Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
3b7f594a31143254a510379ad665500a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b7f594a31143254a510379ad665500a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3b7f594a31143254a510379ad665500a_JaffaCakes118.html
-
Size
90KB
-
MD5
3b7f594a31143254a510379ad665500a
-
SHA1
fc007bcaabf7d6ff0b4b26f900347ed7d981b039
-
SHA256
174b2eb66e94d1c5a018daf5380b417ae9bac971ddbabdd01818e949df53bd9f
-
SHA512
c9be0235b10fd7f1c1640c26017d8b4826165ea339813dd3273ae3bae241774b5280b5ac4a1d1fb71d6ed11b7ab9dea555558c27a16e43e6d30b02a02b7b52dd
-
SSDEEP
1536:gQZBCCOdm0IxCM/F9KJuiH9bk2FxBe0Cr8nT5pAKNALIcTSBp7YrsICNvXV4hEVx:gk2E0Ix4Pd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426909631" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0053d800fbd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c757c8102acd57cbde7bbcacc14a778368624660e401cede3af5b181aa100cb2000000000e8000000002000020000000fa4fd0a4d370f7985191960a50b823aff6673d255d44187d01d5e60ccea1d82320000000c2e073b89f078d8eaa54fa47bb2ae32138148cef3f2ce6cdfa5924b38c3cfa0c40000000c3a2eb8f9526c10b9f1a9e83b0d9cc0db9565f5338660ffec972c387c0f22bacd3e4239e6d472beaccf6ce5dbccfbfcdd2509e51fb677a749b4686ecd07016bc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000006d6104a154246e538e3d571a7f81ac44747b6b1fc8cab0d13d59efc95af6d2ab000000000e8000000002000020000000e5872995557390bd2cefd243c72735bec4e0ad24c1818dd215fbc84ece1f17ea90000000ad38cffddf3c478b4e98b0fb89ede838a08c5af488866983fa28c201a00a2e3743c2cd79ac2eac60ea4e585429d317ddcb5f4819555a75178caae456cbfb1347c8eb5d0f851709c033b510a0cb6e4be259348087ce5375354f89dcff49221f673c2a2d87c1d2781a97dab833d9d54d4fb36bd745779a277de4b1991e97f8f41e8d9ea91e7f340d89fc9e0fc295eb32ec4000000008d2277d247740fd2605aec39d6a8643c5cb9a75f8d4b1a7e29b998a0581aa4f65c5b2097a073ab6180d3f1b8ce2532a31fb50acf0de55d21c2c450d554d03aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B509B61-3FEE-11EF-9BF6-6AE4CEDF004B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2436 2080 iexplore.exe 30 PID 2080 wrote to memory of 2436 2080 iexplore.exe 30 PID 2080 wrote to memory of 2436 2080 iexplore.exe 30 PID 2080 wrote to memory of 2436 2080 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b7f594a31143254a510379ad665500a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae72d45e9c7f082f2edb662d0d40b3f8
SHA1e8e2740fd0c28c8e5af66575f2a67a377bbd228d
SHA2565f97aa130fdca618f6454406bbf5a931dfe8ed0a486144bb51c59cb33153ec47
SHA51205ad4c580d0e0cdbb4ee8b72983d26985e373bd975c93f69428c9187e56b46196dd830bf35bb511a131bfbddbd6b5b04ca2fa6b155d5727189da47bd5a274b69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9ffd030ef364149df0afc830adc2647
SHA1a0ea51085d6c495986798cb767ac25e8035df4c7
SHA256006e094f04d94207bdc44ad3c81f3ae6e0753efcad35c1e010ab705b177f8a7d
