Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 15:17
Static task
static1
Behavioral task
behavioral1
Sample
3de66249f775159bac78f23e2b1eb153_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3de66249f775159bac78f23e2b1eb153_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3de66249f775159bac78f23e2b1eb153_JaffaCakes118.html
-
Size
18KB
-
MD5
3de66249f775159bac78f23e2b1eb153
-
SHA1
c7609180f735a84427a5a9d40150e5b35236b1a8
-
SHA256
41ba3c56488c1436b404f22d3511081a65d9f2de8e246994f0a27d105244d2d9
-
SHA512
01f576c7eddb38e271333445aecf58b4ff2bca34ca400812fcabb763a9c04186552f12ba01a2d3d55ec71e4e819507c673be490e9ae9965cc22bca398fb6909b
-
SSDEEP
384:hkVcsZdnubCupRLqWrWjoZGHcdZCYK2mL:hkVcsZdn9u/xrWjoZGHcdZ4L
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8CBABD1-4061-11EF-BDFE-E649859EC46C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000e62939886a262e71a53c5bd231afa4962a523b4736c75d2d043684ae911995c5000000000e8000000002000020000000b0111fc27d14504f958c43d5dde520a186cbf4a81cc296f65400b02e2f14b9cc20000000022b25d972a52b2fe1fe5d035b62d5b50a2ea19063f0c8c2aea6fd0914004a4b40000000db8e733a136721ba94f18eb014513161778785218073d71438de70f9c88633c62c0dfbf530310b8bf02cae8437ef9066d41b1f786bfe0e770df43e5f61061d55 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426959341" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05a7cbf6ed4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c907dcd0e71a7e075adba86577dfbc54416bae72f4cfc5d3496325c139ace40d000000000e8000000002000020000000fd74420866359fadbfff58722d94ca641f15a4ce6adc53cbece50584a11f26d490000000f0b49d59562676e717b7dba02b5ab5363f6e7824ee6495108c3409dc1856aa0d78f18f01991b8b05373153095275ef6d84dad53399aa27967cc5904b3941202fc3fee5015da371c76519b1daf99ad16b095adb6d4c1aff927a3208bb25026b02fc241e4468eeca58f402ddcd7b9b4d887a657c3b8d2a9dafa5a9372b7b70a19088a498e29728c6ed3c71175e16269c5240000000bfcec2b2c529291065bff2e49b09c1f640b36c3e1c8020598dadb884a9dca5c2dc839d6ade02fccdb0ef0c5b1e22b7fc08e0d38b509e044d38c5bed0c173043e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1692 iexplore.exe 1692 iexplore.exe 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2268 1692 iexplore.exe 30 PID 1692 wrote to memory of 2268 1692 iexplore.exe 30 PID 1692 wrote to memory of 2268 1692 iexplore.exe 30 PID 1692 wrote to memory of 2268 1692 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3de66249f775159bac78f23e2b1eb153_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516f6e3c5b986e2154d2b5f5a7c474b7d
SHA1392917313c825c43e9c3a73697c70165ae41a8a4
SHA25631cf59238388b8b8bffdf78d25b33dcefc6b3ab85ba5c60b78c48e6215b59e93
SHA5125594ef75d6c789db63a534824bb147ee17901638b8bd3e827ffecc31b323898d9b56dc83527e5f13b4959995cad9e79b47de658980d871ea0622367f54e9dc33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3f4646ce030589636f5f9c19f0d20f1
SHA1d2ed447a7524f072e251d3fcdbe015288f3644e9
SHA25691003174589c6e78c1bf3188e148996b9461ea46442a467841a9e264c175d922
