Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
3504ddf7f2a94bf9a93f2cb9897518fa_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3504ddf7f2a94bf9a93f2cb9897518fa_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3504ddf7f2a94bf9a93f2cb9897518fa_JaffaCakes118.html
-
Size
19KB
-
MD5
3504ddf7f2a94bf9a93f2cb9897518fa
-
SHA1
a3c936200966b2806eac24fb0263a78fa929b07e
-
SHA256
513731687b41bc9eff710b845cee365e7be7d1c1b825a68f79abb94925cb882b
-
SHA512
6d7bb08ea136d04f690d52ba4efe7e41550064791adafa441e01f6a1d3cbb2c41309de7599c4545297cf37d3e438883c74471933e5773da48d811de36863c9b4
-
SSDEEP
384:c3wgXEugQtN8GrAddlFGGOhp2OtZS05EmPq/YkpXkQ0ebK1:ZgXEKi05c9gZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426782145" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000aad7a8e46bcf9f3cc4782efaade13a8491eded2750af9e52a7fc98ab2297ab31000000000e8000000002000020000000f8023b05a9fd1186c2cde8721b822640a7b8c82f94d840d7f81b8b918a8ca9e220000000cb6c75ef9bdb3cbdf321fe11975743e99cae65205a84e8fbdeac4f3eee0eba3e4000000071aba84372cd7efecc313a8fbd37bc34876529637493f3fac2fe9cce26d87e63a08db887b4a9215461ccfa6a08c48f10d1a334e983cd85566edb289231170e36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58585C81-3EC5-11EF-A5E5-DEC97E11E4FF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5087872ed2d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000bba0f7dcf6aabbeb0b2aacf02d76a3c80a526770ff975f04329988820ad7a47b000000000e80000000020000200000001e5b66d68ce42e849fedf3c26156ba68ea9d4479bd25e0a2663edc34091452a190000000c1bc08f2facc4dc988beb4078daa9124d51c0f859706d43b20176ff4c2401b3feed656789f502b05d03eb88df1af378edc2c3c31d3435acf901c6e12aa592ef52dc071c2fc2ae3e1fdfe9079986a4fd1e6ddb7d17ae980ea01b6316ac3a83036100b11637ebc04d807cd8f661ef8583c3c4f161e755c7be5a03ffe177839cb3efd738248a4129cee658fd1d0f91e77e94000000002697d4b119c98167d2e074b93cf69d27fc08ed850c4c020d893abfd6067375d5ad031c61808841c18f4effd01ebf0d0dff2d18cbf973869959e55f63283a1a3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2896 2060 iexplore.exe 31 PID 2060 wrote to memory of 2896 2060 iexplore.exe 31 PID 2060 wrote to memory of 2896 2060 iexplore.exe 31 PID 2060 wrote to memory of 2896 2060 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3504ddf7f2a94bf9a93f2cb9897518fa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c35b6b3030d8cb7f2cb1d5d6e28703a
SHA14523569031d948a7a8e6f1288dcae6e3e07e96ee
SHA256ef0216d79f1192a83d723712ffae51ccac92954d519bdbafcfdbcb54a2a9b72e
SHA512648a679b75f9e35524b7af698cb38d29382929afa14afc7451a9c065b2b7e62bf6c0807172b065ad56aa72b941cb97c1c0c35965967c7ea0ae6f89f85f4721c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db0bc9b052a49089f5dfffcd6b2ee3f
SHA1df45a049d43f83ae04971bc7eb5d59b4970afcc4
SHA256e1790a404085ce10c9f6649d530adbf75313d9144c310add0c9fc3d24b8b5b5e
