Analysis
-
max time kernel
68s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 12:02
Static task
static1
Behavioral task
behavioral1
Sample
3d4d6277bde5364b98d6382b850d2331_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d4d6277bde5364b98d6382b850d2331_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d4d6277bde5364b98d6382b850d2331_JaffaCakes118.html
-
Size
6KB
-
MD5
3d4d6277bde5364b98d6382b850d2331
-
SHA1
9ecae75140d23909efb8d63a9624a48854f3759e
-
SHA256
591b5273bcad7a99d67b7984633e50311ee9d50d9f7db72c1f644746211646d4
-
SHA512
583eda279eff1c24ee46c89bf962f2e327cf7da21af085b33e38ffa1e3cfc25d5b6d2266e62e760e8a60fc6b75701b3f8daea037928b09387b1c7212dd361cdc
-
SSDEEP
96:uzVs+ux70vLLY1k9o84d12ef7CSTUOZcEZ7ru7f:csz70vAYS/xb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003b81e3f0b2d6d59e31f6a91259092cbca2e5a820dcdde947ff9a0044c6691000000000000e8000000002000020000000652cbf2fac3711c21ee810b7f14c4e984cfa3b434a646f7a7b8413e73b1f7cdd90000000b8daabc078f415976d3c90a2b1ee5aef0cc7c1bc94900bbe2c456f2ee36d0d64089aa997b915d5ea57382b90e6433d25026bb632cddbcae6565d10d1c3ac3e1bf12db7aefd681c3b315e46d4a095eef59973051c0abd2444de48018e5d61e961eff859dfa9c7b2b8bf9168f0c769d52168346f3fc011b9c391b23a0130d0c7757a61d6931496a82cbb40d8da407ad21040000000da6e080a239edde0617f2a55ea26103b9a2fdfb8332301b692268f0a5c6da8c93afba641ee7fa3e4e72ffbced497427c49d9d40417cce993ac759ea50d0ac12f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09fb37953d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A424DB71-4046-11EF-BEE2-725FF0DF1EEB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000204f495d8d43c61ec2ccffe5effb6a91de47e087473312dc79bd2b1d08aeb173000000000e8000000002000020000000aa17e7e4ece2b7c07ec995e0341b2a5f05b1165cdf830e28002b6d06da465a9f20000000391ad3ca73be52c5a040784e84b0f31240b09ca76abf7841353abf30d9ff0d0740000000b0b16943569ee985b272f8f0c223f3faa84cdfde34242392d06cb7cf700c8a169f610cf2a7174ddd95f60d534a456952bbe6cf1ba0844ff7fd26d7d6dfb2dc40 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426947630" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2804 2508 iexplore.exe 29 PID 2508 wrote to memory of 2804 2508 iexplore.exe 29 PID 2508 wrote to memory of 2804 2508 iexplore.exe 29 PID 2508 wrote to memory of 2804 2508 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d4d6277bde5364b98d6382b850d2331_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cce6955f2cede4bfe148d5ac0e8eded2
SHA167e9299ab5a2eeefa2a434996aba69716444330b
SHA256afea03c3dc0ca5571475b05ded46a7af019f13fd7dcc1caaf2d71bd93f0466a0
SHA51252389aa4411c63e69a1b6954eca5968a6996496be127a10b187f8264b07751115c5f7644e2d23c04b8c45031bee5515ecf5247d47bc68175c78080252eea6483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5478b8a038b2f257728e5dfd66c5ff41e
SHA13d9cdbc2999b192775eb7721b81ad2709bd4818d
SHA2562be97debe888c0cd886cf3103c7e32b2ad30e9b3e2deec83e1b033878ebcbea3
SHA512803296edb32b3dfe512e085abfb8225d4ec42a25e9cedbf24cb6288e99bb75da2e353681ff6158c009477ed1d7b90dbaa7be06d99f602faf355a75a28829fcbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5990b1e3fd4883fb4ebdc6bdc2c61a83c
SHA1e3c0ca56fe0c31019760afc9fa9bd1fc6d53b1b6
SHA2564cc63a8dac2be00c3913007dfb70a3656a8a0d6fc22305e22c81927dfc402f7e
SHA5125b466f227c7cc0ebf71075839d675f864a894a482f4cb463da24a7a179901d4c3230b97f9d1ce2099ff6897d44cc49588964458febe5b7d8165d338d68d3c166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af634484a85d2c66566989843008efa7
SHA1fe433e2d6a26adee570b065a99bccf944b7a1b21
SHA256187fe03cbb6e946fc98f8235c21cb60651811443857868b50e31091e7c9198e5
SHA512ff438f64423c5fbd252e954de6bbaf53102e3d460f1cca35aa63e9d9e580ab462154692b8a3c3ff6b42bcd9a28d7cdf3a7b2613493e1519df3b0dab7e9813461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544493ed021eaceb3a00f0e0ec74c06be
SHA185def46bd9d1809e448e1c20304114e326762f0b
SHA25629773155815f299b2a092145f054c2458f422a9e003c1a2973392cba86b7096a
SHA5127c035b0bc8dad2d68475ac4481d63116ec4f2bf55e1fc91742a3eb2a3ce7489e91e58f80536c58e55a6ba88a62c662dab06aeaff2d107211ede48054b5b807b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5794dfec0e7305743ccc5fa5c6fe4567f
SHA150ced91761428ae4dce6d62402e9e6fc0d9d0814
SHA256e405a03f9362f58732df22fb2466f6b8465123de7bb6fd1dea7723b8fba13420
