Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
3b6d02617356c301b0f7420c238229dc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b6d02617356c301b0f7420c238229dc_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3b6d02617356c301b0f7420c238229dc_JaffaCakes118.html
-
Size
11KB
-
MD5
3b6d02617356c301b0f7420c238229dc
-
SHA1
65b0f7dc8599f30e38ba0f515182647bf357fe2d
-
SHA256
49f081a47368fc1201bcdb81442efac582bff1f917919fa267feeeb6a68fb679
-
SHA512
2791ef10b4fd46eb9261ac5fae77185d05d368b2370ba24ab4dde762ae686dacdae6cb6c0c2c58b2cddec70a89af2b10f50dcb702e75b8bc4735fea41a89e914
-
SSDEEP
192:csz7wKDAYS/ug8JSpmHJVHJGFWdPHb76f:cvKDAY8ug84iHS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03100a4f7d3da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD6DE821-3FEA-11EF-B33F-CE9644F3BBBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003d1ad47359105ce20f0ada162d71a6faf1f34583b90eca3dc6cd9be80242a5b0000000000e80000000020000200000009d825d8c5ebb37a4a875bf3b0f4273b1376da212f3a7b90203d86d452f577b0f200000009ed4741ff25b91954dcd572842ddb204532987affa5398bc519a015a9839af7d400000009ff2a3f8b2a1a9eebac3f452bb4858387eefda2f413548c3e10d7b7ff851a1c9e47839350673e8ca8fe5c91b87c17014c6849e9efbf0c02a1c1b337cf0b23ab0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002405f1841897e2f5d76fbf854d0cd3d970b3aa24e99fb2ef69d24180fa87c6f6000000000e8000000002000020000000a9fc0095e5de02e471fc423ca165ff6e72daf0c3d71748d76a2ce2b0bb0dd9d390000000de99eeadf7d866ad100120b8cefd486cafab235cfdb96b5e000ce56eb878853d56e8ed1aa039a72b3bf2c5f5c5a4a8b87c42c469144b74ebd7622f0137ca8c66319ee9025c94d723753bff44162515e52771ee9bc87ecabdbc5db45b7b5e6966631153c333f340ff6ebd6c409954f5a2608c602b2547c4ab6c8ff39e19fa4b9945dbe0c61f2b669f3efb56f55d57bd9d400000003cb47c7da651d855d2f1f7c6797351a8996948f5f2b3bca383009df1adf0de3dc6463f4d4c822651187b675a084d6a93a22c8e229c346259818315dc8136aa96 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426908185" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2412 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2412 iexplore.exe 2412 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2472 2412 iexplore.exe 31 PID 2412 wrote to memory of 2472 2412 iexplore.exe 31 PID 2412 wrote to memory of 2472 2412 iexplore.exe 31 PID 2412 wrote to memory of 2472 2412 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b6d02617356c301b0f7420c238229dc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b5e58090e166188c9be4f05669d2301
SHA11fcf0611d510e7b671b4b0673009555c0e7395f8
SHA256124c47dfd8f90e1d602c58d8b27cf729e1b7d9da3d39c1158d100a73a5958eac
SHA512bed205f57b2a4a617347d45ee4978b812e85b6e0890b028c04e3b79a5e17510c0b0143be9fe3bed98f14975678b0ea4c5ee48314b0abb71a633c38a8f684b93a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4954529954244db5863599d47a56024
SHA103ddfa3cd44f034aa3475edb1b0758a05d675f1b
SHA256daf5722803472fe03456f0bae491b00745dfc3ae20c6dc604a680cbed709e826
