Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
3f0915945896bcdca6712c3bec3196bc_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f0915945896bcdca6712c3bec3196bc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3f0915945896bcdca6712c3bec3196bc_JaffaCakes118.html
-
Size
460KB
-
MD5
3f0915945896bcdca6712c3bec3196bc
-
SHA1
ea331fff8c84c5544e78042b1f1cb47bcc35e798
-
SHA256
16952d5c245345cfa842bdc37799c09c38c174b25b00ccb56c6f795f213a2e9f
-
SHA512
eecb31612c129912519c56807411fe6e7bed5b0e1bc96fd817ead141b13d484f32269164aaaf0d99681d595aef0a165350d5912021281cbc717160135ad83561
-
SSDEEP
6144:SosMYod+X3oI+YWsMYod+X3oI+YksMYod+X3oI+YLsMYod+X3oI+YQ:/5d+X3u5d+X3A5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000038a92a5670eb8701eabbad6161d0631b4bdb8616ffc4ba74fc4face1349eb4cd000000000e8000000002000020000000d95fb9eeb0e555040424111d7f37a51bad7e3ad533e52edf1cd7a85851223395900000002eab9ba4abfc6e9430003caa97637c75235353bf5c11d399e0f58a40f3d55ae7e2022149672e5770dc756edb9e6c7b11ad4ea621d7c2b9712a6d4e366ecc96c7df653dc1ed50ab88ce96123ddd8c69400419d4512007bb0d52c965273a3d5269fc7e0f88aa05ec0fd7f9612d4c2658f726d793b271b3f816894d99ec74ee61df5eda92b3bc4222db69a261da0e00192640000000bb600ff884860059a394999768cbcb3abea79eb4046efb4fc03f030bf63aa04e6839f924aa9e92356aa87a3abf6c38b7e3eb429cc21c28f6e4c8ec2fd3e1408b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000609e6b12d2e6658ce2a2f4f60f99913d145d0aaccbae1cf2f6b5ffb57c983295000000000e80000000020000200000005ffc32ed1d4dac602c255fbff7b6f346c3cd817432cb235d67d775cee0e86e4e20000000ee4849b41cc83095f206cc643811710dc01eeca07e8b10bef2601d26f2ba7961400000007b4b26c43b362807a6974b5a709217c479fabb0ca25dff34443a6c6670e082c91e0e9623899dd2f092591b3b0629155321a944d4c5468051246b92c252bc2449 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421757972" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8744D261-1113-11EF-A5A1-E299A69EE862} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e022d35f20a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2644 2120 iexplore.exe 28 PID 2120 wrote to memory of 2644 2120 iexplore.exe 28 PID 2120 wrote to memory of 2644 2120 iexplore.exe 28 PID 2120 wrote to memory of 2644 2120 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f0915945896bcdca6712c3bec3196bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5376992c99d98b8d1e38030b56d77f4cc
SHA1dbe69559ce56ac49589dbdfd0bcb3021c2a6fea5
SHA256d4d4a61f39d7bde1c617f2bd59925af362ce8416257465bf0b937ffaa6a3539f
SHA5126f1c3cec27aeeb5fbe6be1bb862d293efe0524bf15f23e0cf3aa2c45d8f579247e2c81764d103eb804aaeb28948269c5e864f88521f7c3720f76b2edcea1dcd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5746ac07cecd1b068a95d07c501f43682
SHA113ec1522d7dcf9cb59547bcb28fe8df1273e7e65
SHA25694d4b2fbbfb72eeda1b7f1bf2676a7b6c9a41ff1d153f7c526b10d900dd6aa06
SHA512dd991e6a9ffcf283b3c75a2b7c31b2eab37d39ce7be67168f51453d1f926bc1b0a50ee9a0f110edf92724343c852498a3d0f308953fa3053e85949e6d3ba7509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd996c4f9ace7379f9d15a6f6e7ececa
SHA11b9bdb47fa38168b6b46e83d803d98b3d5ed3d62
SHA2568e0e10057df169a6774d7643a2b84a79d6e2aaa3adf9e655d55e24d2063bce84
SHA5127649a054b9344d43d4278591d7d61c4cb644e034af342c4323e0ade0f47bb3867f117125dec08a7ca868ccd4b05681b426e9a553d6d10616f26fed45217769d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5765fb8eccb0b29e02ee37a01ed599491
SHA15ce1e40092ea6b15f97080e690ed27f90b67aa13
SHA256bae5b0176759a4fc0ecd39ed31911c1350fc83072af95ecafce291bfd4449509
SHA512cdc03f8305561cbd6addce1b5b7561e29264e9877ac07d0c896c202b1740a34d48ede6b025d30d03801a2876350ef97af6df7ab67ff314f0b0310c202c06c62a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f0acd75acc8c758b0707d8331a342e5
SHA18f4e1f50e441f0d331dee6046dbfb761bc04d06c
SHA256f3612a0e3098f2c843249cce728ddaf478e380bd9d0d73b50155c1bc7b48072a
SHA512f6fa01e0667e18d4f04fa7069e8dff0b31c208c9438845f62e4155e8f148c02e07d94796e4af887ce622993f52c0ef87fe5b28816a3e31b99f4b424b1e7189ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5641e24ce26adf390768487f44e2c0be1
SHA11fabd7188bdc23d3bcd5632113cd1bd3d70ba2b9
SHA2566434bdd7e6327aa8242702b4a65b6f4500e0ed93e81191c894a830b7178dc4b4
