Analysis
-
max time kernel
70s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
3ce461459bd6de7786d0e536676f25d1_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ce461459bd6de7786d0e536676f25d1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ce461459bd6de7786d0e536676f25d1_JaffaCakes118.html
-
Size
6KB
-
MD5
3ce461459bd6de7786d0e536676f25d1
-
SHA1
b430ccc0a0e897f8008995264eb07315bcf61b59
-
SHA256
1ba8b5c8a8ba3e1bcfd04d0d5964de949522af288e5f2504275d507d265cb764
-
SHA512
32c8438060ad0a64cb56ba2d5039b890b6774c7a14d64ecd8a46705dce748d5dd2996776abfe1eb7b997c036b6784de2dfc002e334cc9dcacf613db6f119014e
-
SSDEEP
96:uzVs+ux7Qa0LLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz7Qa0AYS/Wb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7087954941d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426939820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f1e881a841f7f27e9f7a3dba1220f137fb00811cb5bb1cae791d8e1ca2f0ef22000000000e80000000020000200000004891d24b2f8601bb30de7df90cba1fbff65ebfb912227071e52493735381799d90000000dd4e9e274413552ac9147d16f4a42dfb122b37280341bce2703e0956730a690d9c8d2ad64058fe5e31cb2fe32c0e4303a6c7cbeca020d163baf662f813864b4b054085d800c9568a29c9887e422ea74cee032b0c27c26eea9673d068ec777122538fee773c0f35124c5e3ddd61be3a05f45910e6737e2fbec22efa88a093c485e1e04718d8f43230987b7868699557d740000000968e04f0c3c34e35e69de38809e06fac1807610162deb87b8e5ac0568570a4f2a166de789783557d39ce4ad22c4299cb081c8d4282aeb565c5d60cfaf6fc0df6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000de5c0e644f72716057ee9f1a9ac238a29167bbe640791c4e6edc559012b4091000000000e8000000002000020000000daf5107eb7b3e1fdf172bc289604040de607a0a7f78ac3ab23ce3bfcf3fb713020000000a54f3aa9d6ca4c2f85db78d6d33a261f30dd54f42de0c17bd31340f87f5c97da400000009785ffe566d45507eede90506122e55b335a3bd88340aa57c76267217d69dd9b59f4e1548f55b8c722165ca4a85c89ed63f26e6a31dc00fd4182eb8c986fe672 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73F40641-4034-11EF-B3C2-F67F0CB12BFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 iexplore.exe 2520 iexplore.exe 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1648 2520 iexplore.exe 30 PID 2520 wrote to memory of 1648 2520 iexplore.exe 30 PID 2520 wrote to memory of 1648 2520 iexplore.exe 30 PID 2520 wrote to memory of 1648 2520 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ce461459bd6de7786d0e536676f25d1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5440cd10c5f84e1f626720c996dec26
SHA19d4eebda930bfaf35a760fbc7065a47f758b92dd
SHA2565049bea976775174d28f3aef5a1492a737cfecbf9d628ce29aa5b2cdecaad944
SHA5124587fd89bc6cc6dee487cc782c05b33103dc96c697b327e6a9b6eb4d4617a9bf9917dd8d7b78402d55f858f6758d480a6c3f5818a4d3505ebc1b0264bef73abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5708647cb99d97ed8e60ca0d7048895cb
SHA1c3f121dcd5d4f9a56bc9149bf418e85b1a07246c
SHA25666d9181ccf1d9efeae3a1d0f843878dd023c6dba834e26f47a7fa0685916214c
