Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
35ad06b4678ee56e2acd82f5bf899d1b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35ad06b4678ee56e2acd82f5bf899d1b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35ad06b4678ee56e2acd82f5bf899d1b_JaffaCakes118.html
-
Size
19KB
-
MD5
35ad06b4678ee56e2acd82f5bf899d1b
-
SHA1
12d9f52e53e4865bf03148f9609563a2f9ea2c33
-
SHA256
ce481b2df6546fd8c6a2cb33072cc33ea28c51dd05c557072633cef2c3067c51
-
SHA512
656952cf5fffd361304f79cc898306b8e898760d99bc7d6963c86340772a99ad3333569199399238c862091ffd74b987005ee9f6f0f2591aee616581b70e2190
-
SSDEEP
192:csz7wAAYS/mo0mAoXX4LG5maNWJUDyPcb76f:crAAY8eoH4LG5m8WJUDjS
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000002a1ec83c34bbac9f9a7b80bf3be4b30ceedb0029caa866fd1456cebd0155875b000000000e8000000002000020000000e7abc8bded0e40f5e696547992dcdd2488db78bdb6e4de1ca59266ed261c5b4e20000000ad6c896b9f31ed7e4fd5c25d12c76567510b82ffe1dbe2a72fac28ea57c9ae0b400000003e948b8d0e84ca85c1d25203e12525487d20ffe2c5c7caf0f021aa443bc79c18f3e829db4090cd8d9c9d6a0f319b440d859be086e2252cf38efb9d23d73dc669 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3071f412eed2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008f7f214a76fa0d3e0f7df20a8161aecfcfc203f066fc5476e4f764bcf771c52d000000000e80000000020000200000001ca5cd1a67d2acc4a6325736e79034a45126caf31035e46686a2c04ca5204ad19000000055773c073da4676480dfc3283e94abf23fbed3d82084c4d6aef2551795c596e1cd2188d368910c9d8034606a04cc9dacb57ec1fa663da6120f2b17fd968e84de0f2a640abb9b0715a67e3fbcc9addb5f9a2d1d97ec99e09726290a36b639b655ea5f20970b4683278d98520608d88564dd259a25fffbd6ab4450c92348329c18ced29174d6521676cec25b5359835979400000002d175a596b07d3503755f64ce6c20864b96af0f2f4033388d9f355753c50d089198423b4634cd625b47ecabc75ee7a3939c4258b58259a7cdcd6e14e7744dc89 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C683A11-3EE1-11EF-8420-FA57F1690589} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426794125" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2068 2424 iexplore.exe 30 PID 2424 wrote to memory of 2068 2424 iexplore.exe 30 PID 2424 wrote to memory of 2068 2424 iexplore.exe 30 PID 2424 wrote to memory of 2068 2424 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35ad06b4678ee56e2acd82f5bf899d1b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bf2bd9ba850152fa69c7050c9f7e05fb
SHA180d5872c1a7c28b0138bebcd875d92874cc6b2f2
SHA25698efc307b86e9a639ad1cdc49e78e831a7dd449944e16f593b85d60c07cbe5a7
SHA512c95833fe628600428baf5a03aa1a1aa52aba3cc835c201e130403c558e41852bc15393fd3f12a75176428d549b86f1e20883141c42b3f20748ddb3240a6cc6ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57b698e70066b462a3d268c25b95111ce
SHA1f21aa8820581dfc89bb227c275d9d27e0745be29
SHA256e584c81e220bb116246a9f79cb8745db37c0dd42aa2489d925591828f8642605