SHA5122068d9cff9da6fd5f166b8afcbdcc19e0fe1d6e5f5fa24379600f9540360b15dfb553ff857289096de2152d2f99d953940ebd4917caac36b3a076136c44a7af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501e6d6f2248058df4b19efc340b1b21e
SHA13e2c1c14f07c23fd61a6313e031578c92f1b0c87
SHA2565cdeb54254ed2ed1f332662c8a2176f1f24bf047aca07a301d527122c547c0cb
SHA51290bc47cba78f4ca020dae6ad49ba5eac3281fa90a22f1db4f61bb610940f115ccac0c0ffb739345979b067bff161e20b6056b5d143c293544605e82e681e3c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50421902f37adb34fa859ce1297faa1c1
SHA19025a77e5b7fd6146cf1750d56bab8f58238bee5
SHA2560b7178b4843019282e812ea8e84f0b269e2cdba0eb99544a7f346a316792b31d
SHA51229b224384a7dfde0f00a2d2187846f2643e924b0297a40308101988398a42324e8e47617591678edef69a83fc9ed332bd6efbc3d17ffdb2c8d2d016e81affad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bac87eed70f613784bee145c9108177
SHA12a731d5c9c793e277dffb4392529d93a8b4e8f52
SHA2561aac74b1341a1328acae4d7ac57e285f027951624cb7a9f1699372fc0eaf1312
SHA5126c4454dafe475068bf44faecd3fc79416092706692dcac05a5b7fd8bc4a4c8cc5172d986c162c40a53cb3a9b75f089344f65e37bc45d788dc6781cb29b275931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5628c5830ff24559a0281fd1e54d295af
SHA1d7a72b03c4a917618f7f08fef0b4607d4cd4494b
SHA256b6f3991b810ab6081600ce0dbfa53714432a2e386b824bab303b8d660b481829
SHA512817250b6b9429d83950df56843a90d3da4b00400dd20eef0d038271a25adbd5f9ff0c56bdea415bc8935a8269573ae2c4560d64010cafc988fb31b11375b9676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531d3843a725aaabd00d42e83fd25503b
SHA1d8ddb314eae89432c25b797f07711e75e915e31b
SHA256253d5bd30ff0cc2cd4670ae316f3a157d9d22646eb9c29a56e5e5fafd6b82311
SHA512b533962309cbacc8336ad64fd880eb24de33ce7646e206db2146ae2536e153e0f9a7ad40107daa0999dfa0c7ba649321dab3dbc5c06dfee553ad07b90ba8576f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d630f907d0499b0d0a0808f77e5d7425
SHA1ea5b12763bcccf033912fab3f63f81bf257b99c9
SHA256446e96045b0bd9dcf34c98a6dee52646ff8b06665e8112860a3c66e62c5167c3
SHA51236c0f163a359c9ab1cbb7109f62a0e95915e97f81400a9b0bb98792f0d38748ea614e2963b05f7af6e44726b8a1e133efe93b0bb105ef26e415fb680cd7f9186
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c36b131f4213cf84de35f36dee2e4b9
SHA152d79acfa1f2baf6c798c5d234f4f316be9f7c50
SHA256c307b7a832d866c6162a11a1306f9312e2935000f5bff261a443bbe36225d030
SHA5126f5d54b56600f725844c46a96a2567ddcd07e7681765fd041c10a152883fab5fc19729f5096fa808e7bcb1f3f01818e89f297d699e87b9ff676281848c90f35e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0ff99cdb771c61c522b9168c6fc0134
SHA1485b756cf755f113b80fd12c3de45f085d9989eb
SHA2563d839a8b805574a6e601f6e594c813d661cf741764170f5fc0fa6e2975ef4f4f
SHA51211038f547980fab18a8df3adedb84599b1f66e39716df194161dcc646425be8544ed13deda3cd6fbcf690a865fba4a98086e0927c7a1f6c0ff8b00ecab665394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5619d80c0a676b11183ced883e584da2f
SHA1d0f90edc1b1def27a1089daaa09a4c1130a50470
SHA256c00d49acf47013471b5d5b2e3476ea85758cf0659031ef6d4ae309a7706a9591
