Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 04:26
Static task
static1
Behavioral task
behavioral1
Sample
6205bd216df16670c0bf083aa3ffefc8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6205bd216df16670c0bf083aa3ffefc8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6205bd216df16670c0bf083aa3ffefc8_JaffaCakes118.html
-
Size
3KB
-
MD5
6205bd216df16670c0bf083aa3ffefc8
-
SHA1
bb44236f5f28e11419b5c692082eebab6f9965de
-
SHA256
6b89153786efd6294e6f4d86365b151b6aee0ce399de78a8fa5922bba8c2c09b
-
SHA512
606a208a128092ad3a746449cc2f8eeaa7ed6e6b3939db6a70393b6b71339c3646eae661ccb789760c0f43dff543b9f3d82b9b860feeea4f34aa705278be2e41
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f037e79a51a2af7ade23ebece92f0df169cf39bf23aab6e71961580ba4a18741000000000e8000000002000020000000c776917c1c8d2303d04458393e11a132c43dadf2a414411ec711ffbd5a547fe2200000005158b46cbe3a6735f6a1736cce49ffda5f79fcaa56d7b1f435f415cc233357df400000007b29b7c3b40981cd01caad726df9f3fd63bb4fbfc928bf85565cbb3d1aeadc2853b234cee47a97a89f1a1d5cc82b4802f9d1047c2b7f174b4b5571afb792184d iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422427472" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000024e3fcee88d200b102bd9733e61b56f76a387ae9a39fec2dd96796fe8889bd73000000000e8000000002000020000000cdc0046ddd1150f3d172112beb12cfa12c1f09be468cec3ba53637de9f014eca90000000217fc69d7dfe7077f7959d2afa3a3db13d0121b91619d548db7ce40f1a66f0a9f4e2ba334e1ba61a36c8266bcceb458cdd666a8521f34289984ac9be5a7f296c4d89509811ee536e1f1e1209601ecfc766ac9287a810332852e2dddf087c4cb75a0e4020d80cc9891069a62d28383f736c8abcc06f63f8cb00f56bbd3821ff6acbed0cf656093ed20b5552bb6c7fc8424000000041151eaba4d2eaa42f89d6c5603ec4bed9962f738d023a0afd7da3a02db669d56c8aa87336810625382bca41b1dae771aebbd1e1ae9864161d2e9eeaeea66935 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506a1c2937abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{545C4871-172A-11EF-822E-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1504 iexplore.exe 1504 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28 PID 1504 wrote to memory of 1060 1504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6205bd216df16670c0bf083aa3ffefc8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8f28574bff9297de1bffe3598730f1
SHA160eabaddf4389e20d1baec24bc9917701b93aa1f
SHA2568cbb12ca845af39a664dbb57b38c99299ace9ab7acedf797efb288c16599fc6b
SHA5125bf0cfa66ddac6ed4f39734c4311b716024f9f92814bb4a7d5cf86beaffa7bdac87b293bf41e9e529bb87ca9c6d395bb2906287733f173edd40126a5b485999d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f854fb0efd7cd09dc210fefdcaaee00
SHA1f8d0066d92c5b195789240ef84fedba1aa107e7b
SHA2564601f0ca8b2316f9dde2ca357ce4b0932e69429f9c98f10ac55e553dc1768778
SHA5129ba2cadc7362683cc1205d2d6c2487a491204d8b60a6337e8545953e5017b813a61ebb3ce484b03517243f6595f023c2ab8506f73cfdd17d1a440833bbdc986b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5390b9d9868b15852495dcc98409ecb65
SHA13d9fd967bdfe03f4fb45ce83f4d8b650dd835ee1
SHA25614167d3526d02548b02e725eea0dfc223e82f7e3f81869534c5facd2ca6230f8
SHA512834f5ef7bfac363e2169dddff7e82a50baa715208079e355aa79fdf5118e2ce11da31e090ed2129591b31b8582d83cfcb0ff7e5e0a0fd0c3a4c2417f2f68b995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59eff73b7b0a886c05516a684ab9b6c8b
SHA11442c76bdf32363430f72b23f8fc49e23635b09c
SHA256d8538e71eb49eb0ee2144b3ef7f24eb4d9d07de8da36cc1b0b88312f5401331a
SHA512d645b05672aa9901fcdd712f94c0d8eb4f1667204d193554b9e2a8b00a0578cfb0e73bf914f50f37e4b2c88bebff1d2ffdca178ac2c63d1292764bb169f62de1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59826cad4b598fdded2f9ca85e3fadaad
SHA19ee432d5bb110bd75894ee4c4201a57826fe09a8
SHA25614fc090040ab2ef764eb15bc037950e90658a33726d39ed5e8e91d68ffa58583
SHA512f5723bd49eb58ef8cbe6c1115ea159a52bb11c2f2702c760addc61787a34dd2ca7cac904086a01d5840170664bc674b13845a9459839215abbc1587ffe486e7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6241af910b18dcc1044cd2c366886f5
SHA1997c463b281702e279639b403e92af0321d774bb
SHA256c62504ee61f177f908760eb86618cda6eae1894b373e899f5c409a335496a29a
