Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
3f7ba00075e781ab3942b3e1a044d916_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f7ba00075e781ab3942b3e1a044d916_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3f7ba00075e781ab3942b3e1a044d916_JaffaCakes118.html
-
Size
52KB
-
MD5
3f7ba00075e781ab3942b3e1a044d916
-
SHA1
c638c60a94d6961eed9a854b1cae936ca01f9afb
-
SHA256
9306fd9c9bdb6aa9c95a1870e3c6b66e41ac2e0bf24cfc232457fc9775a6e25a
-
SHA512
b4474a6ff302a6b68ecf8a52ad5baec9752e42e4a2f4820e8dafe529a0d2c86324e93f0962f8fba98e2c5d38796285851870e3103dc23c917c3b5be99322c2de
-
SSDEEP
1536:D02cbb++llwwJJJJLPzR5VmAv9tfMWdGvEgjR:Dj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90D39231-11B8-11EF-A635-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cbad65c5a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a697263cb9e8e590d95f65e077a4f8bf2271d4ad3a8c1c98519e833b4354abe6000000000e80000000020000200000002ca29eae15406bbb33617ac367b7ad92291dd1e3b62f979cd30cac01abfe1cb99000000093262485e1121168536a0fecd1e05e5e339908c1258797c735ccc362de13e071cee2c92fcd0bde41266408657c0ad50f560aa71e6d3ae084e7328d7cf975c7dc7d9397a2bdf23fd57ca52e22e37a9bcbee6c277ea53a4544d8c992fc5d1b33b0cb1d002ea470828d5f7e79312fbef6b3f7068bfd94c2cae62aca505096f99254760fa977d5da83496e25e93b4f046c6740000000585fe464860be9d885c0e1420bf426608895ea505e60195c00b446f7c7db74d22a3eb7d005e0f722d3d1d33cd664752a55e604220cfa0a429099f232583152bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ad61dfff492ed108c4ec1bbdd4d6cf77e386923e637d74342c48257bcc6e9492000000000e8000000002000020000000bb99c07bc3ae5d035fc5af5bdb7ff0c2604e222ecad0c773bbe3896bc41843892000000055a71ab6b1a8810c0627b5d29d5ec6f73d6f9e5221f5a3bff2f083ff8c527cc140000000a91b78a88b0d00ae3460415ba37d9966fa3cae260df712808b565cf75289a53300903da225582dde706b9d4fc1367411efe14eeb3427e318c4bcb51ef9122191 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421828855" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2304 iexplore.exe 2304 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2172 2304 iexplore.exe 28 PID 2304 wrote to memory of 2172 2304 iexplore.exe 28 PID 2304 wrote to memory of 2172 2304 iexplore.exe 28 PID 2304 wrote to memory of 2172 2304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f7ba00075e781ab3942b3e1a044d916_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567678aa74ffa222dc277e9bc4040a325
SHA13cb59f035215604dfead815ade56afa6600e2d26
SHA256dfa6ba6d7eed37e8aef275efd5f995034c53c8ee8ec917504ba1123874bbe586
SHA512a5bf3c4cca2ddf68a2edea8ba6439237645e23ab29a340f9e12d1cf78bc5d40915659cc95c96b0d8f81410193567ff05ac3ae70fc23932d16d20daffdab3f9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519e66a7201f748506043ef84c7b1d72b
SHA11629350197aa18c6492729d97c525266748311e9
SHA25692417d41d0e604a4545ca6d64829562f300d1f6c698d788f78dab2a9135f49a4
SHA51255d8cb1ee90512daf1aecc1bbce51bd398f0ea5e06fca0c53eeaeb0cea764865b3c1979ddeec9fb84b89868b72b575ef612a374f453cad928c010ce521ef90d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8b3f4e83469359806e351276b01f0e0
SHA17393b7bd84af577f07ae7b267bdec21cc1d7ece3
SHA25662f92aab2f1592343d31fb9420f3b53c3a77110cdfea8e471e9509a462c949ee
SHA5124440ed77eea725d9fff1be8d408c0491bc61fc5bc64df24b09576f2900155036d0670fb98191d4a602253d703ac72b68da8ad6d9120d85213ce20a66fe3a9e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5040d445d47b2ec8162318fb2b606128f
SHA11610044898818ad5a3b14925db7cf6a9e972d57f
SHA25628e7f727d951ef93a2ffbdc2f2fba2d43d6a999493b7fda0cb7e0284ac09c49b
SHA512f65d0adb5cb37fe302188e442be6f3ed7c19b2329a8f4450d02e3401ab7ebc3d41b9b37f54ce5a13606f1f59282f27d882199db563657bc6406c2178efa996ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad51d5ed821032b0f17a7615b0191c9
SHA10b95347d4feabf04ae1a34e12d32acf5a31f5814
SHA256ff3195d80c434ca59e03a948291342cb5a95e69d2d1b077eff6e8e945fa04874
SHA512bae1e08a59329c8dc4554e12f0d727064b7a15ed260e4491899c31dabb95b67d84a3d3ae470b87087517083ac9bc9907369442f8141b2fbc417b3d742ded59fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505176b1f24bf81775ab5334bb0bd8fc2
SHA1e5cd6860b72786b836b9081b7f0c6d7fe2128387
SHA256cefd434f69e272b998ed7c8778b55653166a4da34eea1249544b168698e4b77f
