Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
3aa2bd535cf5bcdad11b6bf29d09949d_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3aa2bd535cf5bcdad11b6bf29d09949d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3aa2bd535cf5bcdad11b6bf29d09949d_JaffaCakes118.html
-
Size
56KB
-
MD5
3aa2bd535cf5bcdad11b6bf29d09949d
-
SHA1
76926316915f068bd3cbcca2aaa7c5b16c5ada7f
-
SHA256
c9d25837f3a38bb436d5a711d06750ba9c57bc97664a5b1e3664c9c27e2925b5
-
SHA512
e439d5d9e732a83626ae84aa48c817565b476c64e42986074561269de6888fee6f48da071be42328d9be5fc682ab822e777cada011d620067e26824461c1d8b2
-
SSDEEP
1536:gQZBCCOdXDyKmn1PTfzrtqrwjKerM1frHC0IxCy2V3oQr0VV9Uf7CqXrwJgyR59Z:gk2pDyKmn1PTfzrtqrwjKerM1frHC0I3
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426892238" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000002e919f1901a8a584fccd7507000908a1ef22d4b4df70a9b176602ffef555bfe000000000e80000000020000200000001cccd884a2e5be30e3ee6c819a8b136e277c76eed7974827b4b143f4bc6e0a66200000000f72a1f24f3fdc4a7da8ee0b300e48415bd8690214efab548fc36dbe151a948b40000000afc472f59af02e5a37029cb45b379b6a174c42b6778e6f5e1a20c99e7e59028e63be540211c75766bebc7fb6e42cc642011f62854cef09be2181698ce5bc3ce5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACE1EF91-3FC5-11EF-826E-EEF6AC92610E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09d3d82d2d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007deb5ddc81852ead43d61537386ddd58979d52a438195b5d9f25d77d57a65922000000000e8000000002000020000000f50de50494a2b2582d516f7b3ff000f174b57222ac89f0843cc82627690aabb0900000002dad4e85f5e4a7b0eddfab1e4508ab638b99d820303809a9b25d94c890f25201cf7d000c97514a9b81c3cab635f37cbb564a3943556c346eb907b5f8de5162f40989b665cb21a9fde516f21a9b0f63f8a6e773acee0690d5ef58db9f8eb67fb575716fadbbdeb223f9d773812adc5d59f2008c502cc7880cc74ebef1074bae5acc133e8da70b41c44e3fb092f8e687fe400000006f072223825fe0fdb7bb7c72e29a2ec61b3c0d141e4973d20d7ff9c86bd128b7d19837bc3582c25f249813a98a8fd7a9f74ba4328cda4ec90fcc11355d243b67 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2844 3000 iexplore.exe 30 PID 3000 wrote to memory of 2844 3000 iexplore.exe 30 PID 3000 wrote to memory of 2844 3000 iexplore.exe 30 PID 3000 wrote to memory of 2844 3000 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3aa2bd535cf5bcdad11b6bf29d09949d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5169bd66e9ad42a273a8058e726498c40
SHA17e1c52e1272d59f03aa09edec02304fce6d0e618
SHA256b72600f7118cb21b313975dba1c6e539e18d35be4d8390575447032540ee2362
SHA5122c1ceb5caf25c2a8a2477e3cb12f8c9985089157a951fd70695ef9ed6de7cc0b381e0c7f021f4ccca7ffa397fe294f7b0283012b67cc7a66dde00e4a330b2cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b24824ea73351c29cc3560ed643106a
SHA1a8ab8ff697b42825f9ab2a6a86d8cc0b594a06c0
SHA256790735ba92024005367c855051029ca14e917c0568759b816060204273c6b0df
