Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:29
Static task
static1
Behavioral task
behavioral1
Sample
6900a4484b12d288d3ba2fee1aaea6f3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6900a4484b12d288d3ba2fee1aaea6f3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6900a4484b12d288d3ba2fee1aaea6f3_JaffaCakes118.html
-
Size
27KB
-
MD5
6900a4484b12d288d3ba2fee1aaea6f3
-
SHA1
f52c390ed1b972520e5a69a7e8bed7fc1810f2c0
-
SHA256
c882c4cdd9617eaf6469f2e5391068f246ff78689ba2f5c1f8452b70bf89b932
-
SHA512
166e600801c991d0813030c44cacd670ae0acf1dfdb3199e54b666c3e43d00673fe0830900112270c3de17a3bc5175bed6ba5a292e7b520d76efbf3c345f7a44
-
SSDEEP
192:uwHYb5nDOVOtnQjxn5Q/RnQiekNn4nQOkEntX/nQTbnZnQ9e20m6uhcSQl7MBEqI:rQ/Q3MAclSO55
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ccf3fa9facda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582443" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000952e3b218492deaca2b827dcfa92c56e1eff03b263e38b746697874fbc07b288000000000e800000000200002000000028e1905f7dfa9a13429029fdc696b43041db8075b5d10e254837cbd2ad127aff200000002a06635dc48ad193e5091f9cc86b3377ffd1711ebc50d606c0d799149a58c7934000000062edf7896b0265aa11e005f03fd11b8e794bc07224fda8ccb112adbffc4cb258bc3b5f6df8b286abb4ea159de9b0e478dc5cfb863a106d52788b1ab5453a85a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{264C23F1-1893-11EF-B587-FED6C5E8D4AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000344a3347d24ef07c27fa154ca88cd76b7c7494a55598eba5de019d3a76d7a619000000000e80000000020000200000005e416d3c7a4de42de6887c7d5d6ff2184562177938b2ff979bee03ba4fae0c1f900000003b20ed164a24fb1ed37084cf8badb76343231f667d6834c6270bf20a24afd6613d65d81474680465d02c34e44c88a08e6bd1b632903f34295d3540a27091f38142ccaf04a84fdbaa0aea0616ead9f1987d778d18b65a994c01d4e9e91988588e6d82be5cc230728417e31b6678110ece3cd87430273defaafe9fb62722b93c5630316e25691a64656cd26380cf09a63040000000cf1fce8fdec6f916d647cac9bf4a4b7d93c207a653e2d68c50c23f51d7499b72c1bc76cc7ff27b65a48e544fb286f15f562de0b43d2e24a8a4f8df132999d5f5 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 1872 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2024 iexplore.exe 2024 iexplore.exe 1872 IEXPLORE.EXE 1872 IEXPLORE.EXE 1872 IEXPLORE.EXE 1872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2024 wrote to memory of 1872 2024 iexplore.exe IEXPLORE.EXE PID 2024 wrote to memory of 1872 2024 iexplore.exe IEXPLORE.EXE PID 2024 wrote to memory of 1872 2024 iexplore.exe IEXPLORE.EXE PID 2024 wrote to memory of 1872 2024 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6900a4484b12d288d3ba2fee1aaea6f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57224a20b129bfe06a4daae5b4a9426c8
SHA16cd420b886999b8fa3675b5e5ce1247340a2bab4
SHA25607146e6416b19cfbddebe8d359b23d8be26beae8079e8af04fad825209008802
SHA512425df43ec1a44efd758662ed72fd25456c4647b7f9b1cbec8f2d9ebca74e421bdf106f96baf8f0d22e1e1732fb8b334de471a9338a0e32646173e157beb88996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a842b885a029f69b1f38bf95a4308986
SHA137ff3723cd9d233c62c081e2bbd93178f7ae1803
SHA25609767a568e11b7badf01636a226a2dcb8b6aa280930c1436e96cc21c32328247
SHA51282f31bfa83ce20b2079ec82d9fb147493199b1fe3adc90a2c957c0065a4b5f8768af77c6b9c2f54a6fce5ff074405d1fe9bd81127ece02842f6c90b2aede4a40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f568b386ceff96cf3020bec93ec0b9aa
SHA17cebd83de91fd4f289e72155bcdb04e43e7f5080
SHA25639fd9331a5a4ffcd9df5f499cf8d3878f6120aab379961d3931b999895231a5e
SHA512758435ccc5ab8e542cf0d36cdcb8eb6246cd309be93be2f79d840cf21d8300b8830752075a629dc8d3071cf84afa0b542b8aa23ae42bf6c3b62e6542978d1f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d5e2e08da4ecda1b665461e244701b
SHA18e7412cebbc0ea2fbc08a02baf7f8a43feca41a7
SHA256ee793087bd100e4a60945f2918caab8f24bfebcda8d273a0351e64cb26b8e57f
