Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:47
Static task
static1
Behavioral task
behavioral1
Sample
6893e932c1dc835e9d6ab605b4ecd349_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6893e932c1dc835e9d6ab605b4ecd349_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6893e932c1dc835e9d6ab605b4ecd349_JaffaCakes118.html
-
Size
19KB
-
MD5
6893e932c1dc835e9d6ab605b4ecd349
-
SHA1
afeefb082d16375861a4608f6216505aa48386e7
-
SHA256
adcabcd9664c30d547d530c046c3af9a7f016d073a4852729fe61b075fee0432
-
SHA512
83049d62e0da8da5a00badf1449145190bc9fa02692274396bbd41e2fb29f273ebef8631db84364bc05ade7b8a1d58234e7aa6470741eb1d8e9e02ae635e0b41
-
SSDEEP
384:zi49KhgESmVBD8cqQ3RyI6kfemLxXucfIk99heUzVc9tZ:ziPSmgcd3QmQOIk9SyqtZ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca702fd17211704396e3e767e150542900000000020000000000106600000001000020000000d3d4d7d40630ef1dde40d627baa901a1a2b8f85adb991b03177aecb67e30f5f7000000000e80000000020000200000003484367acceab24d30d3bddadd7e4c5f30b03c8e0e882d64dc5bb74f0b75c2d4900000000312a93ecce66f9cc64e879e57117f55ebc36f9046e08fb1c6e2cb7ffabd8d688d537af3389eb971ebc88d7bc699337eeafa757d5a42b735e89556f06710fb35944cc02005ad8fdb51661e45fc8e7001309ce246c75cfd3f3f8807833b997c91e75ecacaeb31883dede8a91635773d0bdded1fcfc18c064f82353de7d6c8d5d85abecc409a6bd78f895642ab3278d957400000008b498c51935908e9e2b7655d4cd021345c835b57ef59806d171f5ece5aaf0bb794f7119d90c3346118f4017b1dc4de3484fc387d206df8312fee05014a72aa96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82DF91E1-187C-11EF-8D50-4A4F109F65B0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ca702fd17211704396e3e767e150542900000000020000000000106600000001000020000000c33ddaa57f7021e823d9826e0be41e7f1d2b3dd6e1f8804ec1426399d0e827ce000000000e80000000020000200000001ff58e2796ced50e8d39cb761fa01cfc720d7410136b34ec9d99f60cbac3aa7a20000000591ad0b37cd1b47bb4639dd703c8eb5d59e17cd1c6a986dfb8b65ee9f432713d4000000016b778f142fddab65f6a92dc206892a70581afd106f7da6fda17d6a67a78d5cf3c2248246ebc321ccfd07e6d5a8909f9699da59010d87040f610536b48644723 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f3f75989acda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572722" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2240 iexplore.exe 2240 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2240 wrote to memory of 2344 2240 iexplore.exe IEXPLORE.EXE PID 2240 wrote to memory of 2344 2240 iexplore.exe IEXPLORE.EXE PID 2240 wrote to memory of 2344 2240 iexplore.exe IEXPLORE.EXE PID 2240 wrote to memory of 2344 2240 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6893e932c1dc835e9d6ab605b4ecd349_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d9e0ae2675131686fca939d55eb53079
SHA116c62f65d7f88a2d0c1b022f40ed55c4bb512c49
SHA2565a3f87e99771a36a0ae944f446d59f53d8bc0f6642f994056a47d643f93db997
SHA512db0e1b73373f06fccf2fb1776b8ad9e78908778b295ba256b2b2952cdbff6a2090ef21affc3ca7f31821355620bbbc2f40d3e86bef1df833ee0f45dfdd7cc611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dd16d3030dabdc452d30574da28ce7bf
SHA159a7a5accf3dec463a5c1487fabace9aca7718e1
SHA25664f2548d0dbd1bf0edd6cceb61f5ac04f28fefc26203b614a9858ef36540dd24
SHA512ae1ca13f7166db0dfc0969f21b2cf53d02251f6a023d0bd04ae643f5997b043151c4fdd3de298da9f4b8a607c391f82d39c6f4c858cf2e209ae40d699d9c7086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c626c70e45ea06ecda2e03a057741e9e
SHA1e4eb8f695f7c7145d6745498471cfaa0a896ca00
SHA2563a08c1d48298e3c4770adefe60081421d493805361ba8258e0c2681c464f19f1
SHA512ba639676be22b89c29a8d0df064a0e76c4510288b7b311e9da77730d1352b55ad8468f717cf64b6c69d042bb2a0b34b706fb012c38d5ff99e5a816e6dd966a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5eb97d1a999577dfde3158d7c4ef8f6ea
SHA111df3b669305eef546c078216c65b7b2cbf2408a
SHA25601beec209686fa39a0dbc27cedef03e73a2dff650fb7b7e9b3eef648a2612591
SHA512b12b2fc87b7676c48a234e940a12a0da43bc21205777f40288fc186b1833b470efff9d0634aaeb4db291272eaec573b8b1f8c9aaee94d8209ba76fc03fabfe0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5348afab01bbc31d226e135d9807dc629
SHA16dc343c8f42b6ccdaf2ff62f60fdc9cf6f8e50f7
SHA256da214150250008f66b37d9f0fc6f8053dec8063f33ac7372369516c6f8ff662e
