Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
3f70f1adef77ad17515df7a44e9353c6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f70f1adef77ad17515df7a44e9353c6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3f70f1adef77ad17515df7a44e9353c6_JaffaCakes118.html
-
Size
1KB
-
MD5
3f70f1adef77ad17515df7a44e9353c6
-
SHA1
918ea85c64d26f3392cf155f8c9f4a683a983b79
-
SHA256
1e0e6af92daa0ae1f93ffcc3b04ffa9a0c7d913702c9680f883f3d7ebf48e498
-
SHA512
16aaac3fa9662ec2dd103f4a64396dd1719f791c930e6e3593012033251fb55d91b6aed2da0899459b26f10b2e7838da8d36b6ba83e5b407e8a7d6625ec4cc30
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000003bac21c3c4cc4219b9f7f1cd568e8df370722bdac4ad5cbc222de4a9ee0ebb30000000000e80000000020000200000007532af7c0affd557902054c95dbdea080c6bf12f67c878e95d37623e75fd4c7520000000a8afd5bfadefebf29465afa1546caa273941cae9b7a135cb0f444307719df728400000002533611074fbd91cad93cf412a8689a2462e1e111b5d7a30b53a5d824d3e36323b8d282f5a38ca4d6d9ee181011b90e504a85c33e4d53f31d7c918cb0930c252 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a2e456a7a86027b3da1a02b80db06373585c31e024752394fbb2af917b3b285d000000000e8000000002000020000000ca188fadebc9ae09f6a55435c9e4c9e6221c3c93e8be821ab404f559189fa7139000000093aaca2429f310912a36e7f0a52050959bb02fbc1a6040b7849f436f4fb0d691e03a0956fe661f8dfa314243c3e471425c1dbdb0026d76701fd2c39d85201a5b38cde8c1f4128b4de8c25d02518d1edce5607ff5dbb0967dc7434c152ce182ec7f3df7028755514612c3cc46bfcbf50c51938b50edf84829b061182afbd3b046bec6e0be6e93229ebf8ce7fd8a98e7b1400000003bc147c7f35016da0341b4cc25cc7f37c59036a9ab57bf252612c2b297d311d3a8414f0f9a6757fd6a61ed8cef260601c31d041fdc8d7d5932bbc2fe603a2eec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86DAB741-40AC-11EF-A0A2-EA452A02DA21} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426991389" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90eeb85db9d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1432 iexplore.exe 1432 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2988 1432 iexplore.exe 30 PID 1432 wrote to memory of 2988 1432 iexplore.exe 30 PID 1432 wrote to memory of 2988 1432 iexplore.exe 30 PID 1432 wrote to memory of 2988 1432 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f70f1adef77ad17515df7a44e9353c6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d89a6f8fc8c869198eb0e48338f6589
SHA1fcfc83e0f0eaee05283d0691b05066cda28d9a1a
SHA256c7a017af1308e9c4b110270cafc482f086655e2d2ad3604c34a6c21289c026d7
SHA51204aeae2e072f4f6676197181d984d7582e9f619b5074a8e75262dec58629db1e43dff0c784a8c139cd2507dc9d4de23b91fd65d7b4e97282c0edbbc5c145cbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5640bae4bfd341d1c211d0ed28ce2d5b6
SHA14b4a0d73045ae05a4037a53e233e7692f134cbfd
SHA2562be7e0bd8fa617d7afd0b4e795c6c608afc71d59f7a9a50dfae05d63c86f3749
SHA512f06e28b561d6b159d8986d870b8902272e51375b974a484aa4cb6e084aa9ab160a4922731d98e1c7d51085babcd5ea4339ee3a253a14da0055a2f45ea72bd870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c13cb20f6165d0891e5c6b5660aaebc
