Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 18:16
Static task
static1
Behavioral task
behavioral1
Sample
3e5dca2eaaeb19f24d2b7051b58254ca_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3e5dca2eaaeb19f24d2b7051b58254ca_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3e5dca2eaaeb19f24d2b7051b58254ca_JaffaCakes118.html
-
Size
6KB
-
MD5
3e5dca2eaaeb19f24d2b7051b58254ca
-
SHA1
0f2b4c34eee24b259f924a22869397fd8fdc7fba
-
SHA256
77bd98ff421ad55210c6138dfe7adbd1dfcae4dba11a644ba1454741f7e1b65e
-
SHA512
b974d5c7efda949b344f55374c070183587cf90a2f8f561908d033737d63fed006a1b057e3f43bc53ac3bade8cacc88bab08070b63dd89ac0eac0788a8def39e
-
SSDEEP
96:uzVs+ux72QLLY1k9o84d12ef7CSTUBIhcEZ7ru7f:csz72QAYS/vb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703713a387d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426970030" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001054351f411a755a2e666d9ca7213c6b089bc339628d3d8b4a4ba8c7a1b6fafa000000000e800000000200002000000086fc8ce86e62602ce86cbaf89c909b71b27bd425ed7e895713fb002be6c3a76420000000d3b65a546ed75aca65acb297e23f45c6044dddbc0717acfcc23393c57f6d1f8940000000bfd68b955ec538ecd2cd77e7bb39bdd1b80a31f969a14fc5b4d9601fe3ae2cc806b44bf59ee61bfea2585ea1ac7cb6ae9f2929c652dd2e222f6c7d61951c8a73 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC8809F1-407A-11EF-BF10-EE5017308107} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009aded81324553cba7e848e7117567fbab833f3c5075df3f09c50a6d0883249ed000000000e800000000200002000000069063dc16140370f414bbcf3cc484f9a7935b0dc38800c0bdbbff0c93bd70ceb90000000c4e51145847fc24c932aa7374fa008a358bec03844347eda3126b7c704e646b2bd804afd3dba0ce7912b918c9683f693dedad0ee914d2f30ed507fc3b91c2e2f9db427d6f8f871ad202093adbdc8c4705910f38492d4b4b158c906961b225eec0a496b6307961e8be719f70c3542e3fcdc30e04b3a6d0fd0826ee995720a1ca15a044df372ec7619552343cd9de06e0b4000000070110a0e971ed1376d88ac595af8ee7a5f9a845a338c38d4dfa1b4ccfafe798e272bab9cee1ae8d9beb58118c34922d09f418dac072140ee89310e931c29db39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1856 iexplore.exe 1856 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3020 1856 iexplore.exe 30 PID 1856 wrote to memory of 3020 1856 iexplore.exe 30 PID 1856 wrote to memory of 3020 1856 iexplore.exe 30 PID 1856 wrote to memory of 3020 1856 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e5dca2eaaeb19f24d2b7051b58254ca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585941b88148e6c70bf0818598dfd9dd4
SHA180cebca389d856f4ec61d28138b3256c6b10d6ac
SHA256fe4db5510a36ee73e991c66e3d4fdcb9b7703fa0395cca12ee14b06a4eb3a733
SHA512e6e58817bf377192fd25c6be7e8cc4715fae47092759e1be0c3d946bc777bb2509e084e75e6b93a12a001675335943f63513d1e23e8424fe8a198c83a683df7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57100619a53495a850438f973066e8a70
SHA14e7e25eb79dbeb783975aaf2e070468936d9959e
SHA256fef3f73c1001180295c5b7e268ea1ce210028e0aff3e13e5d4f331db1dcb204f
