Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:51
Static task
static1
Behavioral task
behavioral1
Sample
6959ad79cf5080f78188507530025211_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6959ad79cf5080f78188507530025211_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6959ad79cf5080f78188507530025211_JaffaCakes118.html
-
Size
214KB
-
MD5
6959ad79cf5080f78188507530025211
-
SHA1
260cd2348cc054e97b497edc1efed1a1a0a9172d
-
SHA256
7baa4ffbd8c8f69bb9227d971f9f9a1078ef7300d3c8c84c7e48e1bf541e8403
-
SHA512
b472abeee2a7b3eb82f4b6d2cf1c6df1272ee69afb71b1f6bbac5f282a9068200a2121cc6070cf76d3b0a2bb8ca27bff4981ff2bbc0e88262875b6c1a5d649e4
-
SSDEEP
3072:erhB9CyHxX7Be7iAvtLPbAwuBNKifXTJe:mz9VxLY7iAVLTBQJle
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06219561-18A7-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590978" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2220 iexplore.exe 2220 iexplore.exe 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE 2296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2220 wrote to memory of 2296 2220 iexplore.exe IEXPLORE.EXE PID 2220 wrote to memory of 2296 2220 iexplore.exe IEXPLORE.EXE PID 2220 wrote to memory of 2296 2220 iexplore.exe IEXPLORE.EXE PID 2220 wrote to memory of 2296 2220 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6959ad79cf5080f78188507530025211_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53891230049a2ddb0c9a52bf8ae485c41
SHA15a32276a91490e89d5e778f75dbcf3f59a157366
SHA2564043a8cb2da180ac86c099f48565ab8ddd59ba770b325c061d4460d7f160fa5f
SHA512d60b60b0b1595d3eeffb197734049ceecb70d1749a7bb68e457e6384146a1f85aaa69ea73f9915492de8b0e9f8a1cbd06ee29c310df03986cf75345cd396d140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd618a045f85ada11d5654ab321a4aef
SHA1104840f53f3f44030a5b5ab5ca06b8e7e9d00ae9
SHA2569bdc6d601bfb865b8ca7bda76b099d195de2e12a37c128d8da3724da28060b5f
SHA5127625fd5d8c888410a545a4934841bc7cf4ccb4ebca995053025b828e18f7a42bd042517400e990e436eb73c64490c1ce1b14ba47051327a46bfeb0d3dfa3b3a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcdde5836aa8d71267c78cfc3a364a8f
SHA173e6e4fb05756323a79f2ee85ae7f0c62b2f9f80
SHA256f482337e591f9d40c5a52de4e13a13d70b600d23eea1d7823996e28f4462f346
SHA5128b662ef32709f8832ec0c063782fe339b3d05707d61be75b639da4afd4b2039b2a9e35dce3ebb13df60b7833b60999585d142371ae0e230d289144b511b88b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ceba045c48ad77a08328a818c313aa4
SHA1d826b26e05183d902325e6fd07c516a9e1e9a6ec
SHA256de300326e48a83f593c53bdd0d05ad3a75cf835c52cdc73b45dd1ba6d88e4d65
SHA51297c86cffb3a67ff700723c22e975dafda5764be17f5e3d0747bd7ea9f8e0df8f8615ee7ae2db179c884dab2fbe4835e45e95752e55c03dea4994d4afc108e232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a924fde13fd5fc54eff5404415fd613f
SHA1b0a9cda52faa47667ee8937d4c7ce8347f748748
SHA2560d0fa50e7c540aac34660cc8bd13d3f2d7753e49c27fe5deb00042b8e651ba66