SHA51289e6a431c051ff9d3e78a2a207ec3563c84f3dd01cf73d4783adf82a2239a8e383c93bbf31e23e57bdc603481ce9280c23d7cc8d7011405afdae99e1938f0049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504b9ee15ac5f6ed3d48d38e8b37e06ca
SHA15d91c05b0273b728e3c9fa3d14e13d3230acfbc7
SHA256a4403318c9d98883d3fbeb8833883d8a7c2a8d35401dc8838bbe885df2234016
SHA512fd3a99229ce99cb49b116edfbcdc3afdc9cd06b25c934ad24cbe5bbf9655803492d16d906dca87b187c76edbe7240b1db62a72e69c3eecaadbb09e8608f29384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abc1dde1add4c7cd25d68f7eef287ee2
SHA172412992c6cf688ca0680e78e2902dc66005d0a4
SHA256bc26bb316b4ac3645c5dd0939170c1c318ddf79e8aba0c5b356c9e574a846dbc
SHA512fd20575cf569a82bcedad28a4438b64ad7c252f9b2060733870907817a60a4f828a1721870d7a2a055fa8a8f914f5dfdc3b05752f53a4c001c23fa559ed92e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e071ea021ad49d9748d42c25ff3f352
SHA136ef0428a7bc8cc2fe9f4eb6544a067b15e7e1dc
SHA2567fa1fe207e16597d6a61ed7527f8b597f83cc5497d0c5e15dbd56cd1aabb0a47
SHA512bd407a84a1dc5bc6963bb2bbd39e6e0d7c1c165397cc0c812669c10c0f2b915ee6edc9e96c1b7b012cd008b3a1d9f38b52357f6cfc640f535290aedb17a77fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c1ee4ae892cf098d81afd7d075198ed
SHA11adb25329d9cfca9ef771f46b7cb4831d0811273
SHA256c3acfaee4395b4a1b82397fd170da76484c13a8114071bb56c79033be20aa494
SHA512a83efe454b38198228a98e66d96b258f62398d70380f95ebf2b7c1fc4f22f64c0ca649231b5f976ab439c609b9bc50839b613ba31a004bd5bd1b94047c80b140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9fbf932936d3f1034b46af41abeb2ca
SHA15997101da7809ec2c0e9127721075a40c05062c0
SHA2561f9f6f2c00edffbaebf755ba8b562638004313dc7f037720981a0d09b0da8d8d
SHA51295beda9f4806a4bfc4b1b016d5819bfcc232af144626a3864719631a9dda90a0e0cdc09fb6b306adf443a2633edb706a30ec0300df9113dfb8765bb1f86f991b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578866c22a38a083de50af1c6094bf53f
SHA109c19e94c38ad138b71c4d1263edda4296a168d9
SHA2564344d50cf0f3d348afc488a25c5c7e22028740759231db656debac78ec3d95a4
SHA51215992d891df790808d2b22cb08e355a18ea58acfcda0a2a84e7e6d52cc669730e42ae87513da54c9788e4c1a03437b8a6509d68d9185b2e943cbde9761c03073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c77084149e2c26f7c07b48112f44f9b
SHA14818fab857c21e21ddd36e29c8eba942b90561ae
SHA2564fbff5daf2e2aa31bd3d83cc917ad0db9663d3eb3c8af4c34241d4866c5fdc3f
SHA51249fb6c876026d34d3a363b874b254e7cff745e74da0f09e72a17691ef426ebc448f48836d0fa17d56dc8bfe8fe8f680de41f84d30705acba637a3d9d9f66bc6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfc5cca4cb18e4816e0e7730fd63c8dc
SHA1778bd1b07c8321b828cca61fa59716d154ccbe72
SHA2569930dfe08540d579707de25d135e9cf3bec3d93f1b539be4238163e15ea8845a
SHA5121df62db834e45a12c81da1092874584c1a18556aa56f77c5d40b346bbbb2df8b7ab168436fad3e7af61be0e640cf262966da93005cdbf0e7cc2ff73a12dab6ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fb22bc78490a5b7855a47e24d6b1405
SHA180a60cae53416e8766cd12be8f6ba04be4ad219d
