Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html
-
Size
102KB
-
MD5
6870c68ad422be05ed753383c8feb8c1
-
SHA1
0c1e9eeaefb58fa4d36c5895b2d67635f7f3b7d4
-
SHA256
b456a9779de9f5219d049586e888754a51e90cbad4347434ac0919d685d2a86a
-
SHA512
9a07fc03650b3ac3c0d82df9d01f80ed3b5fdbc024241b9eec574cdf8778aeba036b2702db6cedc9830c992caabf84cfa512f3870fedc7205d75aaafabb3b288
-
SSDEEP
1536:sUBAgwmp9nsD4WWOtODOV0XONIJe70i5DaM/IlSh7:sWwmp9nsEW98qV0eNIJe70i5DnIlW
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FDD9C61-1876-11EF-9449-6200E4292AD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422569953" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2348 iexplore.exe 2348 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2348 wrote to memory of 2108 2348 iexplore.exe IEXPLORE.EXE PID 2348 wrote to memory of 2108 2348 iexplore.exe IEXPLORE.EXE PID 2348 wrote to memory of 2108 2348 iexplore.exe IEXPLORE.EXE PID 2348 wrote to memory of 2108 2348 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6870c68ad422be05ed753383c8feb8c1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD56728aea2631b86a76c237508d8ba9b55
SHA17a670f95cac088313f7558869162fe01c6dc0ec9
SHA256e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568Filesize
472B
MD5572ce74ba9e3f6ebb167fa9963207f6e
SHA1278aa8ba3ec53d91fec84d2529ca4248007d5b30
SHA25617520108d1756f8ae26f0f66aa0b175d9f29e93339c4fdb67d2687906e3e917d
SHA512fb8420b98a725c41301795fcab199e6bd8fe66bccae39b3d1c296058d4be49b6eb2dc5a48aa4f0ce62424c13cb16e0672af381f3834f35b25de6a88010e7a9d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5e3692f1ed44eb0ae2141fedfafd112ea
SHA1ca8c6920aa33cc14aca2da6a2b297ed147baa6d8
SHA256447f2d133950413e5b2f5b7c91f17dd72571e1b3f6d5ffc2bbaee4c875945c34
SHA512c75ba4c5b5249c19623f0e62028d522e80f27feb2a18879ded64684871a2a6f6ae4e18d22c136fb8a22f38cab7566f32dc7ef2d8629c901ecb91b0b39e2bda28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fe770377297a0854b5d3be768385d686
SHA1a5747da0608fb868262af37c193fc0cff371cc67
SHA256f681f04a3c7c2645e1d8dc2b2deec5d93869bdfd3c066409c6a437bffffcf135
SHA51263af03f6bc41397a351880750dfde27754528f8d154316ef00283eb04ce0df87de12fea51aa009d67de1a90bf057a9454f9ed20d119b459f5ce8c81bff2065e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57e781116392b2a5fe4db62402e7c9261
SHA1325466862d9d36b60bef7091d3ad40a3688ec18c
SHA2563e4885c2ddd34b9f5365dad7c0c524560e05a6a5c3a88115706665d760333196
SHA5126d21cd80668433009397e95421eea81f54737e14b28f806930864fa388794bfdb9aea0d05bc4d475a83666e3d9f804a3e4d5ba2b32dc3efb4a6a26d73d4a0835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52ae7593194a67788600195f695446feb
SHA1c8b23c7069a0c9bb7dc7872160ca7e684b67b63d
SHA2563c9bced4b2c2146742a532e746e4eb5e4c87e8fd8758eb7d895bbbfc6d821a7c
SHA512539619d22ebcbdfddfea20e2c578aa2e837e9073849047cf8de2a0a0843f3b72d9cfbbffea29a03636bd2f9d59703eb17c18c9d7715add099df9b618e40c09f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57c6d3539b0e365ae6fcc160deddfc5ca
SHA185fb9802c4e721cb6a77221ba7a795feb9f8fe81
SHA2568cc7530a413dc3dfa28b9951499ae7f1b6b0e70d6e5d14ac3309a0653692369a
SHA512418b910dc7ea97ffa10c2bc8257c23400c7cdae7f948b685786294602c161a8d80a17de886406611741f4e37ab3a9a07b913a666a5122c2f2c7678d126e5cd12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57efd267dd557e4e7875d3cca1e1b8ff7
SHA12120d2bcbb1f51a73bc08a71f4a2bae98078acc1
SHA2564509a633602b0c5e36a41001a8b6825ef024499c67438f99b977b941951524bd
SHA5120e9bbf6d45be4d63b86673185c71fe42cbcc46c0c385066c09602d387fe9fea625ab06b5273283f155c19208a572157d6d1f4b86450e09be864ae265474e6e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59e828fa8764d801303ff213aa4ae17e0
SHA14f015f77d892f64a67cbbb0f66282d248d1a0f46
SHA256787aef60968336ab9ae14dfe1d23566db90025798603f1ac65ea50a3d44ecd77
SHA5126d1bbb34cb825836ae51ea68acf07a7acf3836e3d88ab519ac3acb67502d6d1f8d74654ac815b09f1f8b08a30cbf17996a3c68b04587b2888905ea9c28e0fd3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568Filesize
406B
MD5d2c5ed384fcfeeea60030b55325bec00
SHA12d0a31da961b278fb3042e61326f621eb3115a5a
SHA25667b44eec6f542e64a3f93d706583ddcbd533d938d70945a00a2188a7d4ad183b
SHA512c3f9e97aaa8d45f0a8f61c6d6a1ec1033e44aa66ae490c45c0763abff27fe962a4ef14ff18d8eb7599d93e80c5f3058537b1351ef091de03cfbd64d651962615
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\platform_gapi.iframes.style.common[1].jsFilesize
54KB
MD57ef4bc18139bcdbdd14c5b58b0955a67
SHA1afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA5126c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\3604799710-postmessagerelay[1].jsFilesize
11KB
MD540aaadf2a7451d276b940cddefb2d0ed
SHA1b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA2564b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA5126f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\cb=gapi[2].jsFilesize
64KB
MD563e5a0b45632b3dde3694ffcaf0e3f7a
SHA1923736d0cdc308331d5cfaa0ea159bfedc83d53f
SHA256889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db
SHA5125b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\rpc_shindig_random[1].jsFilesize
14KB
MD523a7ab8d8ba33d255e61be9fc36b1d16
SHA1042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\D9UU16X5.htmFilesize
92KB
MD56c57dc23c189d0da35259dfe12be4edb
SHA18e7e189749ba03e0530bf24487a43d2244b503dc
SHA2568d493f2c5624cd25794716e0e8c090e0787d8dd71a020541159fa423ace2c9d1
SHA51250a96490c226a69901497076a5d43c23e75480d5f966cd0a78c8d457e85c026af536e2452ef466ab354452d23effeafd1042b4f8052a9d21145d4a6cb8290bc2
-
C:\Users\Admin\AppData\Local\Temp\Cab1CF5.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar1D46.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a