SHA5129b5d440d60f692e952141a203001c113c26812479c510ed4c89e4e99164260391d34414a9c9362930918f86da0495c40b39fdc6eb64ba74076213ac7a7a451a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD565abe43797945ac742b1858d61c236f0
SHA1426604937112f5d14cbfc4fc5d27b89bdd1f0c09
SHA2560fc9705b7959d23941e602a859f2e30f50e9b9b06f1600770b0bcfa3b8c50ca2
SHA5122403f75edc7ba9793a96c0fc7299afa0cf8753b65879aece974f0d59a9b63abbf09246965ca1bfeeac4ed181de0c1cddfb2f48b23bf0e3eb4c89b24005f2e7db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d074282deb348b366b8fa7382f39144b
SHA1e1cbbc35b60f3366bbc1e3110b04f2b9ceaecd3e
SHA25681d4677d1715bece20c10e7f7f3d3801ed627bc5902272b4d07c37ecf1425e66
SHA51283dcd2bbb816f735f7702d7d9162acc7a44e67c08fb619aad6a9434fb9a96aefa68ec90dcb11cbd3b6187285e60f6873e0abd5bbcaaab1a71ae60dc2af516bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f1b0d7438c0f340eb91e5efa6d2d6950
SHA1f620230a50b59853bcedc367020bff3b84aa56a9
SHA25606a9ae9e2aee5b38b9f13193ef82bbbacb1f72308a21404d482e7bc3cb60b885
SHA5129718342520473e07c18f797524c2f6ede47836c8772afd921874e794da3b8df04fcc7f915590d8e152140d71ffe0943e6f28c5f5a6e0ca29d4b73cf907a2c25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f09d8a04881ac6b7351ceaec8bd61c65
SHA1cf1cc18e19d0ebf886de9f4e22456b3d4d550b1b
SHA256bd7ae07e2d9fcb6edf1a199f9c708d98f0bab43b733670ef4ad43bdbcb88d4c0
SHA512bf5679cb2529b6e6224cb3748c68e9109216ed966ceeeb0efd36148262a6460fe599911c892e200fb3b0e397fac0094b8fadf4979cfcbda11eda88a695fcdc9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD597c088723da8bdcba5eb07e42f9ca103
SHA11ac68d2e2ad3e37fa6324c9541c079e28a7f1b4a
SHA256c028458521e8aaa49e723f508cb22bf9369860d4bb497d65bb708390b072fa42
SHA512aa3436ec2824a89c52327d52836c0dd20024cb217d2f099931c23d6d3d4b5345164fc76aa526b6b6cab314d611e0b586deb2cdfded0817ab5900e324165258ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5539d09a17465513213f053db9a17c2ca
SHA126d3991133bd576f2327df61b863e82cb2058e53
SHA25666aa3ab1be5cac9a76e7ec6a2b63c0f488e846d4313d625ff46605d9a74af5e5
SHA5129fd74ccd5f7110f4826343122e65cebd04ac05dcb94a0df15b2e5d23ea6228c9fa404defed5c70fd37e5789aca36eff6dc1c9fd04193aeb5e1641de00e584c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f3d21f2b77b8b538729f9c82b468e08a
SHA19ec4a46f2645fc4d644d3553f6d39091bd91722e
SHA2566a8edb4a53bfc6afbe4bd02a7ea8eb7229bcf37c5e974edbc3edcab8416fe654
SHA512b80f7bea3df79c6bec32c76110ef79d132a3130e1e7d6c2e6a2f7dbf649009cc4b55806fa5caa820d4ea5f10f41b19088b78e9cb358eb462fda659e195f1f857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fd10971b9a6b6ee59afdcccb3240bc6b
SHA1dcf47c7e31735b17afa851b5be25eae5d2aa6356
SHA256c10cbc45aa14f9010fb973d61985951c91012e5b46eac3d24db750a1cb7a614d
SHA5120af6be883f5e97a0f42838762a914cd082c5c345b4a7f85efdc88740640406d2a0cac06dc51d84cf4db0237a6fd132e07f8d6342e552bfa619fc8752315961ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD560f43c7f582ac71ab64b2bd708477080
SHA1e3d7a0262821d828949c4501dff8ebe25c2d7d7a
SHA256bec32377161bb9875d1e2d91f0736c5ffed74d08a4763756f85573a7d3b1d56b
SHA512b4a86fefb6df5433149082dd34303914bdd4b75bb3cf4a592a10d80a3415c1421c3daf1d69adb32be57d67acbb876b3e81aa0968d5efcb36248fc3fca52e4e5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5281aa75af952c9133d3df56bd469354b
SHA18764f0c031117e41e2b451902f07dd2b3e4caced
SHA256d979a9e6cc5d8584f781a0d6b7852731145c9d626eb9bfe5698096d925a5b56d
SHA512cf36c3ad7c159ac8a887cf95a7adc120665a4b510a19edf552db4889795e89ba3a349164d5aa11c92bc83cf01d66dede913a2bdb6797137147975a4d4c85921c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD571fc15eda39887ef6b7ec76371419c31
SHA189fe819c2a83d71b6d7a53de5a9688dea5ff0b90
SHA2568f08a76753e1f0afac8c9eddac0a065b41aef3ba2c7b6f5cb422facdb83f13ca
SHA5122fba08d932b78dda45381189b49849f4dbfe7712291e29dde5f7028a744de3f883dca3aff3cad59f68d7fb42be1db57f7ec8ad742b01b2d2dbe599e4802b260a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fa8e02f5b89e589c02b7207d95aecfd8
SHA1e14154a27e4a536b4ccae0f9782f3e99f19490a0
SHA256848e2b00c8ec05decc56919e327cc421335034c79f5df9f487b1b9003fd84c8a
SHA512e8b6c4aa88c70fbad029f3e2158917ddf41f226f913cbc8c564daec934d985c1478d60b728a7c049df359f4ec4415b18fa1fdfaa4011d248a7cf815a547dfe64
-
C:\Users\Admin\AppData\Local\Temp\Cab7669.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar7846.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a