SHA51279f93bdfbc9bbb54b8a70904253bbeeb0ad6dd2883446422d68f060e7bca44757613276e004d5aadcabbe55bc5ad7894d0549a210d9a1cd3ce506cfb6c77729b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593b49525665428604b90f9fb23908eaa
SHA1f2b17021f992336c17c3d376b592a6685149f042
SHA256ceecd4dc54f84d28a3ab3c7a5577b5e243dd759fd2658777c496370389afe4d4
SHA5126a745ad8fee9d47c0bf9916068a47ed36758f71ef50dc5d480b86f42c3944ef817944e7d35bc114d6d0418c4879a71d7cc989f4c48c277fc9a7a8e4bb419d1f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2c87702767fe60525c54797493b7b66
SHA1222f63497ffb79bbc6597774e7f18671979dbb44
SHA2566c8b0ec505baa8f6f33a55795aaa8f0cb4a8ad282598750341cc0b92c383d218
SHA51285a44591f09b00457031be77e44d9f50287a897dd3efc24a349df23eac1de43041a38020a3744fe1bc112845f394db2f48c889a9e54f7111a33f4e2f105819b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52874149181d22ebca4216214b9795429
SHA1de4409ce4367a19faf7bafee542c519698ebf003
SHA25689e2a5baabbc5a6005558a868d9a06fd4d105c48581ca94f39d2570c30c5fd31
SHA512b11ce6d4d55f6cd1431e73802bf602723ba03d0bc9b822240c228edeeedd6bbe03eae8b4b9bf824879cbf4fc75b4ff1cd245e403b30bd8986a43f9c1b2bc9eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ee5427b023e58e9051283776b8fdf5d
SHA1ef05024a4299322e8991b0cd0c22f1a549b5e3e1
SHA2568a11095a44e9ce49d15a92d5fd4eb26956c0ea3d61a90fadd63eebf1f7ee9e6e
SHA512b31db7648074828e25043b007ba2de28b2d373c18b920ddf9503bf4b03b4d05e4f3804ba9bd791db14a66242531da7a4afcd4bbd130c4d805c651fcb21f3f01b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531b307baa45d780afd52949bf70b8f84
SHA1eed82c3c275ab878bdb8012c785292fb1f14df69
SHA256034d03eeb1833bc0b4bc4aa6dce7ffce59ce705576c7997d5cc1be1e72a79a3c
SHA51214c074841c882613146749b5ac5667a26920be3afe659eb09b894733b216072e913fe9c596a08f2e2f70337d0cf51139c3c479f12f7d4e049731059256713268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7d471e7e0d262a5973b070eed7938b6
SHA1f1aa80d03184a5609482efbd865004771c875b35
SHA25634782c625636c6ff00592eae9ce90a1869d16057c6345a73956a135a8b1ced64
SHA512883f7ea4a25ed8a3e6749f4af0ff435de79bd319c2b60e1defed600a3242030e9aa10503bd636d34367c4a47ac54ad061aa77b38b71147184bc8eb02d696785e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afc78c863a7d206932ff35b18462e17e
SHA1a6b005a3daa4068e1245380d342fdc855cfeecf3
SHA25647cfd0256a89580e61c4a5b770cf30dbf6e60e1c2971dd56ec0f741800a5f561
SHA512d5fc2600928ae4f3c918df59787c0260e984bdc840d8a83fcdd8fc1a4f0c77c71418baea676472c4c2bdf9555179764cfc0ccafe9d55d9b9128a530734e043a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0cab71288bebcf3f1be219bece04ab5
SHA1d0837a867ef14c6656d0a52c58baae8c89725fd6
SHA256c7414f0e996c9a6e53b2df6604fc7644bd5d8e5771dbc7b906abbafc3237711e
SHA5120b2ed97ed5b1c1a317ac92dfe4d2d430dec60d114becc14a2d7783db80163c4bd2a0d9ad2ca75d278394278d4a317e5e726b9cb0452185f9189d02d6558b7351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50026027ceb9d918b33f3935808f01134
SHA18a529ab34f1a74f8424f88564b0f8b39886d7844
