Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
3336a25764f4919443fbc6757105398f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3336a25764f4919443fbc6757105398f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3336a25764f4919443fbc6757105398f_JaffaCakes118.html
-
Size
99KB
-
MD5
3336a25764f4919443fbc6757105398f
-
SHA1
6053362c74a42b19301366ee6cf9cab3665b976e
-
SHA256
180248784d23817cdc704d6f5fd3b6e45bb3f51458a4c7bf41d203c446391acd
-
SHA512
0214341f150c003cce22ebd7da49bfea2ccbf45ebe35886a4395fa5eef992ec100a69fbcacee943a357b1a1cdedd0bff5425fea16c7366cebd17f48c2764dfeb
-
SSDEEP
3072:jTmyH4y6hLIx2crUg1GzeSFLoIN1KMPy92olCttkcu:+IcLIxyHKMPyQQ
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bd3b417dd2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000eb22deec0cb0943f9d70648c2175e7d63414fff485b6bffa5260637d4cc680e2000000000e800000000200002000000037bde91a3107728f0a82058e05fa41be64f05c53820b7d025c738feadf45568020000000c1588be469e5423d4cc30ddd2c5001d695cf2a170e37f14970fea56887f24f9b4000000012834d66593854cd8318154ef5c40030b7add26087d0d49067568e2eaf0f48009316c82369bb1bacd86b82ddb2e818d7ca8a1a676ec303b6826b49c02d92327b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000060054e65780605e504d9bef74835d3f8d374a6c10f1afa4a94fd33d247ffbc27000000000e8000000002000020000000b53abd1e6501c791b9691ccc27db51daf205e36eecc7a3b145713a7b83db3d1890000000b1880413ca4dd1e8d7886b0864cebb57d7f468aeb64e63055a8cab9952aa50ee8cdb2ff8323fb95d565d63b0d43e78fda43d2141c4cbacbf54d5e616e20e97e7952c417ec09ee3516e74c951fc9572ce9200213b30c8f916889437164e430060c53c0d43ec5c26113ad097f1ea804076603f8b4aeff586c2f9aad5e8e56de9db705157d360e5ac5628b811ef98c509d140000000918e4ad68f2c85c74b52621f6c78c6e10e3db303cb00b9e7f6feaf0e6acb9618f0b7d2985502fdb760a447a91a77f418b7dd33000a611b906767765cb4ccf025 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426745666" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{689CD2B1-3E70-11EF-9FC9-7AEB201C29E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2156 2352 iexplore.exe 30 PID 2352 wrote to memory of 2156 2352 iexplore.exe 30 PID 2352 wrote to memory of 2156 2352 iexplore.exe 30 PID 2352 wrote to memory of 2156 2352 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3336a25764f4919443fbc6757105398f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dc8026de03cb689f11fde5f6874ffe6
SHA11eb3ef565f350c9b683d256b31076347674082d6
SHA25668c88778e0629d31553e9b5588c52ae42a8db41a17c0a858e7b9497cb6e18744
SHA5121e26ddc9aaf00678aca60e4260b9b30d5da6b09097794abedad33d56e392606ff8d933092860b38947580a7fd26aee04050d7669f076d8eaeffd0ed73a675797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503efff12dd455199b8c8ff3990c384e4
SHA1c0933df9b71ee54e10b4c14fe432c751d0d9a6bb
SHA2561cf75f68fb412a732c96f3b67538b10780f978fd5986e4fec196e05de8ce8b1d
