Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
6809038562cc5ebbfd1af67dda737eba_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6809038562cc5ebbfd1af67dda737eba_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6809038562cc5ebbfd1af67dda737eba_JaffaCakes118.html
-
Size
30KB
-
MD5
6809038562cc5ebbfd1af67dda737eba
-
SHA1
2b4c14f44cf9e41e67a8d0df7562ad3e667d9381
-
SHA256
b0241050e9be26589203a22349b1ced9be3d97a42819697162cf22694971a032
-
SHA512
2aba5911151225efcf14c469443b822ed6ded264f99b96de752ac633dc0ea8161c537d699c553094f1a7b86dcc8b84d428a023a4537482f5c73e65dbb94780b0
-
SSDEEP
192:RWioST7b5nRnQjLntQ/znQiebnbnQOkrntFWnQTbn+nQ2aVgc9HMdnFnQ5rnYnQK:oioioQ/dbVgOOJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cf2c366dacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000715d958816cf1147a452f95bc9a3553000000000020000000000106600000001000020000000488c081ba9792d0b81f7a63ac7c5e7dcf955356b7d7edbd82acf9d440b26da1c000000000e800000000200002000000001f1c9d66745e3f34999d20d27626ebb908a07f74c4d8186f931e47525a647e620000000ab446d7df78c172028f396febbdc38a5c2ad6c74e39058b25dd880ef1dc0d3c340000000e1ad4726a23ac8f0aaef1b25238ce93e9fee84fa3ac80e1bf09bcadc1e62c4356fa9f68ca62a71ebf8816846120b75128a6636336c541ec4c7e0322f2388674a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6173BA21-1860-11EF-A4A3-CE86F81DDAFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000715d958816cf1147a452f95bc9a355300000000002000000000010660000000100002000000027c05325c68593e66e1ea91d52858e9b113b264572347f3020f58abe9d26a775000000000e80000000020000200000004c649a7e136492a183f453f2ebd74c70c2421657f94eb580a1b54db044f0bb1990000000c692483416fc769e759e2f0a20318311ded7986b3ea415e91ac017d35198f404e4aeb38f6205bd86b04f35c07471b369faf6461c27f8e9f27438eccc19f468fa4208353e1293efdebfae215eda22dc9b622cb71458e4dc425018358744e77b419b059b8746b9bb8245539e04cd846d9c819a6b36dc4ee3a706e48d85c6eea950b89bfa51c37d110d83fae907c7a1c2264000000064ff65a4c34325c0e5530c064e9f3116b33709926cdee8c684a082de5fe5f5504969148c539eb144eca588df5598f325d5511306011ec2742bf1f66e6feb5f0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422560638" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 1924 1844 iexplore.exe 28 PID 1844 wrote to memory of 1924 1844 iexplore.exe 28 PID 1844 wrote to memory of 1924 1844 iexplore.exe 28 PID 1844 wrote to memory of 1924 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6809038562cc5ebbfd1af67dda737eba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec3ee849658682910cbb1ac596abf90a
SHA18a4071609f1af6ee8ba01e0c7d5c2dc81d2b485b
SHA2560cccd3ad0721fa2591cbde4855a7ac9c7dafc28c5110157d6193f79e13a334bd
SHA5126db4dd571b7365be3fa1dfd1bdd45acc56be71f253c5db558afaa7a5adaaa3fc405a539f9a8de6e41a1fe4936f37a5c7c7073843214995a2e39fbafd9efcae55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6df363306f4395172ed5c7ba1bbf3e1
SHA13f6afb47a7da501947f70b206ce069a8ad41ce08
SHA25648f3b7eee857c684349cbf92f8566b3079ecad0d61919785e1309e241a6d5530
SHA512b49020f65a3ac238c13287e608a225cbdc39f800ce614906d04c1da2a1bbeb0844204d7e92fd52044e7e80fea9037b19d9132ec31a7a4031a364997057024a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afba85d2db5b8a1f75d82ef70a2164c7
SHA14885c1e6e24d7aec9567ddd3af246d28aafb01ec
SHA256dc9b82279e012e00c7a47ef15e117e0b97eed2d2b88168cd293c853a7e03aae2
SHA51213427d6e1a586eefe94291786f262b6c2abe9158ad3b7158fb29cd87d7bc6af42a6cfe6395c04a3fd23c267fb3edf8d6f601de0595c0fd7b3169a7fed59aa2e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c40c31a76ba7045e82a9c39c1de83234
SHA13776c03e95fad11ab890e7c29348a677d077ab66
SHA2564ddf312948bea1c0445181b98919221ebd192fa1fb1a6da4070d20a432ab96df
SHA5123f0304050feaf75365038b7239f22a4ced5b56d540f82aa61968a1a569624acc41720ae580356ef09a26c5b566933febe03ba55960192c65ef3cd8ad74823fc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c846931fd8265ed8fa096440332675a1
SHA12450723b72c5509494a0e74085b5e39450c18d8c
SHA25639c66015bdd3a6aaa129ee6250a8ece8c20f8573bd4208c3fe5410caf52f747b
SHA512ee5a52b2cd20bd023660286fab0e9d0e659e357517f410738be6e0ab4ccfb2fded02835c38b631bdad317a4a555b8083711fec78edce918fa6a4e0ce69db64f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0ddeed2916da237eb5d9a30a88e82b3
