Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
3d123d5a183af97e20b25925427ce678_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d123d5a183af97e20b25925427ce678_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d123d5a183af97e20b25925427ce678_JaffaCakes118.html
-
Size
254B
-
MD5
3d123d5a183af97e20b25925427ce678
-
SHA1
51530a48c3557eb21778a0af8fac3cd592eda25f
-
SHA256
1ba96ecce5e73638958239e1de1ee5b7bf10150f3560e387d936f3594d3be240
-
SHA512
9a0211911eb282ddf3bde9ba37e7339c9632d1ebf81d6376349f0f2d7ca79142b429e46ef4548ded1a0ef535a2825f873a6f1fe1f47355ab6ac349c474ffc1c0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000aef7fa34ab8abe522fa89c00e5340747793fea0b189c186b14b8a426427513c2000000000e80000000020000200000009dc5363fd133b96880af91de38da8c45b7c0f359c69428b0c1923fbbb6b37816200000009e08c45cb686fe3c9edf413181d6b568dc545b1fea79e3bcb526da208934898840000000c51d5d68491d555c1675dc7c20fa173212078fbf1a93e7cf59f0a7c8cd17f9bd183b2fbccca23bbe5020dfe1b576e61eea875a81d402828cacb8e5f760c7c248 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dae28149d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f269bacfdcb5ed9635007b9fa1670a4a09766d314ae66283dc8b1b82bf3b285e000000000e8000000002000020000000f51269a0265261928bb3d934c3fff02cd2333fb4ba7b5bbd1b779b8b9148762090000000690d4394c085a980a220b33faf974d4e61448fe2de437cd43ea814383fdced93da27d478e2ec526dfaf0874c73b800f840b95ec29c8ac0a3073f3a165e82dbd4ec77829808d02de12bc84176d7ba816b1209a7be5b7011db289c4bc0c4f6b49155e68473eed655569c04fee66654d3e8d2255b2294013fa4aa1dd22c07212b07f667c03de150fcc659d4035b348c689b4000000059039db2e3ff92c2c62a69871adcf512ab4015cd0bd94fd870b184917704302a76ac75fe6498fa199f0c7ac229ebb9ea4735cb6405c631f021de24429d98d166 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD657E61-403C-11EF-929A-5A77BF4D32F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426943350" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d123d5a183af97e20b25925427ce678_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56c69ecc4af04ab830b6d036706af1e4c
SHA1c796f28a5875071fcebe5a180e5b1add312ff5ce
SHA2569840344c5ca486cfba1321eb925691fa49d72ecebef525a300fad962953c749f
SHA512a6af339e9f376df69424f643ad27e5dbcb3960b119f57bd32498b5b8fcdbcbfef123b19a070c69aed36f3e461947c1707eb32d0fc64f94c572205e2b65d7a62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c326c7939d826958ba9086acfed0ada5
SHA1b202520139d2a42539ad9a48a87bac58f312531a
SHA256f328ab856e1012faa54d92882884004a4b93958467c11aa5048431a938d6e25f
SHA5122cf8761c820828376c1d03cc54b2b2629f890bbb052bbdb5cdc6d26906bf46f67c1cc4b12274a4bbd1b89390c1f75fec2d3e637acf8f970cef83823d582f35af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD584221df566ce1daa395c2599a3fdb127
SHA1fa87639fe16b5763fd8f9a01e233826069f30e1d
SHA256c92a853f112ad7997cf5ddc09e4c671df58e4d8f3909d8fd07c33443939254f6
SHA51209943cbb96c2207a7a2f391b1e4d1799ed449b73ffd4a9c5f21faa6630b5a990f24ccbc8afb193ebedc14fd1db737faf57a4ecb064ef00dae7c3361a4dd2768e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD582572e7806d0832da60d0ce625f8bd50
SHA1bbd245400bc07cf0c36613c3deeb9a2083dc594b
SHA256c7523405196d05bb6511601575726dd2c5858862e8a360a2a9561b2676303746
SHA51219a4259acdca0d7da8f9c6fda7bb683831c3ca22471a2034430483b4d4d266fccb8a008b8866feafe757b754316722a458074bb6393a04d63e614d1c30bda286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52a1feac7c98a1f6cbce4d60b8706471e
SHA12728ec18220bb0a6ef7f52e2285352ab5e4b4aa7
SHA2563c411cfafa3f82830dbc75f00bff09c9509ba7b127c7a9ad1b4807bb7bd87a25
SHA512b0f3ca704d1d34a3e6df5fc69adaff626c41d2a64c1dc59c9425db4ade4780779f3578d29de91657e79a95a7c5daed35b7d3ee4b05798a772996c8bca1a28a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59389744d2e00181d70d94ee56dccbd7f
SHA1fa3535e7942e21c56b1f5597388db239e7ef0e79
SHA25650adf87f9e8112bed40f049190d041753d3b9c084c4ab233c89cd3aa8c9b3693
SHA512b2b4e621413ede32aaadd2ebccf94ed572ae7bcc3d6223bfb7d8b8604737337724e8a4ce42f142ffccef8c92303b12b1ad621ae66c3dd057b91085656d7dc20c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58d80f2cdd3f982bf60907cab6d429b03
SHA1c2da0ce7687ceb6028e90f393c561d1aaa85050e
SHA256581f1bfb19aec810b25aa14c88b292abf03e29330bf353e49a2f65ef04de48b3
