Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
3d95f3066ad8797b4b613365e1bae46a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d95f3066ad8797b4b613365e1bae46a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d95f3066ad8797b4b613365e1bae46a_JaffaCakes118.html
-
Size
6KB
-
MD5
3d95f3066ad8797b4b613365e1bae46a
-
SHA1
0cdad0c4d4dc13c853f6d9c6fd3e745dbe0642e9
-
SHA256
1d1b3dd29efedde0237dc9e95ff490f66675dafb67156bc5eae2b885f1af42a7
-
SHA512
07fc8c2f408df9bce56f89155f2ef1be5bd90e4c8616fd5e1f439aa87d8d2d18b3ceede15836190d8c592f0d6017e7c4ecf28b91ac4be09045b47fb004891e32
-
SSDEEP
96:uzVs+ux7+pLLY1k9o84d12ef7CSTUSYY/6/NcEZ7ru7f:csz7+pAYS/v4Nb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1D71F61-4053-11EF-B985-CA26F3F7E98A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cf4de7aca7ae666f2a67f063f9f9bf528710a48f6f6601e9629c69f5984c9b69000000000e800000000200002000000089ff3c8433e3689a679472b374e34bd4b37cd01dac56902d963d5cb753781d9320000000c6948c3ab853ccc1bcd622ed43917d3822c0701db3b064f2022c289af8179db340000000ac247f87fe1ea1a75ae802322971f095928c047922bd7bbd1d9598467b41d4a63ca69ea9ea380cfe94e6251200a3b63aab8f936d0800928470d9fd2ce77360a9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404c089160d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d7145bd0fa26aee27ef38763783a92edd407d934625d915433eb9dd520139914000000000e8000000002000020000000c242b50ffe864c1a1e7b2a55525a07c0c1b17f0262734d8394f4b4096d21b5f790000000f8bf66aa32dd2c7cffba57e1fbf2424b9f287ee3c77db38783a14ce8ada2ec62b34168e522d28b7627cf58b732df67c7c7c4a6513c1e00e2b1cd1a3fee26d718f8edc6604d207724ec1f88a53fb4ab3e76e28ba2bcac3ced961a6a39e75030b08140b0924d605c512023925e77e680afa0aab3175ab922ec7e297f9fa016813f015765b2a80ee4e1163ba802a7c476bb40000000618417cc5d74667113ac989d93d181b2d1009718d6305e62fd7cfef7178fa48a59648d03c0d741b9ae863b8c066e8f8e49dd873d96162414a01cc0c6ceaa3eb3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426953208" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 900 iexplore.exe 900 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 900 wrote to memory of 2532 900 iexplore.exe 30 PID 900 wrote to memory of 2532 900 iexplore.exe 30 PID 900 wrote to memory of 2532 900 iexplore.exe 30 PID 900 wrote to memory of 2532 900 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d95f3066ad8797b4b613365e1bae46a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8561f953d9cab64d8989558117787f6
SHA144ac9c73fa4fd9636ed8f6f1200fbdafa0066937
SHA2562efad6c31c2cbfcffa108f2f4569702a7e0db858ab497cc4322f00a1c0addc54
SHA5129fae6c6b3bf60c063bec1030dc9db6a718660f33d1f95d605e0d769d0969a1d5e83eaef6b1a51db9e71828e6f674a8f8bde8e4bade9cbf94f97ecf870333de45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a20061f7db8586068ade4ea7ba77b938
SHA19869198a586517ca9a195da81d6197e662b5e4e5
SHA2564476fe42ee45314c80096b0667b1638d4e7164b3700b72d2bfc654a58007be4d
