Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
3dfaaad83c68346a7e46a8794dbbd0ab_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3dfaaad83c68346a7e46a8794dbbd0ab_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3dfaaad83c68346a7e46a8794dbbd0ab_JaffaCakes118.html
-
Size
9KB
-
MD5
3dfaaad83c68346a7e46a8794dbbd0ab
-
SHA1
a8112be7c85d0200233c04634d7c962cabee472e
-
SHA256
d43ae453d1b7956ff21ea5b5a2edfce0f96761215c11ebce21438f4cfa21ce51
-
SHA512
203840acb0c76ca32a5c806f6238a107376046d3c3583c3f610cc9b53cc758c2375723acdc58726ecbb6772e7a0cd1ea2f873c7659a4a9193004862a434dce68
-
SSDEEP
96:uzVs+ux7C6jLLY1k9o84d12ef7CSTU1GT/kNQpglVHcEZ7ru7f:csz7LjAYS/ckgPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA520251-4065-11EF-838C-C20DC8CB8E9E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e2ca232af1e1902a10b715f94e0cc8e4a2f041496d55231833f77dd94c9a0ea7000000000e80000000020000200000004642f72c3ef558203068d8fbf201f4096d7d2dcd9d9e04c5a87d90ee5307509720000000679f40ca1d5626175fe9b739a7d11392e4e06f5ff6256d96b79071714d4119334000000064b36e50d454c7dd5f86b702b5f3166b83fa88b9e15b95aade08585dd9a4f7fde9ac4677e65faa704b0f1365780e2f6daeeb8511af310bfbcc07fa01984e7a0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c020d99072d4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426960981" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d9aa5bda0615a9415a245dbec33b9beee38bed494e8c8a75716626e4e1001845000000000e8000000002000020000000d0cf0dd23a0e228624d42c6aba2e557044e8f4c834a1a6102e66b8d86f8ebc599000000071faf7b8c52baf43aa18cfaad369529003757b9019bae5ec008a50bee21aa10fe5aae37f6526d1766d9d2283b56c1adf483fcc7305325f63cd369f3e2da0820265fed08d74edda62a7248124ba480e254fff14535e260e9af77029e7b3b33b0063c3b3022d7ba728208b5cadd8b7dedf3f8f94c6e5cd2fe073c7d535ae427fdf7d12accf9570c271dbc98fced774e9664000000098281d6243d82ae676d593ab274db37542b0e15e5c838e71bacac439b3e1ce11ad8f71c38079526c31f592485dc48965f1b2650ebeea5a494b963f52c74c0e02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2536 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2536 iexplore.exe 2536 iexplore.exe 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1496 2536 iexplore.exe 30 PID 2536 wrote to memory of 1496 2536 iexplore.exe 30 PID 2536 wrote to memory of 1496 2536 iexplore.exe 30 PID 2536 wrote to memory of 1496 2536 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dfaaad83c68346a7e46a8794dbbd0ab_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2e6a318e8b89779d958f6714a513006
SHA1821a47d6ece0966ae2564615bba2fee8acaf06cd
SHA2564b029d99ff16699e640d9029f4aa11ff941709df00e8bc76c61a6c45d858e86d
SHA51204e60136dd7be88238b2fabb62d8a57d33378dd7f97881e170585f6fd99487f47a2b757f8ff629328f0551db6ba63b01abb6b0f58b3d7b7f45826f48e02aaa17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535b604bd5e2a68451257666eef45744a
SHA174a7e31c706a351f853399f45e8ae2d7e39c9895
SHA256362ad0c9cf4608a6973203d62c86b8f399709f0feee09f18fe3bf3271ae3ef91
