Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:14
Static task
static1
Behavioral task
behavioral1
Sample
691afa206b031047274a87d0561c6805_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
691afa206b031047274a87d0561c6805_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
691afa206b031047274a87d0561c6805_JaffaCakes118.html
-
Size
7KB
-
MD5
691afa206b031047274a87d0561c6805
-
SHA1
d030c6478a53e2b9236283bd8a4e4873c6c368a1
-
SHA256
d1e11d1d0d8428e7f5091a216468a7bcc2873727e478aad610c19d0ef08d60f6
-
SHA512
e789ee28e87eda3069832d7723b558de28ac9aa9ed3e469f4f3512986c81875d7231e81cab9e91e14dda40bd263070caad2aa86cf1510bfa32118166b327c1c8
-
SSDEEP
192:I4hJITEu6u163w+CR0b0iog/mm1ib/bl8mHNlRqNymvFeRR3LxW8fkIG:I4hJITEu11uy9LvgBoA
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76C89B01-1899-11EF-B8F6-D6B84878A518} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205b5f4ba6acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000847242ac72a866a572200083c55fc6722d87388b561b4c6e3545b30298cda05a000000000e8000000002000020000000376be2913030acf8a5ab0ca10a0dddc2bf8fd1261c712e73924f228e6ad981a290000000afeee04c7461d1ed6ccbd7b20ca1fe7479b6f89048215ef20966b1681e2ec632e6b8d238c477a0f7a25cab2cae1f3ad37b425f3cd59e35337e6bb3a5814d54284dae276386dd1b05e1c6e64d458e5f877b9763c8446eacc20d849d0a4890acac1ebcbc03528e7c3c5ea5c200c3bfa22e5914c966b500891339e9fc64033fa178cce37074aefd4b37b8820cff59fd4a1740000000b9a70edb34f1f51f921f54116b43ea63b54908441552c0b8156e1d0071bd83bde60dbb0bd433e0711e234bfc0cf3cf0d17b758cd04e4b3499516c6918805611f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585163" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000804de4564e44221a17be98166bf7e6b3c93e0a950b230d58c1dfad5896e943ee000000000e80000000020000200000006a849f246c9134ec9279d58c607bbd151e1e90a16f2645e4076c52c843b4539d2000000080be01a08977495be3ecd0e9c303ebb97b23e21a8b51d301e8c88d95163bcca24000000080735511ba59cdb6e43f697af47db79a1bf6dd67468bcaaaa51c74523e361727044dd06c111683749918be399b21b7eede6cc4ebbc08a2fb06de0abb715e31ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3016 iexplore.exe 3016 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 3016 wrote to memory of 2092 3016 iexplore.exe IEXPLORE.EXE PID 3016 wrote to memory of 2092 3016 iexplore.exe IEXPLORE.EXE PID 3016 wrote to memory of 2092 3016 iexplore.exe IEXPLORE.EXE PID 3016 wrote to memory of 2092 3016 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691afa206b031047274a87d0561c6805_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52615dbd43673fdcf8426f26ca71e924d
SHA1636bfd4841f0b51c5027b9e8271077aa009a002b
SHA256f0e170207ee6ecdd7343a456c66f72c6de66e113bf32bcb9faab160669c990b9
SHA5124767b08bf0edb954717bd240d32a3ba196712344a19b1e448f9eea3bfa20a97fe376f4e5fc126eb8ba8cfc04b29948c0510adc6f1e4817358124bd7da16bbead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541bfc004c34d13dc5e6e92c957b4363a
SHA1935e79a7629b2080efdbc89eaf19316fa9ec6b42
SHA256816368baf4a489d76e6c00f9b582aaae2eb480b9b794e0daf4e660273642010a
SHA51289b1abdaf2f534174d0f83b80673ef92593703a829cefded78599cef8c169fe455b5b34a0b19c6c6433447adf88f6cb6fcff20cddfa877b5cfa7ff6661928a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a726af4faf0587ef516e4ef55cf5028
SHA186bfc667c8b9dd1fbe856b6c77e7adf2997e4b67
SHA2565b97423ca5a562cf05de61bad44ef1067fd490cc98295dd75df72668fd4ca35a
SHA5125c9745770699a9b5b04d8e09fd3fc0eb84791aefc64091bd3f6de68a34dbe700d9b784df24666ba636f9ad00d81e24b046a27e260ded5f782aa8fd404777df26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c784f5ebfd167c7ec22308bc5de2f02
SHA11843bc3444abfe0cdfdb7e74d1c82d76156165d0
SHA2568303d7faf2ba58d155eaaa8224ec28b107cb441234416729a1289c6163a3b239
SHA5129db327deaa73cba81ddb67e75f76dcad961c7c6ba57b73fda505c1fc90254b0aae7e560966205c5ea441f27df5d3a247c607fd76589502b0b41782778e329c8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582d92104758692f21d8040f0d60b2c76
SHA1276562d54fcd5fbe6b1233b6f69fbc342e97e5dc
SHA256f827c0117f193b1b46db81483e93be7c8848e9a35cac56ec4cc21b5f97826ce1
