Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
3e3d043919bbf100f037c1c535c42645_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3e3d043919bbf100f037c1c535c42645_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3e3d043919bbf100f037c1c535c42645_JaffaCakes118.html
-
Size
261KB
-
MD5
3e3d043919bbf100f037c1c535c42645
-
SHA1
7cba9750b33e75541b02eae441a897335e96806e
-
SHA256
96d48f5c4536a35124833dd73e3420a410c0b0686a1967054dc867685f1ea8fe
-
SHA512
3a1fa6ab59636c2b6346ef7af3a7dde45f21558927093cc094def81b3f6961eda9c84d64b124c60b17324b34cec65f8865e0abff01a6c2a3349e8cbde851ddb9
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fc4YyHA3xLpn7iGQkHcZOpphnp:sZuxLZT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000097cbece71b2166fb9c8c879f9000913efad3d9b6e124d5dd689c7b65e4c89403000000000e800000000200002000000008d83c301acc45674ca8489a67a44d00fac5e21ffa29e457ed2dbf59eb493ce59000000082b0b6a34b516e8e856bc051b9b784bad7ac25de986745c6d143e9a837526bfe5ac5662c6de8cebca706973b603087d43e50a08d92bf9b639997bf6b9d8f6b748c6714ca5bb8025b2962699a043db83edb902c373d8673a5e4ade654b35898e38522ffd077c3e4ac2da4efed2b0881d97494125e05dac4a2de04146d26a3d0615bc58fc16e789ca2c49381f0517aecd44000000076f1e57a8f3cd8fd13340d1b18dae8c65f84f65b5b7f3de4ce77b3aee64167fb94677a7710b02cb457831581ea940caa5dd8205784c4d6d2eadaf912f467d122 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000e7e01847557f26e880be33f8c8ee9eaef4746e741ec1f2ee70f059f7f4d8092d000000000e80000000020000200000006919759d5f2264ec7fd7d2050aaca3ad1a6316b633484cc13e8349a54095d5bd200000009e7244cf13cac41a0319409624705db14bed9bc13a0d49a18515b8913f6f1d9c400000008c46cbc09655bbda4b2622fbdf2fbd1df43fdd8c0498701f4842324ef152ed487437263c9c9eb42f95ed20760664a9bb66252f67dc7379baa099792688b890f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426967254" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705b2b4581d4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55EAEC51-4074-11EF-8266-E21FB89EE600} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1020 iexplore.exe 1020 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2312 1020 iexplore.exe 30 PID 1020 wrote to memory of 2312 1020 iexplore.exe 30 PID 1020 wrote to memory of 2312 1020 iexplore.exe 30 PID 1020 wrote to memory of 2312 1020 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e3d043919bbf100f037c1c535c42645_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5c13dd5c5cf240dd8d4bb961bc9c521
SHA1914e33eb0dc5a9361f16627601adaf2b3e27cee8
SHA256e2559d13730644bb1f2ddbaa48c3e2603fce87fa36f275f2defbdd1c21dc5137
SHA5124b3c37b5efc8a3bb7ccd55c3836c6e0f8553684c659a90b8791bea8de566ea7116525d5b778d54aabbde2555661dec14a809275bcdce6e1b43759706251f8879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50db1b3f51c56e5a7cb9d11057b80986a
SHA10d08c98ec749a6e44daa8be8d919ef231431138d
SHA2565093200086d5fc198203b888f5486c12a61d794c4158a143aa0c3849a7498abb
