Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 23:35
Static task
static1
Behavioral task
behavioral1
Sample
3f518289f0533d264758cf0bb95ec3b1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f518289f0533d264758cf0bb95ec3b1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3f518289f0533d264758cf0bb95ec3b1_JaffaCakes118.html
-
Size
342KB
-
MD5
3f518289f0533d264758cf0bb95ec3b1
-
SHA1
5c7c80ed8e8b6515fe6c420abd5d6353b8d6a1f4
-
SHA256
59ee84f48945043d747510dbd82f30188ebf594fc031ae4ee8d84d586674ba80
-
SHA512
2a88bfe51000b9cb813ffa0bcd3891239df53caa16044650ef343bf460566aee5d6550e7cfb6306a724e64b6d48bf3d1429e23339da6601a36ce1ad5ddeae42e
-
SSDEEP
6144:S4sMYod+X3oI+YtsMYod+X3oI+YU4sMYod+X3oI+Yd:55d+X3D5d+X3KG5d+X3j
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426989193" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c71f3fb4d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c1ab55ee7ff72503f3d4e03bc0a8495b7892e016000bc8017a8f74e91c6f0b23000000000e80000000020000200000004b91f58c921c2f97805eb819e9f1b92dcc0c6e8782f43136ee07f716077b622f9000000010fd61badef6536c88b7813ed1d021ac4fef4300760eea52cef920e4a264b4ca19b9efcc322f1fa7b76a65a5849c6f9378e77730bf698bedc368af27dfe5a6b342def8afccfcbabc388dc972a4f48f832f1468cbaa81175103c6c1e1d3ae6de8027ce99a195e2641edf94d0ac9b7725909750d0baf299f3d49b33029f002003d379b72becf078c863c33b22f46a22fed400000004927a92c9256921e02fdd0b98efa6f24e9c6a7c90da461c4ea00229ae2f1397c9b481fe99d4976f05aea38885719e8943ba3b6fbbedd337592c669dc4ed93b8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000004d7407cc1ae8b420d3070488e5b51b5a87ac4b25feddeb20825357ed31a443bf000000000e800000000200002000000053001a471b1216fb4de05b30e1919df349d1df3660a70948288d917d8de2f43b20000000c677defde351a2674652ad5bc8290b07be8bce8ef22e2b642977cfa4c93e937d40000000e7bc8337187b310fee3baa74726e6564b8114a6bffb5e72c041c60f74abf5f0873bc38df404e710528ec892911056bec60b5cff055d17f1aae83618413a20c0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A902B61-40A7-11EF-914F-526E148F5AD5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2672 2676 iexplore.exe 30 PID 2676 wrote to memory of 2672 2676 iexplore.exe 30 PID 2676 wrote to memory of 2672 2676 iexplore.exe 30 PID 2676 wrote to memory of 2672 2676 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f518289f0533d264758cf0bb95ec3b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528fe4cf36e6caa05aa515cc73541fff6
SHA1fc9f3ddf8d24b942182e56ac74b79928ad44f7df
SHA256f83cbc434744e2bf9bb3ebef0b2d3066a79e2bbaddd581fb419676437cccab01
SHA512744ba85927d05ab5f94bbb204c7ebb117a80fde5d8945ae7eba92eb3217235ae4f315fedd35d9d3054ea19769cc9a3bb263b6d0a21b367cd31ab2a0d4fb2e0aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5397a43b8afe663fd90963aea4470cc0b
SHA1b11da9b3e1d3030bad4e9948ca20cf1387ad0710
SHA2568e571050f49b2e2d1d598e3f43afa262f3a480fc6048e7759e1ea28d742aea37
