Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
3107bd8003b65c505c3882e0a8041cbf_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3107bd8003b65c505c3882e0a8041cbf_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3107bd8003b65c505c3882e0a8041cbf_JaffaCakes118.html
-
Size
28KB
-
MD5
3107bd8003b65c505c3882e0a8041cbf
-
SHA1
8b596c2c6b799318f2d404a06300596374daaced
-
SHA256
42d26d0e32eb92c417557cbc8bd1f94b859057a38dc7e3438b21badcbf034b87
-
SHA512
19ef2acb1f2d5d6b2ab323f9e181e04827ed022eec05def00456ebc0200ea6cfa10cb5f5b5c6ff00ef4d5cbdb3d07e049c88ca8e147d433fec74c215e1fae2f1
-
SSDEEP
384:XmAdk9zncl0/evn5b4a2KTqyTQ2ACuuDYJIkwdLmtztx/koTmsdY1rsS5T7SwZyv:Xudncl02v5b4CAPztusA4jD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426706372" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000300974446a25fd6f7514acbddced6420c7b7e152cffc27415c16e40589a8f29000000000e8000000002000020000000f21d477f214550d2cda0cb51afe3b6b3d4153757b6b849931778af133d30acd89000000007541de454ca2a1a89d0faee0fedbf5ae40b848ed104d36fb480c97a4c928c46dde182655a60d771964d16d7127399588829f0f8b3eb2045ab7f9833da85b770d90c027301a45a4db34cb0971ea0ca37525a550e9cb77188949e55490ece92d8e03ba1fb46663d5928918bbbcff810e030e7b713c0e3517031e68c7626b72aabdb949fbaa31ce9f803e020925b4488ce4000000066b87afd354d790e35cfab14f2f593afa0ba0f6fb78a39e50b29ea7cdc54445d702f7103ecceb1b47020be20134acb6f690ceb66656db7b024a7f0188be91958 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6368741-3E14-11EF-AB8C-CE9644F3BBBD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0556cc021d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e2cd682d1990bf44a95f6b64b0e6368be06634a5d9ad92619a7ae6d726f8e8a0000000000e8000000002000020000000fdb23ce3f4124e2fc0dcda8e105819988713e078901e15d2be7cdfd024f799ec2000000013401cc7a2ede2898f42f40bb0c48bb9c975eae319ce9d1e29175da73cca0f9a400000006117609b63ab7527461782f73c3208999032245072ded73d8cb1724b96528b7fffe427999241f76eb3ec517bfef0a840b4084954012ac1496809b16464b667bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1636 2552 iexplore.exe 30 PID 2552 wrote to memory of 1636 2552 iexplore.exe 30 PID 2552 wrote to memory of 1636 2552 iexplore.exe 30 PID 2552 wrote to memory of 1636 2552 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3107bd8003b65c505c3882e0a8041cbf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5638bc154fe6c11ad739e7172cfa64b23
SHA18bd505021f6e8a504b64ff430357ecb970408c5d
SHA256a1639a43ef804017384f28accb7a87154488022a8a9450eb0e2f852ec8fc1023
SHA51272b0253830cd94a1f3f06b4964392adf1971d1d15dbf2dfe4f794dbee0007f51a6c1ded34721c0ecbb08bc73dd9608d29d52de94bcc48100f5d433e380531a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500aed900e993183c5254651165665a46
SHA1ac31c9a8dba796b4bb989bd08f9519e1f2400d55
SHA256e661fe226fd20fa2e298625bf09ec853b0ebdfe00267bdcd9bd1d35d42639271
SHA512f475888f77ee67d39a6158b131f987a6632dce592fa29f4663866a7bf505d9a752d8de5a5fcfc298acd3dd84c338b15f4bda5905aa099efd5f30b4d7e7f75b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed154a07a42677077c8b2f7f0b2fc9f8
SHA1d8d2937b2c93f48a804c1bbc1dc8af9ea0f77a53
SHA256c52df6380729738f4cce558bf8f7f21dc46c238c429d0f9abdb7ea36b425840d
SHA51202620c7baec2b61c5dbaf2bfd3fe917c514b8db9cdeb946aa5a23eb37d56d815544154a0060ee9683fdbaa9e10b67c00c187ca7265960072b5324ba2f3889215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5286397037af47df0484b62a8d48ac63a
SHA142831d6668e3dc3692e732e70d6c25e6b2868f0f
SHA25698c7f0a86f4e4a045e4de47c1c649c0b2b032481546b74d794b2d75c3a136fd3
SHA5120ddd30c9667e1354981a6443dba1709ac4fcb297fb7760f20ef2983ce5c8252d3c1fc9cebed6089afee07877d596b9fa570217a1171e1092634ea4163f5ff7bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55637dcceb64c680c885c2add75677a20
SHA125d779b062abaa5cf3323f0f90e7e84332cc5f82
SHA256b0cc6a1e1bbbe080b43462e273423d4dbce2cc9e8f76d6831ff65d4445cb58cd
SHA512778bf12f26470a50a78f9da69c24cece6279a2ab5f9276d400a19c669da6161075fc405961c4dbeb567f590f8f9ec6397e8bfa9fca6fe04aa853e62885382432
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cdfce37abf6ebd74c8f88329ee04954
SHA1a8645f0b3e7649ea48fd4fc2aa0df30b930a13be
SHA25689b33e7e3fab308438274b864a8415ee3a228e161fb82ed36d9427a8ed70a791