SHA512ca9cc2ce4cc78f908f9d22c5c712e57642974e3d599b706cf7aefbf745ac31ea8bcb6d17e53fdd9791dbae59fad2021909b883c1bce20710c44e56509f4709c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD575dcae90fb3f428382ea880fe8a456eb
SHA13badd7b8241bb19a7bf31f95fae2ff7adbe05767
SHA2565a09e780cc6389fb7ee3f1601a1caba6397c2881282c9cccd0b3ece7b431e256
SHA512bd1b6f7138c163878b0cc4dc0efc7c7dc475b935600c93cbec32584cebca252d337f5e60aabe5d28789e4f15a493946dabda412a76e5199008b616f604be066b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a8cad91129a1ff46330142a4670c5cd1
SHA19295c6b217c912da21c53307b4fc4737c727af57
SHA25624d612ae9e20c353a05699276c0e6050081ed1f5daf9ad2ef9ee35a348d50b3c
SHA5124d52ef498361949e78ca0fe4200c71993002443dc38fe03ce173184905c67fe6c4909bc4cc6628b97dd32080d791835a2e18352f5edf5039156eb3a9c1e5ff42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56e574bea0db59f771698620ad3b7e949
SHA159037322881c2ecb1af4a771a893575d81a59499
SHA25684b7cb14e32e5e0c8464dc492da0b48800fb65aa95fe687f7a018474f5eb64e3
SHA512719cf51496ef4c41c817e366a735e0f3152a83126e8e22a4670799a17c408d937d05c5f867dfdd248242256b07bac740f7ed84e52e92e75ea7ecc146d14d6ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53c9a5c92b0f582d5f86604f852cdc847
SHA19b02d13eb98c26775ee1b6c88ce6b5c36a851e87
SHA2562af9cae07a694a07da68ce071a340cfb25ec61d8e6f3b972b2b980590b89bbd2
SHA5124ecbc978f260672eacf53d4f817da33258757aa95b0e888a5409c8471f954993430a4eb5eb804d08399d980f60523be14efb7c7a6663542416d43be990b2eff2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a04c7460568f797228368ef689546e64
SHA1fb6f2e5938d0da6ed503db88f90463d7f3254a7d
SHA256c5684ba36f36ed97fd81d718709f69168307ee4d677b449822c2832b1bfd6082
SHA5121e0ed65640d9d3cca4bffebaf0d06691cdef0b400afb991803d5ae32d8bd682a017509458ea478edb7e6d7ce6909890c3fcf4286c5de09955701d41d05e90c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5450627ea04f702502871577d626ba5fe
SHA140aca6d23a359b0df72f8dda22af7d92a398b652
SHA25651fd9124ee3e2929c1ad80703eff110caf00f6604917186c40e576ff1f9269f4
SHA51251f39ad9f2ea23caf564130e5abc1cfe5ea698d7ec32b4f3c916f0d8e04d3fed212c907945eb4d2385254c803227d4d3afad84c1be079eb910858e9ed940b11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56e4f458149f3b5f54c5e2dcd22083568
SHA1e4b590f2a9ad31378b52508b352deaa21edcedb0
SHA2564ef84ee785a3d4fdec65d6130206c97c92518aee34833b7119785af1746fc686
SHA512fcba7c85a8ba5c062fdcd5650231dbb156cfe33270ff4afd705dc54320138ac524a8cfa859f800f449bedb3f76f5bc0b83edefe1226c74f491be4d19d6b9ab48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53582adbf406219fb3fdc865aab79348a
SHA148341daf1510d9dad4474a8dc26008ed2b5ab821
SHA2566f7b7d678c02799394d8c03f13a735fe9677b0660274a81241970e757ef9ff37
SHA512a33e5f584214b2ff9a6c000f3f7960bb356db1129a63b7a9ed20ea2f83e273a2d4dcaadf9d40a577432a47377509efb96928905bba5921ae52a7fdbbffc6b5ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD596c7d80f61703c319068a7dc1e0386c0
SHA185433a52f98c95eb43c3d303de87753f82947c0e
SHA256b6d6302c70bc8c20ad5da851114638d78e71cb0f227cf70055db7ecbb75d6363
