Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
6972a233e6e312bfa1975668ad9b2b6c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6972a233e6e312bfa1975668ad9b2b6c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6972a233e6e312bfa1975668ad9b2b6c_JaffaCakes118.html
-
Size
4KB
-
MD5
6972a233e6e312bfa1975668ad9b2b6c
-
SHA1
32033442d2fe5e074188dbc17d8291b30b538120
-
SHA256
89fe85e4f41edd9eab5c36827d0421085a213e95bfedb863e0688a0b2a612123
-
SHA512
59a54bfa6fc425a3eca1a6b8aaad6f582d79647e3f6c192dc824b5aafa50d6e2eced479c82a27755ca3dde2fdd68e8e4f69f8b9e094eaf84c0b1ef45cd9142b3
-
SSDEEP
96:ziEEBCmV4MSEPBDvV0n47ej/hgOKiljTR1QnyneEh8rV1:zi3BdV4GD8/h/KiZ7Qn/EG1
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422593204" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000068e26cf2a6d94b1f8e13485479c57a339a215058161c04ffe8bda513cac060c2000000000e8000000002000020000000d453a53352e2445ab5e1c8882065b03437576a90846592e7039b67cdae0f9b1220000000ed68920e5b2fc2045368542eff96cf8cfa5966ae3689fae457b773f98702f7f640000000e7548088851f102f33a25487fd0c8675e62c91dc3517f45bea8a0e8fbebd66f36c6ca70f65214e7df9199ca6f93e30301764d2b78906917f48bb9a37a2c910a0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0291ef7b8acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000016887c891fea2fa88c341fc4da906174b0de649e9227a961628a6f95083d5f44000000000e8000000002000020000000e529ccb6fb5f06c1a168bd63d30335f87a81e57e54a923ed0251b253025ca6bf90000000f907d04694f7a4a8a242ead727056ceeb9f2a945c44003e65a2b1e2c9c23cc26777214f9abdf8252c71d37f196f908f6153b15bf0bd15932eb39bf8487cdec5677bc577df23ee18d890c96fa897c629af60c848cdc60c36589de63237ac7837b2aabf733467e2f4414d392934eb8183163337935269e4a236f8e09ed647f45f70b0633bc9453894b57ec5c9756a299f7400000007a78a378c6eec264ada606d53970328af5e2c74926a91b30b833b1c03f0f8831d864cd4c73af1e64f8de7a528bb1d22bef91dc7587f8d1d52e8b36541644a45c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{345146B1-18AC-11EF-ACD5-4635F953E0C8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1764 iexplore.exe 1764 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1764 wrote to memory of 2892 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2892 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2892 1764 iexplore.exe IEXPLORE.EXE PID 1764 wrote to memory of 2892 1764 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6972a233e6e312bfa1975668ad9b2b6c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50eeb7cda5b55244d3165131fb8e29c6b
SHA1b28f21d02ccf1ceaca0cfe774b11b6dbb489149c
SHA2560d0abf7aff6e88e484712df4c0f05fa89df314efac66cb525fe57315ee8b7278
SHA512acc7ce8ae0d2dc0894ab1382bb9e5344c98d6f93b8107fe652aed93c3ab477d75f005524a6538dd21da4dc2b3a320854a43649370acb7fb3cfec2997dff02c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5100612a99b4c7b4876fbf3770d9d4084
SHA1997406448e368f4fa29bc9b3b6ef45213f749333
SHA256827734368ba15a90776fbc600b9ffb9e9b47d21e5ec6fbc38f1370ec0248cf41
SHA5120d3795835328592ab272b455b73a27b9c98be4909b46bd6d9c3dfd4dfaf3c0924a741ea2925134cf20404444694b6005d7e2c06c9b3779697ea108df630b2125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51bbb45117cdb5564672abfa40295e2fa
SHA176108a4d93aee5f3d56cce922dd167e8fbbfcf15
SHA256294fcbe6accb80f1b2496bd32245db2428e6c11b4ada0d7299cbc2b6b7b8f881
SHA51268eda7a4868b54ae55c98eb415ce87660877151dfdc2adf6611bc207469a03699f0626d3c2fbd8bac54e22e1e7bf9917c0692948898abbb4dde61acb2248d9ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cea5fe05b95413f4edce29fb33d140ed
SHA1099f213a8a47fa6ff69c6ffe40745998c536c5e8
SHA256d48819c00a784f41b058d2b29ecbeaf90dea552c8321942d1e0ee647e16348cc
SHA512e02abe9e6bca3e6af77a33e3f58169f49f4bb93b7699001f6a5195c455e15ce96b11cd22e755bb26c6170e4976fa229900c160b65b0500664b81eedb8739b926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54be1f28305701954dfa66af33c6b4193
SHA10feeaaba96c740f481e128d72e4c992d30fbff02
SHA2564972406704342525542c6dab9009ec429f428b023eabca5ae7235bc74ab6774a
SHA512cc2e3ef8aaa733be2e9de283c74e722c7ad30ee2e3ec9da16fefa0fc37853d739b73693e94329b5de26ab6c52363978c426dd52aa859bc3e35d14f14bdc0c68b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD545edaccacff7c9705e87220abe3cdcc1
