Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
3af7f87796edbaea421d7bd115f2c3ad_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3af7f87796edbaea421d7bd115f2c3ad_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3af7f87796edbaea421d7bd115f2c3ad_JaffaCakes118.html
-
Size
433B
-
MD5
3af7f87796edbaea421d7bd115f2c3ad
-
SHA1
fe80cc1d9fdb3c1e9c86d5958843ae2a87bda897
-
SHA256
06aa9ab42ba603cfd9b05a63236732c48c5fb709e4f1d86fac4b981ec3dcd4f5
-
SHA512
b98c728a17ab51af880f52e901f034417080cc655129ea1c714297273beb1a23f60eeb3f5937c7f036e039e4787bc6ec5e8c602c9123b3ad5716ce69ccdf891e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DDD6FD1-3FD5-11EF-B892-EE5017308107} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ed82f2e1d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000007eeb178daa2f2b53e170e3ea23fd314d9a76a265ee11cdb2a946c0d78569b22f000000000e8000000002000020000000352756395b872b5ec53c8345430444e6dafce979ffee6d02ddb938b7d5f2371c2000000077b78e7c1bbaa1096b31e366f6c0af7a443758cb9cc285ad3ff99d7078fd15984000000025c1bf2c115eae4ad1ea0d0eb84a4ed48cee0016a560bcce95821cf9237740b9ce5e2c4aa127ac488cf139cb1b5dd482c6f7c886d9649c258e699addd3e178e6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000b39b88fd52dcf3cb5461533bc48dbe1d06c18e3127665e20e274178537d02560000000000e8000000002000020000000d7afeb988323d73b095e3fd58aa69f7d33f92e96f25f5df064feb68923c19c8190000000073b6d452cc0a44e5e7062386f3d2f4d59a9b140a41c6b265124785db5f46e169de293691d9c3e5f98e2c1ecc85ef72109608405902eb86624df30c46ea42eea4f47acccf262f280cc823badffe3d8cf7972bba40acb46975c1af23adc4db1f68417ddfe3c7fc3a44839505f61330036f856f2678fc1f8c5c9d70eb055436bd5cbb34098c74620e07a5f5cd491be5e2040000000d26df025eb77b931d1d1ff0330b083bb390f691063acedce3c6e9089a169bf34a037dcbf768e1ebb1affeccc1f2cb3ab2006b8481f029cda03a65eecd65ae58c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426898871" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2396 iexplore.exe 2396 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 3056 2396 iexplore.exe 30 PID 2396 wrote to memory of 3056 2396 iexplore.exe 30 PID 2396 wrote to memory of 3056 2396 iexplore.exe 30 PID 2396 wrote to memory of 3056 2396 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3af7f87796edbaea421d7bd115f2c3ad_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5832c9ad5a304da7bb2989112e6d11bac
SHA1c313fe171d8df579e631af30ab493d771af6a8a6
SHA256ba30789190cfd071501fdc6cdb7e7e4039538434e3c4e3e095388a7b2a75db59
SHA512ea78e453d2590d3151a20cf5bd8c0ec7461ade689fa222f80f2dfb412a4d145db1e28f7f4b1a8765c8667b91a60b29554a307ed0e51920337d282158012d87a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b017524b4eaffd206b633fb2bc4942e1
SHA140ae63eb4a58687f059990e006b43d658566075c
SHA256d226cd0ff9d834e349de20b884850da69bf0edb94e459726860425df0e580cac