SHA51273924c57d5e3e6d2fcda6b7ccf4355ab5e20966d63f5827117234896665e6a13f5a9790c67eef45a984f6b5a72a1b227122a5f8fea39d1f67d1995229c22b10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a22546931a51c8004dfe0637e184a92
SHA181a8417a4c5d43a729ed42add26b44c94bd3258b
SHA256e8ea539e2eda3d21e83650495e6a4d1b9489c1d40316c99ac2147be28a0c7d80
SHA5127ebe50b4407f705ead21d44ab55640f204ed7d496e4aed91ee7d69c998e0ccd815e376027739de6710bc2b7bf2bcaa7fdcb2273d71be992e31f7c7a62ecf5f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b902e8265896e93643ca796729406799
SHA1e568a861ee132a7ecdb0bdedfddd8fdd4e23a534
SHA25647f2cd360fa4abd45dc1bdb1e87be1e72d4f9e91708000cbf935c388dac1d6ed
SHA5122358d95062214f7f98b91b57042cea21656419e30f59be8a3ae8f3f75cad68232e3c51bf89673d60bb315607fcbb82f1fcde192d170f931dc447b688ab94d811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551b61ec0858e252539b4153abe0006a1
SHA15fd88ac2015250127c69c574646505fb8e54820f
SHA2565406ba25fccd2be06b41f428f5847d2b274fee112d1435af57143ef9a925ec74
SHA512918b1d3e179637d83192b93752300594209e089547db15f293d27131989423a553ed9c897e91115bfd95677b3f9b21b1dd71d78b0b3e5fabccc3155af7a20a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1c37f91acff67bed23e4c200f4d5815
SHA1c0964ecc904e96d8b51746e727e9ba8fae4fb728
SHA256d57f04b48413b4be26d80232c7601d8dc13b839b1606ef5020f3e68c2fd0c7ea
SHA512a45d167083ec73d34253ed1efc90e6284fe5d979c99e4a9dd73a6b045bb24b3afd764420aa57467107f40ce77be54aadc2a7ed79097d894905ddef8c084e3d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ef7b2e22bc622e5690a4555cf2c5aae
SHA16e9930568fc77d7ce1b19decbe89e40c5bc0b1dd
SHA256174115f26e460655095d9317e50ff7461944867ffacc7c9cb3ffa5cb498c6ada
SHA512a215accc29fcc3a0aaceddd3b4dc7cc0b178ffa636591adc102c2fcf32cadc434aa15e462167ddc6b45ac7222789a0b84546a1014d9b6abbe694eb8a898c7a39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634603096c06235fb8b56649fe109abc
SHA102de381d477a94ff57414a9b1c4b6c4af5a404dd
SHA2563c053e800eaf583f758969a1c5f0404d19f7316245eecf3ed04b5c4b61bfb9b2
SHA512f788f7929981883a757d69533f38bfdb9ac59a13f76a1838b09317280f7e10507f20bed5e5b95738b703edfe0e7a2d5fb09a7be835ef88cb750564e77570c3cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4a23fc5e38e1e912dec8babfadca955
SHA105552e4b6eac8847b676723b9e69450dc7aeec2d
SHA2563cb17bd3c006613cd70b8f21999987600d9608b5dace999d2f4e00c5d711a5a1
SHA512018ca82c9403f4e46a76be2706411d23009dff7a6ddebb4ab5b53005277e27f135c31384703e38dc48cb7f8a87ae3fce2699a71af2d9f92c6d39934e7bd2e6fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b39d294612a5c039ca379d9ad0e3ef5
SHA1f9aea6b216854e502b9b829cf1e672401706bf4b
SHA256316edad235e105d085b7c6ac47f379f8277f33f039205888d34b9ea0c2c7b28f
SHA512056bdc5942a16eb7c193d672f22c5f3e3128e46529297180afa0011c8821118c1f8a356c1708bca3ff9b4777bc5b137028098e5a339b63fe26fd922db87bc0f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6d23425c3ea1259bce979806aac3e38
SHA10a4873786957b3152d6eb35da38abca945dacc85
SHA256ddfcb1f426ee40ad48e08882f9b3e2edbebd75b1e0ad92625d61fb3a42f01038
SHA512b4cf6429c8035c7b5ed73e8b35bf15bc4a9fee090feaffef933c448954076499fdbf34a0a7d672c65c410ce17591ae12f9ae77decd0d961f0e03cbc1623a0105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5158e17461ec835b4f8fde7a7738edf39
SHA1d6560498dd66b34cc9d3bc5b88ec8fb05ba4444e
SHA2565101c85cb7fe3e1b04565494f54c07a4884f387d07cde2fa59677b081a1b283e
SHA51253498aa83f9fdf221281bd466a8af99872a8676c59f5aa69cc3bc158d32c3eecaa2501226ffe1d73e5ab5c1169d405aa1e9fbb978d3600dc62cfeceb61f8954f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5ff69b429b5c7956d0067a49fd033b9
SHA13b96a8068dc54252602625b70186da92f6be991a
SHA256dbb15c0e94b3a216ec6cf26bfb042a33bdf03c06431c4870e7290c374ff7bbf2
SHA512db62e17ffb0ef29d7216c5165795a1d554aa3b50c47039cb3ba5e0fb6d75e4322ad364b6cf986caa01f6037287bd11a23508def0998572063a6584487162f97e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a