Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
06be7d029d7976da2f6ad0fa531a1e71_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
06be7d029d7976da2f6ad0fa531a1e71_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
06be7d029d7976da2f6ad0fa531a1e71_JaffaCakes118.html
-
Size
72KB
-
MD5
06be7d029d7976da2f6ad0fa531a1e71
-
SHA1
8920973c0a4ba9dd9ab3c1c4def85b1e2434be23
-
SHA256
2614b580ffe03ed451fbe123d347927958223f29ce08d509e1d445bb118eb3e4
-
SHA512
e59e6e9a0b6f9b87647d6ba5e4b27d84f08295ddc16708c8ba4d2879f7de1a8a5ed35a5b6d8b10c62b169f4befd49b421da09dd096bb2c0de86f2583924a0cc1
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sU6mhIfUoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:J3xTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420524104" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4A089A1-05DA-11EF-8414-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000818aa25df6d1a00bd332245fcbb2eb3e62b8d7f6e4f7a8ce7f84acc9fac6a45e000000000e800000000200002000000062a81e7fb3707d1393eeb457e445fe1125efabf8e0ea0cf904202abf7d1f3a292000000064a112f8e3efb8a85e6c1eccd1fa06bc936849ff15986d7f091163017c7c722740000000f24d910be12ae6aee59147c3a6c19175acf8238c47dc44b65210b4a03699cae41b93a31bb41d0285ac740afc54ae8569e102400934cee8e09109ed5dd2d8d854 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06c7e89e799da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000005ec9d1c962b62c95a42df5eda4d7e52efcc9ba553ae7c224a7f33f153cdf5258000000000e8000000002000020000000932f4001024269376940b67c19c1efbe801b7f673585cb10426889ea384d8c84900000003c11adfee56921762681f274404a967ad817851a50ac87852b167eb7726da4e820e1b64c3140101f6ab014386b6cd88ee72cd22a19d0251ceb401e57bec556c1f9af1b638188145c468c6fa4bd8ce6799aaa27fbfd60eb168bc02f5b47861957f97cecd153cd4bfa078d404a81af2d205a865f3ef6bcbdb76ea9e90983b79882f11285925521b31db6290436c5bb2c3e40000000257e288833f084134d00f4210623eace7c0c008372a32d2f166f4f416cedf35bdd1e52aea4f487110a42f9cae411ea952f6c3ddcead99d7af5d387be2afe4ee4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2200 3000 iexplore.exe 28 PID 3000 wrote to memory of 2200 3000 iexplore.exe 28 PID 3000 wrote to memory of 2200 3000 iexplore.exe 28 PID 3000 wrote to memory of 2200 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06be7d029d7976da2f6ad0fa531a1e71_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5667bd57010d0d0354aafc950a9aac1e2
SHA114f1484044deeb3eb5761fec3fe814f26263a6d6
SHA2560de03f6f8a81825d4655a9284a082e36881ea368df6c8ea8038469f531649e05
SHA512c8d673898290088839a65d03e8d9c8f4af1dc473c9970d073bb12b4d480d09f18d8768efcf541be5f24bb68fe2f42875f4b9df902b356d025a04282a985c7dc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5622314420709551ba276c52a3b8fb8e1
SHA1e084107e4f280d80a28b239c0b1362660d2f0a14
SHA2567b360c83e73b763bf39050896422f07c4318e2b7fc01aeb1e786e88b9564f3b9
SHA512e37d06d7bd0dd25feb20bf728a75f053f482688b0a21c4c367b24defc60ccacd919e03d110b8d7202d415fe35ddc8c6ee58c51bdf55b40dacb8c1b546b197c00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c96ad1926f52907a4e593bec9dd89ec1
SHA1fc5c9cfc1e21c1edc691bb6778333e7c72cbae1b
SHA2560944732f718f0bc78e0ab10571a0540e1badeca08b65b95c18514ecb5578503e
SHA5124bd70b7de502d471f7b20970e7cb73ece6121eba3f77b9db67eddeaf8b0dcaac85e2aace86b6634fad719dc37ce3af19b704c72231606be198096309ba428d45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da352266f065cd7e5a50e9c4f44bc267
SHA12195966ee00e992a270ae67494859c10c5aeb6f1
SHA2560fe3055446aafeacf2dd0655386c68fda8d65e510023b8a62b56a8442453f0d1
SHA5128442e8b6ab1398405ff3eceda5f9f5a8b8a66b7c12b8733ca0cf7a027c01290aabe643916b40d7c8702e5d717a42a5e55e70e832cf4abab445318cec4ef73826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537249f65881ccea777700f7c32fa7c7b
SHA1469c39ff5d3939796653c8646769d23ec4afb6e3
SHA256501bb9775440f1a347605e63e557b9e1c261a03f5f0a2cb26580509b2fb77d12
SHA51215bb5e3f785db140a7da377cf0aa05555b348a26ffa57d3a869c92f6602acadb60c1a54bbe4b3498d5ce6f15c630109dce42c18fd26f13bcacde045cb2455d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557756c237be5480114ef1c3a7af8e5b6
SHA17378cb8734c16da2aa9099f362506ce915799570
SHA25605c7ab19b211f5165cae8e4450b69742150e1a11445fcba9975e1a954f899bba