SHA5121224cabd0d4fc39076b6aed742a7ae8c8cdeae67cb5f356754bc1acc41ea7f7aac78aa34799af735d0fd4f5232f4378a98dd09aec6628471a6e136708d688540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500ce11baa0e8ddb2f56e1e8bd6f1d2ed
SHA16b7d150c23c06f71756c82cdb472a7fec4ce63cf
SHA256fb7ac6bf32eff6b8fc4d786fb4b2200c13113aaf401973fa6025c060f18d70d1
SHA51285446014301f14c47af4be8cceb18b6ee7c70ca8417b09a0f31453420c61fdd669b59e5dbdfb9a3326d5b8799a454d25d6eaaf14793e84e9dfafdb5b40532296
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d17986ac39f2553c8f66e3a53eadfe5
SHA16e0bc3fc39ca6eb38101c16b711160720c4942b5
SHA256242a45ac2c409714bee87c3a4fe145c3d58e4d8f95aeef87c8a4f0bfe7bc8456
SHA5127e54a5b30f3c5975ce8941ab71c9c34963c866d982c06e336a37a179b88a48e38f7374fecca23db120d5db0b6fc92fa727a091ad1db1193d5f0341861cdb99d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f59ef56fc1c8e2f2399316095e28cb24
SHA1e2a4cb5ea1a3d6c14c04e2121acff75cabce614e
SHA2564acd697fe648e50c44a9b7de65378317654de35584fa3c8f87cc7ecb849fa1bc
SHA512d3dc46cc4e9f9d3043fbbcd2cd1c0259478fd7cae52744d878ad6363fae5c26ff0f4ea18d3b3c2208fd5ca5581ed3007f0dc13378ee25c3839080fada20cef96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d58d94429a68e6a79f9c0c9f43bcf01
SHA16a477d1c22e9c7a97ae3970ee2622382dff757e8
SHA2569e8e5071bca9c637120edd8dc301dd4a153831c0b0ab4a5c1693e292dd6322cf
SHA5126989aa7269f1e71f473187bc703ed3a8c69d4010cdf1ffe36ff99bcaa61b4a958eaa87338b287aa1b8c8c2fce018c10f3a93ab1546beead20f426c876edfa25f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3b90e679dfd48d27c76ba81f310a2dc
SHA19083e6391eac1815fcb0f98356f0a7837c441486
SHA25698605832bea07aa89110cfdb74bd906388c081abb13e7056589e810c80e4c300
SHA51264f6b0eb8991e1e05d9b7f62f4d20d8994cf205c9a464abb07d3d41250c0bc1aae63ff27b76ae0615a5dc7d33ab8e49309d5b56252b183adbc9a447423fe3728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5749ac783a88b6c8ca50eee2749b1ef57
SHA1aa934deac0390e072574cc50bb4fd49394e94574
SHA256b4838304638f0008414f75d333aa71b7d5fab33785c6fa4f45218f662f80322c
SHA5129448b3e31c56e1703623e6f2ec9a7b46911dc2b474f8b5d9f47eb5d32f934debfb33c7621ea9efd533c940d04b3f2262c89476099e1f648e068f74d50942ad4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ce4152f429ea398e9bebb4624520d4c
SHA10cc49d15568191beb74c19dba2dc60f86d42e16b
SHA256154cc4fcf8467cb05c1c921bf5897ae4ba23410e88ccb7ebceba7b867b8e65a9
SHA512c251f5f18ed28096b940296eebd53f4881489b91dd76beae25930cb039cc69dc161d51ffe91f142941df66613c77e16167fb47b4a60912bfefa3287e00a60655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5840eb35048c56204edb32fed8d76a542
SHA17eec3fefe11afb93d8a751e7f72c036e3f922da4
SHA256523de77f9e0c7f3b1dc9a5cc3a66a34d31ecf794d1c04e2227833073b6b7f2b3
SHA5123b736645f3ac351229c68bdcfbf847f8ef2e880faa6e64ba6713ecd81e90b16d72a8f6e0d0c7e4248bd107d9645156d10cea2bcf66a891f750dd970537606f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5761a86e4c6701cd1abf844e2d577745e
SHA1990d0b761880691b622073de02fe9031c14499ed