SHA51239cfdf47b5c0cb0a89568bad66ab9a205b8a4de394d974c796f18e67a949caac8bdf2f73bb5368c52b52d68ccf966f33167387aa2168fe306f1271c002f340c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e65aec7fe229cc26544f08a2af662bc1
SHA1a7e50dde48bea7ca93f347f69f0de3373012733e
SHA256a4de40dd69536430527beff988e80643680155a20baf59ddf081b2addbbe4be2
SHA512a4d1aaa88efc5c15f5a462a41e0a5d192909475361dbbc4acdb3748662662b21a32b825ecdd101cfc2673c5018daf103dec0a66cf7d182140415052d6800e125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57453320b983954bdbd21ec8ab0159a0d
SHA1397db8ae97f18fd58fcf9629198abca0c649a3c5
SHA2560057245897cfb067022c5a7299794532dc26d034b92e516e55c3bdc3876304af
SHA51218207fd177e013741a8df8c74534b8b204c7648307eec9bbc84b988427d69f41a4aa1dafb2564ef69ffd39c9a157ccd207dad783993cd1737a6a80f36ce93bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9e6304f1434b16d43e3537a19a9b41f
SHA1b89aa303ad112479a881fa51925ac6d18170edfb
SHA256cc2e7d483592c7666f84e9d432e14f9c5b9ff71bb6cdb8882a48177914598d13
SHA512620f15f4f28d93ff294a62b4b72b689d84c84d48c000cefd11f936833a2200d58f42bd7cf9cf9e80b5f62373f308cd2162c4b45dc391fe3d261afd632805042e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511dece97100cb753e8b91bcf286e33c3
SHA1fdfd07a2b9f92c63884bc28c226e7d31d3a674ac
SHA2569aa7a4b2523eb900c9f40c5334f78d353de7d684827d3f2ebaf31e9f727028ff
SHA5125f25d34bd13a58390151beaf991a6eb1c7c66d6386c4cd8a72286aa60bd8697f5c48c60bc894452bdc63a2a63321500371c064ab6acb15f29dccab02b197fd95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538de299566a9c6d6e4780a024359c9c9
SHA1aba235d0e441678e70f98b7811f6a67b4734552e
SHA256dce5493e2082555c5bb61e589eb367437fef1621fa889c65618ac8dc45cc2aa8
SHA512def0dcedce3f4a29b2fbefdc6cdb2641ac6f10b1a918a4100c0ab94e8de6fd972dd8c7588d0811933368fc3ca13cfd13ab1d96b1ffdd5316b92c5e0a4d060d1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caa8c863fdbdb3582074665dbb1b4afc
SHA14fd8743a8848a6b0c655ef2af1476c44e9e1bb4b
SHA25602dca31aa7d1451ba4805f875d656e8da63805217b2c7b5af5515a5745887d04
SHA512a7caa00e269d04c5c3aec7d8d064e87e485c8e8ee877a78e4909894331a60c357ede33afb76cd50c7eefb849cd56fb6825ec94d73cff594bb4cac0d58d0b9967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f4c486bea916b534a4ccfbc38557221
SHA19d466d0023918d04f885a836bbd8d292952d21b2
SHA2560871e4bac55f0ba52476a5ee3febc375fc511ca8b8d4d0533b01d64eab69bd1c
SHA512a90ba9ef969d015491c83b1ebd190305a5d87b4b5dcffa48186740e9ddd650ad68e648ce04cc96a38b757c89139b80d9faf83e70109fa55d6d0b2cfda2a8dd1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be08a9a1325085dacabad7fa27056e90
SHA1914c19b174f9474813417f6eccb16ead5306ad17
SHA2569db921429edc0e3429ac8e04663c9a6e9f3d370d815a948adda07489a7d65dec
SHA5124e96fe9ebb119b247f120c699aa23994f9bfded9c42abd93dc0b6d21134424c2c69273f9d2ebcc662220cc9aacfe56e0f6ae6216339ff8cd5bd9be1f71c5255d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cf2b04c764882942d07c25b54ad4b76
SHA1872ebc8c83b419f16ae3c633c8d9071713a5133a
SHA2560f6823148ca0a4def1d1c894b0f46dde0d6dc27ea45bb6ac82d6140a58961e3c
SHA51215c8e3eeda2e537a7636f2c0fb8e31fd7b134e4a239cf1b74a41b6a18efe4858da1197c2ed89705ca33410b3bfc3c2ec51cfaa84447315c5513ef0c4a83225d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3269c6fe5e992f0e4a15cc153168ec0
SHA1410b89beacc3577339055f4ca4af602bf5e9f672
SHA2568b6457e905b3293b5082cf52e5dfaf9b948ab3a60f55794f17e7b2bc91c1dff6
SHA512237bf5f7eac448559e209ca8d6aa98ab26c43b93caf2c7f40c7c0bd3ed6709bec67ed00cea625ca4b5641e6f2aed0b7a89f555961a760fddcf2d8892eb804387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3fe0577552d598f47b60a4f538b5d5e
SHA1067f58581ec490bd0932dbe5c005af08b8aa8b63
SHA2562f0cdebb9acf0569621a83b8bb3d542c92beb92289b105731167e9a14583d409
SHA512f229706af339ce875dc77e60420d0fd934bfbbdc1f91c4023c1772ed113255db79aebec826dd733d2e360eb0990d5af2ea678285a4f6ea78f9fe221113aeae19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7977b849ca7b11a42b85015e0dbde89
SHA1caadd1ee351e183cc9180b5b3edade17ca8f5ad5
SHA25682c2102390321e8460c4289abd6e38aa3198627f83464c4f53660834a85d1737
SHA5127d8109ff97bf50312dc4f60f619c83e8aae523c4e930d88cde3a5caee293e9b1d4899ba5762c161b14fa58061a263361ef59127e35977574e8a9ff2c9bb3e0ed
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a