Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
3cd677b701a618fca785400bee7ad227_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3cd677b701a618fca785400bee7ad227_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3cd677b701a618fca785400bee7ad227_JaffaCakes118.html
-
Size
6KB
-
MD5
3cd677b701a618fca785400bee7ad227
-
SHA1
cd553fd8468300ee82b3b84d7bdf93336a31b395
-
SHA256
cdecb72173f16d203124f434670b52ecb502bec55af089ce1e89a4eed571f6b4
-
SHA512
255185a27edccd1cbdf4b3248a4108293a571cc254d2026f00328f444fdd1d665b93e0868429230887477a5cec85635f569a4caaf4921885f6305d189e549376
-
SSDEEP
96:uzVs+ux7eWLLY1k9o84d12ef7CSTU3McEZ7ru7f:csz7eWAYS/vb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D16FFFC1-4031-11EF-91EE-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000de64b94153f4841bf7492a28637cf6beed02cfade636b97f08c249e6cf6af0e5000000000e8000000002000020000000a6f34f45bcca6c00d759cb58b79897be682fcfb9b7242c1afd2f7615cfa27b1520000000af4a1e05ea80135e1618dc0df25e728f4f0048d0d6180639a91258959ab38b24400000003cd94e744e9fbb1fa11e92ac8f7a08f6b2bd58c7d44ede20aedf900f1d639783878826be003c94cb572c20ebf10cd9600144877b1edbc0ae67c510df3b1cd09d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0880ba83ed4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426938685" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000591d094d91be11ca52ad016af330fb5528de5f7e7ac2bf3363064cd89ca9f729000000000e8000000002000020000000ecee9397a76f971aa5fb4a1eb0ee2ec48d2fa07bb353b9679532964900a52b6190000000c28196889ae3a575b745f4062b45796538a66f133aa5155dfea29f12398f159214ac32b49d5f66735bdfffc47481bb03252171cd9f64079a347c2d777ffb7221b5a49a636d4eb85b504366a38d6f4058460bd4e9cdca202efb8b73ba70106c29b70f4f2486fbeb484b12b2aa9c33a59dd15321311c8c15ab03241af408558030b0d1768d9e456f74b770ca67d8be03fd40000000cd732b97be3f54f0cdef8da8527e772a9906fd72fd6e6d3ddf33fe950bd7104ad78bffe7fef5d2d60a7e1a16b8dea0e8b5fa823f6e0e3f4452ea280810af2c86 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cd677b701a618fca785400bee7ad227_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef8dfe6ea46a47a16d0b4b61ba08253a
SHA144fbb349c9075fe8f6779d6516481bc98312695a
SHA256f8e1e8eeacd12ba8448177d4452d08a98aac4af76290bd70d5542edc5b640756
SHA512308797a63f1b9605be35cf269d63e1759543d85b15967d2389e9f99bda61df91318724aa624dd8c717e86ebbcc4d6e77b3b36c666fafea8b01c0d60f125b8b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588591398edac91f7b5ab6b17b017cc21
SHA18ccf6291a7d905a287ae49d73baeef9cdc7d37bf
SHA256e7cf550711d02ee0f39addbcd7d46536637d90762007ad98f54eae626799a51b
SHA512a9fedffc7db10fe44d136c192d55132c3f85a01a50f968d5838e11d1417ece995704bc7177a5339105b84e2661b41c202f93ac179867adbe25d8cee36a91b4aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d48c72a5909d8e243d6d1e5e9c58b47
SHA16da057c9e9dc308c3ff2cab0525b36a4937dfd7a
SHA2566e4b363f2a8d71d3790e5f4b4f854c633fdbc176751efac438a05cc2458cb708
SHA5125dff43a00f371373f2466cd02479267d93ea5b650b8e30362f3921ac9874f3f0d335047ed222f2a25f885d5012b381cc1d28b4fee3713fbcc847d3fadd06940d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e34c7fd97c0a0475725719b3fa2ffe23
SHA1f402eede00f3b829c06077365f520db080275192
SHA256316f616d208d49453879821e8c87be89cf1842486cfdee87e3223e67c3f7a963
SHA512ad4821adc96c07986d496f3de659848bad2fe7109410e1b92c96fd5851f38a5aaa2ab960192d0e7c4781464d90b32abac8d11c549977f3da87ca303d795d975a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5858da6d31022a088c996ef91cf639d90
SHA1d5f4ed7b2a71e32939aa6fd0c5ced40265b7cd46
SHA256ea510a754567e02ba7f061ee8da2d82cdd6390fe1abcc9f408312e2c8031120e
SHA5121cc16037f193996ee19effd1b1fa22e9b244dc071c77b3882b9ef1e5c3c21d49619cd600365ccfb866f45b941fd6807778146206eaa66102ea43777ce3f38ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0d4e2619e45fd1f5077f8ac0a51776e
SHA1e2b2c2e80a111402b8f154dfe718106a87957bc9
SHA25698e7143270a747fb28e50ef34529549d62817a9eddcc589c59427845014f4902
SHA5125497a320f3f2b073f45363453ca62e176e1337cb66aeaeaf5ca11c1cb6f33c6982ca74bb3e5222c6e9545c887b86f9604f62809cd7c64cddde0845b736f05402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8d6a8d864b9103ff7b65454c50dd7a5
SHA1acfac321c61807c5104c841ba4ad638fd1dda8eb
SHA256649fec9058ec175b596702ffbe7f0cc5da74ced2b651ae9b0ec77734ddb40c36