SHA512fdab2935919121caba00a6ff1ac21a97068bce42fb6271492ee881c02334d9014718fcc0e838ee16b457a1403185a6d295a34e607ef3a85b9761f8b2183362af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a01d168c16f7ffbf0897d61e40e439d
SHA1135ecaa59506a3e174788240535e650ee3deca33
SHA256ba0b63832c2c67e06e46a34a05a6cf3b09107f3d014b912bc4efd61e06a5e411
SHA512a43fbce23371b0ebc4f0c9fe0071da257768679a7d8e6d527cdb523ce5e2b16685785831f0f79437c4b502a8a3fcd8bfc712f72c56ad1c11e7a601fd820d36de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a113a5375f74f74787db916c16f8419b
SHA11aa696bc1ce36690eddd68654a6fecdb8d8dc3f8
SHA256177a935d6a4880b0e39f2aa234daac40bc353ccb9633e7c5fbebfba0c0e86722
SHA51265ca29a6ad22c7bcbb384051e68f4ac93d649ce8e8243c4bf3938ba26aba16219e91268eef29a4376b2ae3d50f7a45155468147051f604552460633303d647d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd061c683f03f44f5ef448211d7044b7
SHA1d609e2f4e9a9f6c202ffb187ddef7bcbeb0f53d8
SHA256bb333e4b125aadcc1a287fa3bfb0804fba70b0d91468ddad3fb21583d2e3642a
SHA51282b525f0391e2b6b3aff20e09d18fbfd59edcef992387d36fb0cd7c6bb4effc5800eb54055127d58258ef7f415e42f441b2a8432a47485acecec4f3912410b33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572f6efa1c54bf83bd9fded3ea142efcf
SHA1ffc4810840c3d4e5d5b90900a8d45669fac8b13f
SHA2569a336df553296cdd4bf03a91af95832b7c09d3c6ada241a67a5a52225de0e41a
SHA512f3236b0c63bc9edb09e5c0f91c93422b02ae9f2420afcaeda223d938be152e245b9e4862c6a5840af905a8a4102299696289f8b54b0000d3171fa7056396a453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc816d8be77992c85247ec7b4729c43a
SHA121de8558f71df1432bbe9e91da828cc47841420f
SHA2569ff9acff3c5b9431af727425391ce67dc528148c894fb98f81c776d36bb10e89
SHA512c7865da8acd8a7cff1194b702ff4911178e47ac614a4aa77d7cfdd4d7011f1b720d1f5723ec1f47df19dbfd1489eb1a91da538637b7e56bdb6ac3124fdcff330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542a2fa8719cc67d29d8aed6cdf5d6071
SHA18db71928ac404418d695deb52d53d4f389ed2b12
SHA256dd627200032925295e20a963b9198fbd5c00d2b93ce933976f1cb079c3e356cf
SHA5123c00a2dae4acbf77af721fbc099fc89964c312f1e6c61efbd09667f27fddbc55a55cd58ae8534a9719ca31118a5deff48b1d06963b23e283ec6db234607d14c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bfd076704303ec5dab246c30db01615
SHA1e106481465fe0afc798f6705241f446a4c0d6aac
SHA256aff7c3d59e0e2d431589dad59a5cac1758b042be8b3ec21fac9b3b261dbaf7b6
SHA512079957f57b2e155c276a63b412ffa5ca09a90d297afac8bbc67fdc861fe695c8a706d648acb08e5e5095cb57d39b18a9abfe02f24922adc94169ef00a42d0d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a20ef20a57637251805aed44b464ea
SHA1404798597680dfdffd5be8e1bdb298db23e8bd45
SHA256eeb340c39c1ef15422acb3d7c0473dd0470ffb2f9e8e5e9f87010b7d8ae4d7bf
SHA51224d6708aa670f37e447885f5a53d77fe54d54ff96aa421ba7935eaebb6ecbc866fd2fc301f67279401bc2621115df4b720fd40266ddeba162447138684b2f03c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5096a88444a322181903816fe8a5f17a5
SHA15ba5099d8273ed614b78e00da2dd0b3f92ec47c2
SHA2563d27fc58f353ab96090728953196a05babe4656190ceabfe1416df0fce3f92e4
SHA512aab7530b126432f79f4b439498185d98ee8baac7a0f9b4f5071d60cffa0b66974f3a33904791c551a2bb6e9407e0c27aeb30e4ae1d52b210b104273ecdab4473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caae324ef9c50698b0eb5827d93c8890
SHA1d8de891cf023f7459cb911c7f4fffa2f908db48b
SHA2569fa417dabc1db469a773738a5fef612613a655706b2edc62a666bdd12fb33299
SHA51297beb58c04cb2c55ebfc044ad103bb775c611a8517a64f28f700540f2bb868fe4449bf00725e26946e5e50471c7cbf56b397a2c7590002db2c93ee51c28b8365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541d710c5368502edb5150582f9dfa3d8
SHA1af62a8c2febdcbcb28020923e5b1d90dc519a091
SHA2565124604ef1c520755a11ffa2be2a29da3bf260c162b21e3e66cb900e85aa9be7
SHA512e0f76021aa39630337a13b99fa0ca0814bad9ada127bc3befd0b68998ae3faf6e89f67e80e11eb49e007f96070222f8a331027ed472984bc3a0a5289369dde51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5500850906793b4f50d65e209a1f2da6c
SHA13419065656d3b8497083e2cb933a157da07b50f6
SHA25660b8f48eb8747e7ea1f854cf6f02a9c1f397b043691079e868229336268f423c
SHA512ed89d50b3bc174ee1a282c2da69aa86c50605710c6640c0b73822af4ef459515ec12a6bd6944468557cc796c02a3790082bc9d02c49607a6a12ed34b5ece25ac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a