Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
-
Size
15KB
-
MD5
3d59dfd9c63bd019a44aec74f5f8622d
-
SHA1
78f628f9459aff61bb79fa97cba368a313e7cd63
-
SHA256
19d794827e94922d2bdd13663cc159743936cf169baa0b4320a602eab099c7cf
-
SHA512
23bf2300491575b51f5694c1fd3386da28fc5199a991c43e5ca35f1a31cc3980ef1eeab25ea0913cd4d89ab82ccd31febd9d1c4eedf282568b99ec2764e4d583
-
SSDEEP
384:5I/ZdzQ9Ve36SOOkHshaXlyNyI8YZFPHR:+/ZdM9MKSOOlaXEMI8YT5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426948651" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0509EEB1-4049-11EF-9225-4E18907FF899} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000296cd094bd218615170af912e1bad3928d62edc2dad0c15b9c46ce6256a2df50000000000e8000000002000020000000c8a3c89d693574463ae3d2152976ca9fd9ab9061447052df1ef6ab7bed9cdfb620000000bb658569affbdb9c20ca80070eaf379ec239ffb08a74536becd27b5ea0e69a4240000000450910fcc78f77e23cbea28221740522c7fac9e36bb0832d377a44e556b5485e5df0f7270c177aa6b27ce8d505aa9297f66a625797cd63386347dd73927a3716 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a288d955d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000007d6b936a87c8961113d0d3a8ef0b9e754a8a267e196150e1dd66c7f165d07a90000000000e80000000020000200000003bae3042bb922432d5c58de0ca7847de20c895b3e7fe4aa20f009e753761324a9000000011d839f12e6ecdd6d153315fdc6f346d2a8f17afdb0ed04cb24cac99b7f1c4b465d06c9e5506b31adfe52faaa227bfba9d524fcaf1cf14f6a932ef7fb3bf4b7b643d68d7cb87720b5589a51eb4f8ef79e130271d4c01307d2cedcfbf18e1cff2e1e1646def64242902d412136d2073f8d897afbdff0ef790f808278efc97cbc07458c514be232f6c1adcad7bb32af736400000002096ab1d92230a91bed139bdd56d10890ca80a039c20e9379a07bf25309c2713a3bc30f15df70ec65563d618becec9ffde8608851170970ff2b83f68c02e3ad3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 iexplore.exe 2052 iexplore.exe 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1212 2052 iexplore.exe 30 PID 2052 wrote to memory of 1212 2052 iexplore.exe 30 PID 2052 wrote to memory of 1212 2052 iexplore.exe 30 PID 2052 wrote to memory of 1212 2052 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58eeecde1a3a2bbbc227991d0ad12725f
SHA119c303ef16a0be6cf527060582b44cc6a24cda5d
SHA256453bb9d9fc0cafef0cd53c32a73fefa9ca4226145916f6fae50a2681f6361624
SHA5128244e035de6d5eb157f3dfee1033399eeeba2303ee311ca93c5002d9d10dfea4c64e7a713df521831141113cf7d0a7b888da4cc2ff78fc08bb878c5c20ab3494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fab24087f2c78d8351b08302f92d1f1e
SHA17a1d5fb8a1d8eafc704d6dba3fbaf4b339077436
SHA2565561b853da4e529aed133fcf07b568160c87fc4b3a9f6375c43fb2c937a3f353
SHA51282b900a2523f99816aca10f26061911f01863857ca0971f230879053026a3135b0d1d2a58e5dd95d9872d0d9eb099b5df8a5cea46394f5e08fe04b169a115270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e27129d8691ffc3119c41503840d97c9
SHA1d2a57cba728f9073a8074b8510ad4169881d3499
SHA256a3526be5f62bdc239c0f8442fb1c268238e886e555921dacdd1df794f9ea4d71
SHA512f6cc7a7eab71434abff1784902154fb12d49111b3db97124eeb6e894ae99cf116ec0d2ca628bf3a628b8d69d97991fd6a881d342a43454c29bf2840165dd85d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5919488c34d3690e989f6b37a6a85dab1
SHA12be915cf2898861e05e01c160b43862021c01c44
SHA256f834eabd5fe592131304b7d346823461a9cd247376d70bc7d7a5536129f1fc88
SHA51290e8a0030ec505b1b68739e1554e23adcc6d9b114e03c3cd34b3ca879ae46cd17b1a15a360758fb1cee8ac9f384c0a07398d3c154123c3b0923765e18f9a25fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51e1f8c27daae2847cc11a70e6badc7ad
SHA18cc2b09a12af4ad6c41220d3bed4536cf5a1b42f
SHA256251ae354b12d4e6a4cb1af7ddc64e00d9bd18b7c823693da4f2e3e6608e66e24
SHA5122eaf20980aac324890fae676aca69b44637890d56b45dbdef855fd752b36dfccdb7c18d4ed27c9e88995061f3500d8f606104a04115e055e1f5531a5c454ab43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56b321a1c90365f851d5ea5a33cfb13d2
SHA1027d6af95cf1048b58016058218311b9a3850317
SHA256f65f8b37a3346902f5afb73f8c7548fbedc00df93eafc524498d6818bccc86bb
SHA51268c0b18d77233bca4d025f458081e6d5280252763944ff810982dc05ed2ae0656774c758f024aae4863b04918357af4bade7163b80fb9f2ebe24893d097198b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53e5613361c1508f3dd6942102b0c49f1
SHA1f4a163b8f9d8bad0a1ed6f449f36129c0893b233
SHA25667fa14ca617402851239a9f30619c3cce933b2a0eeeebdc98bc9f7e4d7639bf2
