Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
3a3819d79ea0e03b9dc689e6982e444c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a3819d79ea0e03b9dc689e6982e444c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3a3819d79ea0e03b9dc689e6982e444c_JaffaCakes118.html
-
Size
3KB
-
MD5
3a3819d79ea0e03b9dc689e6982e444c
-
SHA1
0299a1fc987e5324c3529c1c90981f337146cf0d
-
SHA256
f1599f5f182df6ec9b5de1845ab59cd735bf5b77fea2b49665c3cad3439293ad
-
SHA512
315f7f5a7ed52556fa1cce21ab389739c33029d99c8f7755efb3c3a48cc9ed6dfd5840bcca242594313aa1afbb25d3fc1c886e327bbaaeb36d7b8f38ffb5cce4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03E45681-3FB1-11EF-A76F-5AE8573B0ABD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409093d8bdd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004775cb605942d06bd1e3d0343bc8302e86666c2287e3d91a731894b57d3e84a1000000000e80000000020000200000001e631717efb2d112301cb20a258e2b5fe1833b8d771e89e1f0e8fe3d9da050199000000066d901da8182e12431d71fd2acb3ead0769f2c04e1ed75ce29703098e31c584c568a7d3e916a62cd491fbb0cb354c439e947f3e13b2c93019ead1372158dbf2a65e7a02c8a76530b78d96da71f16d02f55b629048240c1e2e68629102571d3ab49ae6b34bda24721cc53aa64349d15f0624dd31139504b42f2817dae38d76770326f49b8c9a845fcd0c4651dee7ea48d400000003ef2e01fed5bf8cddfc34c3d4831215b09c60911dc378ba45610700d04c5b64c65288c8bffa03a888c2bbd2e7045fdc596aebf586e6bfa33a8a8839c28332d0a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007acf1ae13d04e78fc325377cbaa2875057632ddbd515a60226b5527283b67665000000000e800000000200002000000023372976589079490bef24883da5da3dfe5aedef6bb50d8fa9fe9a6d9d85eb9a20000000fd84de7a3e713e6ded63cf03bdd19355a9000f0499b0c857d12e0ee8c936699c40000000399c0cbfd5c52cf4d3da0a808d75db95a95cf32fa39f6c9296cdab058bc0772ec19ce97497d1998bceef0a8266afd79e2ef9aeae8292309df7f4c4d286bbf238 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426883368" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1976 2468 iexplore.exe 29 PID 2468 wrote to memory of 1976 2468 iexplore.exe 29 PID 2468 wrote to memory of 1976 2468 iexplore.exe 29 PID 2468 wrote to memory of 1976 2468 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a3819d79ea0e03b9dc689e6982e444c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb7dd509e0320cefd8bd1d517b3c8088
SHA160786b57b43c9b00cbe68070097e5714fda8f353
SHA256ec10a6edbaca503fd5f46be200a6b2928929aa8e26e1562184b6e3492dc47ead
SHA512c650d7ad518ffd5c4cfeb4f47769ed555e3e7187feee81470841f3d59211f1f5433cfe6a67415ab9d500c745eeead7f93e8bfbdf841a2ee952017015f99dabd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524ed414d7867f71542d3612c40477234
SHA1fa5a04b0dac71b0b0a28c508aed28193b3a70021
SHA25610941e8649031a2789fbbf4ffbcacb9a01e5380fec008cfee00a969b6abd1f62
SHA512450bfb1a4b21302feb7e6c2969fc75703de1cacdfae94cd39e9288e497defd4dfef52b481ca6e78f36ec9fef5c395d86979fdbaf4a868ad2858ab5824cbfbd0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaeede5daa055de248c03e6d2f5b6798
SHA189073f4ecd9fb9b68830368b2ef13b47816ccd5d
SHA2560ccd2ceed6814039be1d5b0133a8765c0a3722d01200b586b6aa16c9fecaaa9a
SHA5129b55a0f389720268243534eb3ae18ff18e7a06767e281a4e370e932cff9f2fe306bf53f80dc49af879295b41310445958f572b8b3d2920a03fa76a023d151c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599fb779f08cabb803671257b93a5ea0d
SHA1b25325c943135b0fd0071e7476ac9d79f4f42502
SHA2563d208e0c29a7bdf3255676e73a12f3f755098e38606f502a0e19e2e9cce2d7d8
SHA51223236880b87439a6414f87da13f9cc8bc7a6efd0ddeb75b5f2c50421c26403a6d556d1589da5e69b606048718dd33b804f1c7fd9211bc01d05e0fa656f43e507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5e7209379909036bbc184de8913938f
SHA13d37fc4813aacd0993e2a4e1809a495286116c36
SHA256094eb32fed5c1f88cb648fd26bb625252fb25f8edceaf9854197c20d999deb16
SHA512c777d42e88b9d1c5d4a6a281e4328813878b293677b269b3b4588e023d71f3f81521a906403f4abf1551e6a867c9006fbbb15afbf7fe0b5c7de75f7c37ef00b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5568231203c716d87058c6d8067cc321c
SHA1f7a42ad8833ab1e704e7764293d3ee15cac3ab10
SHA2563f59f8bfd03cdf565c1b6269fc29126e602be86ca208673b119c332aa4b5aa7c