SHA25678c9824172084f500a231e9197a88955c95aadb9dd0752d73ea9063c7b4c2d05
SHA512b749248a2c8176ab6782bf9491d56077642fc054f09d5b1501b7ffa680780f7ca29ad8a88ff2d7471189086a99f73cf576e116d8a2299bd34b3bc82c34a0de50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5246cce4ae716c3cd2529d52ca11f05bd
SHA153de9e82b134641d9c0df6785fd7780f6d256f6b
SHA25614adde3cb3fd919fad93d37f7d95c0854a421ce9f65cc8430c8b65c3bf63985a
SHA512d1ef198a2c1f215cc64e0d09173da505b571775eb28f375d0bad88e09bb8dfca030fcfdd0cfb7cdd0fea53c09dfe87825b261c3e808cce252bc53f9544fbde2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f950aebc1b79cbacf19820a8b8828de
SHA1c83aa2c550611596ac0eae21b15e2d89e1852e7b
SHA2564e1c73347e83a49f6aea1362ecfafb4398c9634f2231bb0c83527b3d28b774c6
SHA51245bc762f87c5a57afb93151f8f313fd6edbcc15b2f9c441e3eba9574080406a0d57e9ffadb1d334e47176d1afcd1615f9d5023467b7664ad7f1d6f6b016d0403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543ad3fdf72719d0ac8cdbd60c6b32a70
SHA1533afbf306fd4414febba36bbe657af6b16c9810
SHA2563831bddea7ffc175955a2958d483beb4b5356777751cc9fb40934ed965d1bbe4
SHA51251889cb33803d8f9abb34803a850b2e1cebafeee2be9e413016ed073e41432c8a9b74ac4f80a6e0f7a86ed5a6c692e9b36baad72100e00c5560f8073b6eef423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1001430bf24cc5b13f5cf2dfc082e63
SHA1e29e8228817977800d185f405bb29470b840c303
SHA25620f914a160c75387e122a5d7da9a3654b12fbffba75a7bb176f753ca8663b0c9
SHA512f14807b4282f08b526d165065485bf338b0478735b0245cf3db5d731d5c068892546c9e12097d89dd04e0c55bd73f08be092acad65bdd78eacdb548983d92faa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab8da475ce97ed724fb4a8bb08c79851
SHA13325e27fca7a18661e91fb599da4d7354353c817
SHA2567e930f711531460a93079b38f08e009c4b75b1368452053ec02cd350015dec1e
SHA512e7efec697a78b82eb3858f1baadb40f2ef395a944f519f0b9e416a5a5bfb2f13a14debe93c25e366e469a806cd7f198c176277a05529463e255464b05a7777e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547d51418afb525f6524107795cde1c2a
SHA1134211cefd9bac40bab275a376ed6b857dce3800
SHA256c62d171cf22e35c1e076b2cfb431d28afaf686444d5ebd3fffc9b7902cce3fc5
SHA512458aa4aff6db043e0b7a553be8dcce3890e771e0fa5767f1097e2c6cb00918ed9339834a052c49a5647b0aefe592da5fa17576d02e73e1fbebdfc7cdcdc959de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d058628058a50b45981ee3a8c680f3c9
SHA1217dc8eec6d652c73e6ae0f0cb1d14ae90e3570b
SHA256bdf498c6d1cfd11bb5f8f786a11af58268e9dc3399f1c8390a87abbea6bdbe53
SHA512c2d5791eb3245960b6d922d59ca343a2b77e553f4cf0314b864644c8a8adbbb1b3959fa46b56c8f8668c398419db64da955f064a3024e694636995dcfe72a382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567cfa0d4d821065c218e1eb269efc13a
SHA17575238501004487129ad0498d093643638bcdc2
SHA2562d7be7835d81b9ae9916f825fed49cabb4520d1fce40c6b1a2198e934141ec88
SHA5128787ae915e6dcf93ac5c1984e3a3a2c84410a53a540aab3a47d31869eb4d0024ccb1ac496bf28b06e254d5f583d2a80d9bdeebe8939bf4e55005fb13a1c95621
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b