SHA512372ba35e0655dfeaac337ece49775bdca9cb3a32207af0f496fac917f634985acc1a5475720a7f4489f4ddad40cd9c6a5c55316c676ab82b5b93a94f29da755d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1d5812bff0ab16f4f45f5c41d4d7bf0
SHA1f1259db5246808bcb0b5a14076e38cafae65ce66
SHA2561e5927188474a06c99b974af04d3295f5bf2c1989d67fa47f40a370cf6e0294b
SHA512601a15d5a7e5c4c4e02e0310dcf1bbe1215c335723823118fd2fb7d83b7d838cc95d7bb6e0cad7880d8830c897cf4cec5062e8e81fc5d6a403ec5a4b9abafe14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea50fbb1417536afa955bc2a2713062e
SHA154787ecf2c57675a24d8222cc70463c1a6225965
SHA256aac79681d5d1440a11ac9f72b5ba2d917eca163e98487d4e73cc592455f71a0f
SHA512fc2ed5f161bc3fdad6bdf8e2ceb4b7edff330fd95e9df745c9c6ae5962a18f0653a5798dfd7f6624fd0ee0d49df32d8fc35fb45f062f0a5b511ee680f039746c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f94997b85a1184272edaa2e964bff47
SHA18e4bdc42b1c9434fac4d2303091d650f088aa1b2
SHA2562086529fbe341acaf1ec21296b465e9dcb56bb8e39319633607c011649e5f3f8
SHA512ca6ba1c7fc6824803633fbc9984624f4c6db0a7396c1fee6ae70bcfb753b5b0abe7d29e003a0f949728aebf9f49e366be8a32a4e95f94b88489845149c2b626a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f288a8ad40379919ed4f6965f2d8d383
SHA13563fc8c8fc28e1b6b443f030b25365092a8298a
SHA2568a054762d16819d5ee3c2c777500266a00436d6100ebe6cb50c7feb2a1091b36
SHA512b39108576fc08f61d5e32988a09321f4184e920b8016a0a8341d22c10dc101126cde92bab858f72a6e66bd0ead8093185d0a2b322f6f2096c63e63731127889a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505489fd9b1e456235eb4027ce62e4226
SHA11ce0b8674aea4aba48d3b77ddd6cfdf6c5270c3a
SHA256dc3daf96c255beefd6911d0e5b58d7bdce537ab7746a2201b373759dc2da8b5c
SHA5123555f13d1e96a8ff3a68f1fc257a44230f9e577f787070034bf76fd73cc49f0f2dbf9842597181ffb0a61a1f0389271eaf231dea48b33378c31594339ef02461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6cd9baddc4c7d2d799d05361e3470b0
SHA1b61da17c16ba381175a79b51c41dce7638480e88
SHA25650b92da3a45a6fdf39de486fb52aba6866adbe1ba483afa4d4fe99b065db8e0a
SHA5124f6ab0e4e7b9989ad06a5790bd82b835bd77868b98113bd550c67306f8576b459d31d945fcac45a498d205710e4feea6d02b49794f23926cabcf3fe3979a98d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5d9dd33f2541395d5fa0a7753995c2e
SHA17098e2ac385b0bb556c81abf271cae86c1513159
SHA2569e16336f3e7f4fad9100573031c8390c6e7801c9e0b000aea80148c0c76a0d05
SHA512e31fee8a0bb5e5f43f23ce7cf4052bd3534f93c9f3d6c79afe885c2993d9f960769f068082e65f859bf383c1007ae7555c373f46f1e7050a0a57cdde841ff973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56908c8b9767398595c572ce7336c93ba
SHA1ad5b90d6e356599386aae5726b547a27fcb60879
SHA2569cf8d8a33ccbfe9f28e9ab42080e6dfa8772bb1765ca7882e062a7cbbbc3716a
SHA5123b07a7baa16a7e6a1750e2f129b8613c7a3ace30a41ea0faf244b730935784a34ca90392aee068e91c30ad0c09b3845ce656e730a38bc782b070fc0ac7d67a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1a9d8a0396cb92cc0344d7c9838f6f4
SHA1a1cc3b7973ccf095d6e6e64677777aeb92cb9076
