Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
3252fc208660fc944ff9f5c662f8d81f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3252fc208660fc944ff9f5c662f8d81f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3252fc208660fc944ff9f5c662f8d81f_JaffaCakes118.html
-
Size
6KB
-
MD5
3252fc208660fc944ff9f5c662f8d81f
-
SHA1
4ac24a70473331e3e10671138fe816ded7f89bd7
-
SHA256
581a24a2df76cf0bc49199798949e920a050902c8aa93a182817115b5ce2bf0c
-
SHA512
296086d40ccb4f0a57e20bb6eca4ee34ecc942202febb59a95cf502fea68eba08c883f60cf6cfb9855f0255d38c7d332fc52a6dc09b5869633ee0e7a7d6433eb
-
SSDEEP
96:uzVs+ux7UeLLY1k9o84d12ef7CSTUa9ecEZ7ru7f:csz7UeAYS/Qb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000021ab1ff5fc6ef604c66489ac0e034859cd246030509c6c01651811553b5e521b000000000e8000000002000020000000e2855825653aa464369d909f9f8c912615e5ad90759e3e85d12340b27e8c0d112000000092a8e309ac08ede96461b21f21acd05b3ca8aa17a5a43742d63d84f86178757b400000002f39265103f0a954ba2ecab1c63986efec7c27890eba99e04853892214c3128875671801a1361be9ec2fd1e16892db49a5c4e4d3d2443b4c0ee3ace007c337f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426729484" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5074f39157d2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000030e07092503b7cb484d6b024eafeb982afd6e520bf2ba644f1f4c79ad0eff81f000000000e800000000200002000000033f337c4fd056f71a5792286a85a2b83ec47e8ebb9b57d877f948fe9df0ca84b90000000970a05e2258b3f8e070a4e1cbb33ecce430c25c3b7fbd17269c6b8ff0cdb6bcabc0e9c32e1faa3a3ae3a78f189301b23d3dfb1d42a210cdb46a48b9250c5f00e229df417a0a45114ef58d509504fe3b1ceacca040a1d816d7c4de5183570a53ae58b8392e4b7943774de0af5fc1d57bfb7e39adfd998d4530e13eedaf5b2ac04fed53f3937e13d2203a06a458f73bf194000000028308c52243a0236ea3749aad235bcc45117a0883081cccff1f39524ff80db584dcb5a452aa3bd4f815e3931923d403d2a982fca2343617099800d5e4fcee177 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB5E6391-3E4A-11EF-A5A7-6AF53BBB81F8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1900 iexplore.exe 1900 iexplore.exe 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE 2228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2228 1900 iexplore.exe 31 PID 1900 wrote to memory of 2228 1900 iexplore.exe 31 PID 1900 wrote to memory of 2228 1900 iexplore.exe 31 PID 1900 wrote to memory of 2228 1900 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3252fc208660fc944ff9f5c662f8d81f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5952859bd112c93a2ef19a532e49ec6a9
SHA12404ffcfb3056cfaa91157389a45c1c5a48dde9c
SHA2565b94e432def80f090a620c7a683900572af91822e155d13f4955449719278de2
SHA5122aec74b362d2b4deaeb128922c32cdc9e12841d23ac31ac466d714d7041eb72b81825b615a0c4c2be7aefd3b46b3e6630f554210cd84662f6e6751184bbdddaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7145760de3ad7dfcb66eedbb7c4a72b
SHA1c052e734e4a5417aca98122fca787d17de43d64f
SHA2560f65a0839877a87a0d79e6728dad1ef3b212f7e8ad41f33bc5134db16bfa2690