SHA5124dda004b73299801577b29bbe9d0c68766b7486b5b7f189d8219a2e1150454f604d0360516bb30faaaf16cc556d831bf496a1bb004f545a6ec56fb65b96041b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5ff53b578acb3492fabcd99e1345e91
SHA1d6a9479800556808ea027f424b4ffb866a1aa1b2
SHA2569c410947e2dcff0c1ec99154f710d8d210fbf9d2417e1115c671a2a3a07e03e3
SHA512520bd1f08a5e140c18c12302dab8cd7516bac91e616c7d99a5a338807c69d897347547c8af9551ccfb8da261efd41260e8cdce72a6422d0a7971e100a62dcd45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c60dc5d9d27a41f895488ba3100de497
SHA1a1eaad28c1bf0a5ec0d396d3db6d08ec7727f4da
SHA2567f0d19c31de5860460ea39a331d530448a65e48b1aa5702b46980da82aff518b
SHA5129b815e183d6adfeb9342144c94e715e4ed6db3aaae6750426679b99ed9c5a4a0f96d72aec915c47d3f9deea9fe4d6c74d934bc25edcd09da249f78edcbc66895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c16f2fa23570b241a3d4aa34c70a42e
SHA1d2ff4bb686838feb36eaef521dd251928b1c6bb7
SHA256bc2a37c181e658c78e90f089bc7e63c2c60036468c95e63cedcfc27749c8a96d
SHA5121cd94d6c9a05263a13c9ced9ec2854d2a97d6f8a46bf1c255efab18a463719e9d179bbfa9c3fee63108d262c296b2f3d4db49f0ba473d785064e55b70adf84f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dc07e025fe8eaabd866d1bcaedeca3c
SHA10edbcb8bb2385e1d1c1eee5c540e150a6bac2a5e
SHA256fce98d92f004454c2ff81a602377f76a498491d03dddb695a341cb9ac3fa029f
SHA5122deaa98a301397ca8fae4c423fd5abb158c90a82235d6ed620ae612122f73d159ed5e5b6123abb0173a6b15abc3148dd38c6d5f379288d7130e84ffe8f8fd6cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd35971009ee2c0294f8b9e8861680c4
SHA16dc8228dff2b75e8bc7cf3914d6a588c059afd06
SHA256777c9ad6f74a203e7ce8423a608def17fe6eb7d63165985d9d858fcb49ff068e
SHA5121c19930e3e14344fcc361d4e5b413168a098b552eb36695e6978e655661d514d28df31c58b4164dde5cc56fd66ce588731bf9a70c384397dca2c2fd889e0c729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5860fc4e178e8eff39e47f371ef5da6b6
SHA1262d003c268b9aeeddbc4bca36d0b7a39d518ba3
SHA2564750ba598ff1439f969e2db1df76494d118e7e4b6f592d6a924a33e28360b2e9
SHA512241d1036a9c99f3e00a523e1ddae761274e8e23a8747b76d6df8de7e963ecb24eb6d4e964a65c04155e0ee779f01ade93a929e595b74322a3b844f9b342d6a73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdc2894e1cf4246536decd6832754124
SHA168421d5ab3ee9754bfd209d0ea825098048dc83b
SHA256824f965c1636dfc39891a0fadea66c2bb61804795db578f83d13f0f22cef41f6
SHA5121f528798f3f3f97987fa177eb39a07de85e1c577101c11a889ed12770d9a41ad3774657e4be3aea3380aa8a39c319c3feac16e51b6fb78e1e2add21124fda33f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565223db840503d26897b7472041203a9
SHA170cb9e9eb84bd5bdf9441588e19f734713057dac
SHA2560276c0c5348a2292ef55a05188e2f1873be1d508bc4f6b0476c3a95bb452e3ec
SHA512e87104e2e8e688d73e8be410e0f234137296b7c1af343b2807a135ca5cbc626dc0d6f6d0938287db86f6a0eddfa99efe1efa181a06f9243503721fbec6bebc8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559ae9e9cd7bceaa0b560441bc11ae89a
SHA18ee7f26faad3b487dc040aafe3fe92b1acf6e542
