Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:33
Static task
static1
Behavioral task
behavioral1
Sample
6888cff11422eb10d3987742fd137361_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6888cff11422eb10d3987742fd137361_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6888cff11422eb10d3987742fd137361_JaffaCakes118.html
-
Size
98KB
-
MD5
6888cff11422eb10d3987742fd137361
-
SHA1
3b5e57298cb178f4ad80909db4ec619be454c1e1
-
SHA256
f7d121ce1b0041b2646fe2942a25dd65930578de51d6f3a34f9ef56a5f79bbb1
-
SHA512
1940d7725ebc06e3312645450182740b13216aae0e6c5d621ba20f0e5280494fba814848fa478f5bbe30e4fa29d2235fb38e31f3b1effcb8e376de75a48325ff
-
SSDEEP
1536:bV1+B4yz6GWuRAaHaG1WgGaeASrEQm7xpDG9lE/LIMUmNL4ceAPxx:p1A1b1WgJeASr8DDG9lE/sMUmBeAPxx
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000075ae862036a4e3d0c772f99440fb2dd958b98866e55a65af6d5acd8d9cd09f80000000000e8000000002000020000000f0b6ea6bfac9eb93d3d837dba7ba9e71cdc72fb2cbac49252758c0ef2c7fe47f20000000d11a36fe5491a1aca8f42f7132b0a9afb0b62a0333cebd3493a9d31237691f764000000061a3c27196bacc30cdc93d2be80d8cce155b3b64ee9bdf54206a9e95cebfc3a730aa5fd72e994190aab19396ceb2171822743942f1b5650e2640486cf3f69569 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10231f6687acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A0C95A1-187A-11EF-B3A2-4205ACB4EED4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a634809972a3045a6cf9ac9e1ecc3e7117c1e02c280ec9d53462c0087384a3ee000000000e8000000002000020000000d04d6a57ced0d27afa7119881914ebc96111bbaeae5960bc77d0d605a681778390000000e4c8afbc3a993337b94843916ac3d0361fc587a37fc1775ad0620d59399e2751b0210c796b6132a8c0b3415ca3cefa7a4922f0d0208fbad53f93ec24fbd140af1981d6a7adfe741e0c633c4aa00014f3a31aef0742a041dfd0f162afd1b4f41fd6f73f5ff63c3fa67c271fa3f2d092fc730629d6fce65a60feaa9644d056f5f37866bf6345f0e7cdc75931e8c042a89040000000e4a3a97f391548814a7de3d143333d034faf3dbb15c503d7f153dbc3b778747825a255fb616c089e17e2d22c00c2ada353849110ba6f9f6be7bab8bed1745199 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1656 iexplore.exe 1656 iexplore.exe 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1656 wrote to memory of 1632 1656 iexplore.exe IEXPLORE.EXE PID 1656 wrote to memory of 1632 1656 iexplore.exe IEXPLORE.EXE PID 1656 wrote to memory of 1632 1656 iexplore.exe IEXPLORE.EXE PID 1656 wrote to memory of 1632 1656 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6888cff11422eb10d3987742fd137361_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD564c143e9f2a438ddf74501d3b3cc54bf
SHA166b41aabcaa5c364d405c858b85fa7a995f53c72
SHA25602802fa86c2539668fb375ddf8b3ffa5a6c7ad8ae0050c3471dc9fca1275c0ca
SHA5129decfe443630833dfc6c4e2b728c0395d0cbd59a5d868639f300244c4c61df6540b21d33497a8dd4e1947aaef02e4cbc815f53acc21d70ba1653d9492f438e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD54691c92b9ef583b0c83e161f9d759d69
SHA12631036c20e04574d3ed52070527ba56288d042c
SHA256b951dadf8a5e15ba94199206797fbc4be7a7b276f9ec748bbd7b49bf76bf65d7
SHA512917a714280a823adca83e3bbf2c5073cd6bb6e5b1d9ee994156e5ffc47e5831fa8d9e40e066e2e09aa48a306077ada59b1eeaf281880c2bc002eba123abd124d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511ca3f8d370eeded3383c3e0e05ee65b
SHA14b6271832e9ede171a11f14a9dd30e96db87ca4f
SHA2566af37a2d1d9fa56eaf5bd4024972c2bb2e364e382b729ab7bad0f6e9441a9930
SHA512825af21fe9bc2ffc6e88b096bb3b7c84507243a87fe681357c00fa130c8b399ae7f8f0c3502caf1b98111abe40de5f5749239ffb0c867aec69b06481f6a5e10c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ac0bf49619cadbedae85142b8ce2f8a
SHA17ffee621e2cacceb0a5abe4433f1f3604897cbe7
SHA256fcc09ceeba6ced07287fa2941bc54fad6702c49c100990c638744da0cb5c7d96
SHA5121f470f192ba7467883dae6ab03b9e51c0b70a3fb9732089c7f7b47143fdebd219702914de776c38b69da0bc1c6e0f3af3b90fc60cafef73fec5bc463e6eaec62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6660a97ae0d3f8e915d53d5856083b3
SHA1154321f237ff5b6f40ed7d09dca2491a4718e75b
SHA256a16829b85b8a166e87495a895180845b54fe6010884271a381aec739316f6989