SHA25698c099c4b6231adbe57245bcfa5d33a89340a68010a9c43a45db0ee31280421a
SHA512262bb8860967e8075e502013c36fb09b0d39976d200dc563a13a1d35b857210a2b496e1aa5b2f0e0a2129b2d5409a0d37cac1dc1c4638f656d706b36e8517391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55862f3776d26acca19cccf27d271f4ae
SHA1a272ae8f36bc22b1db8cd25d1d217298ab945b1e
SHA256fea6fadd0c67bafab12ee7ba52cf64a653691c055861e00b2478b4975146d498
SHA512390d7dc99cc584e58f079294cb8f45a8f169dc842970feff2c05a7ecded87b770bea867362e7ad44f0ae93f2c9440382c839e3681c479f340b0537e413041365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4fca81848ef8f4da7f6a981e76d086c
SHA1bba01df50a0d8eb9d40f71e618d5e7647d2d3964
SHA256a7f8f5d05d7942bad5b16270b93e7e26184c21955f7db53528525900fd8fbf3e
SHA512549f40b2eba1c9c7a8a32c1eb7ef9a7d493b5aa54c4cae3ad5d8c2d095e52ab26daeadace305e0ab4602929dce9718ac23629a529bc2bdd0610e5331872989c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c76458c1ffecda8ed25689b66381977
SHA19361138650ab2ffd6dabd71c4006421f7d01e358
SHA256dfcfa6170524b64bee6bfe6a28fb0006cf52b9b98762821c6ec98b9862df65d3
SHA512842c82c26624e906ea177a58d7bf513a93c78553eb047a0e58fce0384141c9baef7bcc35293985adfc8dc3b9627ae4e9c490da3fdc1ff08ee3210db9a67bc37e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7403e61734f4ba6139a085ee4fbe4ed
SHA1fd43884bbd94704beacc8ef58fe927c2c1213e11
SHA25675641110414a1576f18a73a27a55a7b27d43b11dbc805d028a03b084f570fdc0
SHA5125d130894ab1cd376e11767f9780bdcfb204ec1019783d4abb79f83fa043ce5ce9530a8613044e49f2f1a9c433dd53c8d8ade2a181e0da10428112b83a653413b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54448a45d954b375e2af8c5870793a4
SHA1445047a3357740a7d9ecdfc2c091a571b1367e40
SHA256d9c28c19133fe1cc52dc061de1b97dbffb3e46b03a57388707a458bec97de939
SHA5126f7c2564c4e987a471b20d6312a6d19a5ab0cbc7f73d039ae622503c94692a6229ec90d7a4d214cc3989415e273f57cab78a07ff0f74d5095b89b33ed406905b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adcb55f8a2912178b686706f00b72937
SHA18661d5a9d34ea56d1256fff8dbb2534bdc64fff2
SHA2562ba36ede015d83cf12253cf888750c2c612d718ed729e1cd66b6916b8c3177ee
SHA5127af62dce97cc69bf0eb27a36da29967d53bad282ed63c4ebc0f6dfde501e3da2096b19987744bb0fceba0cde2bf139ea5481974422dc334035031a42f8ce29a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ec0aa56a5d474f91c8e872118ce280a
SHA1473ed87f27f5f6a272c0327fe5c36a1609446541
SHA2568556e607266ea4245a214e166a43f77d645cd4e2eb9fc85f9f5071126597b763
SHA512f47d8196f958e81f9ae6f56806df9f29641284adee5641d06a925a910dc0f32c1fc57544c439444c98d021661b345c85c499686fc97b43ced306e2298e73797c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a35bc66c6392d157225b536985e3c1ec
SHA1e3bde374c84fdb4756fa94d5cfe03188567e041d
SHA256fc09e4d2dc606e0aed7871ba6e7cc55566d5df20baa1aad1326a650fa0c2de4c
SHA5126c1d32b7be80e47c4503b5e049a90416e312a9be19660f481608bb45b2ba6a0a571df3bdcd9a869b93700c426fc9386c1cb47b08988b69aeefdbd417b7cf6365
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b