SHA51234580a91b9560a20ba1f6e713fe779734fc47aed17552828d586eaf2071494b7f99aaf3821f6cf2397944cf23ef4d9dc519c8c94ad54e94c7e2add59733b6112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57223c778add17bdaaceb9617a9e5ba6e
SHA17ea4d69cbf82bc32a381c299f2d2ce25152d8ca4
SHA25645d9b336cf4bea65e6631c9720301bfedf0c36ed61fd07d01e82ef99caee33d8
SHA512fac53a29e56bf170ac392b0143e85ce9ac8ffabc8143c0744f7855cb0452d114c9f873b9690f45086bcd78a06a77f089eb03fd6cfcf01e7d44df9e31b645fcb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b01b1be07b68f7c01cdfc1dc00985ffa
SHA1a27e2020b88437c63e1b545ea372fef495b28a54
SHA256adb30d38689a85954822a6bd011f12283dd69f0e0ca41b4d43a033b5ca430695
SHA5120dc3d8980c695246ce48bea0bc257936c9eae35a25808dfa94a1770abf3d17105d8fd1a075f76507ebec63973e19826c93b09f4242513c60ff721e1542d2cb07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f7eee48df66beb7ffa1d7b781748cf5
SHA1d6c07ce4b1957a0fc5293efbc3b9ecc0db03f213
SHA2564d2683e9415c99523cdbe68f34302d6847e43ab211623f05c9cc60d1c18dc181
SHA512c6cb80e3fec945fcfe81d069124c4514454af03b08dd97f4f13b374dd456b68af6ab3bf80fab7da499485ad7fa69ef21f5240da5e37a8e222c8542bffe73d90c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57647555a73f7d6535d52e6e68e502391
SHA17e6c871bededeadf82e5c64c2e3793089c28f4aa
SHA256200a643b336974afb31fc6721ae713088362119ba1bda5cc0a6b5db2cc25f655
SHA5128a9a1ed89d1a863a835528aa7df4881bd3578e8df139788ecb7d872e9a4461fe7ee475191e038ad96e404b93784aa13cdf5ad5f141e10c32172769d551153ddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2414aa67ef519989a8a5359a9f1e689
SHA11182e8d85229b2077c2c6539935b231a31be54be
SHA2567dc2cdd3e766d914424c6327c4fe83d846bfe713f7fb036969fad7b67a652884
SHA512a0e7dc79a8273b1da1747f0ed5dce98991ddad3d9340474f3cb57de03d7f35648dabf1adfaae1034ac60222ca919f45a97d135f7dfa8ddffa515f1dfae560f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b87ace3248fdea18ccc4889fd79ff61
SHA17da27a2da9117a160fdf2df1ff2a77daf45061cb
SHA256e47e59220ceff32024f9ae642bbb50629e8d6f41975f79ea46447cc6f45a75b8
SHA51227ccef2fe914711e82312b04c8f82c41aaa3be52a7a655206847d287d1aa84298c22bddef755bde95dcd69fdd50a248f662c8e4fd5dd3b7e834e0c38a9ef97c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a9dfc423327085f625b563f39bfa542
SHA1a37f3b3b6f7e7013a826a6667ea666eba13853ee
SHA256b4b0f2c078451db3a41f74808157c241d35b8e87a642ba2b26c9a60618d517b8
SHA512338f75a765802a992227b2d836909ede037510ab722a07302c7b1ffadb93f132d8c0816498120442ebaed4521c452876bbac81596845653c815b18cc966aeec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b65253cf828c6b7b2ee4c2340ae80a40
SHA103497e3fe8cc302776435c7a57e411ad05e2223a
SHA2569f22782ff91a59bc0b2fee2f894525d6508a64989fff2fab1e43a73ad2524222
SHA512c33c2a2a3b13e3a6475c3855a255bda55a84a13c1b241807cc68ba821f337a8399f709f7cd26ac59617237bb25328b82654ecd875101b60193eaaa5b3b61902b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f1b1ec2e7dbca3f11eaeeec02a6dc7f
SHA155abbd3e875b966c9f2ef73062453078a636d511
SHA256038d158b52bbcdf424e67846f5e94cd90d4ca71176df35be6724eae6f6c519df