SHA512d008a62c5215c6fc17b8f43dbf84cfe771027c54e9a32943438255dcd5c0ac40d9d30dbe12d544128a91c9db203460e2f45d269c5cc0e1624d8cdd2f43073a9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9f2056b040e58d866358db3bb33dd50
SHA1daf2468482f5863c82c4c1567979ab1aadde47a5
SHA2566126686387de4fb3d99b30d3362e9ca8e848d1b2d3aee0369acaad4da3f72317
SHA512aa407555dfc74223cf94c857efac7b1eebcc1b3164a86c35e38ee864e7746dd240b3a9183ed5d024b57b71da82063ed7ad0d3196fa35b69c5cf747e6cb6ed2f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54893fd3a3b33acd70ba6ef8fc2cc6bb9
SHA1435cdc9b370d721f770fcd19141e619b57f3c21e
SHA256fd089ea36621b5ce2b673d9cb810ddb0a4af87446090885e0daa1ea8361cff35
SHA51247464d3220a76a9ffbae40855303a341731e40e8ca3c63faf15103423a9293f563557d77a06b9f9a95ef09d4ae081d21aa4130498eb2029a956f365d73baa9e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f8ca241f878ca587aa3fed2dd6c572f
SHA1493dd6f6c471c964a64b01a567fd8448450584a9
SHA256e4d708df29b8af9ad3c4624adcecee4aab47bfadae31e173ac9d2dbd3038475b
SHA5129c722861bc64b73a7da7ad0ad5ac852e138380079b1ac3190d303cf6ca1adc6c914b74e74e56ce0c144ecfa2d363e6366e658f8dcdae52ae09a92221bc4bbb29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51775af27819a35c2f7d4123ac056ee89
SHA17850ae18bc7319c9057b62979f7a131cca2e7d58
SHA256be4b8684b88088ed64e1b3a924baefb35eb1c54b35857e65aa42698ef2e95c7e
SHA512d288a2668d201ef744ec57f1c204538b5db1c218f86736d8072ec5d911bd666186336dc915deebb70571f79a811da25dd6b1fceb0f42f9fb48bc2bb24d43be19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9469034d5e468dadb8ba5c4686418a6
SHA13bfdf0bf0fd19c4761a710e00bd2025b674d3f53
SHA2560b59a5c8b2c75179982ceab96f30f28ccd856d8059cf60c8f0ea90f016740a1e
SHA512e6f9e0f112f988f09d1e7042b037ef5977ceb2fd49b08114899361041a8516f1e1f8758d0fd9e3aaa572fa0b55c99c811f2afe18921d3b4ca80328afa6084624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fec78afdf07b2868bf2d1e241ca6dff2
SHA129d80b408bf111692ff9e289d5f6f57bcd343aba
SHA25622dbc58172e92e8495a80f52b0d5e018052ab9607511d90684eff747544df3b1
SHA512760df4d12015aa5348e1deb0e6513f828e6ee31465d0b877ca61fcc527303b80bd10039508ce3dce4b3859c44f59d07a9da93ecdabfb723bab8979c37c137192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1ef1772a7652ff1ed9972badf80d29c
SHA14f52133b6a6c07c3dd2dc147c667c5db4497e4ea
SHA25634c151a5f3c3f188cf97ac45e94f2f49d77c8f46a1d11fdb9cf9bfcc539a117b
SHA512ca215698d310391f7079b60b7f3fea13071c9da63bba115aa3c0225d0b2c2e5f60e0d5cf7ffa34786a57d945198384894004ae245267be20a4d736ad6f4ef6fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515eb00a3277a21702c5fa006e38285e0
SHA19835a04596351e9fd63769f41284e376f291ba7e
SHA2566df69f52fef40c82d32adbb7f547c17443cb03fd6a1504936fa58c6878454d71
SHA512bccc27b103ef01a1ce2c6506f207ad4da1e9883a6cee3eb32915125701db564320be72eb22030129b76888ab6eeea1af95198fc2eee3d1c1a7c11d2a9df3d405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea82cde382a38e1813a6b61fb9b41264
SHA14b8fa1b307eb385a34e467e6b5e6716ffe15d378
SHA256e06907b40ef14f222e507ab378dd436f15fc59e0986bd684557bf1b824d016a5