SHA5120fa3988aed9731d31de6e5641a311a9d5f7af2fa3ec1606a3c1a26626dfa19e999f4da51f86a6f8d9e4e60850a1c6698ff66bd9a7442a53ad6f61fa099a25892
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edaed945f114486a17f4ea5f20c571ca
SHA10ce143ccc60f2020fb91f27098b0b502a3d74674
SHA256548bbd00d87f8123c7410f520c0e1d0cdda86d545b4ed44e9393148e7618b6b3
SHA512305016508486b5e90adcee6f19681adffa00c9f3e178440baa7d000d4357f025d73de045bbc7cb57907866b47c0e3084537a8a4472649c3ea68ebdde3f190e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a8fd97d4ea2ae72b8ed019ec711b535
SHA11fdd03ec19cb9bfad938a39f1412b5272b692ebd
SHA2569fcd94bedc16104d781065ad2fda3868a5f0441b16e20ffad9936d82ed217fc0
SHA5127550d2f9f8360e330bfb43723814fd0364c9d5d14d12b16f8afc9add7ec40a12b0bfb923b79b29cf0cfba02418a1309b8da4f77e518ca6b45ce5e7e29661b57a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555350c0d912bd54111e2926e7075554a
SHA1dccbe8e33d7d9a7704f187e0a8c1a4e8d5ea228b
SHA256f0a153cc75049f543ac9d5725c5bcaa26891cd79510c6c4efcd55c59f64529ec
SHA5126538c144a533963d7f080a9b38958763e3c3379b1ab4c7cfe619673858630483539f6710c18cd385bee04f65088d64231583f05c615eb953757b0531fefa3d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c34428798c7c6fdef6d1cb2d12091196
SHA1c5d7d0495988f57dc82957682727ee30ff627b39
SHA256e8a21e1308e3963b2b5d8f2f6c07b265be68d1e2995b94d9d3d6efbb11437df5
SHA512bb8c6dde302b2b6968979eb0ddfb55fa7e4c1bccc825a8d1f0c79793c239c9add18ce8301ff4455b3e45cf13cd57d477883b8f4bb3071f8c33b4f0e28c3073b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537c614fdb2ab60b5468a9737564ae26c
SHA10d5e199d87860fb1d08b9003c7604c8e6681ba77
SHA256c534af21775aeb3f71355ee5b228427768025a8fe3d944849288a0ec117e1276
SHA5127caf7ffc1604ae695b32693025c0cc4d3583feefcad7cd56eed2da80b52fc013bad10a876cce2e1c604d5b1fb4de915d642055400ad9b823fcfcc58517e0f335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cb813680f72221e33cf41ec072a319e
SHA1768e06681accf43dc78818a07837fc63b4ec4ab0
SHA256d81f892037908fb9ad7ecf3db8f584073078fe326ceb14fa2092b55da763a30b
SHA51207b88cca28644e8d4ee41b3a08057992b70a1c112aa05f5b40acdf97b72cc230ca2bdd88704f52cd035518a5313dc85685317eebdda7f137a85ab5b9c453cb0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586cb289d13417f0e5a055c869713ee9f
SHA13c13559f63fec96e36885654b9386142ead896b4
SHA25601451f16039348095d743841315890de38ea5dee5ba143d231c6b70d6681f3e0
SHA512314e9a610f93bcafba645de45fda55b1193a8fbcc6774be312501e579b0ae624f97d054f6ec6907a91eacc03d82c3b8206019b1ad954f54e1f4066dc3f61ce03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546ceaaab581c8517bfb1e91d4e06bde4
SHA151af1b1730510c984836c4c18948878c2b0a15ab
SHA25666b94bb5a8ccf1e589517648f93e267db49b1d5ef19f6f9e582442ef41a8db9f
SHA512eb7c93a18c2386bb75bf6390abc8bd9d5455af55042ddccec3ad9c840d5ac0eb820179acc61ac5186ee92653e4fdff447cc35dda2834d9d0d9ae5cc714822934
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b