SHA512479d46e0fc30c97a800b0fc1074d740930ef259c2093bfa2cd5b5f34a0dcc619c31274eec46482a576f007950751e6a93ac5c3d9c5eb12c1e93d171b7753c158
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5110da8f62c8a73ae59eb418a4fce6fd5
SHA1d87b6ed128a8ebb2f41f1a840234588778ef707a
SHA256b4288b7296c9695bb27d9ed5ada2d65a7671cc2e09bff93a24f42ee8764f53ec
SHA512e8659a36da8311cc721c27c6fa5a03d3807d91621767c95b49d6f9a84d837941dfe7367b57ed69d42a17034aa0af4bd50ea40e62ea2cfff8f6744b3909f20e90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518748af018c3143514a8e3829d5942b7
SHA12a4aff4025419d31ade9ab0e9eb92fbc5a8bdecb
SHA25677ed839c60ac724848d3c6c7ad7d321bc52c99ffc878d00569ebc8785f3b13aa
SHA5129a0796ef35428039c22475866fe475063abc1dd691897f96b433aa52d6c6fd317ff267eabf15a9a2995f22b5dfbfa2ccd6eb9f244ecccf551652556242152560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526ac549882d52dde0982738b8053ee99
SHA1787c007a3f1ef870d31b67031469390845f41384
SHA25689ee4cebbf14184bf6c318ac66f42f98a9a76db70df5465d77e2c4f6f084a206
SHA51293cae4b3ce1899b05436de76717492c4ea96929960e037b7c1b362756bcd29a5eefc48e436174670b1a32e70f5596359024649092307c2164d7fd4721a9eddca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d1445dce495e4ae0b3c14d367eb2a9
SHA10adb4b805d9cf20be8a2ca33615d48f900f15207
SHA256e6fe608b7fec3ad401648ae8c9673ed184998804cefc0462c3f271e72085ab6b
SHA5123e90d9fc01537ec6e6e22a460d6d1fc22c5d37240c413348d7fa801bbcbef03ceadf0df8b444f535bfa22cc9a3efd019de1ee537fc23aa99cae7296830bba8cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a82fb953632d7c21c4cd9c56cabcc17c
SHA17206d4890551f980e747ecb9869e6967d01e5240
SHA2562e4f8c1b85e06123191f4297b1215aea250c5d166cc5e176bcc451a615ebd680
SHA5128fe4da89cf2fceba2d4145b05a08c9b3207279dd91f2eb15e6a676fe808f4b715d182ebb36414b1e62b985943fa44c238c6148d0f292a18d2ef2638a55918898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53776d1ccda94be2f89b75e63e90fa44e
SHA154bf224085329fcccafa4f2d0fe78b1ec922b241
SHA25699ae771fa66d194cc2405caaaea591f57f574090f85e2c4c0535c954435b7672
SHA5124a046b749335f72759d1a4b4da1fd2c3644af2192cd6220f545d736206aa05d5cc91f008f0c3cbdba0197463a3aee16ee2500487e56293e209a4275df0e3aa4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584638e3779180e112e10fb6ca089b67d
SHA1a8e786ca130159a3fdab188ffc5aa66c5d304518
SHA25621a091caa19480e3ca71dfba84dd4589434caab013463c17e62d57054cdb7a54
SHA5123ce6b3cd506e18fdd1f74a7758fdb60a7c4e595edf5da7ad6e59b1dc7470c42fd68b4348b624e2990e82f7c0627fd3521996176b53ae3c0feca715742f6c255b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50450a99d88902c95c775aec4509f3307
SHA116733d6ee4870174d2c084149c6b055d54b91f2f
SHA256cd189233ab9efad8dedca6b7737746347cbcb57d590ef8221f9dae3e063185a2
SHA512a6d14d1bb455e5bce51bb6cec84fe084f50676ee43f4bb36c8bd2a67095693716c99c4f816522eeec28990cf06f632b819b5e9067ffc852551eaa7c699e64b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa234de4d3c0284bb7d0c50cfa5c2a9d
SHA194f81aec1aa9b7afc4f21646c681aad9f2a934f6