SHA512618062d76d4f9543555835340b70860b5846e09f9fb26c44dbcdd23d30846541fa053cfb427fb363380b7b19374d468bdae3cb858d37123de5cb9440af9b38b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5835436d432f0e07a28b59e063b012dd8
SHA16f04bef1a221c9a2284aa20885c2227b280f1894
SHA256a66a9fdaace7923745e939062891ab9a57bac67f0ac7a0675c6083f3bdd7b114
SHA5120a5388c6798eb4944b8a32d5e68b6afced944b422059b0bf834881fe88bea81b80ff2431cd99ff312d77b96dc4cb32369974ae64faaeeb2ebb5a74d155f13b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9bbf4f48787e01eade5273878e58eea
SHA1ac72472d4d97735f56b72d4098f183ccf207f27e
SHA256b28d4ded6044ef39a14d95d98f9d8c54ba0dff3b17822a0a6ad913b69cef1f48
SHA512152824ea6cf80e529195b1443826bfb10605cf1cebf03e28ff304567a4047d771a3a8b18908abd14ca0606608ee854821f618373e0fbe393ad80f97e83a4d314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503f0dc77f64b577c49ca64d360ffae8b
SHA1a32f50c5a8cec67771d25ce8dd1281f72654beb8
SHA2563d9d6bb1c1976f5460adbef1371658c5035cbe5997f175950510983522c5cae1
SHA512db54bbbf9ea84cd4a60a7ac7a04bdedbfab61bae3268ab820fb948787cdeed3d23610b3a5e44916d50f145b982ae9b65ed1c358b5270f8b1d9f98c91111cab33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53797a4b2e86ad2fdc907cf9f6633d1ca
SHA1ac9c81f780fcae82dab46b055f1f3fe2ea11a735
SHA256ddb02917c0338247a0dd2e1f9ea55748cc6bcde6460cf235ca9366848953447f
SHA51248b0e4ba4c67459e4a35244104a2be1726143eab66863c66f79e1f4740157a2fb79883e54ae3310956af3a37a8118eb25f9fa630106ae3113b29416b8037e22b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532b7ad88b1c0e74f48942d117da62317
SHA13db4c7834cce91a73ad275ada30db4d82d9283f7
SHA256ccc24886124c61e7b06ea7b994c88e06bb0d4f28ca2f6c810a84219c02fea91f
SHA512e7b4d79604d80dd6374cafebae125d4dfeb5c6d80272df1d8c01712d315d43cf68ec8811a67c354959278b51ab1a440b63cc3b0c74a0e0d05dea949789cd1df4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5fe2449b1a4ba55d4af351a48f6f33b
SHA1f8c7f6dc045ab573398523e770d65f9bc74e4dcc
SHA256d86ed840f0c1c10a1a1a9bdc1385c4e3d7061fd8272bdd76bb9781d63b5db7bc
SHA512d914ff48f083ab529698e363dd71d495e7e46e2cf610a2b50d31b256f81a2b56be0ca83a6d8c6fa606e02d515f715a5c987ef6e8f3696017d8b5d9998218f1b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b98c98230f3468c8563e27f7ec6af4e
SHA1554d36555fd7aa96cfe0a65712c852575fca996b
SHA256d949b4143b91a8d26452ecaf5b2f35b0ab2bd7429342a80b9fee74790afcf3b6
SHA5123cb79238e274e41444e0cc7df1bb34cd578a699c298354576e97a1ac24f3e4547d04a3f76cd0179db33f163f89d099fd5853453062f449a0f5bae0bbd104879d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daa6bca2f630ba074b52531d1ac823ee
SHA16a9229e4f9038c0096f9c492e268ab9254cfaba0
SHA25670875e528518e53f0e3623f256f9956e7ffa0b955f2ffa74284f87f5041fa3d5
SHA512512b8846b69a179863750628e115dcd718a1a2203beb5dfb1555b9f6ed8dbcdadb8cd988a08d2ae1b512e48741d994a4843e3c15b748feebb47e8f092b626950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f0acc4332e5b9f1dc365cc19912bf72
SHA11a0f3449b517e497cb68435d6f6fab8f0a5bb3cf