SHA512eb997322e2a1abd3a3c9301a68846453ff9ace479d633aafe4e4817116d7aafdace77f339b205da15a206986bd8c1aa1331ce498b72721fedbb3d2e8a15b5aae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59909dca4935eabf36d6941bbecd8e431
SHA1b6080fdb080cad141de5a64f28217559218cfe00
SHA2562ff39394b68eb3801e01b35a81b0a50bb8cf4d000c6c1ed1c37c3519af44ee83
SHA5123c917d134d880b95b87fdd4d00e31751b89c04e32d8dbec255210347b5f12ef9ec0f7de5a98912b3fa12748562f1faf46b417b9f3d5fd101cb717eb36dc137d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdaac5aac1348a04c593181efc912ad9
SHA1de41df7547509c099037950f7b56cdc356959b17
SHA2568854a1ce125a613f89622e635c547db7a26dd9edfc170acea572a21ff3f001e3
SHA512da28a2d31e648fa687f4f6a082852035991a071d3a50b67dc2c4501af450d28db696b330ff5e74eb62124b521922046302a4ce976d6a3a96c57833249a8dc15f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5050675428af70169a32b0f68ed3c934e
SHA11099c080bc294823fc4f88a9f780c573e2c2b081
SHA256b81b805b23dab0412a655e27a49ed397ce6e14008b393d523938e5997696af5f
SHA512785a7b3c68a5bf10eee2fcfa8602750bc8c55780259eb1631779c6af62f4543edb91c8d21d443074a07bacbcabff1cedc845d3ad6b6441b2f19c8cd3297b108e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f5c7ff35ed21d3360e2fff317a2afc1
SHA1b7b83ca77c5982eca7f0f2207626c1ef56d400f3
SHA256e2e72567917a7aa4ff9107a67ca4d4f8cc10cfcd0b0ff131239bc9ab1ad2a23a
SHA5122219606530244a00c4d9c0539e286bde589360fd047cd16060421da1fc05fb3f67bd038c19ec976cfce52601a538556e3858e413c59c0eb2037a8cfa3d3b9921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab1baaa27f1eaab52266689cb1f7251
SHA12f6c0b820c7dca140272fac341716ddc873d64a9
SHA256e43965b4a325886cc6ebb4ae9aa6b2dee14353bcc1dd4dd81af6952c2e90e663
SHA512c499728cb4126981aa16fb34c2540ef86b2a65c6b3ac9dc6eb416b38be0da08176f540878bfeeac794b027017e91a66f355e1f9c0d3430d3dfe3e7a6c72c29d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6e67edfaa1d7223e96f7b859cd03ef9
SHA10e222574cb07e4b0803939c091cb381f031c9891
SHA25609c4efca7f83b9436564179b0e0747210461206ac223b1f321d6813cce2b0056
SHA5124ffcb9f575531c178a5086b3300c7f35dcc2acb17692318e30501ab54f5f2f074d98e07010de80ae01008d3c0ed799e0bbcd23d14d03d10a6252b3b40debaa7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fe6225f54a5efe5a31c5c906c10c3e7
SHA13f3cddbe4429879dab0321e9437cb6ce8a20ba2a
SHA256547b9c301e4e0027f1ec1e0759da3dbca159d3c12b2de7c7c1a6b41fe522d0c7
SHA512d647137479247a4831747911d3de6428f383378b61b21caa185ac9a1967b58774392dc133737e4998c4a0783e0c9f4de953cd52bca3f6701729b05abddcbaceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568fd8ae4f45493a478e80ce94024a2bf
SHA125a2f8910344d590b3f50ea74c63a6638eaa8e8e
SHA2562ad3b5826ecb6a836f08db33f5d214e5cdd54a75974d998824409ab6cf8e85fe
SHA512da39aa83b969d9613c2c66bcfe00d3053a819dc5204dce902c3a89401b641c90955534a9708e8312abc4a937fb2c4e47327b215e14951056ec72da3667b2681f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53aa3cb7891de42587cfd8d582a3ee781
SHA10b00d97ac044c28b94f1ce097d2cfbac34b184ed
