Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
35020d87835f1a6ef1edc007c258d5a2_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35020d87835f1a6ef1edc007c258d5a2_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35020d87835f1a6ef1edc007c258d5a2_JaffaCakes118.html
-
Size
6KB
-
MD5
35020d87835f1a6ef1edc007c258d5a2
-
SHA1
08fb498f1d2278985e3c671298ba6133a9fa7a57
-
SHA256
ce92e2914a0bfbaa83e2a66f7daf9b61c7b5a3147fcc782cb386e72998063a0a
-
SHA512
3752b45822a3185c56035b20370955b858e22e5353a4f6864b65f4f0e144cd522adf972159d1cb091c1a81d7af0a8dfd4e66cd3bc3082a63245f4c976dc536e6
-
SSDEEP
96:uzVs+ux7avLLY1k9o84d12ef7CSTUB6o6M6dcEZ7ru7f:csz7avAYS/Tor0b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000c83b1c21678d5bcc687d5e48e56ff48cb4377d8f42dddc51b6f8c3f665e48dd5000000000e800000000200002000000008b08d8579449be025f78530799477d39100f600dfaa731b31f7e9ebf92a2a3990000000983aef5dbee4a768ae7e8c2d5cc74f8774108b62f9b08ad8cf4691645da38563728a11f83c2e30631188c55a4d5c9644e62a4fd91845f9c268714cb92ceaa33778dc2807209da79f3bd6c2167698d3c5384b4707a84f61d7962e536a7d89022afd34200ca272598d08d637a5be08102463b988f9015ddd95997e47c0e3bbcc7c86ab43df31fba65abaf94917ae790ca0400000007859ef70b0e5e7f141415c2d31ea89683c10d4635a1ea9c47cc70daee9c5ac8fe3cc53c542bbb4848b1e4699f1eb692395eec98d0d3bd7261a94a56136b032e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0251b1bd2d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45E59D11-3EC5-11EF-B4E9-6ED41388558A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426782115" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000001899314661cae4ed0460c0e6f1398c6297dd4b17e18144eb2708b51f6d660047000000000e80000000020000200000001f4a08bc83fd5d530aeb1e8dc4ccd16917f8a6e67e28c4b087f1443464f0c60a20000000c717b27f215e0bf579adef2c9e12d057d76f44c4688e492fc92ca84e15bebdee40000000112b30a0f413d06aa411671499ac08e31dcd1d7ff5ab8f12df809e16cf733372268696ecbc770dc00b274d0cc4cc6ff080a70388c250d8bad6bff98132b5370a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2788 iexplore.exe 2788 iexplore.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2568 2788 iexplore.exe 30 PID 2788 wrote to memory of 2568 2788 iexplore.exe 30 PID 2788 wrote to memory of 2568 2788 iexplore.exe 30 PID 2788 wrote to memory of 2568 2788 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35020d87835f1a6ef1edc007c258d5a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521188932491b1f3a8ae83688a38b7ed4
SHA11f14c35000df00c04c747d0a01cfa2415d775ff9
SHA256af2ec9ab3d4a2f7e061ad950c7c7f6fe1ba1860bc506959d507df2de3dd9251c
SHA51206c1fb29d3a4d660e76ffdd204fe4f77a086a2ad93568bbd9d52266cd4ae258b0771e990c23760fdb491d0d694109a9a25ae6e583bbed4cd1e6766a144f9194b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d0962349370dc8a8e0fd27e8d1c87fc
SHA1a35ce40b18d26f6ac171bb84322cd812b4ff4ae7
SHA256bad927ed6bef6287f921b9174915b1cb5cbf5df05157794d9c3c5409a0244c11