SHA121305ccbc2e7d1ff70c6137a924d9c08571c552b
SHA25660e3a62053c735e26393c6bca54c063df12688ef9388bade0f0e4201e93dbe87
SHA51230e7e48ae3bc111ee70c0c0d1f205c7a7fce45ecbaf88dd941cebe783d59e39f80a40d517813c1a46bf7f26f7f6f770c84205618fd2e99c260fee135e7309ff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b0f0edd9e4266b3bd05a812a248082c
SHA12f0e81b78de0d910935703ec339f9653d9377107
SHA2566c1a2aeec91b79ff7d2ec42284708d1a11cd5e15b573db0bcf70f040a8927c14
SHA51270e9170df6cd066af91746d2db0c781242f3c25f9997a7f723765320385375269ad73e36277c7adf7e8a941b67460e468408602dc0329f4ad7d1f80630090dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566ec8f3b3d9adc20671c431c99f7759e
SHA103b13102e9fe1c8af66783bbf474cd64a797fda1
SHA25692a2ad64d45fa33a8b34ebf7e49d57bbaec749a14bc1b4bf80c367d6d2f2d594
SHA512ab4c02f5809e57b82c800754c0bdff88214039bbe6d0f415988bf9ac9acbf3efb4bdcf4d562e942b8db64d2f1f06dac37c453281d3fbf8c00a5ed73b48626e93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f1fc6bba8f5b738c9517d7dfb5f94f0
SHA1221693a7f65ce2f973c2d9a0004bf1b10551311c
SHA2561cd792e83e23ec29d51a296abbc89e5fd7389a79d11cf862b235f694e893d64d
SHA512454440233d980b08a717ed10bfad4878be5aa3c6fb58cce4a018d873c5f3582dac3c7242a44ca2fe35e15cc0921084807f6bc48e291f4a9afdf420006075a283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595da68c981b3ac6a3f929dd63b5cb8bd
SHA1aaae3ebe1e94af02153dca3b025cff42008cd5a3
SHA256444d94686123eeceacb3b0cfccaf60707e039d8479f976aa616bd062b3d29ea0
SHA5127344ef90d392723e897028885cf8ae683de810e84da094a894716ee07eae344acfbcd996660242ecc5b8a7e874d568dece659b5cdbc7f44c78822247378cdc6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d427be7df33526d47aabf34f9bc584
SHA191a394b13b02b0706c4dc2f06e0f6cf129e61647
SHA256cf0bbf0c6fd710d81989e2c7feab107176c77510495d67a080bbfdd8a2b66f34
SHA5126460fcaac70c421e1af8828c73af1ef38041bcb3822b0ad6700c44502ba59689ce3e2c7e1854528b4894a7adb331904d59d0db099ba5e40278c8714cfd876529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be8b6803e95c4b7b23c57e26c6c628a4
SHA181717ccf78377cf535d91c8ff086b82d5a2dc3b5
SHA2567f7b1b57730031b7259c84d14f28dafa9be133186b1c532069b2fab9cdb503ed
SHA5123aee6b45d7c0d40b271f106cde6f88c3ca74daf8810c6cc83f4977a549735e5beeedc7695bfa114d7a40e6ba148416d5bca2abb9438c56c27fbebd72697e666a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d76b00c6633f74946f214304fae86531
SHA19389f17b1b3b6ae2457d4c58332631b64c392a3b
SHA2569ccfc75bad183aa112029a174795f3826f8a82898fcfc75e96fa0db6a80f0539
SHA51270a2501ef0e6957b02cdc88b6ba9c99aace736d3a664f6a1f46cbccfae20239f8aa500881d07030c54f483b3f1075a0fb13f8d3b5e9be0bc869cc43b011bf0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5407272c78c02a932ebf77e88ee3bc7fb
SHA1b88c0db26f392f4f53488a9738b3e93b35891449
SHA2564a3e9d40412a08d14e4b8a21358a523e90def4b3e5678f431ba896833e413e75
SHA512b6b751f8d50a5e1b9da15428d4acb75bb4bce36814bf087bc42eae88d0146e45df937e568cc1327b8d2c0ffd014680d6a0791e3bdfd514a33bf7f0f4d8420645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579dfe4f3c1c907af07cf335b1a9f6cd3
