Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 10:33
Static task
static1
Behavioral task
behavioral1
Sample
3007d290272726a5ee7696c0308b8662_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3007d290272726a5ee7696c0308b8662_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
3007d290272726a5ee7696c0308b8662_JaffaCakes118.html
-
Size
9KB
-
MD5
3007d290272726a5ee7696c0308b8662
-
SHA1
bf15071d33d33b6a26397c472e29afb112a0670f
-
SHA256
cf67d457e47f46193a91a1e358f4b8d441ae54f0867dff1ffa06aee4adfdc158
-
SHA512
9ff5d016f131cc7999c5a4a526513583e9a97bac2b67d03ee3833d8e36f4a2b1f5528ede7ac172420bd2598267000ed66f728d9333650db62dee1fb597f62faf
-
SSDEEP
96:uzVs+ux713LLY1k9o84d12ef7CSTUHGT/kQhpUlVHcEZ7ru7f:csz713AYS/i+UPHb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426692036" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0da176000d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000b049fa79193493e6dc731c59d2c72a76912eb57f7927615ed94fab31f6bebe9f000000000e800000000200002000000010d42ebe4887adf38ca7fc0913a06550c4ca697ef25e10d74ea5f93c418128d5900000005cda92e6602e209823fc6a1afc310043c025e0c25fe0edd5f6b660fcefbd18fd5fbf98f38201d034d576f2779a635867c2e121a69086ad807d1bf4ef37d3c60e7be25c67451980da582e15e2fbc59c505369515a455b24cc5afe8fa49664c3bd3825915cd145c7f7edd73c9ec79f9f2dd476ea88090efc4e61827aa7fd15e9ee3a880f14bc49c6324920bf6f51ead8a240000000c4078770071742964245f94076b3674f7dbdad3146304f17a58f188d0dee6bffa825ba0857e129616c664d836fe1a5cb735e5bd162b5cca09e6ab939e692208e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000013352251d1f65dccafdaceb5db90f43272415a8e512b3c629377e5fe2e06f7c6000000000e8000000002000020000000db7955a5432959a1bbb393eea2cd14124503df6676d471aa5228bc531a9944d22000000012aa83ab4eed12b5f24f005f0c640e52bc041822289dc5ff994878915a9b720940000000e7bec8c2c48f8a934cac2f1f6eebde56c4f813b70259baeb6eaffc3844ed79bf325c8de8214bbb5fdc1934fdd23f577ecce436a887d2ce2006de55c93f2a90b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B2B59A1-3DF3-11EF-9A38-5E92D6109A20} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3040 iexplore.exe 3040 iexplore.exe 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2236 3040 iexplore.exe 29 PID 3040 wrote to memory of 2236 3040 iexplore.exe 29 PID 3040 wrote to memory of 2236 3040 iexplore.exe 29 PID 3040 wrote to memory of 2236 3040 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3007d290272726a5ee7696c0308b8662_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7358276e04c7350403c2dde15446276
SHA1bd484efe5155820ab00230b5153bf86b77a2e754
SHA2569d9ec0921ff3166d469e2e0a0a65bab37cb61ade61be7d92b86e7f2f96c31214
SHA512e26afc1638e18e84d62e21447086ce18f45e19ce704340fd5fbdf3a42213338d4f8568fa81f8c4670e2458532207323801a47f58ecb1c33aafb6a3ac68efbab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d26263d94e9c8d068a0f52732eb2f38e
SHA1c81ae5af88c68e637b50c89043a7c691f55d0cdd
SHA256ecfea1f2a10c118468692796d7edbb0ed624c0a2882adce9fb47f1575a128697