SHA512dc7ca8827b4e8f82409c18f21e24ec42333eb8a7cd2a76079f66eee2e4cb6359c7df3dcfc1a4bb89c968df07a25924b5c47956948dc3d658de882570fdae8905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569848489d432be989957fce47befce29
SHA14adac84ed7cd10400f06d3b1309f12e99e9ec090
SHA256dba4b554ecad6cce8c207025674aed1f0e3a9446eb65285f0d94d361cf8d2544
SHA5125bf6b680268b30360bd1d964943eca7edb1fc8f9b812fdc6b1146e9d80844ba246809629d2cbad6843eb628d6b6331e0e36166493a4b4fe96dbd244f7c770d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51de6da7f96a8488676e452459bb8539f
SHA127b85a4b6a562104ba9589294c1f23a39708ac49
SHA256f1f453d10c99ca1de6b6207334f4f13cc0aa08284b1aa7b37aa160102f2c3631
SHA512bd24a90a8a930031d590bdfec430e3552df920036cacded7bceeef6ec5205aac3143daf421754032811bc9aad6a6b1bde9ca87d9ada34d4af4b15b5625ee3eb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5896a81653dadd73e41770fdf13ea6459
SHA1c02d1ccdc353af72f42f469a7e6d6f9cf2d628e9
SHA256103b999f6b6d8480a24a33f50a91387aadc6725dfc120007759034f457190561
SHA512ba969890d6c2423482efe2f71316d7eb15e81c936337119e22d2b6d87c2fe5c15ca82d4a5781cb7cf19e4ae38a9401034c36fd99ea15dcb72115361845668ee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50205a3b7471d6c969d8141e1575451ab
SHA1a910180b969cd8a7020b805b128cf04bd8d5ebf9
SHA256af5b20a966df22e03d68114fc24088139f7825c5a1a3bedb6aeff8e08b8e0e1a
SHA512177b6c273595399a81e68c7f6fba1f69260b0298b0df74042a22e5a2667033770601caa25fd8fd7cfd21dc36c158b7955cf7bd8c94c90c5fc9fc1957c2625d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a07175572b22e9bb9df441d8ed1d1c0
SHA1d323430032b8dcd919dbc63e8638c0e4a5344e9c
SHA256a7dddda5bf27fc71af39ce2113368e4846f9b3883c20817fe5d87d7ca1a46c0a
SHA5128cfc8e3c949e766cc4172cc6ffd7ff6af124a9a43b57c45f2a0fed023489135a30d49799db376a77a3c010ca4d9094cf30a7d956c23f839959a5c3b11e90487f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822c7720a1d3d8ed284faa5b82a3dd20
SHA1319ea71751d492a040bc0f846a55f25577b93ed1
SHA256b3fa6e38461a1577df92fd516b3e517c79b62f7e5e900953466c46bfe8178c88
SHA5129c2c8dd2f5c70caf5ac48eb5c09b739a49597bdf14bd12415cf79831983ef784a01bb19f8e290cb635fefa1ffb464c0846e74f78672c3e4871f5b485e622d781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8c4a79bc917a65c0ef466b97a3ad192
SHA16927e90d99e0ed001764fcd1d9d1e7a0d7a8da9a
SHA25601df9d27fb655171856bbbd0729ab9d754c94bf30bbc76044f8ff1dd7e8c5070
SHA51219ba503ee8bc318becc362266a8adeee1cecd4eb59d867083ba571292ad5dd76987f9549c9794e169ff8f2cf1ae64e85dab8802344c655b945c6a723aa2eafcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51af40953d6cc4c83ab367185b0df7c07
SHA1b0e1f0690f272818d5c7430c884c886111edb5d8
SHA256541a8ec7c13120a65644504e13679debc710f9bbfeb1693a9e3bbb9a87bb5c8e
SHA512eea268d98191adb836322863e972d5c28f44ef5dab1174d8678af87065ef063e21aeb717554c539fed8cba4a58a7ea05a3c6d8d8c9ca1c553935d7b679895e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce2aabaa78b73d1d7f2b73d90f397fd2
SHA1026953a822b3c0d85c8a51cbd3a982362a0185c5
SHA256206e277d79f992b35d06997faf16c6d630ec378dad83a0d003ca5a1aa7cfa0e4
