Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html
-
Size
27KB
-
MD5
3660ba95e6b63946084483292cdd54f3
-
SHA1
74c6ea7804833a00b7fa89b8b23d564eb0e139ef
-
SHA256
5017052fb65e1b07fce8e86d30a16c1aa56c70ac186acb6cff6a9a9e7faca530
-
SHA512
d12a57064fc0b6936ce637e564f10217f57d025e3d75c4c8010ba87809a5e0fd0b1f32dab8898d060ae8483de01c433b90a3ab80ae3471a0d8a8dc3f5a8be56d
-
SSDEEP
768:S6+o/xt5VPBWHnb0YILBjZWxFNlsADKGn:S6T/xt51Ob0YI1jwxFNlsAeu
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E779B1-3F00-11EF-A7E7-6EB28AAB65BF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c3ab459ec0969bada9305b217d6fa3175bedc46ad3719fdc957694035278f95e000000000e80000000020000200000001e04d51cee821ec5954ac1272fff2dde848dda2414452a6f62b5969debd7b52720000000f935c7b883935dcc7da2a586853fbb8f4d1dc361354860c8a12a677626243889400000007a812cf3ded725fb4d0e69e0ef46dba7032dcb57c931dad0e66173589633f73861b7206d3cffaacca1dd0f5cef8a15f03803375a7af168e675a7d2c8f78e3bf8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807404" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703ed6ff0cd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000004cc0b400dc47fab3f0aa4a2cf4ac39c36300cf6babb0ca8e8ef55c9cb84ed97000000000e8000000002000020000000588d036ade30bc32aba16dd7f9175be97e7de19bdbea9d24aa6d27d27d6cad949000000055cf79210212ebff18cd342bc14d653b5b9fa8a766fc52b55e6efbcb562618a0732c751cd7867fd4799253eaf1b00d6af5d74804469b2cc22ad7d1e7ec6dc8afadf53261ca7f5cf8f6363fcebb78426e20eb0e46b536ad70658bef992b7130d0b67f527466da5d4002d722af86c7158cf0fbbb1b8fc0a963272f0d6ce946ddbe175433bf2b0ea72245eb6e8f4837179f40000000aa56afe64df41d19677cfdf9c6c3b18e28448c247a85f4c96325f0c372df3b6d43673897e9a498f34dc465f73fb7cef82cfee9b3438d840bb74848d15598d444 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1936 iexplore.exe 1936 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1936 wrote to memory of 2964 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 2964 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 2964 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 2964 1936 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504ff54f3c4fa7fea2bccc2186d091b8a
SHA1a62f770bfcf2ac54fb1d0f1746b0aa9d3f27627e
SHA25614e18686bb21eabcf54fc076cd15dc6805a181da65a3e37fab8a5f119c9eda28
SHA512e89f063c61b38ef47ae110e40d104f3c3ade4b07a1b49f7d4aff1d6f20e39eb135c13aa30776126b94b494cd1fb42983e28d2e22cdefd43bb545493ac847a8e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e99fd5190510bee0804128719fc1100
SHA18e9fd668ff79d6b6d8a6fdf2518607935e0cafb6
SHA25697d87d46c28c18ebcd0753c7afa1033d9c276fb7f5df97c5570edbf85548a3e5
SHA51225127561a7167e835cf5af707fc0a3d73704c60ddd7cdb05d6c340a6f6d1788a22fe577ee2daa70962391b2efef2b723739d32020f299676da90fad7c702bb35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1b03c55756b74d4688db441c29d8c6c
SHA190d03c351d376bdae251a5661f70a555d9aa767b
SHA25620c0d51b290231032e8f12459e2ddd1a7491f76b615443f819fbd6d0ed0f1ffe
SHA5123574626fb60478dec0c09c1fd6c1939d3ffe7c25b63212cbb5578f0e5a0ba63c510139d73c0c435c3ce7b62bbf2876f018f93c112adb9f238b2fce39e6152729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594efe5c2a1111688e401d78a80bbea70
SHA1436b48022a4584e933056c15a459d3b81e74af21
SHA2567ba14dbc5b4a13be3a4b0ce26d299924768546a023a1eada293e087da6f34f18
SHA512a2ac26bf076141bad9b09d2f61744b368a2828efc51fdc5558a201f6ccecbeb009cf3803685e20ec93150741205361498003842e3366c6fc46d36a6d24e79b6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592e505bf97e3a989455bab88be095580
