Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
3f3d5b75b58785e645804da14f9de444_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3f3d5b75b58785e645804da14f9de444_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3f3d5b75b58785e645804da14f9de444_JaffaCakes118.html
-
Size
9KB
-
MD5
3f3d5b75b58785e645804da14f9de444
-
SHA1
7c404cf5cd106329c70803aedac0565d94fb072c
-
SHA256
1ad7cdb5738197e5e28578cc593994e993be099af052bcb9b3370d09e97824f2
-
SHA512
1958d7356695e4cdd9294392367889cbda3f016e03f9b47f4a7b5ddbf6837d23c934929b99e422c2b0e751ca93c48274a69c084daec05f5d8c6b5b0733c843a4
-
SSDEEP
96:uzVs+ux7u2LLY1k9o84d12ef7CSTUBGT/kPsfpUlVHcEZ7ru7f:csz7u2AYS/I2UPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1049bb84b0d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000dd8621df01df8e829dfd9273ae87bdf186514766a9dcdf7fddfa10054c13fdc000000000e80000000020000200000007458cc7e7a03c0b32661bec84a6ca8edb01c1a6480afade7232f91aec5cd5da92000000044351d8cdf381d76bbb2c40157842dd95c740645273346e432add6b565a010b740000000e1fb34b7076a3976d0b293a793d9402e72564aab94f937716964709e2083f8da16b33552d86f9497435401dbbf5d3662ee2aeb14aeadf505ed65daed5c524ec3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426987592" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFAD8C01-40A3-11EF-913A-D61F2295B977} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000f0cd1258c66898e8e7aabca74f41d0b7b9e66dd2578fe27b489971c23d244ba8000000000e800000000200002000000033b51e5f0599b1d84caaafb69ac94f22a40e444fa4ecb92347a570ae3a427065900000003b007320ec1684a1922ba1c4704fda28e0f1bf8de14985596198df54d20f4915041014744725e8ecf9f52770b8af2bcd1dcd511f59e52b4c05c708abf01ebbe2d9c09ec10dce851d44603318274eef8b144024a457260cc65e42c5d137a5a45135e78574116d730d3f09691a3ec2c46c1918b232c53ee2adc08aaa190a226357cac0b2fecb515c815d2bb30d0cd6902740000000d99747399f0c6cfbdba535d0d43eb9f9e0f57a3f66a1b09f0b3795b3e2f44388258db2f12f67fbce97d12a48d313f037f736214026053783af0a4551609f78d4 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2824 iexplore.exe 2824 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2948 2824 iexplore.exe 30 PID 2824 wrote to memory of 2948 2824 iexplore.exe 30 PID 2824 wrote to memory of 2948 2824 iexplore.exe 30 PID 2824 wrote to memory of 2948 2824 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f3d5b75b58785e645804da14f9de444_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a65455f6d596f97c64de866c5156e9ab
SHA1644fb2967d85d69d01923814e6b0a68eebe11f4c
SHA256a0fcb0582ddbe49db4211d7a7b6adfa2293ffb9a866f0d6059f0cb175cc596b6
SHA512647333b93f6837c2e5586ed07d099511ec9d3f2e8794d90414f13a174d2b066a4676acb10d2dcef712335c03f67607afabfa7fc132c31335511e5bf2e546406c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584f729d18e5d3cf20a4c4d342373ad44
SHA1f1cca9a554f83e609dccfeda8dd3af80e6c3af49
SHA256f860f59b242ddfcb996e8527badf278cc58a58abc11ecb33b364338612fe0566
SHA5126fffd3f7fb84750b35349ae0173437ac0d2d1851c04dda0a7a2a3a739b53ad6f1941c491cbd4c7734f8632c6913d420366082c24f29841525262157943ea6e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5667fa5d06cb0144a92ebfbc117d7f625
SHA17525fdb2e12095c19891ca2aa2f5404c086f6df3
SHA2567b413b4b5dea19b60a74ef2d5702722bfa9d22d1ccd763b87280d846d8fd0dbc
SHA512a873e3b2ddce67a9798f04f270fe098e99b7cd5bfb1ed8de1a57741b4cf59acc459f1aa0bf253e1f2d9436a3d98980f5088dbae69fc27fa1a379627ad15631c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501e633e513cee0b754fb66414e8a49c4
SHA13ca7a6c66c2d00a6a184d24965cb0ce512661915
SHA2561485809920c3418393f3056b26b995924b2e62e2d64bae8ee669ad8e64d661c6
SHA5124d5b0b20766434e2d012cc1d93ed45b3edca64bfba6eaab685d1f4f51ee3063d8aee2bb39a9bb13683b966f625944868ff818ea0774b32fed087a5346bd899e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57894a335757a6540ba3c47ca1a89bcd8
SHA17b94e69ead7d6cb91b8c3dc685d92e937315a879
SHA2567e430ad681de8cc500f68d16216bbd95999609da13eb5a08985545589c5fa763
SHA512eb77573b2a50de9edb7c75aa891831f14321810259f92224a1b1ab346c16e02f6c990eb98a544a2e9f384c3f6506408cf77725c1115cd4329228cdb4c181ba8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e771aea56e9ba24689fd877cdcdd333
SHA12fd3ca1dfed365bf446282fbc4cbb5be569277bc
SHA256fd9c24c531a58514263462f5d54eb09881cf7d87a780bc0f2742d03d1f54c090