SHA1e06c351ecaab42135c8527f7f034d7eb38870fd4
SHA256ad4bf723c50c14b2e8e05e6c73d7cde359ab0f00c5f35e2389ce9bd6abe5a1d6
SHA5128bd4eec0d3cca5e7c18a56dfb39aee7e0c4f4a50a15c79a5a581f152537a60032af9a20f9c0d58c3cf89277ad863e3ade570e69abe649c7520158a33b25edffd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53c08dedbd1b20e55275886fa42eddfb0
SHA1ae8d025936a706f82067dd29d7afd64059e5b3aa
SHA25609c8267b6c899eebf14fffc3d514fce04ca395ed63ce93ed3aa3fb510d8c1944
SHA512037fdd468fd770b4429d14ddf033f11d0cc63e0ff94c53d03f7553c0d9e45bdf745c5de01e14c0cb0543ea7e139c7fc13a94180601891d56d7ade60bad36ada1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD520d22f600e867bcae40bf16e8e59bb0a
SHA1f79ce0f896e1774348848dac20fcf292ba272e50
SHA2561622be8c177c8f1aba1f257f4cdfa69f9d9ad3fd222fc946eb7a883ca313f762
SHA5125021f1fb5d9d06bf4a22236d6c20ac48a93f7a695f93e7c018bc2e418a2ad8c46221d5c50f85fbc96d6cf846e6c586b0be54f77680e3d82fe4e21bb983651a17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5098e30d5dfcb0c35a5f345abf04ef107
SHA114661d76668060de4f13b954c45b573945fa3925
SHA25635351ddc3848f863027333733b40c499485ce84ce2481c0ebce3b3249ac4ec9a
SHA51269958abb78136e8ab108d32912041624ff236aad9a2e9277f5d1fb8239dff0640c362afcc4c20c4210de21ee6e549a6f3cd71a8da02309dd063fe329b67ff402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD583afc67957af4ef7c1373e73ac751026
SHA1504ef9e17102804e6100f8e43c7d57de3408e449
SHA256bc3a8a5ef3222d44741b166bd97e508a8934b95ccca1fcdd23c46c0dee946e2d
SHA5124ab2062f41fc3be800ac45f810f593d173ba74adc52497f930b605fda8c5ed6d41174dea258fe663e77b95498e7e2e170efa3bb13f1f91bd234bff6374e3e6ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5014de740963c47741f86607ed38e6189
SHA144afd4de7fd347834559a41db774954e16ff06fd
SHA256c5717bbc5b1f8a6b0f26997e5013091d0fd9f524addd8cd4c8fbc7effb01676e
SHA512cd827d6baf1295b93154e24c48d8f2140d7557d710ec03dd749324b04fac66c8ef7996c3b66fd9515444d11f1ecdd942b4ce7e31f57f05c6f3529784f95c952a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a36cf610ae51305b9f1709c9141724af
SHA140a887fc3a4181e37426feea6bb95b8356306e08
SHA2562cef686213ab15db9c0e855ad2a1fc94cd217437d3ec527022336abed4f4d1a7
SHA512fbdfa5cc767752a591a4c1bd97739faae6d68775628e5cac6168d43ec5a2b0397147d3d0780effec17803db3206c9532f29abe5e9ce19f2c9191954fe9a57307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59a8c0b872acd85fa70e1f8861f9f8b1d
SHA10d7a942b843e42776e259d226bb3d373f5fb31b4
SHA2560a0a6cf9cc4ce5d3a76548558cff3b469ddae6559c73a78a608c18c423fe54de
SHA512b7a20e9c9ebd94b044ceefe491252c5d3425ddd5d974dd7d30ca249ca037b42d1d587adc0a54cc027823dfad7f72b768b27e3525472b4e330070120b1d998b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b5f1508c3c1913ea4888ecc32f14edd8
SHA1aea93248ee4658b6016493fcaa3e78b4f3f12d6d
SHA25628d75812844d39075ea1234c53d78dddfa2f1cbf89036e92bee22c758125cf3a
SHA512716b1308c63b0d7f33a54a7d9e264fda5172281000e57319559eaddf86ea9d3ef82580902af8f02927625118a968135cdb43a965bc7ce6cb5519328fefda4739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59bd50aa697cb551b90550c501826ec6b
SHA1d89f273a8fc46b0ff101516a66ab837892f3bc54
SHA256783e826b7d29843dd1a7df7c425cc1a3ce0ab18d6c16d9ce80b0c1566616edf0
SHA5126aa7e96e58f4e4b51515745ce8ef198ec61751e2ed6dd80a4e5d59dc321831ddff9cfc2d53ded39d93939118535192f6700fcead39f56d3c54eb8ac43709c97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cf8f2143cbe6bf17c118882f2e10e1a1
SHA17f828a77b06dc9204a754c4d2221d518ad43d74c
SHA256370fd8b485676ffa1349bd51d416e334f7038ee51c9b01cc53801ece5ec2f222
SHA5128f973ba20cceb9b597d668d6168fc8248e05851dc6f12c26305db87939279d0d0999c344eb2ae31e0c729a1a42148ae8cdf7d1ebd1d865e0adcca7d47e647a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54ac4141552e4a353f251bef5d206b7aa
SHA1c5ebc9eed8619d5c2ac60c72f00b8c6decc2f860
SHA2568609af6a0a767620c8e15b452994daaf243a1899782607d53e653c1149c472a7
SHA512b76220a57c33264701c05e4e3289a579f382193d2c22dd606e2f9a2ac5edd23fde158e089f6090ae57b504a8a8960b6a14eed6fab074fdbd92a1eca3c1b18f38
-
C:\Users\Admin\AppData\Local\Temp\Cab3055.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar30C7.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a