SHA5124f9c6c82165a3a70533f808aeba81a400eff204bee912ccaac5f987c95bd4d9878972bd53001013bad0ea3ed2d618891655036ae199f339a771a6fc4ca3c3d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b7f812541e5262f9c56ad510c0855fd
SHA181976d134477433ef5ec0bd7bb72e76e60a320a4
SHA2564de1e5542568b5eeaf31aa58bcb1485bff1d7935b6374557e5dc3a339901b491
SHA51247823945ff7c61b532f391eb1b82b861153a1204108f41af889f12d13c20782b25045b313881a499d08abd89ee97de8bad11a5487f914e19d0be3847bd30da9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2b849062bb3b415fde733e5f2b285a1
SHA16a3eb60c64ee30b40ad57fb76d94d85f0dfabbf7
SHA256ec6769355e1710b5bac7e0e9f42b874e60bb4dacfa783a281758e867fc743f04
SHA512487e819602fbd5a4e2ce84bcf2a3d5bf8e0a2f97a4f8247f9044231d68aebbdb53f67abe176e9776feafca439bfbfdc787ca8b5880bb1cefbc1e70bf108b8a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe11afa5dcb3db9c3cec35bb0011844
SHA1f8f73a8b9db9bd196a42ee9d00ab55ce4bd9a83a
SHA25629e2a023d3b218b7ee9e5040bae9d660021f746099fac6f12e84eeec228f35b9
SHA512bb4d488d70d8660e62cb9c549a8e9709c83c8eb1b90a3b3303e59c99d1d84ce2b276099ad5f6807a575159a921b1e50c0d22ddc3ba91764e0d5d8568f6812dda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591511ab5119acc46725042cdb8d520ab
SHA17e093362f3a904c8041ba4aa68e7b9d8c9015082
SHA2566b26518b692ee039d7e06864337b1b34754f9337dce25682700824ae581a4481
SHA5122fd9c76c18d39c1570e479df953d636e103dc0a5e5c0021c2dcfe3b1ad9c829279a822ac2921efde5781515f4a5a081b3b52ec6f978394d17298f477da955572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530b035b4deffbde754fdbe8993c32230
SHA19053fb9baade316bda33580715b334c7b1061347
SHA256649ec4028eb82d225c3be25f21ff7700214a12e77ce010e7e2a060418538b54c
SHA5120b5b3d1aa0a65dfd4e7a32a4cd2f816e5d70468ffed52971d738fb42293f44f5cf8c46f0872b83a18a89afb422c7fde36e83d2b161e17a87986be8429f75d99c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501518353d8dcf61d27b085ad5ca5f8ec
SHA1b1d4cdf81a4b3959652e9c9d524cdab803f1be38
SHA256327253c8bd980e2cd57b566b063e7d5ccc94c5c02f7597345cf641952ecf0623
SHA512ea2b1170f63180c719626e880c29104fdcc44806d3fe12f4dc6c17e4a96ff0b59c5de996fcaa55454c1cb8fb25509fb6c36e7e4f93835a4f571a0d028f66c9fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5120e037ffd59c12f7922fdc97e98e12b
SHA1f768fcd7d473cc27d3dc5d9abfa308ceefb407e8
SHA2565d534f1c3a52a60e3421638dbe92802e16419b38fe3019b6f458c7eaf9f9f32c
SHA51292d0afebd1cbf58ff48d4c81a6fabf0a390fd29d9360f2d7dcf9e65330901de29a3e9192521c680d3e4b6713deb6303593efc8a92e5f9962e4379db8c0a53106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ac85a79b436d59a874e9ea3f44b21de
SHA1119920a620c767fa604cf0056c7426d03e78e6c6
SHA25602aae0a460224d2fe585d36f1e156ec987b4a289b1b9f023c9daa2caa09955ef
SHA512efde588da1f75a43318c77a68f28e8019843b188bdf57b8fd86d4b2a747de0597352b6d071cdf33bc5731591652ff402932a0255b13abb105164d903fdc51c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9fad7b5e4880133df07181c956c9093
SHA1f23cd15e7bb2b1313ceeca02bc79787f50ccd819
SHA2561b9e9bd14fabec844e71f63a4259788f67d2e7b5d0ed51fe76920a63ace1c41b
SHA512e0d6b0d057580b2eade8810e267441a6845878bede21f10c8582595ee79f7c7bf63b9425f4cb92eac0baa13a564f064b6b7225ffa6bb1c00e641b1ab049d1519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db2802f6b44a7b7c7630cd39c745ae50
SHA1ad70bf30fcada728fa765d03cbbac0c664acc5f3
SHA25644d7eed89f38a2eb8a808a134dd4bc01e1654481425324b438a24ab924fc2d3d
SHA512b22697f0ac03e3ebb2b9449a7cb4499eba698e304519135f924bb24b11b6545b37c126095f1d05f34777d33ac5abeaee1b2b23f53b2021e3545bb8f4506f5d71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512e5b22e2c3c86fc91872f2264d508cd
SHA166dd0c9a2f1c2149acfbec9cc72cd96afbbe785e
SHA256976e1c4a3a2d907466fb6c5b6ffa71e6a7a3f7796b7cbc6402d328f361d55553
SHA512090e8d11bfa33106f99dfb916432bb1dea7d45e106d6fc95454b9448766184f7c860f4c221e5a225195fff17781382fd1f4e21989add234fd6cff746d5611e8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b855b82c7c70141470284826661e6297
SHA13f85a84b8242b3061fe89e1286825ccea15a4fa5
SHA256d41b29a0a538fce0bb3f68c50a8bd0cda414b3ba349b979cfea339dc3d6a13f3
SHA5123f44db92d398956e8406fcc81709714af694dc6f8271542e3a5d86c38827e7ac917f8ed982e14edf98781cd0682905b75801e2d5006cf8a01e841cfbcaa5ebc9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b