SHA134174f5d20163ddfbc76131f754155e3c35f5e96
SHA256182423138918fe2dbde2166a487406cc987599df416c05b0fbb118150ba15999
SHA512df2a6fa31a0d7d1ea31f44f29e8eecf7768a14ba2e582cb104c9d024f2db8e11a17c607031be72c0e3c72bdec1dd1044a8066e83eabb284f69169da94a235697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a01daf53a4213e7fa1857bd9a516788
SHA12d33c4f7e990a87e49dc1700859fa47d100148a2
SHA256723de25bd157c69a8033d3685a2a5db1581dc3fd188469686ae21484f5e0ed43
SHA512a9c31c661aff24ad96f0055294425be969fc6ac3d7895a2b96a615a76742e5094b94f2af71b0cc58ebd362aea5e981034331f20af322812afadf584accda50cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558540ce5b6e21b191996d924d1510de9
SHA1a1a22bc2d17f0d6754050524fb0bc9a025fedf5e
SHA256f10e6ae28014cef0f9a5ae2a9562523a522b864f5b72779655ce64143a6faec8
SHA51202fbe60e597e8b571b7f7592b624f996284c9bcee40e0108fa102341658b1650050e9becbf991e79c26133ec614fb997e2360fec9f4fbae01a37ee1c49f2eef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae65f1d849306e9a0e244cd9f64173c5
SHA18661efe0ee15a241c4925156736112c07016dc29
SHA2561a1cc02dcd895e87bff1b18094a5791dd244af5bab620ae63e396286c9872427
SHA512d258d195a23d256fe3c06a52462ab03fbc93d401e20d1af911eeb88f2cce0aa963857fc6e06014347786a80c98b4e6ace73983bf31397f9b256d997e664d6d04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542da64d64e47beb2f49bf7d5a30a5943
SHA1f521ea211d867417a3cce5711c94635bb6d74271
SHA256a3eb41cf6e911813475fd940e67251ab2c10017af7881c18b8e826fee377e40c
SHA5127b24f70568c6c386d8aa76e270e3195bf529a2a0f75d41b479b1b302a04d2a51af7b159c963e4ae9efdc4f86f39c90c4c45443a23b510421c3666e9da21c637e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5209b7f9a6c19dc0cc66a33904a36e87e
SHA165815da0840fb37ad6815222c813a2e85a9a8c0e
SHA2568a033d2d805b816ca534d50416016aec61d4ba1306da8a8c049d36a0c8e15e30
SHA512c1286e9c2d9f75dadd92e448c32f2b70c04b4e792becf711e7733a0bf5335d4e95e1a4ac657e7404dc78059b14280eef0c4b8c925b75dbbe72c18918261294c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505aaa0a8d1e9135c89c7749e21fa2f5c
SHA1bf7c33c949edea4941a063f1aa9c5e809953f4f1
SHA2560bb3368f21c5c8a77051da19698786a6dacf2e02c5d6349bc3fe0a9ccd24c303
SHA51269134953294c71d403caa83baddea525ba757f07b2a1b1317575f4609864059290982f1de177fe6ee2358120d17ea37054d55b3ceb2cbf6ecd70c1d6c24727d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c56f042913370f07b7609be3178641
SHA132b8ce0061ad365e351c4ca814be553f73759a93
SHA256a28d88bbf71d174d7cb8c06e0c8fd88a495bc250bb9817f3a40169adb948f4a6
SHA512568623440a83302bc24b98615cd0e5f7742f7f2df24b2f20fd5feb21457002862cfb29756869c851cde8d59ca43072e8a8c00605dff1937f1b02159d3ec948cd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\px[1].js
Filesize346B
MD5f84f931c0dd37448e03f0dabf4e4ca9f
SHA19c2c50edcf576453ccc07bf65668bd23c76e8663
SHA2565c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584
SHA512afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b