SHA512f4a0066d1e6e5b0e6faa38c3d4126c74ab655cbc8fca4993de11964a1573329322bcd2f273a0ef4375eb746a65d38e69a047269a041dc58b76bc09a0bad0b100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5acab9607fdb551d6f650f08a4700f5a0
SHA12fca5e74f63a105ab8fb3f47315c0389c46d0dc9
SHA2567b5282711cd2a817325c2592ed91a4978de2ed52d21e4b062c78396336bc2d3b
SHA5122989a69c18ad9243964c08ecf1c16a1c7a58681bb0acf4d36b1864199e918720d150a58fcb22f6d2a3f62c547f9d6a8a52cca099b13c9c6e716a910973b83cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58a0b309f85003eb463f226af662dabba
SHA176aa7b7800e8a0ac31d38b9fb3cb35eaac866a7e
SHA2564b91be874f76c1ea7d810af5912863490679872a19b1e05b075b0ffe28144b45
SHA5120c754990019d13301a9975fba50076a4bcf8172921d9c2fd2e5197aec4d5243e45dbbe34a12737c211c60cd94954e2e1054f63e0be5993b0ddc5c46dc40e50d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5884fd435108f55551e58293351e4ec4c
SHA158ba7c777a3083e46649756ae9606d80f077736f
SHA2563d07d881e02ba31a4ca33d50849071702dcefba04ecf52fce222279c7d09045b
SHA51220d4285b9108f8726721c861f5c21b2714422675cbdec76ed794d084ee38d611cbeb43777ef46063524761a5b58cd6af003293691d11ad61bc9370ee80bd4d65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a4e684282b62dff4aa570adea2111d36
SHA128d38302b0a225093e4a984ea1da139b5edde96b
SHA2561d04302425bc0d93c1c08d59fd0a28cbc1da610c7b085be6cde546e5aa839b65
SHA512537b993d5ce3785502f64d8a40c87c0bf41c8b8ad05e7e1d86f1e2ada02f481cc06832632ae0e4ac8e5ebea8416536942541aefab8ca44faa2ecce3fb0d156d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57f450576eeee2402d5a7d30400886202
SHA153c4788f5e06baaddf262a94e3eb59b05c3071e8
SHA256ee27d43c471432cd0ce58ba7be206cbdd7467ad1ddee671f4b694feeaaffd7cf
SHA512e53732f91cb5cae694a7f171e35d0dfe016f852df827cba93e57b33b4c2b866fe2c2dc2c63bfe07748fd93159b045bf619cb12ff59b844aadbc68f786d73d2bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD554c421b15e3ee5654cb1bcb0f742a318
SHA152ee56aeacc7eb251b8c278275fb825e5bc3894c
SHA256ee52eb41751d83dfebf7281c5f9432b3e6b0a4ac522b7bea9f53c219a6817027
SHA512d3bc30ba7ae0b9e66473c3ce466aee17be75f2c9be4d5fb6fa8916a5d5e6015cc04e1678b3d3770345ea03ba96111c626485bb0eb51c6358d85328922bc577b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD523668ab23290e83cbd85e6c71dbf622a
SHA1b90ddd109fdeda14e62dae85998d8bbbaadb2991
SHA2561608262913df8419d17f324bde52a830d4459d307b46bfc15ba3b407ae8a88fa
SHA512ae40c16cba4c0ef4107d6d31850f3b8dfae4bb146898673923a290854d90515de781d01d9cee0e408a4b427d273f231427a7db1d28122dff131e2866f0e1a08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53264dfc4ba0a2b4792504b45c2dba09b
SHA16c8a1fbb0e44e2b4d15465e0ef4653407914cf55
SHA2565416d536a94a4d025f7491af331b538600b2640e779ae79eaf0432312f824e44
SHA512edb21fba5160277457ac75d346384ab3f6e9f6c84750851ca8bb0b091684a5809635cec4982ec960c18edee5e79dec31e62422be981d1f32f5c5aa84aec33987
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b