SHA5125e6398d21529b4fcd9dcccfac4d6e88e830c463e2923bb6da2fc814169710a38e3c949410617a0458ce098cac61d7b1490da18b4493259b2e6d38bb0f48b39b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d393305809813dc1aebf7a5abeb4e16
SHA125f1560a016aa53a48a9f4081e489cdb9e043a2c
SHA2568a47b2b1a5adc975c00b6365e259e19b4f528e8af2f51d592ed2815aefc7ae25
SHA5126eba1f1e9585c7c9e6039ff41594a233ce65a41e1342286cb9a69c6f04a084e9683d84f7a715a27188714d379692ff2fe5206e5588d6b422a597a83e1ab71c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c05b27c76e7719ec07565bed733f942c
SHA1274b12cac0f3836b4d70c02c74730df05cdac53a
SHA256cb58160738c6c3868cabd09c3ee3e1f9fd51e7e95a7a940d1def7b8f8f9a456a
SHA5123ea5290caef22659821592e1208ef9aad6220f78ef6b5b4aa59dba788c00dd0750feaffb2120586354591e717cbf3bde950ea71bcf7b5a68596901079cdbc83e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564776b58721f764ff4fb523d6cc1ac5f
SHA13ce3b26be7a593b572b8891a8e0c6277cf8b702d
SHA2563c981de0326364b20df90aa32f294861e771b722490c8e533d412daccba9c03f
SHA512a600e38e6143aabd28e5f6ad357e20ef27c0a0a9ac9d3d01642975afdbcc1792333aa78e34b8c938e32465690375d9c38e060975e032a99e271dec6fa091bdda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c028d277e12c6224d1245b10da22d07
SHA1b64c1a12f04e9721ee971dbae6d9b1996c31b2ea
SHA2567789858c31d55cc1b49907c0babebfd68cd973a1220f31e8593214438b41081f
SHA512465a9df87d925aedd59c53db4f2abe8e44380e7cb93439ed245d897119f46c9311e1421afaa125966c46bd9b89693e3f7ab584399adc7a07eb5ed03ecd19b195
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2734d87c33e600f7356f9697bfc4ef9
SHA138277a9ce218e6d2cf40cf3dd44a03d119ca4168
SHA2563625df63043cc3a546835c3dd7a2cde8d8ba3b54d6aff1a14beb2c1195d63e08
SHA512a587ff72c2d05f45d842d383cb6ffe688f3e23adee3cd56c32696546a13c52f9531032303301419e3469e158d4b89e014e2fa16e999d631a729b9b453f315ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2fb32d1e8d090f328e0cc4cf57dd08b
SHA17be5edd136b9adba88242d54484a9e719df67a2c
SHA2568df9d48a566698ccaffff9b50f9cd0dcd68f7d2569fb8bc0f9b801bf1deb7f3e
SHA512fbff5f5ea72333b4e218e93c33fc0e3f84e548afbd4837bfac002641a2857da11d5e71d955209b65d3122a94333c772aabf95524ae73e49c41743d15d9ad682c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516abea27e27bd96ea09879a9f02d2b9b
SHA152fbe850599bd1ecd6e40fee0fe539222d968374
SHA2565c6801053573621a16a8fb092b855f3b041b849ee9ccafa5081faba16a66a99b
SHA51231793f09725131c6436e4c592944d465c6a57bb0d3a1e0ee1ba039ca095c65d3e14089d764583cbb6d2622a01341b9609d0eecc6dbbf94a85b899b145f6e94fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad08f53a2a5a9ceeec0540b786f330c3
SHA10fd6793eae47f13b802eb8f1e84105ea2dd15820
SHA256e52e7adf8571e0bb3b5fd126a5115fb2bf1122d81bf4464bf5f44310f9dc863e
SHA512d1ff625d6dcb81918986bbbfe8b8994f175df189206edf45692f79793917aebafd7c6e24579237a1f71ee4809fb31233e4af0d5e7038dc80c0ea0bc538ab0eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5befe0dc7eb69a5560bbefe9dc92dadd0
SHA1e391b26393903b3b06e9bd976073b38b49cc779b
SHA2567ce78830fe1d8a648ff73d6b0e6b85f8b82f12fb648e7df3eb2b833e6b82ba91
SHA512f3a500500b7685ff175b842a19f484b3350d10238ae63bd5c3739f6fd2827af348ec15f8db991638c5a1cda285c9f9e95024150daec84c70318e1df27cf5393c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591f33ad80f7463e67657e173a65949f6
SHA11014fe8a2c9cd3e6058c756b0b9086acf6aad8dc
SHA25605f8370512a1dd1813f441ec484bdad191ae50305c41f8dabb1bed6cdbf83656
SHA512b5f314e4687eb559f781bb20a7d07bbdb68dad1d35eb50e0e9367c1811bab8162856c30065da9b68c6f869826fec0559e8292398daf78f2c098f70c2e344d917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e09264c1b459d575a8d1e4ab0d96fd98
SHA1e68e3b3cf77655229b227d69b62ed38454baf553
SHA256b058f1af933d6d2c5989628ed288d0c263f099ea4b5e56e62c2126fd1b2049bd
SHA51255e8a1dbbe1efa7b7a939ee85ef1c2cb872aece812d8ff1e976d294e2d0311718af5a8700402394fe8d44d233366f577e3970ccd9b6eadd9089a5b021f43aa18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59db403d5e57343c8c3f991098d45ac52
SHA12414b59f7011af839a1830d74df05d14d70f9c79
SHA256cb8d000e938fe2c4eaeda40032688fdb05df2102858e9b94dbc993bd377f3245
SHA5124c95c9742cb4a31fb54f12f44ec09f1853a6400e9d32c8cee6ed567c202351e8be687057732e924191207fa737aa010e3ee9d3c6ec21f9af3579e8deb64aa1ea
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b