SHA2565bd5258a5e86c9e500c8562390fb4e60a9d3d20e570be5117e739761263fe426
SHA512fd95a441516897a915d2ddfa1da76f05aefbc3cc6045ccf95849c3d65e241dfcaaf28479e98ab32ab2f660658d6faff42d5b5ab8f65a58896a9c7c4e05abf990
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f6d81326b4d96653853750ed81bfde1
SHA1351a6586b2aa57a5c6fd4fa1f9ba83ab8a6d547a
SHA256f6bec7b18dca2a2f88e876f494a9ab8af52ebd6e3b33ce56c0dbc89260df2e27
SHA512ed17f4e367bd0e96fa6967a998e988dd0f9a5515d9f60a7a4842b0b5f5907592711ed9d445aba19f0f9918790d7656ab45e9c5ec249401ce5a47baa45958c995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d63352d2f17a5a3be23e655b17a4dec
SHA1d30b995d35910f289d3e234b16e1eea9109e85e7
SHA256a7150996712ade306e8c9fd86fe07704182a3149ebe4af40c701acde862837dc
SHA512e89a8f9d3a443ba314e59affc5b9926de373d83230e01400395d492bfd6c14efb0a160ffbabd5ee693bc700aae776dca150734e5cca37bd4190a3c2525ed1e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b22ceac47c5100b24cac3fc78a5d2f29
SHA1d814e039df286b05a0ee54f46c2cefcb99e5b2dd
SHA256bcbc70e7c618d06116f09a3e3c479b0a11cbbbf92c6a1f418f2a210498b0f41c
SHA512d867eeec82e741d8dae7c29dd0c98b047f66c79b609b436409cf1708c9252d444fd4575efbf26ce08944b77480c88b0bab72d223f0d9f2138887dda00fc37781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b29ae62acd555933d8c0deea7e38272
SHA15b35c88b1a78305e82d11fbcdedbb524e7d1eabe
SHA256d78ff8016baf3b3745c142140a2fe1f538e0ce1f0d4b3d17fad2319dd9277a05
SHA51256d65c2cc867f7de186dfee56306173cb9406a3185389bec86ebac75fe20103ac11f654186a3ca05dda6afa2f19c6706f872157d015528b9e90fd22eb32258f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a01dcc8c09452fe90d5c00bb273ab04
SHA161180b13f33a64775233038ebef220d73e30ae0c
SHA2562201c07adada24316a8caa17c4890baf62ccfb4c2acf9175ab4c69fcd5c75b5b
SHA512d3943522efd6b75e63075b4cc80eb2e207e773e5ac4f49855f77914f254b193e5d761266e947b95ba0c883f288851481d01093678783dce600f5315983745a9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3471e838128271445278c569a360e71
SHA186a067654ca9a38ff6dec3695598e2df9dd3d362
SHA256932b68ade7bcf04b12e84aabd7010ade6717d34b70af4da2fbf5b79cbb5e3a8e
SHA512a54ca01c08c029e91cf964f2332501eaabb06b400576f19d11a8ca387a27be1db1243df7adc7094a7cddf1b0b2563193ef22f5ebd53c4b6585d8a7d21f882a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e243a95b348c956268e596401a15509f
SHA19cb6743988f9a1bddc7b560ff1f4da3abfa3a6fd
SHA256bf938ec5aea372c2df51cd4c6e314ac494c79a241e40f3121c8b68afc0d56f2b
SHA512f311ca82faf7f34202d655a8b4e8f6988c914040e332649d2c55e40e56ec1c69d41b07ccd69ab0f843244b04d07b0a62bb2cd700c688b8a8db14593072ebefa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52303fde3132ba8c85b49a33a13969f2e
SHA168549ad79d8e9b06fc3879ae5e69ddc8b0480c6a
SHA256d8f68cd1c8186ca8c99467af58b22ef990314dc916a842cbb5d87dbdddc4d25a
SHA512620e120a673f52d7f98d260c14fd1119a2414dece10fa788a6f1c045a910544c0e27f2edfacb7d43cf1e3f7edd035abbdb4e4471f14446e155e9801a3213c675
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b