Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
60fe5e04efd5acfa3b074cc5a9c71b39_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
60fe5e04efd5acfa3b074cc5a9c71b39_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
60fe5e04efd5acfa3b074cc5a9c71b39_JaffaCakes118.html
-
Size
218KB
-
MD5
60fe5e04efd5acfa3b074cc5a9c71b39
-
SHA1
92c8fcc60469dfb798409b2e8651a54b49842760
-
SHA256
fd9828e8f15675dab8b88fd2e13c010d872665b10daba9b291bde92144c84e26
-
SHA512
b508e040d75ad6b3d708acb52ab64571fe32ee879372da2e68ad3a5182ca2b9e8c7822eb39e5034a9df8a8edec6452e7db6229abc2347546991ccb2d0aef9ec0
-
SSDEEP
3072:SADlBW7qKSeyfkMY+BES09JXAnyrZalI+YQ:SADXWg7sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{412EC061-16EA-11EF-AF73-469E18234AA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d386f2d53b101e4c9cbab0c0ab3a9bff00000000020000000000106600000001000020000000ada58b1904f508d69e99dc15ee722dc164d431e0e355fc9661d3ca01e4b9309c000000000e8000000002000020000000230f28874b27569f16fbb4e7e89685e85eec1fd88c08679a8d43a969ca0f142720000000392007d072c3650f63f540922e2d1c92915afc66225dae0c580dce84debeb095400000009dc1cbfa80d9821a5291116420cf46855c26b108ed50052929a385b1b402d81c3266ae6e1f2c4d095b061e6384f97f36942dd30d50cf2850983c8f0a53652c10 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03e8a58f7aada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d386f2d53b101e4c9cbab0c0ab3a9bff00000000020000000000106600000001000020000000ffd088363a260547e039160aeae5ca27bbb896cbc7678a77bda073211aa3f3c8000000000e8000000002000020000000f6a5b895cc1268bd89c111ff9a6161eb8ecd5523e38138ab308657285d267562900000004a76814aad9d1577a5855ebf80d410f9a1ffd03b61a9552faf1824b6814a88a8f1844fd19d59b7f8b6625bfe9c3f0f015ea8d2390faa858ac92586b358813c3fef9c97b2789ea7271cb1078aad3ea5f2689bc702015ec57a9e6928857c429fd0fbaccb623480786341932564f57dc9da25c4dcf4fe6bf50c784d64cb37c476ee778ca09af329771a84f2a2fef27f3af6400000004c75f29480197179deb21036a9348b73c712cff677c0072203c28ff22f3fe595be69d4e2d640ba80771e5cc4b77d23cfdaecc993d7c4f1bc64e0dfe167d1e794 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422399954" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1540 2740 iexplore.exe 28 PID 2740 wrote to memory of 1540 2740 iexplore.exe 28 PID 2740 wrote to memory of 1540 2740 iexplore.exe 28 PID 2740 wrote to memory of 1540 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60fe5e04efd5acfa3b074cc5a9c71b39_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f41a964313ad75994adca70ef6c563e
SHA138bb429bd33301399d323482081b6a1bcfa4a12b
SHA256b167efa54d4b96d83c7db646b43ad5c804ca5d05cbe4bc80000fe0b4811d2eac
SHA512af63590e0b3e2a59d5e3eff5c02dce05acc35ab3d8eae101951d0804efcfb5b0905ea2ec255655c5d237a011ac54430d5c88a87a5d593dfa449e74d8f02aaa01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57af5b40d2918059029e2f11debc22a13
SHA1ab3df071de93cda4583e2befe740b8f3d706426b
SHA2566c95b3ca017f7fae593ed266983d5100a3c520b2bf28487664816b31aad0d30b
SHA5121c2fe4c9157c368c7f1bb5c8693e01436cc3ee929f4f8ab5c1cf6593b87c84c386c097c9e97969b122103c83d487b00c9b6b0424387586aeab26b43294f9c5bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ec2c645be46caf194ed7002af012622
SHA1aec64927ac87d2d1e195a4c9ce1df6656f6d50ef
SHA25632b0a7813718cf5013af0e363a147e3057cf9c9ab94654e377d5ba70bd769290
SHA512781d7c52ccf17ab9fdd3a21c15194c148ba2250e0df33e42b9675aee2ec08185adf9d0bd03f159193f0b86331d6196f3d39ae6ae84c79a03beae0a7ac5f41263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc08525b5fc5895065a380810b8a8cf8
SHA1998f369265900ba71dccfa96a169d4790eba8560
SHA256f7afdcf4ea379161955ec67cee18671b6efd6ac4cef00f96aa271d718951dde3
SHA512c8603a1963209a1b8a21ba84c2c935b15a490cb5874249b8aff969ec949e51b4f9fe39bf1aefafef4104d02cf5ef3e7c6a91121ddb86479146143473a6ca1583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509d515d4fcc1c34ea45cdec18b73e844
SHA1ac2fcc3398f456c387f44e88b5b6fd02bbb7fd52
SHA2567b2c01880671fd5d75d9610bb14b2f1d66cd9ca8e40659e0ab2b66a0a9c7b941
