Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
3d931d4ad33bd3fa38b141ceae1ee616_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3d931d4ad33bd3fa38b141ceae1ee616_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3d931d4ad33bd3fa38b141ceae1ee616_JaffaCakes118.html
-
Size
461KB
-
MD5
3d931d4ad33bd3fa38b141ceae1ee616
-
SHA1
2e6c675080da1867e228f02256f8e5ba04961b6e
-
SHA256
b06a4cd973a8c7d484c42badc0031580bf2e8f556bb43ededf6466f7d8e09423
-
SHA512
1845d8aef73508237a3e89f5414b68e75031e3dd2be75dc2a9c3842fef31b03c62bf1afdb0623ee26c5948dfbd10d5a88d3fc79990828ed8e236c4e444da32bc
-
SSDEEP
6144:SVsMYod+X3oI+YeJFsMYod+X3oI+YydsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3QJx5d+X3G5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6027635aa7a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421815944" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000fef2f6af04577b30c8f857321a385653edaf63d4d4581147996f5bebf057168f000000000e80000000020000200000002c4c1406c7f0420a850489f2aaa33a2faa22a037636d37cbb3feaf3cccb492d490000000c53b384b43772758d62d51f4a2ca8aba8aed6a0316fae08eae06683387b4e257bde9cf8260ced54de16e2601b0cf2fe4e1da3ef8a5d0dfc7a9dd64cf7ea2795038444b1b6906efdde8d9261cb29edee365afb0b7074916ab3660e2d446f99b18b9cbf8b891a3a77bbc14700824b76b6e091521b03e259d24e670663c1700a3e16ad660f63aa7d73f46d41c769dc9a3a840000000af3b06638ee7a548f660f231a70599b2f78bc1fed0bfe070ce3f4883ac16575f8bee2a1f85109acb535bae215b885dbf2cd15d661c0b12cfd7c86588cdb72124 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81DA9B71-119A-11EF-AF3D-DA219DA76A91} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000036d6b5b4fae79ac61a6848d5dce5575ec9db60b519cee949fe3af11344978a2000000000e8000000002000020000000410b33055203eb7dfb7ba951935b206018f3a5ea49fee4cfa7be74760378803420000000897d65854f1d900a04967dde360c5228096477040fc22094a716ec8bcca9585f4000000071872400318b3d09834fe59cb152bf58001583a521ad2267d6010b36f3acf4a105446457c75469eaf0d92b7b639e73eff7fe9da7573d6d18052fdcb5087d1975 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1716 iexplore.exe 1716 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1716 wrote to memory of 3064 1716 iexplore.exe 28 PID 1716 wrote to memory of 3064 1716 iexplore.exe 28 PID 1716 wrote to memory of 3064 1716 iexplore.exe 28 PID 1716 wrote to memory of 3064 1716 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d931d4ad33bd3fa38b141ceae1ee616_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5000671f7591cb6b49b3aea2efd614c1a
SHA105250e5182534eb69a17b4adfe741674b22d9b2e
SHA25669be00cda18f1ed143c94d979f7dccb6c2cfc4952fe7757197cc3837ad4029ba
SHA512519b8e3b09a6642737f6b7f6c61ec6832f98d10aaa303408db3f7be7844b8ae614b41c3fa66192dea4e13afab07d4e24cc293552b919d7bfb80e6cdb8dbd2042
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff6fbcc73076cb1791af652d81b99bd7
SHA1a181f4ab4d918e54b3416559a96ae4ec3f12ad86
SHA256be5e33987536962c26032ed825b32aebb70deb64e00f2d992e685c948f889040
