Analysis
-
max time kernel
135s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:09
Static task
static1
Behavioral task
behavioral1
Sample
3664a800328be081c64cdb16d2155c6e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3664a800328be081c64cdb16d2155c6e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3664a800328be081c64cdb16d2155c6e_JaffaCakes118.html
-
Size
11KB
-
MD5
3664a800328be081c64cdb16d2155c6e
-
SHA1
6947c0cd4cdfed85095122783990118b823a7645
-
SHA256
cd9229065e725b5f2809bc7cfb3cfdeec659da49b63dbb5fe0097a233dd69e4c
-
SHA512
a8f65926bffbb2f74c6c9e4c254f63025f70b249bf34ea0a5304877c0890c6262fb5096e95f02e392dc4583126ed3be92633bf6122ff37f94756bf9479ae21d8
-
SSDEEP
192:csz7MsAYS/6phKCO80HY2vfUyfcHHPHb76f:cbsAY86OCOOfyfGvHS
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6085f2970dd3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807642" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000fb8987d4974522c75a8b4eeb363c3f91d786996abe11e185d771ae86e44896b7000000000e8000000002000020000000941cfc4077ca9a154f78bcdbe8a18401ade4baabffbac6a75e165647f841933090000000b85be04b5fa847eefc8e6c471de7efb6d413da2778432cb0d4f7e64bad795ec6275d10b78127631d76cb63673bfea1cc5fe070d40b40f856d4964a005f858d0e54d494ff502ce2eb12b125f32b485d06093883d53ba36219bf10de47400b988eb6ed30173f331282df07dd48ee0fc62dc2d1183e6ea736fde54afeb6e7d355725d6084fa653ff445cdc650d0dc2959aa40000000b67bc8de6eb994aab72c3f97d5ebf9745276284c4632535e0f483fa28c01534b55e3f521bc1372683d8c4d9dad62fa06c9f5bae9e78b8849254f0ff793a8e27f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B489CB71-3F00-11EF-BEDD-4E66A3E0FBF8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000202d149492889abb364d27cd7980995d11b96082224a2074671fbb17ae25e547000000000e800000000200002000000002c44150270c7a4df955069b8d61af0ee9c1f31b9199d0d23756107e40f9aadf200000001d7854f77b25525d3a87d083828578e2aba62a4837e903f415e820dfc4a84f4640000000f56e343d1d7df997a048341aec23a3ca57386e2f16f3354b2ad09da1ec05712064ac37643f13adcebc270c20aa9e32ab4d942e3f3b13a8098dac2df0f5f2c35f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3040 iexplore.exe 3040 iexplore.exe 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 3040 wrote to memory of 1524 3040 iexplore.exe IEXPLORE.EXE PID 3040 wrote to memory of 1524 3040 iexplore.exe IEXPLORE.EXE PID 3040 wrote to memory of 1524 3040 iexplore.exe IEXPLORE.EXE PID 3040 wrote to memory of 1524 3040 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3664a800328be081c64cdb16d2155c6e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e74b08ed634129f9f625aa4bf7d356a
SHA18f964dab484469575eb1ffea643fe7c931c1bfaf
SHA2561c4ca82c9aa0b3293cc6d4dbae2c8dfa7dbc2d68ee9dd0623cd62757156b62e7
SHA5121b1bedadbc350f2b1eb826fcaf9480aced8d4784f51a42113ac3b0b4694b2634589ba1068c6d293a28bcbd600c116ebd995c58e60f7f0166325ae452b53222ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5521912105cab59723043f7cf24d7af1a
SHA10784b0792b3aefa1fd9fcb3e18298b16a769b672
SHA256c732d62ac72e418606df92182695903f375b6dc6c0ca1857336576dd261f1642
SHA5127a9d1db2360fac1d4f78010380807df8f966ff98f047cb042b18ed96b584db4ccafcecda540ac6cdb6f7385e0d80294832c705d5dda88b6d1f903c52f36bb8c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55814ced222cb18a85193ad33a0ea5816
SHA10aae526c1cd91243a5990628f22c42339250d90c
SHA25674d36976c1e4b28b626d4b1aa36c0398a2ab5ea0b76ae551c1440edb1a679d69
SHA51252416ef569e558e12c760a2089e8bea3be2e030c8ddaff2039683c856872db1177d83dc2ec26e9850b111587e9efb961689e6e12609c486f0df2b05df0529ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a2ce3747343c6ec4fb1c8c10886fb5
SHA1c552469b71bcbf94aef0d114d56c5ba2213b6288
SHA256b8248e92c6d67fd7beded29b6e06fa436ecc2c79c0ce467c8829df68e6af23c1
SHA512f58f13a1025609f5b69b4857dcb18089a07b05d9d6d1a86c4010941a423ac08a7f15c097a532b9490d5a349d784decf81fdb42eabcf625597bb19039a760c179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1c6e9b02a8f1ab16d77bb215c7e7dec
SHA1e4b94242b1b66fdced4b02278282f2f143a769a7
SHA2568f1860b7562529f88e3ce1e362243f964ed2201b306ffdccf4c11b564c8db622
SHA512bf047d0f72d7ee1223affb03aae9820fe9410c5e73835aadcd44fc77c54f164222ae0b8a5db02e7aa182455ba6a2dc01dae7674be4fb60ad6130b96ec402c695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd4d9d2f8139839cb6d35ce95c6f291d
SHA153bd3bb1a83990cbca8115f0a0118efc3686a6f5