SHA512e602c8031c647e1d381228264c67a8dffbb8252cc466c50af92664083002ce97173177c58ca11927231d1cf4cc9c643037c2e3881c13d988e2b6c2917e22139f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ea39e0407da251fc9860f4a2c25b52f
SHA10ea0fed705b44f21e10e2ad6240d87a0b3146b54
SHA2560ffa56c4726b459dc57992530ca7267145e36aa43ca8da54460a0535841ac992
SHA5129a7c8b0549695f6e22cb20a839860c64486e2c4be879d4bdb05fa6f362d125aa509d163de253292f166e5d64ef0f070e509db7d87887eed95fbc0200716cfa7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50718efcb1d96cf54ddcee9eab197213a
SHA13523cfa7f5cb53da884649db63ec5e1a96b34d37
SHA25687274d9241670b5e4d11a3ca9ed3544cbddd203d1bf6725a6edebf542d5866c9
SHA512329e2682927b289df084dcbf626780c595510bcfb29a66853ee1a80ad9507eea569d5df14fca21ccbbea2638c4ebe28622227a3e0ef1e39e01735e4a1f28fa29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53074d0da46a6cbd62f7bfa6966402647
SHA1e581e1fc3a93e266099392bca2563b84c6644a44
SHA2568bbb7b452b7b91474328ffb211cff086ec392e4cb8116f614e0161da9f8f80b0
SHA512c33ad1ed70e6ff80a25b7ca20a4c83c99c96b145b606828ad5085af4dc0129e94017718dbfcbda2ae417181f6f7755e10aad66706a67c743205ad9a4342c3f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dc4430f5cd7da784c1233e9e3e5a913
SHA13961f465cd7a0432f54d0984fdc512b389948671
SHA256d28f786ef287d30cff62045ca8522fd08ec7e99bdac588fa774a8cb830890743
SHA512881eca771834cad3a81608ca1c959b21cf365938244a5726043219c237e023f56209314748b18cc511932cb31f7a5bb2b6fd5433a2c41adc261e20f74da93a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b81d01c73054d7eb64a860bd35aff0e6
SHA165d59ebd61e5803516dbb32f344c3104511b5abf
SHA25650d00c9b0d31d9ced83fbc52d44a8cfa9d163c808849cee2ee77f72cd08319d8
SHA51264c92088546af449dfd827f390e747c3f123f252abe02f5166bc777d013c68816350f6cc6355fe7e92f84ad75385419334fc97ce5f757350472d0e4ea1c922a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbc06664063a856a5bc9dd5bea74f131
SHA150ae2846c328bca952dddbf22b7bf0dd80633152
SHA256edcf4022b9c181390368cd5bd380b53c2c702c62f93c0ad88e4e2573131513b0
SHA51237d8fba37ccbf322cbbca60d4e41b48cf98ae29074721735a8db006f2e5c2df3351cdf52c17258e35b8997561a07200978cb1a88df152ab9f729924560515bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ad95ec3eb3c1ae3de232a202a00f294
SHA1b13a95a8da8aee3eaae48443c3b548f8c2017cc7
SHA256a4ee4820abe7597388cefe8da41475948d1e6eb0a34cd4968e86a839ff286fbf
SHA512593fbb96519109e031b267de4312cd7bb6391f26c422d416d102e0ddfdd14dcd3c836d3543fcabca1e3912d59a6d78fcdc65b9a40438bc1145718777dbe82e8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9fed79482350174c060013c057eb90e
SHA11c958a46a32453b6953c74a4aea46c38d4c25452
SHA2569a6f6c581d4ff2b414855a72d71d85fc5d20c7ff61b2329c80c0291b13e9f3df
SHA5122662b003a366e9c14b10dcbbb8486c438a4221f1c6077db67cf7e6f7c99086783ddf30961e97983750e41295bd88da1ae281be67d7c83e37b06461e9cadad6e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57be3d49acea2e5589b230ffd115f855a
SHA1b80cdd587318633efeb4da09ea386d262b860499