SHA110d361af44bbab63904d6d2cda5d53f8738a04c8
SHA256762a6872df6b0983e99c4f17331563c85c58471a04391b3e5451354de174a171
SHA5124ca73ed39c9f4d2c3043e498416c399d7c397c6ef74bf673a68655fb0069cfc1d4afa2927c0dafb068514f6e09965b6e2a110c713e6cdc0b6e19352d7d56b28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ad49db1cb03b9c5c0f62ef2d68909c8
SHA1d4eed261d109daaa0aec2d254ae75769102b8099
SHA2560b90f262fa1de54faa4978aedda17917650576b1efce4df8fc82f1db44b2052e
SHA512d2f016796f38aae44b3a444ad3c492dadd59551ecbabfaac780461377396d3dc990ff58d5a700a8502f963de0a33936f128a611c339ece50595688a3d8f0e0cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dafa033bc81802c762254cccfedc0a6
SHA17e741509b01cd98f34681c06d2c29c059bc53624
SHA256eae19b090a65ff178feb7e4a873775db409263b351aaf106715027ada6f89f39
SHA512b5462533c9cc77f50a2adff3d26a7e0eaaca985eeef038c1506f675302714cc16bc6eeee1d605c1e42b855f3d3b37864dbad342afcc99a9c4eeaa947b0649b3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9210fb98373ba6227708aeb12886dc9
SHA18bf272d1b7a8502a8f2e5b2bae854f652ce4c9a7
SHA25692d4d7f7cfab84b8da3f029f4d13d2fee1c5811aa145bf1ce82e09233f30347a
SHA512d14d97ac8c0375b68f6517e63c21addb90f206fd6e4829fa5ac57e6fb1b3e856c7dc975073245d930c72903690a2376a69df0067936c93491aa8b09849c20688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581c20a24fe2e955ab646bcf3b1b96a8f
SHA10259da8a13892f9fd5cca1d001ebb2b58cc2191c
SHA256c17692bcbb9e20ebe3f85ad1ec3955ee93988cafa465c872fafa20334c535c6d
SHA5122c22cc3231fba4642b332ce992f4fa6749ebb456c5ed2dac8b249265d7a90d808ee275574144a15d028e4705d6c81c61a2d16b22e291d30bba6bb476f8d05ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5596ef4e9b68c2d017ee0169a13d104a9
SHA1a7a03c04dbdcc4fe2688f0befbad00663fa8e1e2
SHA256fc7ee36c669076a76befd5a4c7e0f4652ac91eea89b63f830cb0ecee961bb60c
SHA512bb84f2b270c13df096911ef96bf5952ca95344a4665c3f50c7bcdca4e803d74d7835ca583fee0ce19f9b6eb8c09beb161a46d01e55670e5bc7490519234f88b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0aa33fc267386cbae1ce5d433ee0602
SHA1ea60cd9d5e2769de9e5f82d6ebf9b3a112d2b507
SHA25681f9c95e9f86d7989982e7ed1afff685656240b747cb5ee30a142c7c896702c4
SHA512d5d7e82217c1c8409931aa2691143785991fda8ee8a3dea6b8c30531dc811c203ac71a350dc2ad7ef984653e115864a78baeabebb2678f542245374bfbb53006
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc3272a82fe5a8ec49f82014172bace6
SHA136be5aa15e009e46558f0bcfa6cddfd0ad268c7d
SHA256495e078824907b1bbf940655a368eb3d5c4a1e18c113b4826c1bc3a845f869a6
SHA512bd0be63cb7efa49e1ff6f6f4b5e4e4d35dba5916c3855146476a6894160a43f6fdecf8ef5860077f170db6c1246dbe794a5ce4fe77cc93b1a5da673b9e6f46fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55696990010907209c763f9e1c1ec4773
SHA184edad54dd33e2deed754984ea397747eafe4496
SHA2567b6c6990aafb91b459cfe7d59b26004697fef6378fc66d7db2fe3d82f1e26b25
SHA512a1037af8787137cc569d563eef2187d10375747ba0061dce19ef854f3e05982e70be74000cd8c27ef5dc9bf48c2fb6766a5d54a78661e78caa05474e6a0ee815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504a078cdac74d4d1c64cea69d188844e
SHA1520ff9921b925f711e67e2183a1f5997725f4ca8
SHA25650c4fe9451868202c913d5d960b737363cbf97f9869da98876ee05e4176e84f8
SHA512d024c32efae3fddebbb71197b9ddad8ca1e61c69a477448a2156c79d1a750d70ecd9c26a9b822ec12aaf0ec3d99af27196679096c8dd1f6c28ea4874ed9c774e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b