SHA512145a3bc76ac647c34b2f2f9d0e29cd37c8bab1afe542ea4c2f98bbc32415ca84e8b6a5229fb0a083f33c482d54e1a0b81d28978a608e8e997555bb02c028565b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a994de0bf4bc63deab90bb8ca1acfa31
SHA15110840cae2f426520968f41f49fa46eb4016631
SHA2567f656ba51c7077d880ef1a541932a12b3120d18913e824e56e63dd8cf1bbe1c7
SHA512a923e85bd356c77b47ec4b2934d16649a18aa8f091cf242932e706957ee3f6afde2288877453ad8b7037698638bd76d11c0eefe2291c78050a334c4646fc0d10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8e1b26534c0712fa98eabad554900f2
SHA10ad3e7d6c2d532c392745c3d5a32feb709163319
SHA2564a7e05888f825233ced9c044dda2467ae22feaa16f50272e46e5094cd1fc60e4
SHA512fef6ebec7f26221266dfe817fc38ec93a436d139689e414801a83df70c8448ff58d0d1d2d96fac7ecd45857a581dfc2260c236f86f822ae7926a31cd21e6e38b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0633b00991ef1c1143c87d03baadf92
SHA13f8c2f913b39ae6877410d74da72d34942f8923c
SHA256207a513423a28e7ce60051774ff24563e1e2ca5892daaa29ffca8bbeea362c1e
SHA512ebddd7f8dbac367917fd0a937e62aa1e5a23b45b9a5c9a83c4fffdfd9e0f117e20a23b1e061ed9d20bb82d5e0b06e9a1634ba6145947316960758bfbc465f6c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55011bfb39a0792afc50db98c8a709b7c
SHA1d2d0bb85bc765507e0cc91f0ee393cefaf710c24
SHA25683ce8d693751e40855abd2d56876bd502934156fcbbb3db939d87e8263afd523
SHA512612df971dbc30140c43e6c5996f777e2a0740b752d5a0cd78dbfceb47acb32e30660a3ccc62c79a5fb8f2866ef70427a0383dc3f15dd9e116a2c97ef2287faed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b67a3c763e7fda4e33ca0ee50d5de50
SHA1847372d9bfb2bfb75bb92423fe3d07c62036777a
SHA2567aa74bc3d0f4eca75335d6e865711d141a594d598302467b07a9489cdda0b236
SHA5121224b2161c531debb6ebb418a284320a21497eab012f7c9490b38015f4a35df165e2b3fde2924342395478c23cffb0cef76490da1d7fabc65142068e3ac1f1ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589f2d71694df29ae2937040c9396ea0c
SHA1a93ce5839af68c526453d150dffec9bce359e491
SHA25698956950ba52628bf54861f6a6d35bcd691a9445a7043b4b7bc676fa761668c5
SHA512598d8337646fb4c1596d13b81b5d2307e937003b81d629d2bb2970b9caa67417a2ee4edac54d4a6f65ebbd8dc84ee9551ce76906f0a22958e97657f8014206b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50861256ed1c786444afc8fc54e328091
SHA1f503a517f8a8e853d5f088ad4c356c1a66048111
SHA256b71558f2db07d113aaa982861035c62c56d7d423180aabc3d3df8d57516bb551
SHA512c5df32a54dd104c04726676563d59cb33586dc775be557792cacb04dc5290a310e1ebad5239f51b77b17e5b981a7005525394f47edc731f347a352f60e069273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3106562cec47a3687e147a46018b393
SHA1180d9e75a93b91e136d568f23928ce5470ba7fbf
SHA25655e78d3870260f1cd9d8f279326b7500f8d90321deb697c041a65649e74b3b34
SHA5129449d221ad7821a345cb4f3aacc3d31f420b9f9d5b27e21d38a208da65ed865ea6762f0721af450c688e48e3d54de1980aa964814f47317bd5920ab4d0c58f95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5136a3d3d2176c3c271b804eaf9f97dbf
SHA139a04ef5afdca71640caabee6f16cc2e2d2e96d2