SHA5127f45f2bb5b1187e5a8b29e6180a43bf9cde044350125f0dbc2bd411955804aa262ca6e6bb45dd83142998e49c411fd80c3cf69224b6941ef8366fc38f420ace2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576784064aed0ac01f674a184e774ae45
SHA15e3ecffc46b7dcdcf8454da28ee20e7783dab57c
SHA25646985bd98de19eb44b58f04689c649c527a5ef74ee90a9cd18d907590c0a42e2
SHA51282a4b5609f6435d4d8bd6851efc3f1c48290db6d710eef585f92bff16a2c15cc3f4ed12b7a5e1c0b3b3b0820b0017029c5a7ecd1ad1e6c5e581e2117ccb86403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8cac058c641777a758396dc42e32e6f
SHA1bd4a7cb6e917eab9e42c50234bc513f802c4120a
SHA256efbf3b670e3f51db9de9c2a4500c3c93a58d5e4216882eac65740f045478ff85
SHA51297ee3f0ca81c8ecbcf988ca2eb6e7e992db7c5f7fe366b895e9ae0396859532d487282258058ac1d3961eb388cdc7155504bc3c9b288a276e5f421afab36e548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5ad76d7ff659906b85584cfa7de922b
SHA1bc3d79d68d491ee5288a2f0d7bdba4ac7bcc5b39
SHA25682248d98bf865d1ee6b109841992d7a30155ed9b77371aef7ef72d897b5df51a
SHA512def5341f8cbdb84f4925d95c2e1cc211ed8f3543809745dd56e4ac294678c4bdc53f2541eea82c72674893e10ebd3923c768f2fa84ca02c9fa2e8fe2bfa2764a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd0d71919983b4f871a2be599fe773e0
SHA1cd3ff9884f4846f94145373ed1f42aac97d7e3a8
SHA256a0cedf0d8656ff2cfb633215b6d8a3a42da27c6d399b60b3a12b6797563af22d
SHA5121ed2b648ed96ce6ec74653e3986a8938f1fd1336a51cbd5f84efc7f8bf25475b011e8567360fcebe2cfb4eef740b8869d9c17f2da1553d6c9ab810143567defa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591c47c17a8ea2b70ac3b66ea774c14c3
SHA10bdb9c61d28131104fbbd04ac367133ea94a38e8
SHA256a22d56d77a2c2724c92f016e20e1c9c9a0a8c0cd588334ce3ed79c99cbcc8463
SHA512725d2fa9c17572916c15654c04bad9bad42914746779993335aa6f8d3aacf39880f4c67db1e2df7054289796ad98ceb06ec6cce0368d36e5cf11c80014562d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fd55edfff1dcb326e7e9a0fbb568b44
SHA10cb44e97d5bdf4a330ce80812dc85a8472694635
SHA25621bbe1217d96ee989b921e493862797983930c054b9d1347a5927c2ff92cc77e
SHA5120e925b1e6df25969b944849a37006f75c620f6bce5b459ea90399fb2942124f1345d9f3edfdfe79a82a430cd45833987d8e7ec4a2c302675d5269c2b5834e44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b986748c73b1bafed052af4231db199
SHA176aab18ef7f9b6bca3ac97528eb8108e802c5184
SHA2560017995e98ad6d8550386099f4cdce5aca7fae057b26a67b0e5f2db07e93eff2
SHA512a9308e25f306998ca7566811989c2db7ce7172ab157a1b51031016af13668f4c803fe183602fe98f3d232a8cea3781f9caed672cbfce8baf604792e57059c14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e94ff5883f41a4dfd66a5b71b0c77a75
SHA1cc5806e7573f23d37643d8335153e0f25e9da202
SHA256a11449bf2d55e692609e8b7cdd084470964c25923ca37a0afed662e34a7c0131
SHA51225c919f06cdeaa59c8f1b0d1a58aada689455f4056b17ca38d92e91d9ab523b77baa7d4cc2b1d3fc963739a3b511fb416c73e4067a6b584e15c69acc2a73eba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505b9edb2ec85cb67fa7f831d6153ec35
SHA118cb2b491c0c2dea066f8bc80f71285e5453d95b