SHA5128846b21ed03bf52fb825a6aa95e13ae4494a1b18acbf9fc342060124391feb8de75f258286ebf7d2e344891d2256d69e2ecbb13ef11ea1fa8f12c27a3e170d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3442d033f41ac1149ec8fa303868cf6
SHA1cc6ecce5b0fc9738ed24ad938177ef9a145dc1d5
SHA256d15ade777ceff5cbba8d016eeaa66eeb63c6bded57150df4f2a86925c28e9c25
SHA51214c0e09520942fccf3b85b99f85a38a0a90f33a52ad519fa0ae340c64befa0faddc57196be4d81e2516c7e474091107434ad37756310bfff401cce797850fa2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59734c5168d3f62f6a7a747eeb19be7c5
SHA126714a257bcb6d728bb955e57268d9b7fff843a4
SHA256524db2e7c694795ecaef22435572c03ab260562aa7f718723819648dac0513f6
SHA512f31667b280b682df807279a3eed7478b4660740b7d31f93c54f942fdd94cf70cff0c99c3ad59d28a64acdc4abd2a4d4525e50b283496042aeecd3d3258a2fe9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be99336efbe56f5c9e1d0cd27287f02f
SHA1426c636ebd763c6f4f6bbbc9bc6c5d48c554a438
SHA2561e6fbb89bad9989c76dbca6b0f63dd2f5c982717a3f75ef13f19975abf484ea9
SHA512e0db178ae691c78653e9fd97f24e7212baf94de2ea5218967f291688bfaacec1fa182d5f1c97510d1d6fcae1161262f891dcc8e4072491dbf21edc223aacf231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e927d983b03b6a39f9dbb28c6a7e329
SHA180cfb6a0584dcedeb6da21614f372405b11c57b3
SHA2562e8512a7a068f7f87032f2bc5b1b11f17836bd8dcc534366e5edf21cef7edadf
SHA51287e23747f98a1f621f3b38f2e8376a05ff6041dc3f83be1c3425e9e305bdf7b10beecb9228199bd987547a246d669d35ab658f845dfe788c64579a10a5fcdf76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59492bae47467e42ac86d3f7e87c1c1ae
SHA19dbbccb5533dadd75c9279607d901a04529164ad
SHA2560ec5307857b0cdb24dcff46705488e595016f7041ca25b3c266907f15b2f7e3f
SHA512f7896361abf437309d7d07a6877276f1e1b748b51c84cb8f5212cdb3b6bd653553c8fd8b692cf072f3f0637caccc63bc0520fe9308bb6749f987e5b1a120c605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ee58eb92f3482b89eae00ddf251c97e
SHA17c323cd0988a78d660b044066f30d64f0f1b3f02
SHA25644632e1880f871115f55e1390563e961e85d0abcd0182140ca42c57815df6504
SHA51264796ab27f7d83a25c6edf6e0399357b9787b8f68696cb89a3c14f324ca7db22889675f9686d44280ae9cc05d9f4f5ee3940d97390d89aaaac45fd8e1ef1c1b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcb043fb0c2ed9c1a2b0eb1dd56e8f37
SHA1b4174f92c250abf06fec3f6d09ee63c30035174e
SHA256546b55126ad64f559537a58ae908a5398c342c47ef29e6f9b76310a30d0d80e7
SHA5128abcd514c3dc4519c0fc696830e7a6dde3bab2acd7343be9644cd7e61dcdb10a892d56d5cc418cba19ac76aeebd6a0f52dcee28fe7f71a4c44e9a42ccde3a521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5807512a3d8dca1aca244cd6b8b60ab58
SHA1b2bef3af7e94e9f94271cf93436cd8af9254f175
SHA2564c2244a53579bdf15ba8a306c7ec660e4eb20cd04c45fad9967c36648daa9577
SHA51259e31a5792cc148b044212a79555e9ca5c1f22ea9d898e5b699738dbe687c9795bfd55380caee6d09e28a522a7216765c50e9e3d2bb58d9e7db5e9673c40e702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5306e30252598aa2d84858de2f6268b30
SHA119bdeb9569b5190289ffff76d8249da1d7fc672a
SHA2565f45e446e31f6a56da3409e2cd1e90493a39003c25f94b6d82ec79436dabcd11
SHA51235d44339bf03fddf60047499b26f8c70eac601980f3598ed2dd43326466e78f760b61c04934ca3c2d3036938cd9bb82c47f128349d38911ebaab7800f206fd1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c12424797f9829fba7ec94b9515eeb0
SHA1834570ed90f8d1d15bb170217141c4c9bffbd8d4
SHA256982c92b911fdb4f6edc1ae5e1c8682ca8cd5561784a732072ca528033707b7ad
SHA512e66acdee60976ec56428478e5f37207bb6b52b16c354525180db5a8352069cee3d6a92c82340c125072b2a2946efbde459efb47f2c5ff48706d7aa0c8621413a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5084314b189e4b592ac71b6ac5dcc350e
SHA1b21d788e25893dc770848106b3b6dbf05fba1187
SHA256ded2a26fde5e61d830d28d16caa35710767004f19ecf7f6e3848ba670a8c8994
SHA512cdcd15242fdc278bcb3ebaa7f7cad68607a59e78f3db87bfecb8b72b69360c2be3f7482b13ccddf29b7c642030c27436b63cb8245939311124ae1b686ab26696
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a