Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
6c7743465a74496977ab3687460af73e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6c7743465a74496977ab3687460af73e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6c7743465a74496977ab3687460af73e_JaffaCakes118.html
-
Size
30KB
-
MD5
6c7743465a74496977ab3687460af73e
-
SHA1
3928d0af1dfdcfe5fcdae663ed697533b02f5b37
-
SHA256
5ae5c09abefb12917692edce6e9305c11ed764da64b3c95cf910321e091d6be4
-
SHA512
d1e19742dac767e97f4859f9b35cf17f8757ad6a1a02c69e9fd0fdf810ea1875b410e8935d6a4fe522377f50ba017473b4a8cd4e48830a7c97f9a6c213e2ecd8
-
SSDEEP
384:rbzf/TCi7oRgLgyglN/jIBaBMbBMQBM0BMXBMWDQYrajf87Z+fvg3:rv58+EPTjIACbCQC0CXCkQYrajk+3g3
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005e959faf21e14589bf7727ba5a14aa563a2a5a56aa58405f74b4d292eed2bd0e000000000e800000000200002000000034c75346652eb8925258076913a460d17975fed2853a41637e58738c95447bc490000000de3228ed39b556dd612ec67324eea0d09c101dfeef58d5716452b52bd1aa0b041e5c1d0f6049933064156b2fe73d6e5cc1edae382a869f5652d2f1ab8310b78f23fbade8cc2c2169de1264a87b26bc6814cba95ace202d9ac24634f4e68ee31fce95e412191987274172e65aaf3c4952106bc5f0ebeeeaafbf3cc1dcf4ce6fd0c292b5ae71108c6acd6f2c4a00a48cce4000000097a5685428769c8bcc181c189040c44fabdc28fc5bf24a4fc6d0ffd1af8a2cb5c71f8f9835d41e4fc947f2ef3694067eb8cea514789d00044593e88acc89cea9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422665247" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000049b46aa9e07af7122e893a0553282147a476cc898aaea658a943d0a5dbf267c2000000000e8000000002000020000000c822704cd16be7b6e4d57f9f532f98f9741d1f00649a95a3787d91122d0b945720000000abf9dcafe8c35529d8b0398bb68c3b45dd5567aaa47075ab74463e44db40ac9c400000001b7a036276716948ffbc6331b841fa387aa64b64befc4b272390ee1c7a4cc45965da422b5c093632e5bd05d65c4bb1a7dffb68c7372bde317bdb0be8ee9042d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F14F3271-1953-11EF-89B4-66A5A0AB388F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600986df60adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2424 2960 iexplore.exe 28 PID 2960 wrote to memory of 2424 2960 iexplore.exe 28 PID 2960 wrote to memory of 2424 2960 iexplore.exe 28 PID 2960 wrote to memory of 2424 2960 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c7743465a74496977ab3687460af73e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c5260a27584623f70a2a640677a9d37
SHA1332f7951ae611dd5d13f67eea2f305477cb61494
SHA2564f917eb4e6483ad5b02ac74e2c81c7e52820cf6aa55f7a64038c876ae64e26b8
SHA51236cefc6e5b23d94ecac4f46d442dc51183fa189ed5a499da1ea9ef42f9ecdf42ee514c8b4517b6fa17adb041407bbf172ff4a3ba7ad17196e8364bc2e158fab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af6a1bd5d228632f03d7df2003a1a73d
SHA1fb04b410b6d5325139d3ba23c6455d4a67ca109d
SHA256c1d7b991e5ee6c5816f5c26df296a748ecdb88884bd0a42fc7bfe7d6edd41775
SHA51243d5bc20ec7d120ac3e6c38b42421fb0cddcd373234fe448434ae69fba27ecbd21495211641e9731307a44d922d3a6f3090b64f4d562948c48bb92c4325ffd41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53352ad7a76522ae498df4ba948cf6fb3
SHA1af865ec39e4bfe15e98fcb8f8029774a43d6af60
SHA2560f444d38ffc6ce00f5a3a87e672a157420b44d4cf8269c8896ec2d7acb678347
SHA5128491510902f75dd56f428ddd8d6a3972d3ead9f030cb6b2a9fa25d9774c9f5b6ea64d146196d10657424e675f8d8e54e96acbfef8b76f9aee858997453c4ddee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0583e9985dfb0fbdfe8871e88e89283
SHA12a3d0eba26ee8e39245e5463bef70c1c8f2e31f6
SHA2563b38c6a9b9c05af39b349ba772ae9a4764e85d304f46fa628a35d66016039df3
SHA512e6fd2ec0def909ffbc4055714a08361e4b399363b5597e54bfcea1438bb57fe246194ba252fb40f2e6a01735cb33e6c61f0106ba31f5b9d6ea460599e475521e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5218af3aa0e099a6bbdb9555da8d4f7a2
SHA102c4635ced1097bd68a8dc7674493dca0eb4759b
SHA256a7d1a6888035c48a4036f5289a7eb92680dd804b1bdfde149e07b206702f6a37
SHA512d00dacb126146d679d23018d60e0639e566e0fb25406f096bc9e16f48758c13d93baf5bb1c64a72d81c6da0c608b96a8d2967458a52f804df50a3402b1e1a8d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fd102b6f996f348179e61b3b72c2dd8
SHA1acd911c7f79f9302ea3fb680b35b5ea14a09a508
SHA2568075deeada7528caa172f3c4d89ff589bb170d94fcf4c57c4dcfebbdf3e9623e