SHA5122239d7cd5df7805e03b1889a28ceae18e155952451609f342c38fe9ca816bbbb8713d0ec6fdf87a5961d86daff4fb6e9274995dff24162b3c81a039807afcac8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534496084d8e8587b206dd13bf0a0437d
SHA10365a0bf950bfdce8034821317ffdba0e616a1d0
SHA2561ddacf162d8884e26909bd1d32a9cf304e1f006fc01bf4299c23902688bfaeeb
SHA512d4077314bc0bb320c498c7c67015d801790c57efa1425ca0213286b3e1a5cddce54fab998dbdc1e332f548ec2c112b26535e94ae89306fa5d50b290a1a5f93ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52907f72525dcf83ae435ab468ecfdc86
SHA1b955a5542ec011d1f1fd2f64e21893ea66380972
SHA256aa98e8d3e37a63eee4c3b85a93f425c256ccec458c7485b55e097df8ad9811de
SHA51243b0e7579e12b90ce2ff1c2eeec159013f1c3d6a586ce52077b93d5ef66c36bdb59de4927134a0847d5f3f174e0604f934e232817af5c73c1fb1dd81011dc551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc0ce7e10403ce1914f46dde4428edbe
SHA14311983ab460b635a4a8fb01fd19960d2c102250
SHA2560f4f5df5dccd286dad306447ad288c97d21c52da85f0eea239350a8253e69822
SHA512b81e5606b37d486c2cba6af72a5748d0512f54f063fc61b831104dc6c2a01964bd1bfdc56c41c3e324ef86bd5bc74befacd9027d1dda70c257e9a4916d189a72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5386ca0d1e21879e756be0698845d6437
SHA197544cc3fa9bf06dfef170981c5b1169c2b26071
SHA2567aa59ab96fc5020dd7d3d28f1ed100ca41777bd3ec19737185ff397f5efa51ed
SHA51259bc4f3c4acd66d571161495d5ba5e591ae9d39abcea4e485096af72fd00c4efec7a417a72da5fb76bbb9529a0ed050be36ee7e7443bdf41da158e182e53a393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8dd018005554bd30c848595cd500c6
SHA1dbbd406bbaea132d9293f1ed8f39dc8f9a6463df
SHA2565f02d7b77291112ccc878ea5b99811111e81e6977a0446709dfa3df0ae591fab
SHA512bbb54c5243a44d537a20d983a9164a18dc7103580ceb021185ac1641ebc9c2bac68f0cf4738f9319667761853ce5acc1da8b9505d806f5f928e7f2965b94b724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bbf62c9800697a6603b6f178cfb6927
SHA179475fae79a83058de5977b1309a8e49e3868176
SHA256016f8638b6b92d3f56cb9249290bf9e4d57a14b1da0ddd5b18f0a8bc185a28e7
SHA5125368ee6cf58d145459d23523d2dbd82193e9ff9fb707d2732cee999ee0e1fe02b24b01192b0fecae23f1e9588d20cf1431720902fffb29c8ee165a0e39a08dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573c3ca589d89a7a631449af8f19b9585
SHA1ddbdeda9b41e006c5dc5eaa3ad4761b7641578a2
SHA25602d06bd46703a537342c110229b1cc082eb9d85efa16dd06b9a2d7b7ee8edf71
SHA512243fa6be8b8408b21a23c530c46f58ff85e4cbc5e81d4d5d29f400319340b8809d8e420706f471836ab1d12aa59cbaf8abb05b282841472dfa797aa0f4ebbf30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccc35c776e3774cde8e6ac5c3ba65eda
SHA13e7970dbc529a14de555dddd93baed854d553e25
SHA256afce518e2d5467567af2a7f82ddef03ed9d2676d521c18db73883bc7811577f9
SHA5125827f2ca9ecf6eabe949bb31a17b4ab931c3f606e20b2f59d92b9613fe141009a7ae6d57420f2ec3680338455b46de5135658b5b9271db12a0153c3fae8dfb56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5161a0adfaba47e92d426bc0bedf4196c
SHA17ab2099ab1f0b247f806926b8c37f86446ddb035