SHA51286e7f64bba59a95726a3a86f5abcc64436ca5ca637a1534f93559acd4dee246212f2fdd86025e409d0338bf7861e8c187ae1d3c96ec3b875a22350652db1500d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b3ecd4f189e97330f60b2ef76eb2b3f
SHA1b7277c075e91ea85ace81d705e659019992a8ff0
SHA256d8ced330f196739792a267002c32f5f8850426d924bdbc440b98714dd1fb287b
SHA512e217ad109c5dcbabf9e2a045ed38c41c870cee0a64ba8298727d97994ba27c1750f4ab55ab09f027491a8708e649253881ef174cb574d518215937130f7a6f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef0e2eee13e8ba6696eb40ab3009a66
SHA12bf72875272f28cea6af7f7e9bec5d0b997591f8
SHA2564dc9b8402c932809b0a2541ada82eb0fe5b5054b76631365212e595e220cfa1f
SHA512290bc20b57af7efe49280e11bd07bc8dcf85db599e91c75f73c3f93d5a60a8625caf11664e44f756996887afede8ada0b0f375b67d47ee64aee6e1ba2baad192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed63d56a859d2bdbf3aaaa1438ef267d
SHA12fb5a76ecdb899093439d55a5002e6d8467b3224
SHA2560aedf1847a031bb8ef5d9f6148580a76b4a5ff96eee0ddeb64552def4ecde83f
SHA512be807371051d118a30ce467f147bb61d42eb8205e468ce2581df568b948b823bfcf6ac0589cabd0ebff6af4e1f3f0c399dde5474e1cc268000e8fdf38fbcbb1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cbfde7a0502164088d14ddc4c78bd6a
SHA17737c895cd2c885820fc00f1d7d0f1d305504687
SHA2568539e4a35beea35963a9f96e60c9971ac35a4d8f8dfbcd4601cffb34f6914c80
SHA512cf8037f8347fae2097722c190f08cd6f3d11843ffdbad255c02ff8ff94524ad82a4897fb9b81993f833cbba3fc6e4a4909003d39cf5844f8e6707950b24c8379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dccd567b1090f4cc45dbb1375c0963f
SHA1b7f85863200df97e025a0295acdd1dc21b8f1137
SHA2562b04e2232e98c84cd17830e1bab80c97bc3b00eff9ed42029d17e63f3103f57b
SHA51272a5a102a5d4a0422e5bc291607b522cce45f7c5e683e1e739b2840b567434cd2e4bf63d8bb4a7727ac6d8080c5b4e9c88b790ecef25f3435afa7d5a6c6fa18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525918daff003aeec6187ddf6547d4b88
SHA171c6e8daaf34eb2233d8497b18575a295d6670fe
SHA256e52ece0e28bd63d75a3b44ba9a51729e58f2e3da146c4fad56a66bda85ddbfb7
SHA5121b97b6542344b7325af58b495374275e6cad70bb179075dfe212c02bcea20e9802e6a1b79793b1068a5c16a63299a0d785d1980d7d78025ec269508228f467e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558e1292020b47d9c50fd9edaaf4e1c63
SHA1629227c106a8159217b5b94a3fd4af0d8f99d205
SHA25635bbf19d8bcf73a0997a2c3c17ab1c9f1bbdc461edd283454d6e8c6d92be2b21
SHA51204b5eef5df54f85a8828919a1dc2b8c6c27db4fae39143c913f232d4a17f508792f6ad42b5b2ed9f0795b83c082d45b7da5d77f8a1f8ceec0a1465dba1c324af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5787e790ef7674d2bf1513d3b0e112d4d
SHA1c154fbd173dbced6287b29e68bd9456cc8b92b12
SHA256c1d5056b9ae662d2d7bdfbbcb3defb7e3a11847f9e8b1372779d26d521745bf8
SHA512bcf8fda80b4cd286c6f0131434cbeb255c0ba6124153e9b44460a9eed3d772764415ceb42a8144c45926b357bf868a68ae5d51aed1cbccfd83b19a027e69ae65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b16bf2006562d7a1f038db324798065f
SHA15f5ae10b65f42819eb394fe84b86f7ab2f7ef222
