Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
6480fb699cef5146eab51ac91fdad238_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6480fb699cef5146eab51ac91fdad238_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6480fb699cef5146eab51ac91fdad238_JaffaCakes118.html
-
Size
22KB
-
MD5
6480fb699cef5146eab51ac91fdad238
-
SHA1
85ffd0eb066224a9caeaeba1202cbd9d9d7dbcca
-
SHA256
d76646d4da627e759eb2a6cce5bb7d64f986891836bee2afd66510838abc50da
-
SHA512
f6cadf7d8aec37b859743b1ddbb70c8cef6af8c6fc4d0144b66057e1a7c77d7d475863205b2a981c9c39afb0fbe3c85ab2786c3f2fb518e50a3dbcb85c460c84
-
SSDEEP
384:0SeHRXXVcPwEpwlgiphzk9hjdrdoK6qQOaqFWiyEypbHwh2fXS49lkPT8OqcFbYA:Sk1pwlXphzk9hRrdoK6qQwftypbwh2R8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422481971" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38E0EF41-17A9-11EF-BADF-D62CE60191A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806f650db6abda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006b807be9651e687b8d50a178a520927994c5399e22052ff487f49bd0b72d130e000000000e800000000200002000000064f026b1e830cf10e378f050e9dc90b92f2c4c7842623a4acb8002f1a99729c120000000d8a8fc878fa136187dc49bc6abc9ac638f5c59c951d68a1959dd5783bc3703e9400000003385bf8ba717f087deb5565e16c03425342dd4580addfd2310ad1a30f1b3c3cf486ff03030531abe563a3bf5d811f7ffb434dd08dcc0f940b0eb67759ffd31d6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000050e767105c33dd6e26490abfb81f5ac2f378a7ae56850d7e87721417112ffd4b000000000e80000000020000200000009a4d2b69d24a01ff2665c70961c515f84e270b135464afb55cfb3d5f7fa9c7b490000000c9db2a8d917af3b862950f4a552a697073750cc5c8ef5babbf541c0c75c934f54992970cad3bdd6111873d3ebc072b5458089285e59c186c4ebd9938aff602a045ff96af6b3fd88885a6df8029e17ff0242b109c58bbef948fc048a00243bea43117b9840f200c5c63a1da61f4762570ee4d4679cc4ec6086144769ef21a349e38ddfb8e8458d5e98ef1475f57ab742540000000af3b3a9d3b8bae267566222db63c4dd130efa91a007b7b6c92fceb9e4360b21cbf0ee9fa708ab554cd308f99549cfcdd186da91a68f412e689aa36f09461dca7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1284 iexplore.exe 1284 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2164 1284 iexplore.exe 28 PID 1284 wrote to memory of 2164 1284 iexplore.exe 28 PID 1284 wrote to memory of 2164 1284 iexplore.exe 28 PID 1284 wrote to memory of 2164 1284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6480fb699cef5146eab51ac91fdad238_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e25f6909a575a901fc8eb2ccd48fcda6
SHA14480486226d558db79eb2d69b2ef75aa7c9dc891
SHA25677d9df81f90bab5e9e5c6cfa0f7c28e7834110f5c67d1f974b778850503a59a0
SHA5126c722bde98640fcfbdda80830162645ac3f748cd9346436b77d1d3fcfe9879793259e92bc27a70c933b0770645bbfb79ea93283b657eff57c5c47d36f493ba84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a81e6077bb93cd1b1848a4db3996172
SHA135ea8bbede50c7d67990d359148a0f5fc7f54c5b
SHA2562f069aecc62f753fa089da312c57143c4b3806daad336885d8186c34f4297705
SHA5121b3bf15c8836466208e099866aeb8402d1073deb3995758a2167992f533aedad8c24fa3cf59e999bc004130e3df15c3a3b6a8e2569868e27878100d0fcb65902
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52281094ce2d7f494a1730339be80653d
SHA1e9b38d8bda838ba7a91526574e4d21094fd8cb98
SHA256a5c653e421bca0600f62958ee23aba905b1c2dea1bf4049d3d316860ebd42797
SHA5122e23b431b1f8c2f6cbbc9c131ce6ddf2b5afa7d3213faa0dd9fe7236f22a12972c47c6d4a04d34ee2d5d70f98b8bed6bbb00c50e80b899e18d925d63cdef6961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5192146c86e5f6fc2b6697f789824c525
SHA1c1c9fe3933fab68e4db3472c275b351baa380d2b
SHA256968905e4920ec2fe60864f43c77cc8752b4d3c1409260fa674c5455fc33489d8
SHA512c678c5190eec778ff19f2d0c1d1ee630bbc305b99356760cc3ef9a6d08f8559300aeab60c879afa55798eb5915169dbebfaa78bccb46debaaa3700ffa11ed321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cc8b98b2e6672b76511814b08bc2363
SHA19270cc8dc4ba4895976a1ccb9c72e397c306a09f
SHA256633e0a1fce03bfbb13b533db0880511c0b9fc851a2b9800836695925504334fc
SHA512d3e7373d3ea723bfa1da48a3ee8f72cf2ef78af46296e80b058058752f770bf2db80bdb2177b9bcda82be10c3bf8a2bb1049b646e578d8bfb932f0b4d7fda286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f200a3b101adba3286478773e25f67ad
SHA19b25b02db5966f43f2e166c4efa69be4c2a43b14
SHA256e330cae1f505d531e440e4ea0188c7133860e0ddccedcd3ca0b3154a46798bb5