SHA5128608b7af579833291ab46f4fcf921364269629febc5fad069d989bb378ce8f496bdfa8024640ec62348c8045c9807b4df0726b001bf9396341e324d744346c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565bb8adbadc6c83859b7e68245be2000
SHA17a156a2e6607a8a809e1cab1364b2d6cee730678
SHA25676bed7b9a452118db3fcda82cc6c908270f0b980b8a4c2e4e22fa99fbfec4c9a
SHA512461ce8725502efbffc2a5214f2fca396de917481cae911079719d0c85d6cbc178a7273f5629ae9470888acdaa25211f3afc683a6c278fd9de32791452b33bfbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5571ab521ba15c9e78200fb57ada95c4f
SHA1802c670df2c14a34fe612476794abc697b670d70
SHA256b20dc10228ff27336d599bd5f7013c17a34d282e157b3a9686812b94a2d128f7
SHA512e5b220dacc4ca16d6e1fd3c7920b7b121620488ae75f27eec338d7211fc210a7288fd0b114981e44bd1c873ffa43126173787e0ad4cdae8e205a2da5778574a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51810bf2bd3ecc1482fad3684edf57037
SHA13094f171f02bdce272487d741394632f43228b41
SHA25608a6a0461d5b9fa3b5e8738681b7a949a8bb6495664580428aaa95f8170335d2
SHA512479a39f97d15763d01af3d5b3838db812e2f623a54b8aa138510afdb31c8a876831761f819aedf7c5f7e4a70033ee756454276a45df2e16359f22d6a35b735b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569416d1c1e5004e877d5ee2485b8aa3a
SHA10b406eba4405e14da79be0af19183c81493cb7e8
SHA25623cc79c6e1698770043f461b1b528de8c707e8e6cf4c3565d5f3d0655f23d1e4
SHA51203310932e02bd8c4dc4ce4001c0f4d4f6df55439ecd89de64e322b51b770be0a59f536b6d6814625e9bf0a9d7525002650dbc9820fbb9218be5b479383690fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4c252a5060eb78fc93ab226a066509c
SHA15ee2031b96fd4abd4c73bf809fa8c226efba111d
SHA2566c6d651004d6a0b47f01902f7224cc7fbd49b69da948fa4187600b1e28227ea8
SHA512863bbce8b24ccc3bb2f8db22496d607f7f1e101c3baedaf3b196966172cf55c626bbc4c99e2901630524337e4db95372233a49cb6208a0a6b40cd91c2ad17e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547902f766c81ff2b56eb39c3a34a9e21
SHA1d981317a75f2598805e1d66fc70eac40092b353e
SHA2568b6a690bf4ffc947a42fd9461d86c69e7d1b2a8f8db8d2fba1a61e154def9fc4
SHA51243af1caff0c0dc059d1dfd6c8343692c4129277a9d71dfc61416ac177eaf0121d87ba2ef33798a411c721a7d2b4472f134c4bd04cca5fd643a3bc789f1b9cc09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57efbaf28f58fa92f7d9772cd505d6ce5
SHA1f3e21e7cc58472d3340fa299bc8bba36ab1fe8d2
SHA2566de4ae80034b6445408981fa35088cf76887086b67e123c223e6e3d20a919674
SHA512f0b1616f44f8e1916c3a8a4742f2c83d6cac277472f6b6b62d450da409539b4e9fbfa699131b800073a1cbadb9d25c84b3a746a187c7271dde79f40b20021ae5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5a16e61911653c25ff06f50438f74f9
SHA1fdb3985a4f6f29d1040392fb9db52ad906005466
SHA25621230223e12068a063610cb73eb67c2620ded7b0bddf60e447f2557e28c2f18f
SHA512735c70bfc6c762bf1da25c6cce93b740ac6190ea0b0c1def393c4eb7822d2e64f598d1a3fd8b7d44625235945b8150670f8e2f73f2b741db189994286326811d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb7975fa51d2c1614bb11f433eb59873
SHA1b00b6b8baf8e0e377193e9ce48ad5c4d69078398
SHA256f6f32cd7931d3064c8b2bd6ae45d2adab67d235153231be08bb3948b1351ce34
SHA5123e3e57637257806ae4bff3c9d1d103148e6f6661fcf6d20456b73ca8d2c291f7f3dcf337ff3d9e2aac27a85fd60a90201a0ccfbce6f232eb44eaf5b3914cc5b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1cd3c54b23ace26fda547a17e7dff1f
SHA1e9a2688e198687a1a2184f33832f0ccb0a82ec96
SHA256681e79f53fadf48d0ff7661f0b477a811252bb602a85a8760f702ce6f0a7d2a5
SHA512a8e3c1a3b5da98549e9348b3dada593bc5e3586b27f16586a688bfa9a2ed53448404d68e5140d0007e9a48a61d7ea1f8faeecfe8f0664000295dd5099eee3a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9df1f1970448a3cac4e2004752f5ba0
SHA13ff1d397cf77ea0295aedd4c6c354365c054b55e
SHA256338ae403dcd4081795406e1a9d5f58f1bbf699d2380a6dfa38c318c99dd28d4e
SHA512ef694448ad5a148afc761aabca2d1abf96315d409725f8e557bd6c64b9d000adff7858c1d67575042a65c686a7c004cf14e329eb94149e7c7f8117cef1a8c377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5666b5da21e5eee233d0aaefe94e0e580
SHA1bf68ef2bcceb1b5f214a7ff69ee3da9b179c1463
SHA25674388631a72f449f74f836fa4064f8ec1117ebda2e497b53b8e6197cec95eb0c
SHA5122da7d29a2a2633a9fc7e73baa2190bce25a961c9ddd376abdd411e0ead683dc2dbef8ca54af1580e00cc3a05c5d8f62069259ac3c6e7e0e854cd1783cad23903
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b