SHA256f3081ae955f28a82cab7a484fde80d2ffdf031bdb360dbb828de7944f8b629fc
SHA512218ad0e209dfe84fe3aa78922e3c00abf499a9bad0eb8ae0cff17843510737814ae44608778148cf47cdc011a8c80bc9784149b55f23466514806b6426a22a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d6e47629b7589bc41ee471ea3b6a1e0
SHA1a52ab3637db0c5f5425d3f46049a8d393be14889
SHA256dd325342d83d73d44e79763770c0a7c5a4bf1309dc1a9c7756f9ff70fe0f5dbd
SHA512a09d456c3cbb88d3a5bfc04ce419f826ff593a0cc45b097c9127caf4058a6728f3700222b9e4467c3b5b3f39151255e299f2a2b07f147326b8a125a3392e3c28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bc1713ffa6382e38b7ba67cd39c3cff
SHA1787fa3e7242e4b484da5fd9e38c3877c6ff4c25c
SHA256b43b9f20b97bf3df8d91f7faa215ad75974a314530d621085c3e78431b1b6127
SHA512bf759d3993310630f1b6f808084515f451528a059de71f48363a5ad3ee8ed9c79fe66a07f1a12ac91af7c46638900e386040d30fca8c58510e6a82325f9957de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a529d4db21fd094bd88a4721add1ef49
SHA1c2e66d1e5ef7a2fb9774b7c6e6d32d998b393c51
SHA256a36e7cb31547391225540a6b791ddcd23e5acdb58dee734d82183ccaa43d7ade
SHA512f262e6bb330d9900d27cd7570039fe1850810a0a88840ec3b5b052753fe383bdfbbd812e2bd7d4e6f7ec43f11e6974b7fc69704345a5ffa654d1f33180778606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596ba82cb14af499475828fa4e3498559
SHA1a3ded46d9d60fb181f18f64f62485cb4d8781649
SHA256f7a163c3d3bb45adfffc705e7dee121c655723e06e0ac4181fe1f1eb91d860e1
SHA51231bebb3b1cb60ad8f0884812e8344283ce4db8ad27345083803aa9cb91179bd7152f6e921232b5f0cf20a0b851cbef69c09114aaadf5baf3f6e0b8f09e38374a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b79a02eb19943ab4a233d77844d290e
SHA135bd8a566be60f4888c6f0b46a31f843590af35d
SHA2564d5b13eb71b8509dbe5e64b352348fb61cd57ead836fbbd0a9037a152c8aac82
SHA512a82e431541d5b80d756a57d955fd11a053f8f4aa08f4ae47ec6490137653abbf1bb7106b5c09110782e1ab61f13f1d2b48182868c50dc4162377fbb70988c96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5900968fde9be74609265ffabb105d203
SHA1683d82dcd3579647e711efd72250d5e61744ce0b
SHA256ed14c24c82104045f124f67613683f90570f45635933ad7942708d02e71394bc
SHA51262a25778a8dbd76891946c212041570b7ee0667a71a7a5c4053dc37fd3d4b192af31f011e553cc430ad46fcbd3b827b14184ba391ccad2e7540eee3dc68d487c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a8f8327a8876603bdc12df130471501
SHA19dad070188fbb4ca8c760206d93a74b760eb5f59
SHA256555d1c60eeb56c4ac83794ee11070a59aa778cb44faa6d8d6691199cb5d2659b
SHA5123f6d08767410f6b044045345530cb0ee8420833a23aabe3bbf78dca0dbed951959ada6db87633035bca3aab0bfdcfa4869fdcf12dc42199559d030a6ec4e9f4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbff76b7f269ff4d6c7130e54a5acf40
SHA1b83169ac44acc37059395b1614b82341b3fae0fc
SHA256edbffa32bf2a612b7b2fdda4fe2d0b5c56fa39f5b67b7bac6c57f399c38837a4
SHA512f5015b30b1cecf1a81a29b848bb4901db34346da2c979f2fd2b923e9d672ae6895137d9434fe2d9956d90fb27056b2092aa94b6ce0b6792b472bbce1ee1fb044
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b