Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
6120b7c2c4c338a6fa000a3a10f01d83_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6120b7c2c4c338a6fa000a3a10f01d83_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6120b7c2c4c338a6fa000a3a10f01d83_JaffaCakes118.html
-
Size
142KB
-
MD5
6120b7c2c4c338a6fa000a3a10f01d83
-
SHA1
681d917d31fe829e94973949c8595bf69ec0ff06
-
SHA256
005d267f8dd0ad3152ec1bb9d073b6df32559cccc200500ad1dc534856d790f8
-
SHA512
354b1881d7ee66b198687f87977ed3673bc7d6862f06efefd15ecaf5e9437b818ba8c9e8b4e978ffff8410c16846afbbe9600004f5c8be809fbb55a1c1aa8018
-
SSDEEP
3072:S0BFzwx7dyfkMY+BES09JXAnyrZalI+YQ:S0BFzwx7osMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A094FE1-16F8-11EF-9FEE-EA42E82B8F01} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422405953" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2860 iexplore.exe 2860 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2860 wrote to memory of 2484 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2484 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2484 2860 iexplore.exe IEXPLORE.EXE PID 2860 wrote to memory of 2484 2860 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6120b7c2c4c338a6fa000a3a10f01d83_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dce1f9b8859898fb92932110da7057b
SHA18c466969cfdc32b67c9f8549757208c80c580943
SHA2569429f0cb33609e41f63d164a55f9c7117c50c247f30d8852fe02c8ff5f213d38
SHA5127ad52a989ddccf32ef8c838c96eead3c312a98780d6a453d849097de36a7984710f533225e2600218dd84f91429849d8b59ee57c14c972812ede139315aeb565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef89444d0c1d2c82837f0d150b9b7603
SHA19cbd301730f262ba16212ada45e838145b8fdc8d
SHA256318b0895f50e16dd56392473b01c841aa41484ddf87df8284c74fe091d7493ca
SHA512b071637f2eaf0b378e323513c7eafd5842f39c1193926f28ef5d1836b5f74ee552d46477a50692a554dfc7fdd36edc74742d4360055a4c56de6c3e0398377eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509110a35369dc570bc7f59be942ea8bb
SHA15d00e1e20f9bb5ff485ceb5325dc3428c09ca411
SHA256aee733a6dcd47c2767b2d9bd9a9de6bfda18b3399f2597cc6a34280a7b35adeb
SHA51278cc7b772f939cea712ffe9a308a08c2a7c70293536f26cf0fe55a3da960626d429471d574763e80fc07b61854a738047cf861dda77194c0b7164fee2ff7b12d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3afc3d229c7e81166cebf2e1b2e5c47
SHA135005d698ba1aa6b9d6bcb487bec638f12ca15fd
SHA256045cd358181726f8c80a2b3fb9ec3126ae6c72ec1af071b9c00e648bc275f25d
SHA512b96988fe568008c9b022f8d8aa009b0f75f235100164639c5412675fdb0c5a6ae5401ac9f14a2c974e6eb4b6029b50297836fdd7bbdaf73ed5fbd5b116f773c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e499d7e4bb5a0656bfb90bfc7fcdcb02
SHA1b7647ffd12a89ba00086e4ed73e4861a8573b5f4
SHA2564e5d3acd37a681b055082a55678323dc43cb58beb0250bf84116e01e14e928af
SHA5121b4973af5122184a0047eda46617b44732c5307a12aa0f015df6c3f8de82afa312265c40e9cb77c6c0acc997a7e95e70d7716afb3f58c816fb4b6afd94c5c47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5027dab4b14d01fbd850b9ff2d0cbcde8
SHA195afb9987fa236cb1f9c12ed6929b5cfe32a20cb
SHA2568f0fa0589c39f19f3cad60de9cce931987971c178aa041e064cdb94f79c494aa
SHA512754d38f8411ef59bd36a61d31b9039457d2df8f40025e0c141139cb8fefe6bef479b3b30a4c5bc5e4d98c62399d82970b7ce9a1d9ad58aca33368f123654f08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f314107786b8eaa0dc140f310d51028d
SHA169a5b7e667c6a4c4a965c2677058957d9e6bbc0c
SHA25661fbf7b6f3ddd1b915e5faf0e8058bc2868b474395997355bc8e2aac2dedd553
SHA512c59998343454cfb5a847499e603947a5da2c9003b9bc3bb947eb4c43efe9a3da5774806a069474c2fe5fcb6be0d3ef9dd7196dc58cb44ba0301fc51301dd7334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e3f557d703a0dc68c7c05eb47b19924
SHA1546c10dcbd13f4d3fdfdf35079d276e1c0211720
SHA25627dd9146f5f1e153dc0bde15a2af4cf90d2cdc37d5bc5acea00c79244d3e5047
SHA5125ba0a2ccd5002c0f73b5657703ebe83485810d2628d7711eb982681dc03fc9c5e67cc6553f173f38dde5222ddab853765c617b285260998bbdf0fa7e7ea5dd5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e4f000f533c6a3e7e9d5a2a7fb8ad35