SHA5125a1578b494fec22b723e5e7981b94b5ec2204a9a149008c25d7eacfa4c664fe22c015538507113ca535b94acd3bce7d854464a7cf382349d53e8ab91cc9b203f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be5b592ef855d347d83578c48913828b
SHA15dd15bf33875a7f722b43e320e1542737dd897f2
SHA25674dd30ac51d322f42be52505be22e389216f6e8497f69f5e2eb9d4615c5a86c1
SHA51297d749eaebad4fc0897e3ecde877cdb50799eace2f9130f779120d83ff8ba1453f9a6d3e14b529aad5c094ab3ca841e7adb105e542517a768dd13dcdd5f7d4bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4f6478346f1712330b35ab2dc68d9d3
SHA1f8e781010d42dd18a31429047876ce69043c2f68
SHA25637ece9824c443ab5185945b3e16565bcb1318a05439c7b15eba9d1f8d9fe2ebd
SHA512268d294ea67988c3d843f241d9f2376354f25a951e85cd903776bb3fbd1a3765ee7f851ab45f8770f29b8ca3d6fb12cf3f349296945d717c24f4036d3be68104
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec355e92aa56d868a5787a4a57f71e7f
SHA1ef6028dc9a580740b692c0bd8150b97f30a7ec29
SHA256c5b2ba7b94f49aa615aa333842a42bd183e6fff4c4326dd9386f683a28e51884
SHA51233952655a1830d99cad86675e13a379a361026a9a5d9bd8722034f00b51a3e43e5980d56d2c943179ce23a9e21f8d4d83bbc604028f175bcce7a06644cc805a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519d2b8efbda64bab3e8ae31d3b5e9208
SHA1da1ece194da27c038bf9d7e00050423bb5861e2c
SHA256a2d918623f14145ef2cbbce2b704d0b486d2f130b8ea065660194ed55dfcca85
SHA5127cd9092bdc99c39270bc67b99db826c3e3b1e5f4901d4843b40a569b3821331db54565416084fca41739de85dd6a588a988bf422854824be8bae19b76715b823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e716c47326c19ff1e6606385814e7c8a
SHA1340a971bee7a3bb777e454761683bce758197fec
SHA25618d4722547325c0543d71770d02ff9c197bc47b7642c958bd8a671db94890b54
SHA512d2e98c155be751c1f25bd5c44a146a75c7f2d5281fcdd1c71e659079161d752a558317d6633a3b3b557d63741ec7824ab2d6df6e047b0a21ac4b4e08e31daec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5548385ba688eb6e39e7f1a928e650cd3
SHA1ab9493534d21de5f45505398457f37dad8d8d065
SHA2566bcbdd88e86c19cfa36895c5b449d3fd1e44c9b8cfdb64edfe2a6493af95e0c9
SHA512239c6baf6b6f7b9cfe5c469aa4c900ce78dcfbf1ed12c8fa825dbfa30ebbe58da8b035abd123a3477a682e564e6854be49f20a99b79147e4c099109ccb9d4f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dac21137e33f02f2d0563aded92a82a
SHA11729e8b76412a6d7b6311b14564dbc139186fbe5
SHA2567eb25596fd8eac1a0624fa831e33011cc1ded4604bc1c2bff7587ac3cdc22413
SHA51215f070db4db7c710d84b22589e6f383bc4572f79e1e854c6bf32acafbad0f7c013c43ed2a2b0aae012a454ba3dcd4a298b1ab24ea401e72aa68cf5c45f794f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f6b124de43de122834e6f4db741b8ec
SHA1ddae30c9e4b8b33c7290b6fd683e047c4a707f8e
SHA256eb757b83cf12ec3f2135edd277801b135e893cc5fc994dd8cb5170802525d2a3
SHA512026adc070e470695162cba385f3e28c25f3eadba8aae9e7f647c30116ff3b53818c56e50a0654d830db4d98f1476e0b42495c4d60bf5607f255e9bcbebc61b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55690cb68efeb2b90cc98b1adc8617ee7
SHA1ed0cb876422ee4da799bca9fe34b1277b0516d28
SHA2560dcd2544c926de97700b00bbfe487c51056a251687967dc11162b00c2b2d395d