SHA512d5f7de3d752a170b15532acf9544cc5279ed703536a0236a15d303e643392782969f47a4830529ebb98b9b614d2e11dca7710009743e58e365697cad449855c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c8324789bfaa4ab7b77f32e04c06701
SHA1b74b68ac25efca2c5beec7a67b271d86ea5c5ce8
SHA2564c0da3ae32cbad668cb841fba0dd7ed6956d470bd1f6eb2a7180d56aeff7d482
SHA512329762a50e0e70b484690d54c342e41afc3a8e08f73606956796bc32675b4c6e8438491a9a43f9bb4b8d2bfd763d15de159f9a7de015c21a5cb346e04d9b02de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a93b0d20202e952693a66d2220eaa834
SHA165f5875237819a597a74ec820cb8a7ff83939cd9
SHA256bc9e29ef90a64392bc69d09c6567fcd2de865843df95ba6844d08e2a5abdb3f3
SHA512af917c4583508bc1be5fd12607846a64d35edbd7579c69fee2dc7ab21cc5f8f8f6a62d817fea7c9b7fe5de00dd91bcada8de084d56dd92c8b4e305f50b50db93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd1f03a079ce0b3f549198181a0dd41c
SHA1729088d4c6dfc6923c8718dde3eb6d59b9a0cf6d
SHA256763f93ef1a7375fa681b3aef491b566d6162f84187077e75468a2d058737f8e4
SHA512cd5d6c8a6bd3b54b15a5b14404b336d4b72594deeb3c99aec19e6b83cef79084bc2c3233acc23fa82290cf9616f9d3a99629ca13d38cca522433af8900d0ad57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c21b2ccb1e455d986db592dd2755257
SHA1dde25ec5a829b6cfa417309f0b5f895728fba1c7
SHA256c95b31bd075123109eafb393b8fde01cdcb6506e950bca36799cfeccfee14f76
SHA5123327596758888ae2edc48f81877b653a1cca9f064918869d3aaab64632a6a8ac78e6d5124a6d132fdbdfc3848df64ae16153ebb0b9e324f9f7e3517ca33df226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507338c515e5c7595193bdbabac73e3b5
SHA1c4404fc03a3c240ed744cec98b4f6d4ab7fa821e
SHA256ec380d9e5f2e6cc0f5ed9b13616fca1e0b94e00864a7aa7daf42eb3914281ec9
SHA512ea6644560c62003d67344ab621c26322bb69bfd2917756f62bb83dc9838beac8f4c95ddc693e06eb4c9d30c099a1e856c706a555838978398c5de155d5872f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5027338c0f7d5385e0773b0f537a8e375
SHA1aa3c5d17cf01219051701298f1ab90930838409c
SHA2560e39615852e736506e064055440d1b2a0bf3e7aad46b967d2d3d895d751cc628
SHA5120d261b4dd7e76f6882bb927fab97d1ca679a6e11c52e45f3337995b183fe4f80e30ac00abfbaf7ad97d780b92c6af27b4461b112e02a310c75ff061863349067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ffef000a9dd94344747893a8b4f599
SHA121171dcf6c074d20765a15f03c198e4f0e51f2a0
SHA2567cd700d5168d45d72836d804ac10a6a776d7872cae45756adc745ac38b03075c
SHA5122f543ddba1126a56b77125f28e5d6df531c62c4168a3d01f7e057aaf83f79798f8fe020c744be5a68370db445307eeca0bfde811ed57363b08de0bdf27f23b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539dc9fb3aaa031956b4bce7bbde7603c
SHA1daf062bb4feb171b88d9d46413cd24a098f95099
SHA256466e2f4d87d5e5f85e7031ecc18358382f49bf437a2182b3ee588160db2ac5d9
SHA51201647c992500aae62c582a197a0c991571d2fd8e50f7300747747fe972e858951355d172c8eab77fe904749d4832820a5cb988d1f8a5ba53a4e29e7acc9c779a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f280b39a76f6668cfeac3ca28ac378c6
SHA1315990a72c29a8ff7a24638e6a249000a7a95bb3
SHA25634cc90a4088bd82865b4ed6925217123c612268efd01fb30bb78e43606101f12
SHA512eb1b9638e4267a5892a8ff7d80e8f538cfe14575e7a309693ce14d96b1491a3e5ce97166916efcdff6bcb42970f63e3c292f28a675da5e4b3e43c245e7ee44ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa27c913f5d769124ec59a3bd60cb770
SHA14b483e3bb63ff33ee89d257a66f450269d40c13b
SHA256b116dc138d47bcc715d513edef1f6bd54e53383536d13cd011638b9bd297ecb1
SHA512eaf3b5e2d2d0b4eaf7fcaa19218b42409024fa13e72fdee665ed9da967652018e9389fa8e8efa07b45543d9cd44c2037914f796e52b7ae77f6ac69ad3d1710f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53954785b0bdabe998c02fb182a0b2342
SHA103d797688ffea1436f29999e5fda7fc14ebe3859
SHA2563a3d4d822d9cb843e6ea776ad4c95c4a95694b25fea061412d801bd263de6fe1
SHA51282fd4ad86ad42435c9dc0fef58a10991f6c39434a30173f272e53bb454d7bef357c4c6aff2c170bff86ec643aa66a66739fda149cd3d606748af890fd9f8f879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a30c9f26ff89a22c67ab3bbe530bc5a1
SHA1412f18e670c4f304ec17fa8cc895eb8498612098
SHA2566f08c083a1113035d5ceb808ffc4aad153c950816727e9a8b332123431f482cf
SHA512e20f04784b45b96a9cbc0ab4ddb24e8a58bb4e087ce5f9747560cf2df115f41590390ca7d676f55057a49642971ce0742e54f19fcbdb0bbec4c131a24cc3bd9e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a