SHA256f51d4110a61bf9a9bd5a56d89b269bd14769abff3e82fe7e80f683c5dc90a181
SHA5123833a603a881b9ab5d0b7ec74dcc75d2dd16984ba8eec0f62199f4f52a73ac88fa35ea6fe5840f67bfd099a3d10ad301cfe2a5d0f44eac8f884161a6af48d508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a044b55b8310646d521c9e0b5197015
SHA1c3edc3722e467633184065e1183a6609134858ee
SHA256e63d4ebad4f41b497240d59be4c1bf50b165f6e84c9664b71ac4c3b8c23ba0ce
SHA5121bf9238f3d75368772303685dd0fa8339532b8f6e20e2b72b3b83ea4b574f56db6a88e28217cab5a4ee7f69028ef67f8991a2bbedaae67195e962c2314cb91e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e28b0d3bcb2810c7e79b9a57fcc448b
SHA150534a2689ba8133e5787942e1c18114b1b1568e
SHA2562c448c26d2fd43a479b98dd644b5be37c9e71ceca6e1c385591f49ef5423b63c
SHA5126d0e8eab231307bcfb0d1fff244336bfd811f9ecb22809ad653440550672203216a7818edad48bb49d20e8d49f2e3a115a3576941781f68084e193a1172b3a96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542ca62a2739b6c26abb9422c9e2315ff
SHA179ed62ea14daad3c2c1514baf54c0279f4b017d6
SHA256ae38b458d48b703fcbdeaa668e1d25d8348599020b8b5cc64b4d259cc2c846b2
SHA5125d34c86099b77ba842985f76ccbcb2207a3239c51fd01e9039b7e8b3a3fb5f95e7ca8bf2ddb5251bb3e4d2398c38ef0cfb95d3ccf38c8d59c8df85caeb23a2b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5c1f7f9c98e4859b7e43991855d6eb5
SHA10d2f47efbc68fdd8f68a7edfa4bfc0c111c3c003
SHA256fb35dac43f44b8f086329c86b938fa1328ddf069b178566384e6dd4a3d03db9c
SHA51243478ed600fca7a978bf7b1429c5fb6b281205f8707a6b625778db9f3519db2069f6a63b84fa3dd53d2abba9a8d85a70393d7dc0df63bd17a05e84978d592641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb54625fa02d97e00b94fbbd80965d3d
SHA12cd56f9e007d6afde3ec9bd768c74d4acb17dc26
SHA256babd6ce4718d173c7a28ef532bfbd3ec634b8e7134946ee47006d6f1dd52fc9f
SHA51242029e08550a306175092ade5084cca9b0b457924191d9601c29c82658d9ef3756275df614d6bf8d1bae72aee7268cc33436c9e20d0f98becf5796c34967c33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518b2318d6d6400bb7a82d41f5933778c
SHA14d84961185fc757c8c334531700c12c385cc5d4e
SHA256330eb4c96d8d6b3e40d8e750e243fc7e6493801e138cd27054a791569d158946
SHA5126b63de88582da2bb828543e8569e47bd5ee7ab97beb9d9dcb516854703b2eb0d223ae029ac0760b211e874acb6fd99a71cbe90c93ecce3f62b7ce25d1da28e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a60ccd5bdec0fe16c4c4ddfe297efbb
SHA1c447d19ddaaf32f187fdfe47c183102db7963eda
SHA25685091009ef25e829cee545302ed5eed7f0410b0618f1fc3182f8d62f3ebb9ba0
SHA512464cba78008bc5174d0b26a83f80d7f0ec73bb8373f06ffb7e4e008c2b73e8d738e8ceba674be194f072e45dcdf3f03a929ab6c1296207f28ba39756f975e54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529d3d7f06094304cec713e1e22fa0716
SHA18935fa6f02ab880151e5f73fb54bc6030491f59d
SHA25652565ad22c24f9452cf31f59d52140c9e28c2988f373ba5b24e37e9f09ca5806
SHA5120cb140a0fc07e3ef1f5f032a792c8c94e36a2df3f81d68affc5e2c91e065a32cfdd30d7237f15754fd82a92e523c9dea1eee62668b6db9f0564c9c1025334e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f61643ed0c4aa13cf361bc25af78bad
SHA19934b40316f81ac4bff3c153fe14dc9bd918948b
SHA256693ecc1bfd64bcc6d2b474e2ea9975b8e4d9df9d93f4412cf6fc2695f1dea97f
SHA512a605ac5b1170c9cd4d68bc866cc05ce9aa04cb70cdfe511227777ee9d580c172b2910752138ba50848d802c151117ad497f88c1b594a398a0a6cbad50fa4f7a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1331cc1a1ee6f66e16830a54b709a5
SHA1e3a71f4839165d26e0d2d126b24e8e5431ff7535
SHA256e65f9b799bee0019b4eafa5b14f519245a0efd0f59576ae856a3859674c49416
SHA512772ae8f30becc7f9a6ab6de6bcd445c002fd3d883b60266d70f72d791a9e004c9f58cabcef1c8c60ec506acc131fe75896016752c9b202f82de09ab102ad830f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a89ed2f5580b14ab17cb5db607952b60
SHA1c871f96ca44949322e38d2053315de3f2bcfe2f4
SHA2564571d87c8e56b6e7dcba2c18461959c4193ce20126d6c636b30963453d0784cf
SHA512aa652fd0d26649e267043f9c001d76199c0c62559459cd016e937e43e68116202f1bd75c77c556273f02a025a043b25a22e6cd33b730a731ceb6cc6791dfe883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c6b9b0809c2ac6aa62ed2d684b61cc8
SHA1266c4cb61f7635ecbcb4ac3970a50b5a3d023229
SHA256aaad43ce3d3a6392deb67b1e95caeaf046e8d980baeac1e5d6fa8aa28a635c43
SHA512959a3ff732953df1c1e2ca37d2bf9d4e0b76e3d50dadd28fb4e5e6bb71e8a9e5d0911e6434d5960bb4c1f6565d9af8af5048b7c50942ca503189dfb907964a34
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b