SHA1d8e362764b777d0c1323aef53a28c83e8036b3a6
SHA25671c33ba3dcb013103b8cca95c100b5c1315050fa0d81ff5026ce6a9093eedac8
SHA51236ab0ffd72b9bd256dcb47d82bce37f78d16d51b6fc38edeed2eff6a9be882e84048353373f72bdcd3b27f662b95a178ca5de810cfccd854285c9e9ae20d1b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55221390ab485071a67291b145ce98f0f
SHA1acad9c41ae5480ee2ee8346afb295df51d83f96f
SHA2566578658e2ae10c0fd65183f1beda443f983241ab0c1f8e7ced42049091ce31cd
SHA51299ccd56f5ed5aa3487545344cfbb5b963d53ccf6b92de98b6f673060a63ec6e204a9f98dcf75cb3c84b4e98bc461de0b2a49201497f0f280032ec22e2a199780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc9c4df1d34c09059b41e76846d62a16
SHA1d92184c7ae66988408b4b72dc9bdd9d0fa04510e
SHA256547315742d62a40de7ceafe578115bb4e4f314c6b554c98413bfe56b1df7d634
SHA5120e135dfea18546f7e0a69097cecbe81cea43105314f79508c2eea304ad1e6af0b158602afa267ccec90acce60e2e782d598bb68ab0d5ce7537fa8dfea1c292ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55db051cb813dff2a12c06dd140545c6b
SHA141bb2f50e30e51105b71453ccf7d317e93f41e3c
SHA256963463ae63336b45a5a2810569a5aa06762fc591aeb1cd635e52a570a27c46eb
SHA51258a815865e247c292abd8c183147e3c2bd7fa0dd891d3a490944fd19df4e9c75e6907b9dfb156ea75cf129856fe824b150e43c6350521969a83e27840ddadf5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b295c5de6cffa23e3ebfec6e56e55229
SHA18671c32851ad101d4169242f72d846e65a4af6d7
SHA2568bf6c3e2753c20c75956df47b3735b7a5a58c94fa347fee10cdf40f173f0d791
SHA512d97ecfa59f8ea8475815c0c23c87f405fe9ff1e2adcd7ffd407cfaa1ccca7ff321c20221401691b3f384fd2ba17d5472e29248892f951de9f6a5d189e01a64a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab7ecddc7516c65b778b988249ad59eb
SHA18c5879e24832df0ad49450c0f2c71242dfb72610
SHA2564d16825d01832cb48fc2f10fa46560da947ff2ffb3a5989bf800941a0dda5fea
SHA5124d97da9e02e4181a96853e018eedbbf5e39d1c71b54a59a1d5666a6d925d3113a2819c5296ce502837c78ad0d2827bd6a750f8d31d1600a09c2b926938ee4c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504143ef99ba263e82ced1258cc6283fa
SHA196b6f61db4bc53fc62101d215c5857c4eb0c5216
SHA2561d0359707edb224a0e42b4b55968cbfbf571b667feed1fe1b2addc32d94fb392
SHA512de0e38193c41045e601eb89ab937178b235726bb8183a02db1f872d5f90dc5eea2a3a8d50a99d22c7152d59917884e5e9894eeb9ac04add8c72be3af212e943a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf48818b6e2161bc5a148bad2e0090e
SHA1467de9f188f7530bf6c47de4ba596b04677640b5
SHA2563909f7830784c20ad3c14b50f705609a9953895bc6721ee43be273360cfd3c08
SHA51215d549215b7b7c16674fc5dc0d3225005fe9d1ac300244277fe261a13d6303526b088dede1fb95564db143216d5b5d797ce0b655165178a0fcefdd06c607e378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b02644cc9c5a2e9b3e781e9ea014f5
SHA11f76a027587f57f9dcfeefb2c8c941549d006aa3
SHA256c01ee7a616e1379f5548e1758c4fedbd21a72123f529ec9c0b97dbf2141ac33e
SHA512b053550a8ac6c3f07b5fd84c12a1835ca452fd14697ae57d40c0ebc34128ce25efab91b41c6391943040cfb20bbefbca6f5103e3063b77dc5503deae0cb39c15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c57d24133c7282c2456c9cd2f17f0194
SHA1d85d29d7cdef87001866efdcd38114c0522dc795
SHA256c71335a1a1c2e7be06cfebdc4127017e308aea15c7e87a99d2e782f2bd630595
SHA512d037ede027afa961c06172a4e931a0766e8c176f5fd38e29dc5597b363c3368adc8b87c592620d9e0a3bc4553c7489681f59b0e568514af7199abf9e30b0113f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b71985d89aec7043dc531cc9d6f69700
SHA152f201c6ebe9f5e3fe5f4bca42871fdfa3150ada
SHA256b5a494de94cf9f7c6dabd659a254817f91c1b768c2f833cee559e47aec1afd00
SHA5123656ccb4dbfe4006b1bbc9df7fbb7feb265641390e9d29606592891b044c9ee84b564704491b9ac4791875a7a315ac71c301286827ae4aac3c8416eea2bda845
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc882e9f5760cace94a4a6af7bd32d32
SHA186b501621380d91506639c17828e4a1f89b00e64
SHA25604796d05674c5a6ada27c73d12bfafc66a69bdf772ef52a1162819dbb29e7565
SHA512d7579be3842f44372960409753c4bfbd7c8e040227d223b2e32d05530ac67846ca6f875ec6ef5459cb3bf0b1b203b5f12aa23b0294b6c0497f210b41038a9e8b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a