SHA51232d0ffcb90a5f7cfcba346d058897279100ae47f2c8000dd904f39e348e9dfbd88496f82d9b03596d999d3928938a89d3b5fbdee845cea29f61bcd84ac8d7ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57589647060935f7676e65c5ed31b85ca
SHA16dcb52ffa0260bd0d04cde39a06828ce19dd5f0f
SHA2568e843498f784bea851994d8608d9c04cae3f71d7a048cb94934fa2618525e93e
SHA512964e64a83e0fec701e093465e27a8e4edc2863d92df5a9a7b257505b6afb28d50cdfc29a17850d691d55697d17b4af6a529ded62ecc570926d024e0ac61983c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7abf632faf2abda101593e53585863a
SHA195a4e09c15d330acbe350517ce2328bec3feebe4
SHA25621b539ef0cd10574005f8abd5570b734ff4917297c1e4e255b774153283936e8
SHA512a9e15b61d4411784db0dbf2ac1baef6e52eeac073ce5e0a484041d5135d1ef73c38c48613877760702651d702ff100c61687a2fa0b3025109a910e28bab89750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a33e7aaeb6bd2b50e3abf2ebd96930
SHA1403f7b1ff75f3c462f06c47c4a94f9b759dd9b72
SHA256d99942c7b7f0a334bd852affcb8d63acc5a92be9879af443000b279b1962e4dd
SHA512c05d83f62da3578262ca6b2ddc979f18aec87fc1ef6689501c8981833afcbdeeae8849ec1b58de070a3f3c75cf571d78cd1a38e0352b7f804bb29f75dbba9516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5780b7c9c2c1bb6bf1bbac331ada93a32
SHA1f80c166d237793f15cd7d46296acbd3eb80601ab
SHA256a475b836e7df87b0ab8e40421672b188d0114e5351a11467239740a36b012970
SHA51288afa1872a6647caa110d93cff2351f50ef17925d0ff2b5e2133b9cf616c9f8a5b1d23266db10906a70133a06c2e149d4b1f6c893c1078fc60214f25c33ea099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8454e81a159cf607138f0196756d433
SHA1dee8fcc2cbab20daf98ebe0c76745c559344feb5
SHA2567bea67345c98fd642a53ed07b39dc7ba867da52eb6434727720222fa52f9d5b5
SHA5129a4a6c506674a3febb07874a552fa305c6e653a3039cb8effd1f0eda761e157b03a7ca94e0dbaa2d85020fe6bdc2f252515acb8e7125404ad3c55559876ce127
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd50dc6ff6ae5800769c3bb95a7cf9ac
SHA1f0d2cfd8728d54d41f7908dbde3a8ff95f516977
SHA2566c237518698270fd26d174f359ccac69614eb06909068b25fb0f39dd2aabc89d
SHA5120cfab72286554fd8d0aab01a9aa5cdf6e8b9fd2a6f48957f52d78215a64f3ae33ca6df0516141423e040cfaed7175b8417be39dcde1263b38f2699255d45eb88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525f50f618b3e25a4ba9e7de358539ceb
SHA19af9f2291ed15c804cec59e50f6aba5482ef2fa9
SHA25659599e8103f4e7e007a03e6a34166fd499dc9a5f8e14f59f704b52799b953bca
SHA512067a6c8a782e96e7a54964f3b9f586526e537fb6eb03479472996c9729b547385a661e91e3527202c2112d64542ed7c47a2985fc9a98d27355985eefcc430463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5489e90ca7f60bc9ab891b92bd9f86917
SHA1909fd01d9df659f5a464cf795e4d70c8d4c4df31
SHA256d2c99e2bde5ebfa96df4d187c94c3be0ce2051be8d5e6296f2a3ea5066e7c595
SHA5124850c572e1f2f7ada5b37f56eccb6dae0bcd302f3e3da417b0e3b27d0f0948b385488f0597afa5981a48c3583376b8923131f13c2506cab10ebdefca020e41b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57236134e57b2222f454bf334170ab6ee
SHA19766e7d32ce628b52d1a39a9554135339d4ed576
SHA2565223d75b9d2cd5e80596061e2ea0255920af9a9f6c4c60c34cf5b04648d0fc1d
SHA51297b39685f33d2ebfda2ca15ab92f9b300f0aa10b1a6ac719592a18dd7ffff93076198dba786e2264c236364d51f42245694d10e8cfcfa2b03cfb192f08c0bbfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5811aa6fa826c33ca3f38795020bacc53
SHA1f9bc0ff0a3ef93940ac92d3542bfac2b63a6f028
SHA256aaf121c6279baa50d1020cbb199b139cf37eef3322f7f576788c7349186ec6f1
SHA51261c7b2b1c371aa26969dce7397ec8d016ea943c8257f57acd84447220be0c0ade008fe08739010a481a85126a8629f60473a747c5683c77a615cd41b62ea94eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5279c12c603e6f848ad6a1708ccf9b077
SHA14452debbbdd6b550cd5e02fcab0f004e8081d644
SHA2562397e12fd7c6819c41f1652dcfb6c175a52ed6d7687fec0e888b0bdd3a4268f0
SHA5121f33f6002c480343c1b453da665511d0fb8efd66ca63bdc64572e98321f9ab62112f4c153e24bc89ee30530e5bf9d4ccdb759f2df490b5cff19439f084c466e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579bae9a96186751f574f72290897e5bd
SHA113f145884900f0bf83b61491d8f4efd965efd843
SHA2562b0ea0bc4a1c44ca5363483b9ab3d9d372f4bf1878782de95e302f77ca4fd28e
SHA5123c6e6a4f2b3f326f3c7b457c25121ed82fc08851fb10a552c6bcd1edebbc23d9ab3238e3fa96e3690ef927c66173cbb44c397ae3932a37b9b857a531bd6eccf5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a