SHA512baf03d717216a0bb8cd13d9c977364a6dc378e7d95db257b5bb2e7484c5fac13ab1c99de3dddc080f83e6c7e47cdb619ff28e4f0ea45315b5c9795b9bb678685
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3dfc6a37bd101bc1f7802b891861748
SHA1be7fa4104dab0ce67fff0c10ca207d478ae3697b
SHA2568df4f59b35178356f322c20a2afb6ebbe5aea26dfb2f6ce799935c06549baba8
SHA512f642424bc77af33983f6cafca44d8fab1f52bc6ec9bf951f62e4bfbebe57fcad5507eb256d2e35884432f1f6a4969bb2f0a38325ec37f0c9d98df1ce04e46912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa5e9fba375c7b513873c533eef54246
SHA1fabf8d54b9c630f8dd02aada477c2cc32657c1af
SHA2569e4eb61447dda48a3d46d45222f5130e2c0e5e7b4ed71fba12606702fd803ad2
SHA512f9b236deed992112939d2f5b4a6612d1119dcfec20eab17eaf76329b6322ff9088cafaf9a145f59f01228641ad0ffd860a6fdf602f8e632d3abf3a3029214cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb28eaa1b8eee85993429a110c661122
SHA14ed33dc7ebe32bc87c99bddb9709dd614638c19b
SHA25665958a1a3a057c2b5fc21dbe78532a0986606d551b287a194972aaf9290f324d
SHA512522ace537c1e10043938f35139b093d0f84401162be2f0aa7836060c890274eb5a47972ccee72eac36c9fa20c28cbd6766c0d1ac2f8edc02de4459a9cc35af43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c23d304c3679276534d615c99796066
SHA1b2b67fa9f5b4718f422a38b4f571a324c9c629a3
SHA256f10674ac790488cea5b6df17911e3a30d3b85ef1125e2ad91878e85f31cadf47
SHA512b32cf9b6eb289501c5b33db0cd581cb21c3e3911b8c5db6efaa5beca1186b186d76ab294dc86f7818dc0da80dfd7b015fe0477ed3d452c8d1abce286a1531f02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5583bf91607ca62e5fe8f70cfc7550497
SHA1300badac544c5e04092f673797a548cab391325d
SHA25681cc685b1382478bd006fe07b20bb68769ba0cbffaf49f17e2d15232e80286ea
SHA512d8138f08d3e565e3498d55084a354cb33ab5b6c23868b48ce106266c0c25a1895abca314e1ba2a283743915915c4ac1b2c46c99092743e1e167d40260b26e466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a29c7f7d074b839ca0c2323fc8820df
SHA1d50950e3cbf203b033046cf0a8490724f3aabdf3
SHA256610dfa413306123c0e590be14c3891463e30904ca869b230c71ed6392904de65
SHA512b9439ba1966afbe1e133485332c4644ece98a1c965ab8ed6c0dbda57e6ad35961d411416b5023b330eb4051e6b3ce1b6a8681741e6884a435f8da49ac3872141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3183422a467901d4c7e17f5c3235940
SHA10c47a59661ca5b6b8327ec7e95c2a083fa7120fd
SHA25640b15c3c679517e351e603f8006b3c99dff6f275a64ceb42a18991bc8242b6ab
SHA512a5c38e0c723bf8876aa3c4dc257123fae7e35db7c076041eac5029a28033d6acaaafd2d87d79a8ea7e685414682f99743fea299d49850b49eefc769f0ae5d629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6dc3cb3e5e09cc93cca073ddbca891a
SHA1a67087115e423ae8c6cf2580dad5f87a33279f71
SHA256a66db158b771a98dcc885d80e9ed30e41210120b300b91d925a8a23308ca12b1
SHA5124602b01bb724403a9461308d244d676bbc80b51313a42c06923f7c5dcb71c66d8299b25caf81fd74d24f237f58b672d7c16938e84d08d0cf5a5526798165b856
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b