SHA2568984070b0beabc8544485d17be05b606e446e2d0c2d8ac1aa41108319de0f953
SHA51268948c6bf4fde08dccf652e18077c986ec81449250da32f30191ad803722b357f34d711d725d7b02840785a9051533d926f83e32d84220050b6af73149b588a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cba3875ec02b162c500f0c6be63d71fd
SHA134f7ac16516d0ff98c38f26eff925b21e1c345e6
SHA256fd35b08779350e0add4bfaa1ed0e3cbc0d215bacf80e7440304824e2814d5ab3
SHA51238a064a100a83f9e999719e353f9a8f678a450e3039637c7a982fc456954b0b2c769512b4cc9fc54e22e239bde0c40234d1ded76799f2601b764ec31e8715e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582a1f1eb11a6b82849fa582e43dd6fc3
SHA1eb525220df7cd075e1de83dffd36c376698042e5
SHA256ded617766a389d89f7f52a64555ed5ca7a573ffcae1eb424754feb4326e90e68
SHA512afc2f5915a825a0c72c282b4dd8daddecb8b42047ae97533b9eb311539cfae9b155fd8e54d450d8aecb97f8e01cbb4179202784a59305245642e5f1bf093fa34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c779b04b390241652e9d20e87bd539a
SHA1f9482c0465b6175278b22c0887ccbc5c8e540a5a
SHA2568eb150f890931af67c4fd41e6424a5bf02d55b8e89b6d4b27524981e4c4c8bc6
SHA512245338ba7d3f6702c51c45b9b1c6457c81c9ce2efaf9a456e45f187e35ffc79be514b9c7c939fa95d0a131d5c4805eba54914d6a21d5fe4c84dbe0e73f213510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d68b46dd6ec899656c7daeef16f87563
SHA198072bac418df1881fccbcbb0c6dfbe71626de49
SHA256bb7f4d6c1e5be0d700eb4b8f9cca754d9d585f1a35425e52420dda463d223671
SHA512ae34b097c228fc0204112953422b106eb1c6277e860c036ef29e51377e211a4ec3733262a80911f4ad759c6cf3d2c1646fbb3bd0cb5a6b93ba4cdedc9b2ca411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542469e55f84d6dce69b484e63a7862de
SHA13e876e70105f9a22a4bf04a5a201532bbb4ef359
SHA2560975801a0e9d85aebe862de728dff23bd4c5209519eda5e6f1b6d8f6d6acaf8c
SHA512f09740be3bf4f864a6ba792707a0e93cd7ddc64d41db14a1b04439fbe43b93ec05f11a8be205b261615fb1c16cc625dc666ff8d75612feb98a4a3a68d1177913
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed404629ffaddb89e7a202937f19d64b
SHA1ad0cda8af547130c9a91688ece5a79b4c23c18ef
SHA256f3ab96d1a826cac3c292febaede8e647eab7c16737f4f66db7c7646976dba070
SHA512baa1f15efcd604bed747630074a5ccea36343b3078d5523589c94d430053bc60695ed1833c5fb941aed984e40d54e6a8107475fa10b33390acc5059dfc7afbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfb893e66741c171fed4215ef18e18b1
SHA1bda982bb1f8b8f0d2478a9e150514e79071ad7b3
SHA2565c58647c150cc8827fe7b56197e1a92586c18a29e495e0ebe61e8e42622c8d73
SHA51243b2890d31c25e90b6bbe1e0093c28f192cf397f7d9258c99c5b8ab63f1076a8dbc4e5c3ddaa62239247bf67dc9ffe36ee0207b882f2440bd10004959b72186f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a3b3cbb831f0e650d9550bff7e7efc7
SHA12f5ccbbf4f783685f16486725d7f8c7c17f09062
SHA256ba6c743eb8e34d33b2c992d87fa3da94d52ec905730e0904b5d2df6d4511430f
SHA51283e6fb3656b3ff02f6d516cca61b4383c3fdb81144bbcf087e1c8adf8a426611af5a2ee3adcfbbd8a31c42d7afe02f9136a43834a9a11c564a23f5d48dc33b99
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b