SHA5120d5a38a649dd746aed3e4d7ee76f4f2979e2c6b89484807b573d123a44ae28544dbf3f4acdba120fbf342bc8a1e4de9461aa3cbd3d6cb498f710e69b2f0b5959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595c984d29cbead1bda639cae7f1c60d7
SHA19e82a4dc3a8ccf8599f0c5472106d8f7fe60a6f7
SHA25654d59cede12491a23de40a73b608801f61e7e4a3096b95f177c93cc0fd788b11
SHA5120713ab827fa88a29ef151e08f4f0ac447ca4ad68a6ebd91227f2570d67e91e2c6519ed1c81c1f6a647379bb503e29ba02009ea75818b059845d96e2ddf266c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7151a2d25da2bbb995cfd2c33f2c1d1
SHA11272f78c9fb89e5ee024be10255303c684d793cc
SHA2566645372de9fe030e76bb4137a6be03dc548ffd9241f4615409d0ea1a19d6e106
SHA512bf756f14b88a8e32057d1c65b3b9c000fc12ebd834b9dcd0c8084bd11dcf34aac50338c6942cb15002698ce2401c5fca4f12f570a34a1bc46e4d8fb063221ba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ea5d74a8fb38de077d08871a8eaec6f
SHA103437aab72de038e2ed67e115193d0705a257b9b
SHA2566b5d2712545369080c4f3469ca58523b2c836cf56b6c40f60260766a6b282657
SHA512421f707e9ee1ee3d3fefe23f53df0f7312238224959c387c4dd2880eabd4a19d80bd6178d3d93a04f8211e68968046640a36abdbeb1f37e7f07e40dc0be30a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4437ccfb14954ec56f2bf417da8033f
SHA1674da6615f9b1cbdd76acab2ddaee2f20426c740
SHA2560fe789b867d60425495cddca0f648b4e822853b72e26d38b0a377f02ed060c32
SHA51277c3f2aee20d9874f0c220eaa7b57151fca1136b5aff1e8d25fc1be1ec070af7077ab1c1513978b8f85ee0d20e6c9fa35cfcabd67cc77c9b00dcaba9b3c660ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7bc6935e37c77b2c0219ce7d9500da7
SHA1ad1db320b267bee910b1e8ffc7e45c420e1c7913
SHA25639c8924b0d95acfd5faa46c6d08c1e2173794ebfb5b175f9fc7285e86adcbcb2
SHA5128d9aec1eb7849f14d89ec429ce1566c0a80020309280f4a65f4ab7362c40031efca727294d0788e80f8b5babe5ee40ba2ba74c3994abe0e21d47acaefc9a8045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54859744f5dfa438cf6e44a7978fc4a7b
SHA10c071a288a12285feb2cc7e267d3f509c49dfabb
SHA256699aacb50ed47afb93d77fadedd39739f7ed2728acd91766b36de0e1c49101d3
SHA51292b5abf20ae1ba568d4bf4385e1e6f624c878dea43df15f1d3d7f7c37f6358c0aad85e9d2b8abdb7fb9eb7a53113a9534b5b183ec565f4da2f0df004f638e540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5715411e5200df2386ead4209516ebf
SHA1e175351d26d630bb8a83736c70e712469c68e532
SHA256a4950777b1a54d4aa6d07401cfebb8d2deade405e731fb2785769bbbb67c6b5a
SHA512f6b9693c6642ad49b8ac934bbfba644ff1fecf9d3bcfffa09d2942454f6c9e48bc02d7f9a7a4dad6cd8e49b553318fae0c1ca371fb64c233f66d77e9c7905a57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547cb47b596f6bd5c19d738f70e161aeb
SHA1d59c3eeafef2d4abddc99515bce43317119f0625
SHA25680efcd5225ed9f211a729803b3aaa9b8054ae02d3af07338281cba20e76fe0de
SHA512b559a60788176fa7a6b9c47a4d71994bd4502003f2128fdaad1df08aa40cd2c3f10391fe9d214274a0c9c19c9ea1976c815497ee446e0ad7349dc26cb23693e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fa0316cfb6f36de6c8cfd949b790a93
SHA1f5f26bcdc73470d72835d6e7f5e7a60fcd89b320
SHA2568dfbff3bf0383768cfd32ff1ab971797425377a8a34bfa9348b176c492a30707
SHA5120a38b80e3b0aa84e1ec818ed8667f08c26ca9ee4b2264f2b76dd3c660b03448ecdbb07d0c2304169846ccb5a130fe94c5cee6112513e973d7934879ea6365f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f512b6f6d4dd5e29e4a55f673ac041ea
SHA15b1de4d456aef1c7d1268d646416ce31d56b5d53
SHA25680df6eb64f9e3528cee5afd2b3df4912931693fe9f5efc3b27d8bad4c4559b41
SHA5128dc3c080ce534955da0b3fb67dfb9cff266a39784598a56023b8726a66f3d42eb88913066f38cd1fc975f15409ab0a6dd2457797b588e3799c045e388da8876f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3a37bc95365a69c456e2d1c43184292
SHA1559be85eb0b24a5ac457b216e34d8039327730df
SHA256fed54ab8effc5bf552c1edd26441da35773af0ae33bd7315bb088c26dd6dcacd
SHA5127398aeca03bdc271af9e6532ec92e825a443ba7b74fa5b7fb2bb1dd2cd97dbd385a745aafdbd8c84ef497c5a331db0ccd691779a3831a02b9dc54bfda92bbcaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500473846b68c222af760b0bbb622b24c
SHA110ba6e13dd62da4a8e111d3d4a17298d67034c14
SHA2561e93bca7ef2c4ceb855213bf19976170626cdcddbc713a2bd834c53322011336
SHA512e6520a37a923dcecc1930944eeff147a6959847f171d13a6336b9a459bd54b2a0c39ff093ed6bdc6e5685a4a60617a945bd8536f61478c6a960071f3be3d8206
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b