SHA51254a812da69cbef4b81078d7eeb01ce168633e94ba31aff4eeb916b935f947994b4a8a7a37bd60bea52cbbc2ba05801d90457ff438203b0af35c7b190b65e2db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a431a15718db93698deebbaad075a88d
SHA12f13b662d3444be626bdc86b8fa8785c49d07102
SHA2567c68c25a8ac5fcdef025fd65c2af9ffa0071100ded313242e238e2fb0d062418
SHA512b7731781e2a780e46615f0147bd4d99ca77b3dfc698691423f531cdb1477c9f9fce71833a7c093fe9fe35ea25fb9079fe315a7fa7a92deaa2c714b8a4ea049e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522d69f84346e5cc03e51b4f3c1688247
SHA19812a956b985f31521ef2487d7ab8de4e8cc3db1
SHA256f6cacc87c4a11338a15e2be714c40b2de74dbaf2197c5a67e7ab72a5573e75ec
SHA5127d6483b081498732cd7e56043c550427c8dc185a5e2f8e92c12af6ce9b31feb2aa881fccfae4d10625fbb15d086aa5e07ba49a6d57037b746236c96ae2a73d5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5314a7646d9d45e7e51d3e1d9144a846e
SHA1aabd9903bd06eb2f32c1f158657e62726b5dbbca
SHA256c3a63b9f5144d1e6af0a306e8de4e871e812fe91e443f09e4002ad6e09a3d356
SHA5122d490294d00e576429bfd26f079f183472d32add629fe2854cd9a2ddf3b302b9161e0a4be298072de7b83442357bda380ddc1fd9ccfc2dcb1eb5a4a55e4c7265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fef491ba60017aed73981662ae9872cd
SHA116d94f374cba5fe25435136d8d64f4333d9c5d20
SHA256be644705f6343fcdba0a9369bd604be2ecc589ab72ac8081085affdda4017058
SHA512eee6d8e587468915b62507e24ab8e5622c8100d3568fcc37589c662f8b2641e6ae2c3fac22c406af637a57c243b33b891cc4c090879d8c576f4c8165e9bfa84e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541c73949b1d6527649ba63a69c5222cc
SHA1a348538d06fa5064ca2727c2de1b41120830277d
SHA256d471648dedbb0ee30d0d1e55f3e1845c9d4e5bc2373a64650024c6fa375456bf
SHA5121bfda57c797173d9aadac7a2cad6f4ed70e7db65c06e7c1c6829969e870e121d2d1b4d02492373e7f6485c1da9a8a822bc929642302aae4a05be3abc48f6c6c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51888cec16e52632f6ede8d54a616c1f3
SHA16eb0404121804c2cd64fd197cc25b61794ead194
SHA256d045940eff69780d05311981c0321bae144bcce0d90c2e9dfde8313f349495df
SHA512ca4d3914154aca4e51cdf5e2c44ac8a57622f315f4b3addc197ca613d48412f1dc72bde9a87f3051572b7c8efde0ed455e78e72b0db9dbadd4d824dd79eaf300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2ddfc68d2acdc20b23a0957e81cd575
SHA1924e0b5c13690f9b4d358d7abdad8a784ad532de
SHA25686908720e848ce97498916e41a68c007181f590e86d0f527978d28f80fee9770
SHA5129483ef398f4f89a9f1e0ab8898c6a25283b443e3ddb274a08e428fc59ba916f3f77f81888679ef45e3e66b59bc40f3c60dff8bc976314af03b492ae7acf21562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9d7a799c814c27cc88faad2e82d840b
SHA10a35cffe25f4e71dee718aab6eb91816f5176930
SHA25677bb996475097c8029ba5cdba12094164bf17906dbc450b9932398e1806164ad
SHA512a7e1db289d296b8538fc1f79413135f51197762ca0ab32a3f05004687f557e6c55674a91e1d57cc80f4a5e4426e434078c74474b0e35c4e3613f1f6a9f71c7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51698a072cd0299a04a23fa7cfb1f868c
SHA1fdef685edfd7ea98ae067e87313f8f3bee4ac9be
SHA25689910642ecf3c11c2cabc090c0c4b0e80a7c5b5fff997453d3f81d7aab3ab69a
SHA51205a60a1e848662129e787ee7325ddbf42d0b74b2b1b67c43dc89c168c519884118a46da4cb673ddcbf89a53dec21808ada6c1ac65778131ae5724df197956b95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD566de8ed4e4ad2dd5b04e7db6ca19ec21
SHA17bb6585b406d20ce0df12ceb9ea4642e8f401c06
SHA256e313c7fc4de862dad371ae4b08025766125f25c4c9a64a59c77cca06e81b292b
SHA5125b2d4aa5db3ddf4fe6bde7361f7313dfcb5b7bc06b8289c1c97df71ee69a4e1926257a948242f9b826dd5c87672f63c5d3487607211a146167513ca10e1d8e20
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\platform_gapi.iframes.style.common[1].js
Filesize54KB
MD57ef4bc18139bcdbdd14c5b58b0955a67
SHA1afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA5126c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\cb=gapi[3].js
Filesize133KB
MD54d1bd282f5a3799d4e2880cf69af9269
SHA12ede61be138a7beaa7d6214aa278479dce258adb
SHA2565e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a