Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
6917cc1d21c14aa35cf9186a4afd876e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6917cc1d21c14aa35cf9186a4afd876e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6917cc1d21c14aa35cf9186a4afd876e_JaffaCakes118.html
-
Size
21KB
-
MD5
6917cc1d21c14aa35cf9186a4afd876e
-
SHA1
88265d5d4ea705130fbb74aee13e09a78695f723
-
SHA256
6041eb95b8e0e48280269358f09e92cae94289d40f5c51e8040e1cbd00982c8b
-
SHA512
dc30cde9686db260a624ba70f4b05acde68d4ddf555394c6f09027bbec79e1fb2189034a432a45f3050e4555129b7dabbffb5ff5d352b9ba6cf3faeca7db7ce3
-
SSDEEP
384:Iou6oxHR4V30/ezMbGY2NLYCQFeds4mXI9zxxkWo+lQ2mJc6YdpV48CUkXaBz5YI:Ghx4V3024b92VYCQoL9rmJc3vBz5Yvs1
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8ABB7F71-1898-11EF-A4C2-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422584758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000464c56d0b8698372fd3881a9f7e6e755b0fbf032da2a9ea5b805caf4cd410952000000000e8000000002000020000000418dcde158c0650798ebe42ff2afdc37158f9ac4eb4d26f5bed5a0509757119d90000000afe167fbea157d961c2edf89a20de423bba6d7095ff6644d16c788f8f67c51a900a8e2296658580406ddb47cd7681453194004d33f721701c5d585ddafcd436832799ba9d8299f98243383c8a06ecc3125fbaf33ba7b003acd0a5dfbf296794f83c4f728f2ccf61b9789bacc7bbfb52d8ce8ca1e90c31a10cd59ac23a7669889acee5ac48f8da233926bd9221941cfea4000000083da0c3b704cc3ce6f4974608fd71a4d330772734199c8374fd45e821d80018df2bc717ff6c1116cc8aaac87699fbc3b9ff83557794f240b4a1867b61629983d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f3643485114a627dff12ceecc35feb70e7795685c75ba5bdc5375d8e0418d815000000000e8000000002000020000000fffc4c152cd7b314aa4c174e22e246f044fcb33826c35522fc8e891a344cf13320000000483ef76a3e21f3544a7ec12d0dc90ccb0c30af7ed9cb9bd2dfac5b195e6228c540000000c7e11bf22376d8586ffa4298d21f50c9b47cfbe117da37eec47462f9360048180057c5fa781b7c9908b21c51f88ca6798c5e5e72a9945d112ebb8c930309939f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04fbe5fa5acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2044 iexplore.exe 2044 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2044 wrote to memory of 2896 2044 iexplore.exe IEXPLORE.EXE PID 2044 wrote to memory of 2896 2044 iexplore.exe IEXPLORE.EXE PID 2044 wrote to memory of 2896 2044 iexplore.exe IEXPLORE.EXE PID 2044 wrote to memory of 2896 2044 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6917cc1d21c14aa35cf9186a4afd876e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53acf7c18af37c418bc4413c54bf48836
SHA176d8bd6e6753e8f8fec3f2f1a2c56a0e2be22b90
SHA2567c43e7b0ee2b8dcbfbadaad43382ec371da95f7cda2e4a00f3f7fed1e4250013
SHA5126f5a832b30653f240bcf6f3445a43265aaebd404579b1209f550d8cf774bb36c5e804e9785e5128cf97a8f3ca5d76afe0e1a6f9022bad9af64789b786d5e055d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53683d1b4cbd983a481d61424354804cf
SHA178db9f68a62121f1972807a8053c181abd9351d2
SHA2565fe2d2da556090a40224171b584fc2368bf82c81c4598f5fb863b9de2da56611
SHA51281735030d94a897b4fd9ac9a3d2bed6c1547775749c6910b9ede306fcd852d7a350d68424a31fedbd766f01784df63688861a7178793b63b7f2f119445dee258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e7a5d900c64ef6759a5ccfbe7ba7ce03
SHA165f8147a9683320d4d2dcb29acf20131a4c917e3
SHA256dbbaeaa654354aab7e10b7340a74f925321364b8463e21addd663dcb1ed00229
SHA5128fa0a01c8175c7406b7eacc4a57f9e681e3dc527eb1714c0e3212ac529487266634f937cd89d6512d19dd140e7a2ec34c4bf777c41547e3670a87c110d0569f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD595c89ee69f1919b9d1d6d3db0653cece
SHA144bde815c3ece9d673c225c9f98ce7155bbac1ec
SHA256cdc1b57a91095679e0192fe8e38da278593751b970052de8f9a40dbdaa818e4f
SHA5125ce1af3abb8f3cbbbdf52305bf1e5ffcacd2642c6d35419ffc889db128511e01b875995b56b8bf43173d11642030fd4c8b1c64e5f0eae5ed05509cc3bb3e517d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cd35d695a97875a492989870c4a3368b
SHA1b2fba0fc4f59a91c2f172c314db6c4eb06877b20
SHA2564b3ff99f25d52e46ba9fdddcd186907fea105ba1601e654addcb7a0bee6e7a76
SHA512c79e47a1918bf5d29e1d23c0a8e9911b2f62f4d10f2fc25803c76827f44d2eb4b37eac0bf58b04a257a5b06a183f8b4d1d8e6fbae730298b86fbff91955edaff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5093e26dbc6e3babf2943f301f43d4f53