SHA512fdfd674f283a5d76e609564352857d07dfd0854db41d51e473244c4f1b52ce3daca483f76e805bb212ed84a3e690e0a91f60b706bc0adc611e6b2715f2ee1824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD573ac47aabf7db172ba82c16d4dbc8746
SHA112012291d5075dc1996250a51ef40312d97b570e
SHA256364e4391cac2aaaaa684f6b722b60356ae0001ca344db57b8d8093035b61d642
SHA5129e49192c643c579e8fceb09f18cd37d93007cb38619981b9cd1c22b87639266630b6cbda558b62022358f3b4b9d3634010efc7b939c05e982e27d8c02e2255ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55f6172b176ea9d8a0b5b571946d29231
SHA1fed11f00e56b3206286d2efdcf573d53ed699723
SHA25693758d2d2c1eb983cfca02d1ea3908ee41c7b9ee780cac2b74edb70fad2315fb
SHA512e605c57d6d8a85b14993477ca555a7bbab5b488c26b7391f070552c38a5c3d74a941ab9d4586c0476e8d8fe6e1410daca31fc91922a704a9f4be11e739f1e54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d4b66728b6e86c5e60d3146e77c7edb3
SHA1e64c2ae5e3d3d2c1e0c41b1475f8acf8bc81fdd6
SHA256e23fe2b4c35cf50c7377397c025c8a8e207acddb38be5f8cc6c6b3ffe54df1f6
SHA5120d40f8c48c5762640655ee3476ae0267c04660af4e1a5215e2abc093a2e9656170826d7d44b7f72fb5d42dca269125a268f6fc1199feede22947ead60027a7e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD557324dbfdee8e1c07c464062f11bda6e
SHA178134945eba7959e61ee0a0efd4f43158184b61a
SHA256e3f7d7396eece95d4efccac192ee2fd8ca29705bbc752dda0e0538faa0d81ab0
SHA5120f8a4e9f6b6c8f47265aa1341f90fb41c79c4b921804a14c7282f2517c0f42ca36be3b7566e417113369a8e7bd5fd5aa90aec5be8acb7c469dbeb9c64fde7f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD567c95a9c263b61bcb0b3494dfa3d0683
SHA169fabc1e37684dd127eff997c360cea976f7e4ba
SHA256b9a930acb47ac95b45b9d6adc90e87d2b3345c14aeebf5e891ce6fc3703ca3d7
SHA512e99006377e2045384bf311226e4f64c2f48a865a6b880b3e6d5ec014c1912528e23522df6d28af4b35063083d4be0a0aba4c5fad3c2e3011b9cb221bb1999a96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD599e54a9e0f30cd91824d4cec89203aea
SHA1ee315373595716bc248da76ff99cf0b721647eb2
SHA2567700ce3ea94abd40911d16c2a2b938d9b26fbab4ee82af29eaa214ce21ef3c07
SHA51260bfc5e15cbd51192d33907e0b975f3218de4f6b5c02f7b9efd470a16f0be498230528a3aa2332a79bf2157399636545fcc97516aec9c3fbf8334c66811768d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55a12fbdd2688f22aae3b7e69df5da9d1
SHA14a3c44085097f7333dfb99c506c12c63e6a87c1c
SHA25628f011564ac272acab98aa971717ed3ede8411e3bc18d2c1bc267596248321f3
SHA5124f9a3aa1d331effc316ec1f421fb85922d7f9e184ef0ab9ffc9576292212448f5d9299f74e4ce9965732455d322e641d2f3818611b3039483fd088220d46305b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c5211ee28043aac0bb08443a2c8edb96
SHA127fe3758692229873961e2392cfd68f75d778f62
SHA2563312b67b05b02303d54063d197eb8b2cded23f8a22209a42f26a7200e235eb99
SHA512ed522fea5e790b52658457e30342cd17feb351c81e2d53af074277118a765947f23eb4677842f59c7f400b93a596e9639c2b33a089eb36cb0961667a959982b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eea1a854da45531053abaffa0fc8c977
SHA1409fb56f68ca2e4c3ec9fd2dd567d770a8c350a0
SHA2564423095228234184de9627baca93f85f7c266ddee2fd871d9528cab7f92e7815
SHA51218996f263bda97e88ddcd6e7f006a82ccefef3e83e83a30b4649e9d6a344ce34476415b5d861408ce3918b279d15a93d0b8407040ab6ed3b2e6d840f59122122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5242468538a19d2f5a2fba410195a9d89
SHA1de23715ff19f7c039fd93b401deea11d62f56c4d
SHA2568cd411812a7358c79d2ce9bda28499df32902a8600339c9cdaa705ae3eddbc53
SHA512a27324fa41709bf1b44201fa5f25e0c89fe73c59f185dfe558b71b1cdd0f6481bdcdf8bad17af54ff5145755fcef5570783f9f0c3c7fa04d67f8f1c5039c9df4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58401b9d5e24bb77adb90024a1eaae9b4
SHA1b17a55bbe8d857c72d044e2b26add24e7b59413c
SHA256d1bb0215ad7604f93c6b9755af7536a36a876f1e48bd7cbc1aa9061cbd9346c3
SHA512c8b05464457d3956e3b49cafc2b3fca3fb9ea42dd869804bbb6927a5d4d2015ac0b269c74c66c9f2812879d7879b2f6584330b86c9fbd55fdadb25dbe321bd9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD515ff2b7f9790ce1f080390bec1c96b49
SHA123dadfa9501cad9aece6a46817d7c6b3e36edc36
SHA25653c8e9a4912f9df87fc2eeb1aed80706c9bf4c12ea45a8c9cdff34d5c7fa253c
SHA5128b28c5f01f8abe29ea8efc9d2ab942ad7f045e342f2e442733538b2c262924f080dc011c6e5e8e52bc52e977734be5b2c943aba0802ad52f12ddf737ba88598e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b