SHA512fa089bdefe6d2031b28369d5766baf187a7f992990a438ba4678304b995538d4a0941978dc8ecb63c78cac82129c9ff3fe181db745ac59582d566f4c82cb9b18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5761cb97ee2416be2d02fbbe851b50837
SHA1a3908740ad58e9e8236f6d852aca62c850a4e6bc
SHA25698e66ea8a31f37af721ee65c4f669b4118aef704975f5851a3184ea734a461bc
SHA512b4bb689a17dccc3fc9e6611f217e54b4cd787cf8e849fe7b0aa76a0a31f6bb070e19924ca27c7cfc45b56c79dcdea28dbaaa0cead302fcbf6a387079540c00a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a52c54275cbafc0f698dcb561e1b009
SHA1642552931676549ddc3697fd484c85e9f21f61ad
SHA256aa6e6903277b5b2186e30672717601922d6c8c2a49244e35e22bf49c6eaa4e0b
SHA512d48e0b07e2e0d7ca55d40563e04ef3f249c2edb69aa4fe364cb97accf456fa18e3dfb4aaf3700380da493253dfee22b731ef6b3a24906a784d652346b2e79722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592b0374ff8313b9c4076b139280191d8
SHA10d0f4f03b5ecaeebc8e00f043303d38f22343341
SHA256a6b5c596459dc6509394ef10befd4fff308573dfa766c8a1c249b10bd9ec64f1
SHA512d06e9d86fb85fd6d8eac4bf6aa6118113fcfd7f50163b042185add3e8d0eb7790e82536c03354c92c5648febbd2089e2cc4f2ebfb6f25bb2822d9409554abbac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ec4614acbaee8ecabda495be8ff47b8
SHA1ca8181293ce5d311aed0a90994b327b8460e02c2
SHA256de9c559585befd2438602b7d4bf13424ffa35b7618c324b77aa8b3d0f75b249f
SHA51222184ee22b921c03b55637d49c0e33ae0efdec9926fd6d971a37eec9c4b74fbe9f81d314a6eb4cfda690b382616a82b5f41013f537d2852f0435e7e917680229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586d1d4e6add28a25db26c10a5554e398
SHA1330affdaa41f6c539871a52b042ce3c36f53ae61
SHA2567f2bbd6e9ae21b13200dceb960a095fdfd94d85552c12317de71c604ed150082
SHA512f97a418f07633bcfd3b1b77948675d221d5bd3fd251c4b1ad696a8b276418b6e6c771c427401ebe07d81c615d31a9e127672ebeea2a864b3cbbece389b792b65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506e4a12c47a21f9a0d480d7a698692f7
SHA1353ab8c464a15abea46aebc627d64dbd696bbf86
SHA256e4b2da80afc9445dd6834553c21a44f19e9327e82ab53202b2787e354b2fa1f9
SHA512a7d3125ae798921e7d5e33d2c7a3564607eac3a081c010724a9b16c37f960be7267f3cb808a8e344287b1b74a050af5b61da2e92c0ba3f0113acd1c77fd264e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c7c790ce1771fe5acad62437af24458
SHA1ae0eb4b4442362d045b731851333a33ce57b0315
SHA25620c9339aba89d5526e4e899fadc3fb7fa7712fea4e4f5d575a6b3baac2a3387c
SHA512f8a7c11a0ab36a5d8673c29a177ab088afa7a2eaf1492ad091af2942c0fa1872d26b986c6d1f9e3da5f6020648103e1550ba3ac4c233dd02d13a30e01dab30a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577adaedc04eae67118c8b49d0a9b99bd
SHA1778d15bb7d27459d743caad7964fb2f717e63b1f
SHA2563a9a6ebff25891740ccd578635b9dc789c77b47bc78dfb1682a2e1330605670f
SHA512b64d86b36d4c862564528ef68f279f4f6691d322b8fa096a43da889f96012b78dab6d32a1e895484121afcf0aa8423e2515fa52dd7b85d0eef17e591c90b1cd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e7a66a762dab5c72017f187f30041eb
SHA15b14b8b6746136c9d0f69fed0a3cf86c6f8fa1ad
SHA256602c8bfdc718d4241d5dd3ace3b168d60447de5a86d7ac76a9d23216c598933a
SHA512246245a5a43dea5c930137157e8bc90ff657c7e49f1d351b2a7b16b36ba17b412c60f716b1783e6ba18363c312ca1a562f469ff3d6f5d7c384acdbd070661fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3bbe44eab3b38f981195c6e5f525d35
SHA1d362fc86798428ae1231b1b4a6e5a529e40e5efa
SHA2564cd47e5eac7f1e7b77af8c3e97b106674a80e376450a9f02225133190d706d3e
SHA5126462d76fbd98a1912a4426059268205e378c197d3db0a523b00e7b3795393363ee43e0688d6d254be5671c3721b8478f19e8ccb1a9c24bd6cae08b672cff439d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b51d92f3aaf54a454ce9fc3d356701c2
SHA1ec2da0abfa00c9afb5cedf8c3feab5f69a65b759
SHA256d3e04b1fbf5803523f5eb050d36cb6a42a2d580bfafb555c04a92d4db8eb7ca0
SHA5124496b498d0283d8b26fdbb62b9569c67f62e436fd4e3d125bcff65493fe4da61efd0d95cea4119d43161749d2a4e49a93bd3f781a9c7fb94b2c51c7e3cfe1720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54887f94dc90342d3d74e215a09d035b4
SHA1e9d8ca3626ee830422adf7f6bb98985ff5af765f
SHA25668463a44e25d5e3e4285f7d480597aaee32c35fd214a622440bf6676d722975b
SHA51224c945c56b5daf7ef62c978dd3930f2a20eb25f8637fd9718e097b8bc9a77366cfc9ff363b42eb79732eed646e777120a705d65ff3406a184293deca353bebfa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a