SHA2563a02caafa2df40ef219cafb5931770f050d5c76c6c57a3001f740cdd729b05e9
SHA512602a3ad082d96f247c8f577cf4ed52eb90d6c6fb6cc2faa9e9176f05f5beb0d9c0199b05c8762083b962d3b7a40090086c14eceedf38412b90675be6cba2f659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7763b717774ba9b2604b0c431783f9c
SHA101f6fdd7dbd31286b227a384bbe5801ca87c1d3a
SHA256e5d55495bd6c8383702c59f33a0201adfcde0ed92a68fad38b32569fa79ab788
SHA5129cda6b68971563bcdbd356a3e192c38d34d64515ccac1b05b7f8fe870644d0ccf30570b2df25bb7e86f65a6a26c7a7119d374459231a89a714a05e09022c510b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac6b6ba843af6c19e5fb57ca2dee26b2
SHA1b9107fb7c32d0830e6f6c0b041ad7f57c83e4f15
SHA256d715df127ec04141e28e753b530cfa1bded36751e90f2f803c4aaa80a2c08afe
SHA512712281448a4e6c4897c2ddd6a365aabe93e7353ad529932a85cce62ae47714168bff497ef7cbffd4db0245985e038f199ddffcdb83abbcea14ccb2fcfad60a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512b2a56eb06d6d1ee78259af86bd45b2
SHA18c273c9d51f9e0ed7ffdcc756dc3bb1bcc1d3557
SHA2564acc847dcfe54e386901e5f4be394ddee72dec2012cf541ce5cfd60f4009db2a
SHA5128f259b26f0a2f7cbf74a9a8ca35349a48bd5e927846889b114385ef661d885d4a58eb7a936c84f1303b68411a583423dd588eb18e24e53340ac64cdcd5d7cac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68dbc2c2f268335643bfeac555b62b3
SHA104b78767acf79e2dea347bd1f19ce89757769378
SHA2568b1fee8385592d9a03c1fa58c2c7a8c5a3fbe868732c86d70b7ec173ae5c9e8e
SHA5121b38e3e559b19876b1799166d5b2e944ce4c9fa6e8f9452270d849810c6d5db22bc9deead7873468cb1bc72a0a59f559939da8cb75eef0c877b33f81a8cabf34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b59b3472aeb087e421779671451d89da
SHA1fb72a77cc21282262746ea39fce9dc2d02cb6ff0
SHA2563491e2415eeffd76074f11add49cfa73dcae374b2b5332ed8985eef7ccbebe02
SHA5123f46975787efc2937be8b4327c46c90f08dade2ce71fb06aca2ad0ecd6ba86f236bf534ea733f5cf9aa0910896022b9ed4c5a0c3e34281c2ee053e64bb6a34d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fab95922bd2e704901bfefaef432cd31
SHA169b4457679aad25a100a87bc51f3de90f1851535
SHA25630b8a8a70d4e587c01ca96f11fe685b80f3d41a4b381b49eeb0e35ce040e8c43
SHA512ceec142780c74df731d5617d5ee02a34ef85f065ab343e69290a30fd939968accabc9ff92a538ab597d03fd2736ae38b9d6c91720f65fb3bc24cd60df0a94030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b176decef282ec393131ce00331b559
SHA11796589a1038020667d29c35daadb94423c32acc
SHA256e6876225af505992c072f43056f4e331602f6d89b312f8ff841d2c8f0819d5d2
SHA512b12604160420f9ba3116d7cdc89bbc08e6cb1aa782ec9b221b09ea299f3ba6a94b9766429f04f926a85146046f4566118997e2f40d03ccba9a91ff8ed0588b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5905be7ff96ad67a5b805fca2b1115d3c
SHA1fa00e4325217878a58ce9ba2bde84c6ff16a0f93
SHA25607b8db537ead430e5c3bbb0cc1446af6989381c611b6f6e441fcb82994752215
SHA512db83efc95a22315dc34706cde05b5fcc2072a3bb6f1d28b42dd60aea6670cfd17e6d6787a85409c5458994eff53021f9960c7d8a1763329addf00eb886fe13c6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a