SHA5126c78caf4172ceabfa07ca9a18829532cd974943ad7eaddb1e35b16f40e03dcb801ce8b98081b3424ca56bfcacf3367bd7bd5e5b21d3fb1e2a09c6449a732abb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536c800b21a281c1ef1227729d925a974
SHA1a75aa49db5897623fab2c57a091046f1f280c603
SHA2561699546041308a90b8add82e89ba50ad1145f5c167d8510f74e5ed855f89337d
SHA51284fb2609afa990fdd3ff786fe419df2ffad9248bfdc98fce21c62709b1c33c4ff1ba2af5b82691a2e91f45e223567e95815bbf57d47172b79458ba316f1485b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f5d87514c5935953c4599709190ed7c
SHA1f62e5bd3eb3143b186945f73a95e3863281626e6
SHA256f5b1becb3464754dbdba80d1070154ae99b7a9cb7f51bf91393977fc07746f2b
SHA512265177dbec1b351082830cf791c2b5539b0d473771a8da79704fbf203a0b5586d3d385ccf63c23bf16617c1bee7c9c7931c64ec01fd0ffce024f2dad47ee4c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fe2eca9a834fd5097bf94c3b1442396
SHA1fc73f92ef66c314323e3963bd7e29d17f38dd8a0
SHA2561c3866341168cbc5b70a392c511ed1bc5cdb9bd1e721461f9c2b77ab181f6d8f
SHA5126ce5e59d8df9218f88edd8fcf534bbe9e6dab8572aee943bc74c3c9a4c67f411c12662fc4b8420e10efa4d7fe0e11ca36c4a100bcacbdb3fcb3a94b94600995c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542bbeb8886d5fdd445435a5a82eac9a9
SHA13711aedb082e9019caef679709a80823acc0a7e3
SHA256e2fddd1ad673b5c486fb1576a9f1676fe8cd5491f3340364fc8595c3502e7585
SHA512cb82f536c187463df2c7a909fc06bdecda0ce2ce23fce4a7ebef4e69b0c865e2a70fd2e515a3f8b2310722c68198b3ba57593fbd5c628a2881011b9ef3033758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c5f9541d32074df891fcc38e7274c87
SHA1e0b6a5360bbdb26b2593b50a6ec21783847c1bb1
SHA2567e8b34608ef826147fc889a2e5491999b6561a1215cc4ac77543125f3bf5366b
SHA512817c30ab2392f4556ba72a6546bd9af0e97484122ce08e7915328af061321885270f45eba39900b834879df7ca1c7a1076254c7c0af98cef73fa3bbadddf9aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57721612773d28b612ee6eb781f702bc1
SHA120dc70dc1a3b062062f37d3f6086aa2b07b8cd00
SHA2567e6ee044005c8a04cbaaf41a78034ef2470b0c24fc984af8e8d5aacb8516348c
SHA51267443b401a3fc0dbfafa981bd9247c4c45a548655f20075859363579df5d418a794c961e89a1d40fdf32ca42771660f060805ae9c40a8949df63a57e55214e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c543952904e0d0fe00add7157d6804fa
SHA17b4020df407b07b7f70a3a9c968860da6db1a371
SHA256b9b8ed2c0483f345f592835b980f127c670470b1cab4c75aa88fea0a674fe248
SHA512182ae58239adba81a62b7431c386b54209d50bbbd3ca3028e40c45357c76f8b3be7f111bbf2867d33d5d8a947fde8cda40b85e4f1277d92743567c7fc7f46e43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a07728ec533915f810b5df59943cdbce
SHA1c01f84dc4429911fda9dbf8c0bd0ef1717334baf
SHA256ffbd5fe3c7f9e037ca35949abe2015a6b0d71b1cb8ebc295568a2a005d82ddcf
SHA51260f9a21a4ea6f29f9433b04f71eec9b25d10aaaa7dd30cff2a6d6e3df91d8d2a499b2db43e5b90daeebd8081ae292d6d6e65a8a1eb52dd5ee04b332e40406751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55940a99606f4479ac6abf42d9c88660d
SHA1a5fc779e0125bbe6759424554451cbaad10273b8
SHA25676b3460cb096edfc04923c431f592d258f7119db6f8094580a84a92e2a885f0f
SHA5126b33141684b4f52f025f5b6a08a630564eb9c5471e3dac69f32dfa69ec441a3daa763136c38faf1ebef9b1e1cec8ce34dcecde1f02eaa8c4dffbeebfefdd0a4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55005898d683aacd6eefcac27a2d6d875
SHA1473e774fafd5356243451d021d447706ac39ef5f
SHA25619ac2ff585ebeb0acbf85ff5cac7d2c1f89da8c948707cf23fecd9b1e4c5aff6
SHA512d1419efff9f308c2aac97c6de2ecc61d10281dc08c13a73af7fdc690db779a6e223c738b6f31aae4c67407129d5b8c20d02d628b88e4d07e0477c7481f0095c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf1df80a01c8c257cbcba87c1c67197a
SHA180d91d3537f56405215fe72de08d6e6dc83fe6f1
SHA256401f367a0fd0e323ef7486bff0217367bbe7b4d2b8214157c1401cf042f4f7b1
SHA5126b8464f7c7fbe033305b902fb099112b93aec82228a1224fcf4bd992994ae93de59a25a4c71811feb871fbcf99a718076054c4be3ed8eec32cb84076b9170940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44149cfd75bc802e32390cfa1d1b9e7
SHA133ac16b13b58e5e3bfac66222ed34d93f0bb4735
SHA256839601a3ef9964b3cd7ed2ca39a8aa581af342d17815c190479b20b9194c0c0a
SHA51267553f7706eb937d3e2a3b8cd4fbf31e5f1d271b4b784d39a980abcd6b82b3b0f3d5df1634d111143387272f117151db479f6c5f2e097867b390d01cbc1ac4af
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a