SHA2560e7670c68ff8d0fbbfaa8440896e38699c6faaaea33a84e712c1d252b6a02198
SHA5122d0c25c9e2b532e476dd1d54c1831f9420fe7014e3b93f1cce6bc9c7d8a5966f001b59781d9b8c9d6bf034cf72d0b35ec9cbd59475cf54b44a4a5e76f6332d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3f89c078a755ec523004dd4fcad3ecf
SHA1389dd90cfaa2699982a2daab7e64f84d68b575a6
SHA256abca55fe808bcd8ec300a3382c2f381db11adac75df83f54ae1e083f48274a42
SHA5127ab2c919dbe61d395177623a1ed47cbb3a121377269f46934f3ab6102e4012e4903ed0b52d4303479ed234a0352849ec24d026504fd33821de5e8e8b55355dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59499b37eb24c83c30f5e973d3b506e36
SHA18e21324135ab304f9508647a916ed8a0f34bc8d9
SHA2569a31a10f851cb6fddb225c2d370b70d22a0c8c4329d934c66bcd24106c10d00b
SHA512cf2765a44c89c19ca199584db43a136b09f36030930453f7a836ebdd51145ddc20b423d6cac8cec5068178c5c1a4c618a90a0f350b3ad147dd5b8f513ba47551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e347945ff670ab437f95daee1deb0e6
SHA19b6d16ba219778d11bde67a9c6314e1e4c56562c
SHA256393e34c570086d347a5ff8dbbba800f421cad8662ac8d9a11f2309333faa97a8
SHA512d1a58d9b04d9b304cc7988156d632f599a69e565f38da75c07ed7002c86a99815ab7e6ba905904583b8d423babba10b505828b3ac7f95ed55690558758a1ba71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d5c7b57710794412996f0ffd123088
SHA14f399d8a95a9a463bf1a301975ed6e73e6cbd983
SHA256b2f681732f9e8cbd1fc2c1854c1d7d89d45ee53f327880050af7bf9d7f551a94
SHA5120030637413e12eb39d451ec44e5f4d6f225810828df2d49543688196abc75fbca8703fff7a32ab303a550335d12f7d9e35c1c03e4a5d09e32730714d2337a145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5623374fda69592c78de446d4bba806a3
SHA1de1e4af9c255e6b74697b1c15272a4ae88e738e5
SHA25698dedbacdd67c7aea650f5253e3fb25bfb4b70664a2defd570b07a51537f6d5f
SHA51250aa7ee329a289c002d0d38ba193e7e6fc531ed1b50437f8c5c42622c17371da92f636594ef22696c169a829451461ea899d7cc34506981f7d2c72f2afafbbe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ba29e52ec770ba49fcec4b72f38462c
SHA1c18f653c78c2d9a23a18e89b632812504dd5913a
SHA25693fe7e00c5e85f649c2f0826d3aaca31b04f72887cd1e097ca663b2da2abab9d
SHA512115b9c7937da8da00a07ff7922618d09ba22915462cccfdc13ec64da1bd9973a8623af34a300f44431b2723c9124aefe710e5312e65688418ffe3aeb3956c813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f1ad6695b8b7d10c18d6be5489e7450
SHA1a728cf3b8c29868a9e6e6e117b744dc30d485e1c
SHA256b7e5afd2c13e018c3326d2e6b5c26588e8b73b540a86cbd4bbde21b82cdf874a
SHA5123971d15804ea62a5b5ec3a193f874721bb1952ac6d3e92b21e54b22e1b59fe8a59e0d033226428c71398d9842f5687e2994730fc65c907b85c4bc6dec8893a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d43a58bfbabe58231eb3ebee891d345
SHA13a021d8deb3a21ed1ae924cdcee69862ccd3ea77
SHA25622ed04044aafdb2b2abac0ff179ba14cd4d6411023f6bdaeb3ad69ac18e3ae63
SHA512bd72f4f09079d1259260e6ae991729be0bb0e989c7db5546a8d5a4b656344bf2ea9d51d59c309417a0dfb23d1924d2064e24748eff81df203c579b54b3cf8890
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b