SHA512802117255a02cfdf16ddb5ffd45fd51ae747f9ad18ad5d057eade7fc13c748649e154964617dc52817d7dd82e2d7615020c42a6668c44dfb4b10bf3820f80fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599efd5e04a46dfd53e79d602d1c89b2d
SHA15dfadc96f66b80793684d914c87b15616b87be97
SHA2566e2e506a8972dde3a4207f804029f35665f3545336044b4d8b69366da5c13d58
SHA512c197d97b6e764030dd91ae7893316f0758a1e55858a2e9181b3d9e3f9d463c1230166bcfadc44466e183043ef6e7c4f2261825708df454cbd8e7ee32a18b6c33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bcdf922c05ad6ae014a2d570447ed33
SHA1065ad8cfafffa93b58778e7c5ba600ba1bd85530
SHA2563922f777f9c324520d1cf62a8fc5d293ec93362db26a7667fcc2995b5e1bb1e6
SHA512491e0846aa1fb4043e90b398dae62a7aaef28bacdb236d834a7db979b8c0b9f5ad9ce3443148f59cbd8a3e5c909515a52953e47b08e88a8ec0f5a3f8bb199a57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554b8e95fba94e9fe0eb7d527687982e3
SHA1b425ef8ccd98fa7e795c50b8af7c01c13bad3d44
SHA2565a811d470880efb6f53842b0f6b140ccde78fd926c84287ec4ae05dd9d48b318
SHA512becedd0998794073a3a5802e2e5bbd397e27390954ff5d4bdae1fb0af36aec68b97216c8e4da4f99a848d795853b622962951f4c15797b3276f9186405c97413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb6ee1b9796f39730da8a93e0bf7175e
SHA1637d14667ab70258d21f0c5d68d05898e4cdc9e8
SHA256d4801c64ce4ad17587b5314275c4abb39c1ac9fc84b4677808160ef248336a49
SHA5128ff5013094870c07cae791b7723d1a70b145b40a72344514ce6ec23de00d1b67756c4a9b8fbb2dc39ce62c60b852602c4f4394d31b4678fec67484587d10d856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4a75ba410b70cfc9fc3170ab6712f13
SHA19389fd77672ed923c57c54a04fa134ffbc248ede
SHA2562127352aafa7d517af020b3b6a739d8f7340985133dfe39a71b6f8c25a03f257
SHA5123bd362b6a75ec6c713e5eab59ab003294e50570d8532801560d0bf439da6c25983bed88707dd7070a111ccba030397cfe2aee9d1b673d93ef1d9c57370eeb0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5942a937dee195f6d0faa2a3537f75c0f
SHA15d6118c91fbfb3273ee8ab769600288e17e5dacd
SHA2567c28c79f6c8476f40947d86d84a389838e4e14cd591f8692f7999addb23a3a50
SHA512b135017a6141e914cfed86c2fbb1ab5c1cf8ddc130c1e209a536c594b813be4ceb7fd7739e9d35a2016aba6fdcdc106dfebac26d6d042c4be0256a2244840739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5378f3f8338b05707d014d337e0c3d4e7
SHA19a6b63346f50b9e8bb419965fd98f128f665cc04
SHA256924981f1d3e1ae988c0b1831b1c2221aed5f90e8ea89774cb6f5840cfd02c6a9
SHA512a32e69f5826cccea9cc5d20f000e6f6ca3c3c450ef42b495e3420afc5f06db31a733e6f3efdc99dfcf83f050a62e45fa9e29b4b2fbbf366d8671b8273fdcbb64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bc48bb573f056dc2eb04aa84e652ed2
SHA1b444309ca887029957732f0ea5a30b42278b1c65
SHA256fd67db104ba143071bb6fd32eb0f69570e40f96551d2f28924336075beb7c691
SHA51251c3eaf2a0a956bd9b5292641128905d61da2b0ccfd5ce425528e70ee1c47a3b907965ce8e543d81a8873a83c53d0d5e8b0915b094a78ae64a6064eb7eaed253
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b