SHA512134939762c8ec15df19377ac1aed868060f025e695f176dc560836f8e14a6a0fb616dc2a3972cfbd1a5a9c57bb3ca5e6b6ac321548ce125c2c0ed186af6dda36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fd163fcbfdcba67414cd771aa4401989
SHA163328fa1a341c01dc91a55f46e5c5f0763a09b16
SHA25695886a9bfc49ca8785a52792e32a48b546490f240a8c3b023c1c0dc9e07ca20f
SHA5123bd2b8d7f7502bb5c036d68daf8b4f1c243a1f5ac1d3b3bc0f9d741bb30b8d0e4b7c201d6943e8c82ae2bd5dfd8e6375d2b32aa739a34c4628b526ac4782afaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ede25c139020308015b142eb0d9b9a65
SHA1bb169dc75839e49dae8d9aa367867845e8a513ed
SHA2568220e4cc0962c7de5ec29d4c629f58869530c339e12ae221c4f822473cc705d3
SHA512dd1d8a90f3682af826b74206206e86347e4b54096ab8e3a3882ea2fde13772bb544ff0f0fa94efa49cc02e38481c695ced0f0e2688ff9a6c142cb01cd6c998c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eab2eeb3d28684cece316dbfdc7de36f
SHA110472ef3288b03f1280087d53fb052e1946adf77
SHA256f23a0f537f670050db5c4a37f072d585e0f74b27e10a7321f84ec90f1f0a2130
SHA512bf7fa90b9468fb013d10b3d654159d4ae4b809e4c6a6f42aa8dbb42e0322b45ccd7f0d2f10575d2e6f5416f878c29ceb36ed6eaea6235081c4362c1c67677feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55c3efa027cf27de809a012a81aa0b7ca
SHA1458980128b246e71e0f6c81c16f9cbf1bf9c5918
SHA2569a99617698b48918636b84af50da75d89734e73a0a47bf6deabe105801552911
SHA5123b1f58d47f6ed6b89566ce2cfd16d89ffcdccd123947dee5c3eaea5613603a12b4d2f5c3e8b97a694798e2fb28b9d7ead661a1b64f409e8a1cd9315ff7b91e2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cfbe29c72337c9db2ec02d96f9f45703
SHA13832d4ea29d7a1610b462067b870572d0b826a79
SHA25621fa5b58f665042cdd8845fc640d2743fd7302f18983a834a9544be3ed91caa0
SHA512219a3e54c63541e57de3a51e5359cb1bfb66657c20447b057c732a134ca4dd9ab90e9984f5d2b6121d28fb15f2b096acfec090ad0ad6b2793506e93ee9a55dc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5070d5fc37dc840ad41fb4ee38162af22
SHA185e64c5119608ef49d26d75c3e10237cd3d9c136
SHA256af30413982618f6a0f1f30833bd0adcbe3a0daeedb5c90b2bfe85f77c78e73ee
SHA5127d8e269c497b921aaef025c21f13c9cf34bd24c6557d5eff96e3a1aef24867319188b5b5e593360e4c9728198a1dd5efdf269dcfb902316e3834913e39c4bb6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5034d917630be8e61794420ac235419ee
SHA1db2df474c9fdcc9bc3708b92f4051e2f4175e7cc
SHA2564dc1b8327db6c31f2739f26b9ddcd74cb5fc57fc114b6e2c62874aa9f768631c
SHA51219db23f2d1f1fd9683fd966cf4ece483d22ec25c04b2f68f98a35c694205fa3de0afa463ea616e33840c93c84cc36ceecbfc1df0524180db071e5fdc8ef7cfeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5091c323201c9751a54dff48158d2b974
SHA139088ea07b5178ffe6ad68cb91c653c652e53a61
SHA25609275e5b9d612b2049c14af10e1fdddc407b6f240a6fa94baef7f53aa519955b
SHA512a7c822702f79890d840977eb950b99a0feacf7a97618746687d6936882572a243a742c404e1c2b837ce72ca3f32cb57f24f57661e3f68f55eecb0f5a905b2bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD552a8c5f20d041b80e6cd07837e8d79a2
SHA15c992759f30fceec042c48b8b59613b28dda62e7
SHA2563c5ec68a0156458e3d83212d3151a3e9d6a943ee8717724207e348e80fffc4d5
SHA51258697974d508908ef35fe41114662c681e6d86e884f4a6ba4761ee94b657840eef82766e08767c69e6fb7952dddd05840087599e4c6a3011a2c89d1a4f49bd2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50713553473b9b2838f1c080d5f9923a9
SHA1dcb5defa3830595d93edff8b9bf99b8fdba1e0a9
SHA2565b71ceb96b9dc13dccf9572ae558c2d97df7afd6886e785d93d1456d68efc5fb
SHA51209db67bebf90f1eb07a31e44b5989aea6c0bff7b56bb3c15c356b682d990c0a529d04f4a899f69034df1196b28c3721b3d4e4d0d6398394fba57a14115e46020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55715b3bc8e4018dc0bae6d71bca4a998
SHA16a6229ba38b4ff598d29fb56c07eacb87db4059a
SHA256c14934476c75d136390e5a3180f427124fec3d1a80bff20500aec851992a2d8e
SHA51239ac9f15d51d6cf9ff3b7d063bfad51d5d624917cb001e81b9de0a8acfda7f9ef61743a9a20fcbca80e451b538eea6415dc275dd730e2babe04da73e18072b57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ad1c632f32ae7bf310a659666617bad
SHA13b78b8f6077191565844751e1bba06811158a254
SHA2568f5a86c05f5b4011f4a3f0dbb5742786b06803db2d760331e29a34c919028967
SHA5126ff67b0150f5345d0bf2eb0c1d4cb64cae02ba15cf9f5027bfdb22cf4b3ebef78f3d6f2aa966599c5a719e3af90b663716e42cee67ce6cad0025ba1dd3fcdb14
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b