SHA2564f2c323048cdcb72264435ab447bf18f5498813f9c39170ffa93efd173235cb2
SHA512b0ee4ddfd4de81e3b273feb5cd86704d982cd671ee2ade71dc6a215449f0da4bc4ed05a7a8003542ca6ced6bd16a4ddd644711085286756b41dbfcb128cc7c43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b79532eeffc8c5425e4bf87d5c76488e
SHA1a03f441f1efbf33e1b5b4077ec57ed82425492d1
SHA2568cb0c20def646a6844d6304fa1bfb044594974316d22314060340c15157690ed
SHA5124ce4bda0de0bfe1d8c47edcb23a11a0431bf13a84be60fc780c2a9f653bb992c065a3e2d96d13c1dae668c20d8933bbcabed2336d2c3236b17e0b77108cdebc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585172c1a8b2943a0add4c29da769c7f3
SHA1745fb61ffa712b035b22782f5a127ca679f14f32
SHA256c81baa208a208a8f20a36ee438539316208cd8382e57c8639e5a0229014ec2f5
SHA512ab578a0a0a8c439f84d2052fbc5a7674bfb75800f669eeb496640b5e9d4fe6ce5a879584b69b25fbdd481a72c3be82663d2eef54bfd562dddee8b3b8d9909b90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9c50b400f44cee4832dea50cc23d506
SHA154c0ff224a00ac55d6fe9ee9b1e8831081a4f290
SHA256a25fe23d69ac631c9d136a9d7beadda39d57549db0f054d81ff1b22a3557e4f8
SHA5127d833250c74405db0cfc289ce295cc9373a2e7be4595edd6d1f003212b8d2ea5c5cf0b91ab2b13c095dac56f75cf7cd4c704a08a9ff97dfe33373aa7720a865f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf1b8793371965fe3cd4e91e589498c7
SHA12024349b89c5aeab39a62c8e1464be3cd4a5987b
SHA256fbebd2f9d2d77e522f847c5a90f0238cc5b0a0d766fcfea8241f171e1addd5ba
SHA5124445c91a8bcd79770ccd21d33560d479b6a30b92e75d30fc7f9d350c94bac857e07418962f8c03fdb6d2927317830d65996f2dab98f4cc6b3ee1962efa025217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5775e46939b13311a2b1dca907af490bf
SHA17745b924a4487c19260ded9d6cb73cf1be4a7059
SHA256e0604abeee1c1c36c018901b7ab229fdf8025a039e63cfba251c40d5ea5526a0
SHA5121be41f01236621bdc0e7658f868123e875857d44b13438838853549b82665933adc0d97e8c25781defc68cf038ae9abcd75196c7812a7c30b6584d93076c4a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cd6e1bcd6f9565571d1e9461cfe8b1b
SHA15d16050a86fc4e3cfc8de2f33cf519aaca0140e3
SHA2565b3efb63b73fe888487ca096adecdf9005f3ac8cb44049470e9bc49fcd4a9a0b
SHA51268f402fbca4bcdf0603dcfc132601d0c76f1460bddb073ecb259180ea53af3160dd2c3a3b05e0420ea41940346128a9ae703c17577e70ca871dc7cb84c294fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531ce64ca775833bbc35d2d9305ab208a
SHA1de0d243d9066a8de64fb467791b3537a1583b335
SHA256fcec52c7eb0dbc31c73f0dab71fcf843aa47779702d9155f4187b62ac95f11f1
SHA512b99ef3995f6e93f2ae3fae3a2113e87517d7877374d141f1b28e810c42a4a018b9ac5e5695e28044ef7023a95df24454f4b56870070d855ef01764b79c9fa393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5516f78c03f8897c2c6fd585d239ea42a
SHA1f867f8825fcbf40ca985ad155bfa7ebbb9e11944
SHA2565997034eb86a3566fe71bb1255d52c6fd4981d4a1e0c1809fca445d776658bc4
SHA512300b248a627a94664341b74a386d13684cb2fea278941523d7068fa77d4cff1218a4dc825757cc92f83fc97b484ade46a0644f112551f207234cde8f9b234dc8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b