SHA256b5c36d4d97a5745259d1bc8bd9302f86f8c1368867afdf55f74ac1685f1d2bda
SHA5123e8423e6ea22ae05b3c169552cd972ca720730829f2baafa05e1a7eaa4712257109ac95611e9d4a78e1bd3f77739b029088e5abddcef1c87f691e427a77cb20f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b14f61fc621d1d07a89bc9da024b90e6
SHA175127e8bb5de55d3eb6aed4c5e3355365c347d86
SHA2562267ed11e1a4384fb919c060fc4ee18d7a3590047e89611865e49fa815bf8937
SHA512e660f162c516b456e2666df9f11dbbf40e041d483c18a9c5aa9662bfad557b4fcc6e45fb18cce785cebcdcc2955f6723f4fd748827ab096220829385d0d68abd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7a3940aaf50b65644847986d5f26f8c
SHA1fa265d78e868dc2efa0e3d8e36674f9c623d6bd5
SHA256ac7382e74047944fc88a99b83b6718abcd90769d2bc47b6a8701dcf56f659fe3
SHA5129d62c7b169a3341f52440804c73dd85ae7417903a357d5244340887645d024a631dc7ecd2c6cc85da5c0061828d8cf5117860eb0763397c09a57506870b3dabe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57474b6b940c1d117988a27451020bef7
SHA1da30ec53f9fd60db45bca8b16f0304e7e66a258c
SHA2567bc96f5a33f53695bd086f6505924f4dd70900e3ddcd5e65153f3497a69fab0a
SHA5122eb1e3cd6126d05c037f21dfa400b6934027e7a1c8559966c2c9457d47db2561b06533a62bfec760f4b652a3affd60a52119eff0ef675c7a4c9e7f5dcf2b4e34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5581d5613a5d40a9fc1c4aebbb2b9b0e8
SHA1ac97c4f70d6ce7cea201ea1090b24eebe9b4d5a7
SHA256b970d0f86dcff5cdb2bfe78d633d51d57ad2c9b6c43531c4e29a2b34296e8ee0
SHA5129658fb8210680fb7744213fd8cec0e464160c8e0b38df8b688fd92381d521e1d90b96256be2aaab4d126c4b84a1558520846da3e9f2d249b4240682db4f73dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fa3e9f3a31021b71378f7b4c632d174
SHA1424a38fc1da7bcf5a0bb1c80152d7dbbaef5c202
SHA25661f812879efaa144005ad68257ac64c0f24824c0d251be376bbe09cd2a71506e
SHA512715ce36f999f48b66755d1fee4fc8e586bec07dc1170405032f9a56762a71153943f4080b5671363cabb0d05e75926bc901de81d5d639fff212af1f434fcaf21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569b0652109a36531532487504495d89f
SHA13b90835f82d96a08e226417b3d6629158a48bd60
SHA256331fb023670521a400cd23ea448225ade3f5f0e5fa5a88531281a73836041054
SHA512b2d3ad1d3cb9e3732659a1b547c20fc65a68f464cc5429fba8ad3c4a77bfe3c9c675a24a55fca2ef68ceefaa06a20b2e8fb8fe43c2bdb23172db4839e326776b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518b841dc2346893dfe985f683e4590b4
SHA1a2fc9af8af10c0457438cf28c6137f34bf2a3cea
SHA256536cd57bcc03ba6815b57c6c5101eff0b90dba0772e518a3b632a8c507d52294
SHA5121fc763fd452f16219ff8c0bf393a316bac2fa626995e824a51531393321b39be466ed9d32c2e9ce5373147de2a38c2b7801555be2679e1a997f601740bc0353e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac34d99210161c309b0f76cbe24aa236
SHA144466394fb4e2265e1173e153b9f30353794a780
SHA256fd19e61297414c3a318faac8423d9266b57fa563b004fcafd96a5c66b1a9b6f1
SHA512d1df5b88a475298d5e67ecb0c6722ff5f9f64a02accae0de90dd91d6e22c4fb3aadcd92e213c0c989d6705ce3300c9f734a715cb4fdb58269da96301aeedf301
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b