SHA5123c7b16a34b00878d8708e8792d808e4f9c58a6d9d2f5d51a3d15c96a7493ec9b2dd70793a274d2c1285233449d3dd73814f3ef427702299e59ce6dfed99ec159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b42a98997e9677164e2273ffd26a2bd
SHA1ee1706e136e32f4f96f888357a3c1886549d98e0
SHA256993b84a9f010d0e3d74614726ea4cf3dc125a9aeb1fa487f690c6c07ffdd7a8d
SHA512752644f7e0dc48f043e0137a56dacfc98bb0634a02fb0c9aa53d1c7b8e9989dd3e7eb4418918f0308d56d4370145c2072acdb60338baa1bb13a20a93ec4070b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a973b51eb3b0553f060f618a3707788b
SHA172f6504f0001a5766f3f1152bdb72518b17cfe21
SHA256e8588fddfa52a4fbb48fb96676362608e6696679dfc178c1427926b096f2af72
SHA5127af83fa32b9c95b912294f9dde42b8ff6c79ca015ca48ac2a35d4e8d646e849cbd4375dec4934a115314c4ad080f38e5fb52a785df9c3ca96d9c7e258e7d6d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c630ea71510ed54bc012743cf45b751
SHA15ae399c9705e60f35234b03fd349d27803fb4055
SHA2568a86bd354f3b998d08dc501bb3e28b31f1ff1eaaf280b36a3c0070239dede8ff
SHA5129010d345af5f260ce7d0c4cfb58c614eee3d2d44986170030c292fe27f9e81f208b303187179388fef82a7dd2f2683c8297475d0766b99070f086d3cc3d2ef16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530a0fe2dbd664c6bfe99c939955dc77c
SHA1f3d5bdbae08c50339181908e65bdf38bd5298b6e
SHA2569bd4a6892fbae635d4ca6c92a9f1a04951954fa111b56cd950932cea66ba2203
SHA512613be3b5cdbd18244e35b3cf6bfe1960486df65af6ad955c2444d6573cb9eab429a50f6fefdbc96ea1c05c52f35566a944cb21b22a6b31b542e2b3a4ff4ff889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c533e04d91ab04c107df58cc1640dce7
SHA1cf9084117065625b71219b01ec01d39c359e752b
SHA256bd68885a0827732830c9d7574f90386aa5d38ab172335a59372575b10498fbb9
SHA512a368c3d0250b0962fe93f5a0d107c00be4cf6f33c2d025f0603ab1e67613a52f131353115199b346188bfef21ce9e306515078b9c4e68a22882aac07d7fdf4a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ba07863c8c57278d77f509a24bfb9e3
SHA14358bf6fcf433e6d8a54ac5439ef8033b780353a
SHA256f5324b9990e2fc9c1d46554e7b7e5f33a9454961d0ab17df5761d8023b44bec3
SHA51255183e8a2f3a0ce4fa1b62d869535b067e83fe7d002cbd174368e9a65418ea5b5f56186c398ce923bd19ab629b7d0f19a8cc752917607b01ad2bb20441c59229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5a6b05215a4e9ced7bfd154c9398fb2
SHA10b33e630bbc71b17297a1963007894c047dbd13d
SHA25645d59618fddd56ea30c77c98589eb103b6f3f658dee8682f7142cfcf5268b9f4
SHA512f6806f169ad99e13edd51e1004ac4b2bfb9a3bf7186c4cf6b0a83b07eb4e5a3e5a26c19f91f12dfaa7f190362bfd10aa98402570b152f0dfc0264d540a455413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5449458bff13827305e5cb23c69853da4
SHA1b3441ee09d567efa47b0c379293ffe47647310a7
SHA2564b6e9a96da0a5a6f99f182ec86ae0bd3e4fd10cc82ae6ebdee750034f00becf0
SHA51213b082b731bdb467b1c4badd70aa7ad0739e4f0cef1e122772e7ac7c5cc7bad90200d30661acf31fca3036b940df69a1358e33153d3e0594cfbb3a070c43039c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b