SHA512878db21e9c38a7205ea058a6f22afc192ccff264107ce8347d316a30bb670de683787ca78e3343d01320f2dd535027599ce6b5d501f8c71cf4006d94531bd10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571f613c7b633d6f3ddbe1fa1d217311d
SHA1861540f6a1754dfae36fdd2b3c31df1a35aad8d8
SHA256a822c27a15a66f8fa394874b30140c78ce768d55361f8d814edaa1dae6524ea6
SHA512b0cc6d056955173ed05642f5733a8a95910aaa618ecafd7ff674580525235be5cd917bc67494955c2407a9ad6cd3f20d57e1b3dd021e35eb3bba251f1c8c1eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562cc62d6f1b0f7978bdc3ee3c5eb2d56
SHA1feea3b999a6f9b7ac42e640eb6267cbd61bf70d6
SHA2564a62d24f8920330c473a6efc4e7f4d5c8131a6e979b9391a1cc5d5a66f646481
SHA51266d09211a7f3a9f58599bb2f84ca3143ca218c63c99dc2dd5e45d5ac84984e50634972b036f53f8ad5c9c0145e004ff75427a2119d272e1e88a55d468e9668ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5027fbba186f34fa60b91c62689c574d7
SHA119623fe7f4470a60913a683e559a17bdb0bc6a7a
SHA2560d870720a129fad8354db0ef8fbe6de7f4c571741aaca693a32e7ee08cf2518d
SHA512ebc94b2847d79da7636433ebccab58b7de6004f6bda38ce31a5863297fc827de40e960424035e986d9e9a8747556937a52618c4ecad99a46557d808502032f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9cf0b620f091556819cd0b29d024dbf
SHA18bf83f4f83bee4f9f35150ae55ea77af67eaf25c
SHA2564006dff26b9ce06bea5b22da555bf937ab6db5202b9eaf2e979b1efaad6e125b
SHA512323e0b6ef6b53c8a71ccea8566dc0228fd3ca7fa77fe7966875560c5f8e6090b35cce686b370b2b9418d5888ae2bfe543548181fba5aa84f8267609e76c6b63f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d501c1c79885af53a1fa96ae7d30aef0
SHA149d40b2e0ecc1a13700de5d4d47b52c43193197b
SHA256b6db569be31767e78b58d5e2363449c32ac13e0644f2655258e4123b2a00821e
SHA5124f3860712f2b61e7241dc4ca89eb5d22680ad7b11d07512a5d39cf6c83d505838b13e7ce8933a8eb1370a0d6d867015c53d9b5ca8825fb74e410b6adaf8feac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5677262540ca6bbbe2ec661bf22ab3cd0
SHA11724cee50c0b9d8207ecd8d46df20083d592582a
SHA256372ff147afb86bf4f70ff24e07b804680220c42a587c860880c7009471afb588
SHA5126964b01ab3573894962e67374e645e03d73a1fb0af511e1a302ddbc8098eea076e09bfcb2ea7ad4d9206ca13540811a34bc70a33d071086576e613ceeb84050b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542453a98f9a85778bce09181d33f670a
SHA1ecf371c48b36f94ac0fa6a1567709001cf32c061
SHA25654225f0516e291d03bdde4ebc600d4e553aae1cec388dfa45996c4f97f4d9547
SHA512bfe901f4cc129f55a74893f55ce1902457962f4de5bc0257cf5ccb6aab3ab02239387f9475b4644681066c00b2404b5f8e0db17071369ab125f1fed409300697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501a194b943a438207b9f967c23d61b54
SHA123d0f4891956cd82f510f370c4df27e25c9c08d2
SHA2561970a383d13fecf382d91f5839dbea48b4b3513b56fb6249b4c650b5e473f96b
SHA512884386f86dab5fc25eb7e0712e83b8e7f04cc803544390f48abe02203163d66ff13703e7a43bea10989266e5cd989a535ebf1dee782753b4cb738c97d4ae9f07
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b