SHA1e862f68a6f2c79f8b04ff22a7ffd8f2ec1227809
SHA25687dfb1758dd8530f67718abd6e32b2585a037afc0aad58052e1485faae183790
SHA5127994af093a676a35f8a5cd92f6dac4a1ca4912754bea0a8b8625f1d91a27a96b6fdce0acc2972d8bfc3fa572179e8e2f4fde607122fd6a485666170f92c95842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d3b380247250eb0b70b4ab4f9670069
SHA1f458ff185b620591837028e32cdcd86bdf382954
SHA2568834a3b7588e5ec6b44113cc5abb141d1d817b48914b3ed3ba5aa5ee595b9a62
SHA512761221824440e1bd89e0a35a50100f3ea809bfb9085aaae6a226790a6ce8b0f5d0f8c78d6a2f1a42133fd363937fb15cd26f74fe9def51f56e456d44533e998e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564b412f33b3d1d3f608f6887718e6a8c
SHA17017fc4726cc2f8adbf4732303fb4381ad973dbf
SHA2560034aebbd9e362b7ff19175e1c8655cd65e204c094d57fb2ddfbef18a4fc1b27
SHA512e51e4d671176800c7b70b5f15698bd4c972ea5de1425a2b7875640f4f1382c043d16e35ecc1b4e1cbf989b7ddd93bd5f171fbb4dc1f6ecb7b456929988c92e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5d645f30baced575ade8378251c0a09
SHA19108450eae31d5cc47f80bd80b0d59616e0b5029
SHA2565ae50e5cbbe897fff9bab6fd9990b232c5705126707bb0c15b02c5954539dbb8
SHA51235bee66dddd0edb12a5c5cc5334cfd1df87e7f28ecae8178f4f125726f9392712c6dde02e5d0c32dbbd9287c7ecdfe4d9e20d5221ce7733cbfed41b222bd5cd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a05deed507c55b5b29d410610083af0
SHA1d930901903d1a069ac868acb6382cc9878cf956e
SHA256c0057532914b799b95650fcc2bec2015b2e913c1014e2c5cc3d5c01464449475
SHA51265be458f4db8c7d93d8ad33e3587ffee3eda73ea83c56337e209bb1e3a958090039398b50cae5ea83751e60ec77bc88fcf2061673f7a097f37e1368a1f300e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce896ee45c52c33e381d239ef9e96c65
SHA1921e202245d6276234e10d4f0ffac6e3e99d91ea
SHA256465d99c34771d251478f92e9d8f342a704ea1aae3eea881e8b09d227fbfaddbf
SHA512cf7d5878d25f17c7ff9a8f45cf964aac06cc47011d2626cf428d7ec43518a8f79f9ea97384f03161b9dbf2aca7e7d40dc86c508e12d5b60da9c12118ce43d2c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5038cbfffbc5614c941c3d86a6d8b49bd
SHA1dc4a77dc04b29dd930263c17a111f69e05f8763d
SHA2563a6f4a7384778c85e4ef47a2b522a42ff692aa277188b944e781ce2b0cdbeac8
SHA5123f52e1715bb915511b5dce308f80c85fa000b0bb2306151ac31a2ad36947da5dcd71e1aa4e968a2620c0a11c775a08891923cd4263723f88f41538bbc3367f13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbff6e4aa8f7a337c6731e4a1023513b
SHA13ec01cf6d482feedb9eed0e778dfa9429eccaea2
SHA256e536abb4392f99d1c9aaa340a506abf4b86bc98dccca447c046a2a620543aa46
SHA512963fa9e1a6eb9579fe44e9580ae06b452978c495b3c766a3eb808f961215fdc7531af50182f46bd65dbfd9fcb6e775e300f1e22f46ce681b104d2a38c6cf7ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e4bb7662314d737b4a03a53b01a9c30
SHA119c1770f53b77b47e45215141cd475bf46d9245e
SHA256f6a21fd6a5116b7f73f596dae52b146e39058096f08ec4c1910968a8cc25dfb6
SHA512ea699f2d36136b4b08ca24791406185877631e5178a7550b34fffcabf97da127c4d08140df8625de354fb452e293d9cdc3377e8653e10924668d8703b680c8e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf374cad145d28a64c0654924628bfa5
SHA1568bcad7d0fb11e4d16074a5c2ce070aae99f4c2
SHA2560a3a354ac74c6d8e06f19cddf1bdab1caf052c940ff9f12a2ab7566f573c142c
SHA5126fa908b7c2d9d342b635cb724969c64eb448fb0a12288392fded6f5edff298feb851e20a64375fcee6fecf7ed5c4044ae2584ae77c37e30452afd930c7784444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c1a9d8da1933c83be2267050b950e30
SHA1feea5237fadb69c9e2ede75d8657e5f6284617fa
SHA25615b8f7370b3373109eb97e1cbc8a93ffae31961677a58b936992af40ab99c4fd
SHA51218e7a6f8eed1dffd7697179c67097dc98f686bd6afd4896d908944dba70fb88ca4b80390eecb660d011cd8808315e64ff31d4b4159e080ea1e011ce58f62125c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504e5dbc87d71ba44f91675efbfc0d2e9
SHA103795ebcbb58ac26e57143b46db7e7d59a127dd2
SHA256192ccf3c8d70958d456cfe67c8c0474c98a20b8f88df0cdc6b10492045bd43b1
SHA5120dc851d1dec8d317d84fe85d7c8c635ba49ee7b8008afcd5ac026625ac943bacedb59bf05652c5e6d8efb635b41fc6388ef3d42248ccbc99534629a778c7e8f7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a