SHA25633c2a8e67843eb62e090b461cdf6416d5ac13892de19c95f620f121ce1e9e997
SHA5123c6ae6d00075bf3478b867fdbf90030f8bc073abf3836a69df79967f93d4d104119e1ab755c04d82a3475dceb5381baa2d88b4f07440ae33d9d5b82d81b2f303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510b84052108702629885c4f0ff2d0721
SHA1b14769f585073220ac6eecfe0c0fe8876be90664
SHA256a39f658862b5384ced2daf674b62c6957c85605f16ab2b6dc2c77553dc121f37
SHA512a77bb53b9d4b95dbc4fdcdb765c5602d6d94df1560304896dae13620b5b6b6932e3f14a24ebc25df4cf8d384d619da69b4903eb4e21595d82da7dc15b27febf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557205c2092487fd8bf6268c527f12f43
SHA1f65906f43dcdab32098e54a63ae5080696fee5d6
SHA2563e94e90f12e064387aaa977151aeed4f06d06e63068b773aba67249e8a924a90
SHA512b32b0ae3e099f542efe8cf5685244daf09f0ae64d687d40ba5b82465d8d99bb911bbfcf7e9094252f2c1113a7f02a0413c71ac21fb2ff2f0f7d068086b3f85aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd808e678d51313b135aef6ce24daca7
SHA1420774676d6fd94aeb21f84032086efabd361e6b
SHA25691fda967d2d6e4e14c4393324dacd883909c52cb760e57c8cac6afc72757a686
SHA51230d9ea2e7fe395b0f86eb58075ee39d3e092be24cfa6bfd35238987bf68b69c5c32f1acf2c277afac2e47557591a57f56ad690516908bf19ecde74fad3c84f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb1050767688d070ae6ee3e6fe13a8e7
SHA18fe14c1860dc778218a5c69b697e6275cc761497
SHA256d0a223233dc87c4bb57a851d7c157943ac0dfb68bc08ccc7b687f919f36626e3
SHA5125bf002ac16b03b8eb158a157a2b36c2f4774c845d2858d8f5f953c43bba27575988902060ecceef7a7c56c60a1939fab1a4d8135b5963990fd8c6fc38be9a329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f64004fb0f20f37c0b5ed59b1cf55d38
SHA10e043a7f69ba6c9455c4a05d268cbc66ec5ccb86
SHA256ab099c243200ce6821fa71249fccd5c10532264474dcb7dd9bdd5b1823cbf529
SHA512cd1f6df8eed8e6bf8674c73a61639945f36caeee0fd2cf02d1bbbd335a130edf24fee69e66f7117321908015d4c34ee65ab66de2e46c9bb8cd4a66fa544a169b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb155073b8198ba34c1781ad16041b1b
SHA1aca66666b04d3ac405f53c56f3f0ddb90d55a3df
SHA256fa16ce598bab4a6acaa917cdd08b2837f06234962ecf53359bf5710959256030
SHA512f6b5690d5a3eb74c10e45cf4644b9920e16e8d7707c95b6d20ab1194c8733ce2d251425132a0ed55b1e1a3642cd785b85994eadeb4c95c2c55f0dc6d06bbb6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f48584e0356feb0e48b17a31e9bcee4c
SHA1464ef4cb26894031819ebe928085c84112366a40
SHA2560f4acd32a2704fd769e82b26b173c9bb1fe7508804d9a90f6f800cf9f0b5c91c
SHA512b1fb778109ecf38d96350271c11b59872cb80bd5344f6d21c1f7ebf6bf825f3e379b2396f6daccb9ee817ed3d4d5d72de984844b261717375683a3b4868cf246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565a3a816a35f81806e7fbbc4ba7398c4
SHA1ae09de4ba31141b3ade332c2f01e66b86aab3a84
SHA2562f2756c80f1b10cca3728e0d16cd64620c3c0250d36f91f35ee25db9dede64f3
SHA512ae5c643232c0c03a4258def26a66024012aec859fff68d90578309f20df9414d3ea8bf46720d9750e0868eb4e0c80da5f69f38db229d599088766c4ba8966d0a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a