SHA512a77c525b37c07b126a6317b8eb9bc4b36524077d9fca318db3be69d48de5e77fcd7f5922927e4606e081eb0eaf1f5fddbd3e6fa7a564596ede661885f56c594d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5455e22daf9c45f7e17c4d1eefb5623db
SHA10629604f58bbd9c159fa1a468e95d9442e638c05
SHA256744bf5eb25989b99dcc7b04558001aa3896a45ed12a31d048c62a2682a8c5edf
SHA5124ab545476c242251055eb1f9d17a076c620857938448aba66faad0bd9b31e81ac0cb0356856d965cd22a0ae63ae19dd9cc1a61565c40199309dadd51f2a4067c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9abc2189cab71883676146f96d222b5
SHA180dfcfd3b0a7fdc5499039d79a4a3f33076df5aa
SHA2562ae28db3b704e84193be695bef72cfa9cf5cc3841e1647434e934e8605fd51e0
SHA51273647f9730f39e7df403f00748e2a54486907e768e9bea31cf1d0988f69059862fe61c658ec5a623a664b762c0df61b5851ed7f4e7483d546867efa010866f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d22b28ea61ae99ee3ed13a3da7c6baa
SHA106c6ad684fe23e08c889de0deb5a8ac671a7c74d
SHA2564e670c213037ce335c8980feb1b8b6147441ed8932ca151975cff4f8bab2373c
SHA5124312a40d5a2c0287710537ff82bdb68f58a947359e2d7529a284b0222041f8fea1b5d8092df302203fa0756f2a62cdee962e135657f7b0fb04669abd93eaca97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c8b036280b80c5314ccb95fb40de125
SHA1ebd4e4d95b9c5e8f6640229553a29ff488550f3d
SHA256bb40d45bd8c81ad1f15a5409485677aa64b1db229decefe0f7efab01bb64c5e3
SHA512442a4fad176ad7e4c817db0397bb171dc1910aefee4dbce6f65af7fd50a5bc808b3fcd62d5f8c28e5fb3063147ff0eda22f223779560b4642654bd299a3f4331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce73815afab741da8ddfca3b02c21de1
SHA1bbf4363a792818d025586f3be8a31ebcf3621d3f
SHA256007bcff340b56bfe99e9222e8b773b8c9775959ba814ce8a44997da1b29eb14b
SHA512579e7887cddb70561f9e3efae31f50ecaba63f4e2bdb65e71568b1abfdfda5c0a38e78a2387c8b8fc65a00500db03cb1934c833be6d21a6abb17b8ce00fd9e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4e809b0de478c35f3c8330043a3102e
SHA135654449a885fd7bfce61e385b1adfe12f6ffae4
SHA256126ff0170f087a09a545e705e0c45fd6a47a9b120a2196daaf4eeee1f3e87040
SHA512b233c4850c844fb14896f1e8eb974e406591dda824dc857b5504c29ac84ee9c1aa3b22b5a0a3800ced42e3eee0ba9efa84058cb21b25449b88baf3971dda96a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527243d9c2c7146911198afec7bd50bb3
SHA1e3825030d622363173c9a1877d35d3f8bac9ab4f
SHA256f0d25c995927dc1954d13ff491c3e8b13219017e3311562f824b251d0c2d4934
SHA512c295baffe05fdef2090bf95cdf36632750ac212fd907ca68baa1da8f517a6bb30820c0f80cc26d86286898533b7c0861392af0913c393c77cf25d91e93cf4618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bd6727c61cbf0110a04c9578c240c48
SHA17b3fb7d5d1a9966c56dcb06553e47d6ab1a483a2
SHA256ad7ec6554df9ad07e06b048bc7675150ab54b650a47ae016be6f64d3aefcf623
SHA5124dec2652f98b9590257635a6a7f4406063d47534d9a6f3abe940bda10c8d3108913d70cf2d43aad5008c00135c9c30e6d5c5f90c172bdd36496040ba95d90086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57da77e2ade60a747aa68b88330e4f77f
SHA14162d623356a89109add1294cfe034ccff6b72bf
SHA25665e70343b654759873a84c1b58f712afbe542ab4367c746c45b03a7e9f23bb66
SHA5128225200dd6e7e8382a393f183c7231374a473bbb1cd869ee41d8a864515bdc3141863234b8eb1f3c640bca1db103839a00acd586a098432cbcc6c49691e991db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532a49cdcd969b1f073e650f81feafe46
SHA11c3bc6125e775cbd20ec0d1c1a5265b8bc3c1ddb
SHA25654cccb1069968d7f57adaae2b35f81514e90838c0021d613b2cb445e733a3e49
SHA512828644a85fc07d1b91c6b4beeaec66417db1188dbe037ad235bb2c2f1a3a596240ea2008c544501c6b78dcdd99cf9e45955067ab626038d0a710e4637841bc4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6d6faa18ba423894820972e78605f0e
SHA13ddcaaa7572d7b45b23bd5a4ef5f32dbac81bf41
SHA256c172a4efa73c3eec41c9404865a8649ce549d0c39bd169a726022ff12e0158d2
SHA512f9e05da8fdad444941f9636be03276ca77320015f54306d8c4336a56c35153a073d1100bb9ff9ba24ac7b17c2453e996bee85f534f1a66506950eddcad1fb972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5017f4e01331d3885f5db3181802fc835
SHA153fd1e4718a49fcb4bd7c4b3dcb7c460b4308196
SHA2562af1e75a0a66b2ea3d4871227fd060cab0978f9e95f789fe8d7cc2ecc0270c6b
SHA5124765e59b3501978c2a8072d0f82c6e1ccd47fb452ab9bc077dd94abc8f6d09195a658d8804855b7fa03d91e4af2344fd2c79a8b78a91212d7be34d094967a6e7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a