Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
3665095473c8c5e5c2660b475deac773_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3665095473c8c5e5c2660b475deac773_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3665095473c8c5e5c2660b475deac773_JaffaCakes118.html
-
Size
6KB
-
MD5
3665095473c8c5e5c2660b475deac773
-
SHA1
889e8231c662aeca636d1f3c96fa6d70b7d2aaaa
-
SHA256
988c42bb024702e8aa13579ec41af1ed630eaa8cf02c74951a28840974392898
-
SHA512
92f27a3687d7ec805f777ea789692565b688c62f4f8c9e5454b9df491fe957fe7bf67171400594fd397f522b5db78af520773a2b367cc3f5466ace5dfbbc161e
-
SSDEEP
96:uzVs+ux7IjLLY1k9o84d12ef7CSTUWbca1sLiVcYR16cEZ7ru7f:csz7IjAYS/T3R4b76f
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCF93241-3F00-11EF-9BD3-424588269AE0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e8c1f2eb548d4a4c07f39e4ac0eb7520fc4fb76819e64a38014ea461010954ac000000000e800000000200002000000028e7e31f4f6f63df63a449813af543caf4d1d598bfdde63e367e55e9fbedfe7920000000a881159ce42aa5b12ade0603cb4d43e2809aecf07d7edf14e4bec47bda672d6240000000ee49202ad41804c0f776631992b1e9363345c0217d32b1d6e1e70b70385fbaf27b4c4e1881a9c9cddd88d1984fd3ace93157dba545b661dde603d96acbe966b6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807684" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102f83a30dd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000559ef6bef80b30b0993e19d901db2e421094af5c90d6121fff4410a6dce90400000000000e800000000200002000000058908d3591608782c3b5a8ed49da38ecb4d32d1aefa340f7a1ad3a3111ae0f1790000000b3269cfeca5b1fc12574dcd17b34e3b2acdc3441ee9a9ab87827e4d4e69aa1749eabb9f516809f7eab9820ba065b338cdf24bc4a7688c312ff172bc3acb7324fb68ec4d904d535bf150365b1586b229664d311f4f9abc739d63075ac5e8c375d50b8f6a044d6ccecbd4581452b493562d3c3e14762ab5584c19b9421d2ae3479f7b7aa97cb5b636f5b70495c126c4fa7400000000d54469128bf0a2b4c5dcf0590a65d369ca794cacc4f77f90a66f8aa8fae0dcf7726c44a3769b60a3763eff8e09dba6afc4bfaa319478ee1c936407f26794dc2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3032 iexplore.exe 3032 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 3032 wrote to memory of 2552 3032 iexplore.exe IEXPLORE.EXE PID 3032 wrote to memory of 2552 3032 iexplore.exe IEXPLORE.EXE PID 3032 wrote to memory of 2552 3032 iexplore.exe IEXPLORE.EXE PID 3032 wrote to memory of 2552 3032 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3665095473c8c5e5c2660b475deac773_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587602201c930b2a6eded7960bff14cc0
SHA1cff4c1da14f7c36ccc6f7970eff8e6029a7a658d
SHA2560b9bb1c3f59dfb95071afa8147e41ead7f78d97ca8d700963904ad9f0a5f7169
SHA51294ccaf1d5951c7b0aa34d294457399d7838e934e517195eb6f44488ed6cb955ba58735d0a6a2723eab4a67b5635797092b2c2afdd39f09c038bee4be2ad06fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aca4e63b3831a4ae0227f4e94d7bfb10
SHA1b81bd7049eb127885461043b9f6cca0f49ff97ab
SHA256a316c32c657b6ef334e95f09322516d0afbe796f4dab23a0195612de992697c7
SHA512c0906a1fc96aee55d48c8cddaecf5c4826e90cd964d74614a9d22cff9a3d903caf845f52380ca2ac73b20f724760ee9de596ad6e97573c24b9ea9ea97f433641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5980826a12ac9f14616128a67b0b22fe7
SHA12133996a586e2f6e6f2ec2d7b5f359f60924183e
SHA2564304a42058f02c7bd155f3244826b87a3aea15473fa57213e02029e75d59b2e0