SHA256ada2e5b5affe7b2aea2d7876bf83cc7c50107a023d0c87c2e70653be815fad86
SHA512d383b81969d325cdfd51763c49785812e11d5acf24e0641a424680148b77b2a9e29563d7643192f4888163ee0370da2a516357a3f943b992a8958505ab563b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f60f87bb40e3df3f95ea11a7d972e69f
SHA18fce36549f24ee07fbafeba476706a73d561efee
SHA25659e4ef938b08944c0a2bc25ef2f1f0f1f609209f22096784323b4033ebc5664b
SHA5128273f81acfdf763324b4087c0d51b36f34663f7bd69c72452085c84489f50d9e52f1e83966243cd4a076b3ff915f9eb36a5a82c660dd4af2129d6f079bd8c0fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5350dae6f786fbca12a78c8915c87f636
SHA13c152eec8812fa55dd554775662bdf92be6ccab2
SHA256302d2d72936d33eb665205c4b29ec34755e655b214526811026f818c43b8050a
SHA512cfb93878d4dc8aba8a9c93f2ba1d606229836eb4b88560e7f474340427a2c3c404173fbf3e42768db3ac2c54e708c8150f55eee332eeec930a004a065a73cf6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6a72c798960e686fb43f6cdb11eec79
SHA115f4581b76a8a45202087e4ab5dc0dcb9d3ab07a
SHA256ce1b5571002913d99edce0363a107e5391979de5ffaa731256c939baa0b110db
SHA512ae736ea5efa20f060a791860b4fa7d98388b5d9397dcba71bf206b381bf8b529512e58c063291c9e63951498f5f9021f6caed16c66b98d0ada5ecc9ef11f6930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571da681079950f0363e22afaac3d7e24
SHA19ffac194aa2aae0d6ce84d72d353dad4a3dd9f65
SHA2564074b60a2b687b3b5c3352948cc0b5f3f9db3905dde5c22b4770e234ded8b268
SHA512ef2eec54ff904720464cb31d93a4822b2541f6af6d1f7de7a51437627c9586930bbecdc75a57f61f3d9f2801b36e8fedc51dcb9b9df3399595a3a308193793fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f24a6008196c024fefd5178e751447c3
SHA1c5f8602c972f04216f85f0d2eb628ceacc193485
SHA25678575c50520e6b469594fa17411db671b5ec2ae23df24ae1b725c28e141d8327
SHA5127364b22ad2018a88f941399ac67f69b6e396e2bf25c59beae0c722976551c81f9fb5b91ee1672211182fc1628c32571a22b2e63add1e3bec197bdad22e1e794f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc882966d6262d310b17c936e7672aa3
SHA18b652677f7e44ef9f0522cca620092c65fd5657a
SHA2560ad78e1c51e694190d2250d38f8a05f1dd1e2dd2a2516a1168beb2e58d36fb5c
SHA51231673abd11f41ce77d90303acbca3b894f27fc01897208c96a1bc6b56f27ad25747395791c989b2fb01a9208eb0f38f9184235e7b43ad664db8f67c4e7f7380f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba41a2c7b04fc7c0561489567bbca213
SHA110505f8aad9c533c39f904c600a8236f55ecd5e0
SHA256603c176c9f0dfb41002b51192431c6c3e968fdeeece6d7fb218bdf427e25e9f7
SHA512ae3d947cf3d63782440d80be0bdd21cdcc8b87404fca3e38cbe4ede1ec52024caa1387b90c1ba7eb737386030012a241960673dd4b6b8f36e9da1538523bff03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5082be609557dd0ec094c7736e278cdb9
SHA135607041a59a16dc0bfa82347af9a44b9b5f555d
SHA256b1e3240530e6e4c5c9eb88259cfb5a7366401721a0bceddcade9f4cde65bad5a
SHA512a7326217c050ac4d50f2712f0fbe989c510e28a2a0e020b55d95b3657b594b0459e22ed2b000ce2e49c9dc1a47769b1a7054c6cd097ce1789be4ebd362115b89
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b