80bf8e84d5c4d0fd1369fceaa59f71d
SHA1aaccbb7d1d0769eb5dade45174e9940f12ecca33
SHA256db97dc374d6466909f5a16326e92c0f83afd6c14e44df79ddb3492babd37d8b1
SHA512cd48ba0f9b78a1be7ee8b19fee0a5a94bd058fa26510b717910eb5ed4bb99238fb724790ef9bcd05877bb1862c1f201aa8de633355bb99feab907c99372dd812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5235605aed338e30be518e639a2aa6f63
SHA1d9de4e5732c2c102f48326366e60d1cb394371f1
SHA25686e8bd16e0f1e29bcf815c3ccdb480b66714cb9f582c9886ffa17995137406e3
SHA512b90aa2ff87ec490b6bf4baf5a8b832e074368d1fe2120a2acc10d80bc55509214199b6dd01923f6a89a58998dfb2c7901e3dbd3a2536e8e0ea46e25475629d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f96039608c1361db6aa21e9a2371d76e
SHA1b93f16028034fabb53f89f8d7b022575cc54091a
SHA256575468f4581ae8fb598b9fbb8b265d456012be2930f9e45cbbf55aedfda95029
SHA5120f25736e805b950f2b9a3ac8049bf6695f918b842790dde4575334009c4fcef71c692442239fd802adbff437c6352796b28a6c9e004ca6144a4f9f7fe3c55754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5589f7b976883b6e2504bd7e5fc2b12c0
SHA13d2e0fc3beffe0512e05c11cd9018c0c88527404
SHA2563de05a5651b25ef00e107a210a69da964208ebc38309a01326dc3d4933b2b5b4
SHA512c3817a8181c77d7806f37265724e411021a8c3d7568e733715a01bbb5ea61778f15af8c23a123f777f4c3bfa88f656a0f0d491ac45b57869c4068bf77b2ab884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558d199e8de15383c2e39b4255889bdb0
SHA15b65a6624bc91b76131dc7ed6b36aca4cf9a451d
SHA256549a89a1830c8da976569bdf634d7533b3099c33f86e10cf3e18f01c0d67ea62
SHA512d8ea47b071c4d2e3e7e5fa607a29a6b5fb86d4682434707ae715b190deb25d3f5fa391fe7adc62db9f2758ba292b195dadf8dc980ad64b402738cf4501539bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c65bad6d6e974b0187663e39c693caba
SHA18fc5972550e11dcc8573c474cfd29f22851520d0
SHA256b60b1709ffe7ab8e38dc54f05a248adb56f0240a184b75a820627648c543ce50
SHA512652e010a2d603216b004d71f40f8926f4eae6bad573ac79b3e5b442baba697973f1b38fcd39fa9433006829d391b703857b8dde84f63f09f12f569bf2b28a94e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e39038aa9f7699bdb647af95b5b875fe
SHA110a92e70dab6550fb0a86da7efc28702841f4ac3
SHA25601d6c75a695568074aad634236d2bb50fcb9c21d2c7591557382c1fcaab6e0bd
SHA5128192078d892642352646ec57e24afb5d8f794a8bd30a679b12ea3deeaedaff328273aa89e564e76dea754fd3e1fa3ea6af87786bbc48e99c79509df048ae8d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b14e167390d600006b35fd7e0a67f4ba
SHA19b287e502889f7c9133906a8ef29939dd14b4ebb
SHA256668a2b02465edcc18bcea02bea87d0fa0a01362f7c302fa41302a5661cd22be5
SHA51273e8c1c97829c8ca6691bc7068172a74cf70fa5fda777c784ce0b1b1f4e2c99c2f8ed21bb667f64766d1ecc4c01b9860a651e549284c34daf2c433c2fd8589da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d275e1e590337a312c0db21930a5403b
SHA16df5de25152e0f5b5b8d6ad5aefbe64d2ccd4440
SHA25638fa72dc368bb5b2a1cdcf8adb4929c59813eae5922c38b01b4dd43bd7057a19
SHA51252bfeb60ef95ae303f007448c200c5626b1bfcac3a37e6937fb5012b11f75dae82a4c6e5e075aee39f162a61d2aaf19de43ce3b10084cd4890dfb048181c858e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d45497be90a971e3c64ce98bfa6e8228
SHA166b2f0237ed67b1e94e522ee56811fa49fed17e3
SHA25683abe815cecf500d1577674678ddcfc6da18c4bb583564bc156c60f19053ff9a
SHA5124fa0027e1b87ee506ffa70c7497285082795eff93c255009d5518aa279344a2fa9ab5bf0950c8178fe75220e7b23cfb16d63a93466665353960ffe47dbf9e9f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff13f16bca238fe74b7fd40b527691c
SHA181b8d8c31dda14fbf7146d506e030027e713c327
SHA2567bad6f90ad957dfb49ab8ab6fd713b9f5cebcfca59540e3cbc3343b5109a3b00
SHA512eca6b8d0b85169c2cb969ce83d3f61ac55a4b90c8e4fd3808b046d01e0bbcb856ba8c7b8000196d63daac62d43af308786e6083f8dc6c4c2f908d452eff038d5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a