SHA5127254cbc94b8fb0a886f34245f5fce154253d51c5aa032a8852c742d4d677e9e748ecc573c11f19423f55732ff38def726dce9d23169b1998291331c05417a514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580737aa4ff5fe899cb95227c23f68ae1
SHA1e9c63c17ee39e509055561d4c4c2b27fdceed9a5
SHA256c766796f4d0fcf5b2f97488e32a08593b9922fa9f29ce942cc7b595362f72668
SHA5125c433d548fe8e558192baa1d8adbdd5da92ff98f8a08597523bbabfc4eb43c9fcd3b452552e8598533aa5b3e5ff3b159f50a0d94b58b38fd70044e73f026da4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2af122d195cba097f59981aab25d2f7
SHA14a0f15160e214200d5eeed89af65c0c87b38175f
SHA2563839c6fcb947dd6a46287526b2e96ab63eaaea30540bbafe025568af65c97800
SHA5121e464aa7043f5b357710fdc8cc163412bda4e0603ffb57d02e4d121eb5d5acfbab9e1d627862f885ac13066434f73cb2e13671c1c8fdceefd0e5cef80187fc0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de1638317796783df587847e65d0f419
SHA1eef263a06b3935f0e5ac763d2f57dd82fe97234d
SHA25629a20ba4312a1a6193b86afc7abdfd68a14fe2e194e6d45ec993e7219dafd2bc
SHA512ef272575fe62058557489276e095f57b8dc2be833d99d142afd4f61bfcb5af1cf4be27584452a4b52c9b6d74220cb059f664ba11b024b8898f4634fd0c4b9cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5085370edb6579ecfb94ffe2af306794f
SHA15ce40985907a12b1a17afbb121e78fe002ee68dd
SHA256158a54156414f2d174419a49c8fbd81395627895a4c0f29ebc7b3efac8cb4fa8
SHA512178206154c67e6d87ed7b270f2f4ab3902ff20b992ece066590ac1e84155f56675a6bbf06abee6cc875837adc43d4b84c2a824b9036bc08284eef63dcfc93029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b2742863d5790fdc03aa99a2432e863
SHA169321f276ac88a72d8ce2b7dffb82b8d6b161c55
SHA2568379b71449450ff602223941a340f911f588b4fc70013d02332ea725a162d159
SHA5124294425ed463a857774ef56e2d9618fa17e81df8269b9e42073d473e3279c78a653a610ea4fa4ddd519e1ac32c3de37b0a79cb709b5c45783a68b231d47724b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5795ca88f24411248c7f6f81e29f88375
SHA1d1b34ececab81b75b247c3e01a7d1bd783c4c8bb
SHA2569dcdf7b94a55c0d6d53bdecf9f297170c27c74f5139a730f557f395e9ba64b5e
SHA5129252da2b3bf4ef9116c0e70425627de375fb1e84716e76487ced7205d58fb59ea09dc2877adad0d7b7275ebbe02676f6bb50d9cad759b8757b5cb02ee5208cc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a79f7e5badc4c33b30d52899496e6ed
SHA1277f1a695fccebb24f640d397ef2837b0fb3dba1
SHA25697c074b9091079c9c08eff35ab8aaef560707b10f2198fa18ab76496b50b4b4c
SHA5122fbf590de65118935734539b37fd6e58c8b13645d5afb38e73578f50d1ea09fd9b65d6cab4676daa16498dbc2e3fa3fd90cd93d80adace385996c2174d13eec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaf01343020aa11de67f54dda0f9d24f
SHA1754733c9feb890fed018d01cca385ddc449a5618
SHA2567c82276f2a0cf3ba3e23ca348220f9b4c5d1a2bc6b416b5c928be5277153ace9
SHA512b82dcfa00936965f6c6554705601565eade9fe766d548c4bfafb96d64a2833a68db7ae0cade3cdfcee060ef086bd9ae1e1281aa5790b4a5bacc67f9c6a6851f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d6d32b3a8a2792bb2e7aff464adde90
SHA1ce2e66c392cd0184ef557e48db606d39dd5c7023
SHA256017a2881b11044b2c80fc10d832327eff58cfd7429405eee0cc30319ad69b8fe
SHA5124c4034ffcfd100fb64616661aabd8182232d4e24ff198bc121849645a7323fc3f0b4cdd66ea9ab3629ccf7f0247a412e08207c39c9e9dfa9a8af92295ce863a9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b