SHA5122e2238a002d8b3047fec6c0241e11ecbf88d4e99a3dfa3c87f40ccde69d14a46218ae33376380149ee73097ff3c694a4af1593b5eb6f996ddc5afb16d678a553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e784fcc396e24af5bd78e62b07a7cc5
SHA1baa2469aee703c317bb9b540fcd2d0dcbf54e793
SHA25631115346f204e6c847379554f63ddd822ac7d59ddfeb7d84a6431e557f77a398
SHA51210e2572a820cdd8f596dcb6262515babf032c3a99c4fc03ccc856f9333c9b86dc8c8371bf819015466235aac77ad0424e6bb54788561d21307e4ed6172654d01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548b23cf261f6a78e50ee21d141b3486b
SHA1fd457879ae1178bd61d99a2673de4c57eb4428f2
SHA256d9a30ebe27da92d1c114ebfd9c455886c10118f607ea1096b7371d13010061eb
SHA512a19420c2a39f0c5fda443688cc65d7e9e0f09edc90dfe3dac28992ec2d9bc017c887c78938170a13e781c6526f0067b25ab99c782d25366a224505923598b9bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586c9683b54629b4821fd06437a8b8950
SHA1edf9f5ca725d885b723d398ffb5c5e7fe1a8ec53
SHA2569472ba285fbb4eb04258732748a7c5d7a3450eb8874e0d5636dd2fb155c158c0
SHA5123d76984c82ef2a0ddc4c9bae5a8f12229bead9af6563fd6a6c1a1e805ca8924c55f6c6af2e3f697bab990c159223262210e41f9c983d7ed7bce574d9788444f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5978cdc7502c42a71c97af7af28aa2d87
SHA1e8cc00a6d007027ff16cb4c42923c37cb97287e1
SHA2561071423a5e497d59d5abdaa33e8b36d9781cc167e988af3d0c50310469bcf865
SHA5129dc6f8be4564288ca291d081071696448ffdbbe9c91cc4f40b9ea192c37aa8af72367d4b04fed2917d19fcb9fb5681b0c9adff3d74d3e59ae753b4094c57bb42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d222a51dbb8d9765f844cb8a463d858
SHA1e7cc841a55aae0e46dbc18aecba6a11c684436f2
SHA2563c55c5d06e2e20793986c4e277e83c11b2a0c26daacae72f617c3978aea87b19
SHA512caa88564ce0f96b68cfa7161e94406d4a73a8e4196e01440215089aaf4ca657a6b2f26fd7caadb24e6083ebb22ed756fe15dcea53c3f317f4d6828504dd606c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e9606d93f9f1d032921ac1732f7db7a
SHA1c21cbc482b04b3645f71b865bdc05beec97f74a8
SHA256eca2357855dee031c973b05704017f81fcf5427086c69dfc6d885afb99d203e3
SHA5127b7056231a58fbe83e8aa551c1bc4e87bcbc21ded69e28152fd10170b9e0f62ec8510fc34ce9fa133c19ea0dfba28d1ac1535322f98103031c7ca86f010ed90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f61f3bc25d221d5825c93f03b46852e
SHA198bb4ac74b365384b2e5d67a2cf9e4d473d254d7
SHA256373117acacdda49e6a702e4e924ac0022f1965270c7332650b4609a9e3c663be
SHA5122942389377cbaf17deeb24ff21de43389b3b637264861eb7847fa82bf9ca7a34fdc89139d8f2544b15263d707831b1ccdefb95e6846edca70cafab2ccdf09521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c2e683293565768ef04b833e1392722
SHA1e630c469c2bfdff346b3b598aa598fde81e9a90a
SHA2563901407d6caa89a79ad7a39d2bcfed639b6ac5cc71bc51dcca2a4c19e3a432aa
SHA512b546a8b5127f630f1b9bd675b7ba62ee7e8c12cdf87121ffe80cc27f202f8ffb97a3ae8e720f2856f7a01a1d33ab9a3119949145a741817f6f72db8241160efa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af041e95b07cc2a31f3f72b46aa1ee93
SHA1d0f83f9e0cd1eeac7ac6d10e88f79f8fadd00f8f
SHA256ceda303fd1cebc8df75b88c0e30ec4dab2a8d80a543c61481cc0a5ebc966ab67
SHA51227aaaa7cd1120e551cf0ae870d657cb32a82947b5ad21d0bc320747e2adca2e2b12842b0d19a858cd853253f39d61dbfb3c2a5496e8c25a8c10be855aca66526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a67c7a0c0be1fba07b4a4006e619e46
SHA149318630d3f43dba84762824323f11a958a60b3a
SHA25614f255d757b18ed266d148937be4f3578b9c98c84322a5c74a7ab7b036479ec7
SHA5121b32c0cb83259c2082a2f7aa8867373bef8767553f7083e2edcf0ab597d82b6a3370ec2c6e2eef11a17de60b2cd86d5ceb2f98a86d2a567f0ecee0c099ca85fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b3ae38e59f9611f38f7a95d57414536
SHA1bef1bd0835897af1c48b75b0705806b8acd9f05c
SHA2568f38d44a6a542c0d2eca51a83c9ef3c713c1e11df215fd0621f9b0b5a7800cd6
SHA51264b7418d84ee9a59cd07e1e2d8bbde104e241a247741fbd58291ddf49f73318488a57ae9e34806981fdaa9a351968e64398b7565dfd2055ca08b9d428e3c65f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51943c054eb00e88671484537b179daba
SHA14e9e004202bf863a8ac660f1bd420ed1d570e0d1
SHA25681bf0c2c883592566c365079e58eeab8f72051dbcccccdb63c8335ad78d9683d
SHA512840da87eae367f5df4eb4153d048a9bae0737df91ef3ac7f631c753e37b10ff91a6fe100b8370d8c387aef9e3785190622c92bfc3a4f45fa2750c8fb1153869b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b