SHA256e55becc3c7b4f58252a7bb1acea94533a3d66e4116ba82f00017672423da248d
SHA512cbe8084d74461bd67be23e771b1605f3e1adeaf7522c6edf2f1601a8f7dfc4fb727d81ee2b826f6ce6e21d3b6a12425cf3f74aafd87937cdaa8f070ee69776b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e38d16d269ec7005ae354b34177e1d6
SHA15956991735d0ae6072834adfa0ba9323f6d15c87
SHA256b416bc40021e2df5e41ae658ff9fc6a947b3fffad8abaa0c22231727bf2a3167
SHA5129dfb1f001df5a2fffc3606db71ae4afc0daaec1464427016155c0db666287825166d9b213cbb630978846d6d91da4bee75fad48ace08a9b7d37e3c96e6b7b03e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2dbbb22b53c562bede2ee52e78bb024
SHA156ae56711f969916251f9d6a706280a555357f1b
SHA2562154da863536cabebaed51e6345d7b51b5a7e2965e554d9f65748651a39951ed
SHA5127d932399048c296a63568ad7ada185eeb768cb7698b42024799283ea1b2a7d707d8796c56eb44da07d644f76c5eed7fa8b8c6065d6a5c828c22d320c104a5a23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab9e486b939dcd4507cab928752f336b
SHA1274f9bf21a77872f95001b0351e9aa60c508ce51
SHA256d38ea8c9f84626df630da5207f3f066dda3568cf381479e6cfa5af01a07c555f
SHA512c454957a42acfa66307a06e9ea9b85eef2dd0e6f7c0b4b802ba5c4a5ca34a60a0760c94297e1e8003ccd1a807019fc8c1620794864759463a8c70ce823797512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5505fa6b43fe13a2765cf2aa80257bf5e
SHA15ef8364084c0ef3d7ff67abb4598c1de44e436af
SHA2566fd49b1885f80a1c715aee6a6d680ff33962b9f3e89273bf35d2562a842ca1a8
SHA5123b081098f9ce1bc36c72a37bfc2029bcacbdd6073d0e634168e9cb4968f96550e8dc95ef76418c139a44d95da957af8b92d03f8d14389afa032188fc66707f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546352828a54fdca9b4561d18e1b8a72a
SHA1a4b7697f2d3bbe2a809becd793c8691794d29e2c
SHA2568259f29b7d7889171476b236526a51ccdcdd46d1a6dd4e9e9fb5060ef8e4ef7b
SHA512ef83fede972d9da77cb507e6298811072bf5ee344b2f6cb67783fcc1319302571ec86efb1ab47b080b0e8bd494750400555435163ecec69e41178d6997a334a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f4e1f5e266dc5c07d4be5410e16ca9e
SHA1dae8f9df087f78d75bfb18e524aa134d2e28a1e6
SHA25642773e397177663c22555dd1a054b892d0ee36e2ca3ce8cfd56a6c4144922300
SHA5121b051f23c37c1aa9cc0a1cdaf08b792d67642cdb54e6f3ba1d556f286f366c06cf94bce3ac9269467e76e723d50be47d7541a103da6056a7f870a668bcd81788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5408715f85cccf7520e3d8fd2a35789ac
SHA12e66504b3411ed13b65418637b2d4b107ce6074a
SHA256b0ba8f856f9358a354f563030dadd7e3fb071edc122dcf43f3e167e49f83002b
SHA5126d492eaa48c8c7ce9d64c544485359225a94c82bfeec710ea68210998367e09f9e06748de6fef5e4dfaf53d6d9b08cfcf9d65834ca7ecc91a2b8a4010b17f8bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ecdd1a3c4502093a55453deb0065605
SHA1bb8491f730c72bddc153c798de5412b42e44885a
SHA2564d02cd14ea72b76e6d75eea8c19c0bce27b9952dab0d25fb56e37ec3b2bd3748
SHA512eb331949900229e5f7e4fe40218cacf9676f2dedb5a4753a8136f3efe9bc90d6ce796426ec893ff6b388ce83c21c404d1b0288ead58de285f1356d9267b8f35f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b