SHA15f08961ab6c846f04100a12b55393006437f8fe6
SHA25688ac01c0aef271d6ad09951e05b6805d5cd28a7520501d7b6cde8f46aaeabd0d
SHA51264c2d36105245b9859e88083e6ea257de7b93cc90b18bbce57a3d58c90d658a0715c4f886152ab5dc5e23ffac639b69a13cc89ab41e08e3ef28110e807dd6f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52717f6b7fbeaf6a9882adc189766aec7
SHA1706e505a4f7b035964ebaf04c71d9f8ef1749a5f
SHA2567719eec4b42dc16f64a8e6395fb202fe10b35c1b810a158dc476e19bd6b3c4c5
SHA51258a0104e559280461c2ceb258822ff6d2ae8ff1a3a52dc535cc3c53c861eaa4e4606040a59d8d74f2136929aca049ee769293fd9d434c969f41897e30d810fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5475a8f986a98e0904f7b8e589db47420
SHA1e8da1df3bba8e8d535d745d412f9cca51bffadd5
SHA25635130fda0ea77a0217c22dca9f0227060bb8ddebaf46756421c384cd6b4a7551
SHA512b2b67df6ff73c45fea94df40471e4e330521a8d9d238a0ad084d48f2a79d1a5553d3f2cc326f58eda85d62d756e7f698192ba0db893449e7185dcc4f8233f9af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58a3c8f2d477bdac40564b154d501485c
SHA1ac1adf1b0b645db164f0381ef44a255a411f5e53
SHA256e8071ec28a91755b4406a4e0e1aea6fa7e3a20d641451309414af04dda420dd0
SHA5129cc2ba00453d6c7f04a341b119e0d413efc33697a779d7af88021429a21b95e8a56e432cd53439c2cb660b99310a39a07feb7312719d00ea0b7d1b45c14750a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD578eddb74e6bf8f44f38f4a1bf65f92c7
SHA1cc5f0cb68f522f66893db242df0e5e8b11c7a5ff
SHA2560fd852388412c1f615286ae824f71bb852ca1227cba40042414962a5c335c18e
SHA512262f14dbe07a1189ba6f6b9c9789055acc0df2c951ef09f3d58892bcb0e6245f67eedbdd10e09f2c826a32bcc6475c5f5ad708011f0f02c350d1e03d69559157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e54801b482aa536b18180dd3c66ad1e7
SHA1c611f47288ab2d9443b85712354d5181193044c3
SHA256e67189c9330fbc9c978a7d5a52103fb8eb162134da9341a9693d251134a9c9a2
SHA5127139e9f6a3b0b0bb413b56517acf2953864c1dc4b98adbeb275ec419d6b33802f9fd47752458bff9c98a611ab8c20881f5cf3a86936d880b1e5c26ecf6a755bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD570124008feb40a7297bba9a7f2fa6126
SHA1f6565bb1b634c238046d057816bf62cbef44ea23
SHA256acef032874474bdc9a23790ba5a6b24f19ab37276aef81782dc21f75cbc3f971
SHA512e324a4c833cb876ba9dc00775273978c33cba9546dfc7dfbc66793eaa7b804c3efa5554bd2e8b58a8cc3df342f4167d9d1b9ac76ef987324cc91e691442a403c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59623bb0d11023c77d10a7dcd8869bd9f
SHA124cfc20c72b557b47fb54f420b155613939d4f9c
SHA256ac862360766f7e33ffa257d9ffef2b0166c6a28a6040aa0b8dc521098d329d32
SHA5121230c16720f1297b212620550d1843cefa71f7659db258e8a51bb4a5117af45a70abfdbfcafb59cdaa5d609729a643ce93358ebd4cbc6416d572cc4e76b9c198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a9234f6739c2be02b1dd0c490af6eaf0
SHA14cf179f7a5511976d0561a5e8cc177c8a5235eb6
SHA2564e6dc85a212d0f82a5f221bc5d7897b37f8b16968f95c4b3d0bbeb30926b0406
SHA5123a2a6a08b35edbc5af04ae8f9e63656c7ac6eb29f7dbad096a16a30a2ec3e85752568be956683859dad299756793300a1a9bc1d39c72167cb954b04f65411abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d56b58f649a5d472c4ed0b03f45b6b06
SHA141f70e333397870a7372274090916ebbc020f779
SHA256dcd1cf51f2d120d8ebcec8c18ab35fcdd79e4b4db15c81e8bd7fd5a70a3b7be2
SHA512b573933cb247e11371c3ff19ec05ac594145278f5352c7fabf8b76bfb058f12818264bb6802c54bc73e75587537a98a00cde7aded59f6b95ccf1c469a14b4c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b5fdc3d88aaec43c3d5870b72432b18f
SHA1ec098bd333c42f3ddaacf6930a16b5289e5caedf
SHA256b75b893e257a53f0b109f8df0e166076cc40ce003b64569195a2d69dbaba18c6
SHA5123d1ff68d216fdac8dc90d423f64892cfaa28e611c3c74c21d1b6d6e7126e57de209ecffaa1b28e19172b8dee0913b00f5e810852acfa2eee9511b4483c6d322a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53e6bf449873727d535e219276f7e1f2d
SHA197a051150910d63cbe397e75808a9f5d1e7dd4f5
SHA256d76f31de05ade07e68d82a87c95a42a7fde41d13b04e086a06d9e969cd4b39b1
SHA51270c1fea908ce3c2fc80eee03a6bf5fe34cc2b158438c34a4e3909c8b4ca956c8d7605069dfd4d93164c76ad4d66f57fc5b200e0accb1153350fd7a36d71b6622
-
C:\Users\Admin\AppData\Local\Temp\Cab343D.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar34A0.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a