SHA256fbcd80002cbf9733773ce55aeeb2426debb55fe7ea7cfa4afb25cb8110549df9
SHA5126641cbf44d74e932377670f704969263ec50368a5d488d4551f113ade352a1b8bfdde43397587015be766b0459ba2bb5dc40ed94fc05503cac3890bdff615947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b286727a351d3ddc710a08728abbdd4
SHA1bd4745bef2e1a24332568f4961313633db65cecd
SHA25664ab766381daec3d394533818df0d4298c570513cd244f3a035f9edd2d40841a
SHA5129df3cd66b21fcb9432ce1fc1e6ac6eed55bf847aa05d50d8bc0878213a2148c3dc9d8aa285ec89462e7e60faf3366bc82c528c40ccf3c1baf4c24d65093bbe99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4ef02ac2dbc1c1775f19464eb882883
SHA16cb487155cee8e19f938576d5ed1a1a5e2ffe4d3
SHA25631a20673128b9ce2456c27831f88b38e458627fc4da6e9f0faae529eda84e767
SHA512693b9cf7014ae4b424a58e3af3da0b707552dff3ff9a92e02493af28571becbedb72bead99cbf99c14f62f7713e878be6b8943b655ad1caba30dbc8849728ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c68033ae04633b73b7cf1bc6b6d17a66
SHA196cfc1bc371a266ba38dd4930dc1da58dc2b3fa7
SHA256309ae246967cf0f3a23560789fe873b45df9f29984f647e8266c241c3bc4b441
SHA512d6df7d6cb9c691f572f0257f12ee57000ca05bb478fd52283736968872d474992b7a2be58ed20958a8120f8e24826c508741f3a9c3082267a48869b9747a7f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0fe528aa529a81b2cdaefda361b8d75
SHA1b2743d871fcfd02effeff5a954ceb744422c03eb
SHA2561eab97061ebdcedf4fbe25531590f4842ec34c60c40dcf1032178dc0c47e4197
SHA5129d10d561f0d9707ddc0cd1c48b6cdccd0e5623043e258fbd97f2c76fb705ca8754c3d67b9f6b84fca87360cf2195d051ed25ca2677a53fbad542d79784bb1a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f6152c0dc778b4ce7e0dbaf456b9723
SHA194a5c29ca79c387b3ad3f6f64036869aaef3a30a
SHA256d4834450062b1385ef0010a1670877b8cb49c397b91d7dfd8ff7fe8d71585502
SHA5129b94977e0c9273db8207bd9bec45eca73a878a0fa81ef91f8f608694f5e942e454c6d5fa21ba215ae38770455e6cf9e54c48c1a5a2fb8a62f578f53a3a251545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f3505096cbecbbf23444d1833f75ac0
SHA1f51fd81be5ea867ec3ed4d6077b2d412b426b701
SHA256ae7ce399cf094eeb38ea28fdb27f754248748418eb1e5141f82762c3dcefc9d3
SHA51218a4862cc29aa0d700cbd91f40c6aa006741a622fa5695aa8733da6e54ab9f5be2d30eca73a7759a7c106a17994531a24f521db1af4cf711a36ed23fc78ca11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566d1a9fa26f87e21edd194264c083293
SHA1a155e70cc47642dcfaf700c8b0018721d367003b
SHA2566305ce980f7cb3d051c116133721a8dbca98a5799aa412277a36d9a51b065e21
SHA51223edf72e3e629da42031aae4b3e03c9c486e25427f3138e7fafa72ec480820499bed395fcc8b333c8d5a8b5d75c409551c35e2b079dbc39e748509db69a9325d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d39c4e38e28e6f723341e5dae56e55f
SHA1a1e9116171e50db4a84ef8137088205c55b8efc0
SHA2563d15dd071a0fd9c1cb90052186b8402ad3a5ad0922167fda296687f611126cc8
SHA5123f782e6b659c506736b3013b6c18b87204f3c8ee47610e57d682b07c0ca28c5b2f9e5a383bd69600bbe9a80e80254bcce30ed79ae835baeb04ed62afc281b9d9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b