Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
6a548286d6855967fb1245a3e2a5aacb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a548286d6855967fb1245a3e2a5aacb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6a548286d6855967fb1245a3e2a5aacb_JaffaCakes118.html
-
Size
3KB
-
MD5
6a548286d6855967fb1245a3e2a5aacb
-
SHA1
1dc4071b56244589db286032ada333510199d5e2
-
SHA256
764deb3bca2f5b339005f8eb49825a299bee5e5f17d630c8f6a73508d162ee99
-
SHA512
b1a0d976e5841aecbace95c62835a843288ff37330110ad9da6c5e5c8ee760984d7d77a2844985c11bc151ee325dabd9d734f52ad188faa3ad43d568514ce280
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAD51AF1-18DD-11EF-AE43-7A4B76010719} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004715302a13a52bfc964be6834cd136630a0ac0c0f6254de87dc97f1371bfe4db000000000e800000000200002000000078f8a7ca2e8d6a98bcf15df92be5c2e48ff2b1b7f2ed5f0d2fc06191b40c95ae2000000093e7f327c584bd331a494dd3d5cdfb8609da54bc1b76986e0f01711f504dabb740000000f87056ef41843c1628c8d4e259f66dc3be11925770366309f5368da4c43d3e61e745d5feec34eee6b955b53f16175c710d06eff25a70f5a658d6c0ba6653c8a2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000dbc712f505cd4108af3e64c1d30b4ec88ca40fca56f1cec997619b2c39368c57000000000e80000000020000200000003b38c7bdf3749a8c874720b5d4c14259e3e21e1f0985a8955ecb639f9794c4c490000000cb0a9dde07fdb9801fd29b27cf70e8146dc8d67fbf3167ef26a12cfe14cf5002e6816e99a919b45e79d997b7e1b31579f5a120f1f191fee301e233e233d3ebfef0759cf5eeb04ce3456844bf93c37cf23b02139bc8686babbcf0e7d83f457cb903a7dcb6803f8eb69d9f23d72c2180ddc152f1ab21c52e9ff7523fe6e9e285bfcbdca180ac54f504bb3ea5cb17b8abcd4000000084f665f871945d3021a99acd2b7a38c52c67f2dc094c759fc58c7df1ae0ffbfc5a1e1d021fb054368da0ef36be7447de574b8893d6101355199d7ca9a2e73d6a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422614474" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b097648feaacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2936 1924 iexplore.exe 28 PID 1924 wrote to memory of 2936 1924 iexplore.exe 28 PID 1924 wrote to memory of 2936 1924 iexplore.exe 28 PID 1924 wrote to memory of 2936 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a548286d6855967fb1245a3e2a5aacb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f940870f7335ab74271b1cc66d91592
SHA16eb4ee00227b9b92b685b247930e14e32bb4be9a
SHA256e7ba03ad185fd5f9c0c98ea5c6cb05265a73d85c8b859bbef34d3a42f626db9b
SHA51286de790f52bae06d576e9210dcbcb8a5a492da479e936ac21c9aa4fde76bf8d6aadc46f4ccc300c761f94e07863c82eb7fd088599ab3ee0de156dd95241fb03c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bed36075be7dbd814e2b4521c5380ee
SHA1f2d1dcabbce3627a7954668ec09df455e9bb3f2e
SHA256ef8b9882a27359d125d22a7f9c30d0b6b57902cec27afa6391395339cfa595c2
SHA512b5c7aa066f7003174ca436f525c5f80c27c9b2f12d844036ae391925809889ec4a85ab4a63c63f0085c126d7bbb747ed3535f12ce1d2d25bc0fc581405c69999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d09c7bc206bb83ab13dc677d9d5669
SHA142e5f870b2ef5e247c92421f1ff99df32b6e7f21
SHA2567ce3ee00523a8827818941c3abb121335d17f093606865db3f6cd6777a13005f
SHA51228da4c3896dd873df0cb90fc6dfd6dae1acd5144f4f88db52f7c0c391f46c9a95a2e6b06abfef81f02d516dde6eeb09e836bd3eb82d7755738d933dc9bc2fdd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bbe44a6c76a011cf974fd69d1a05cc7
SHA17b33385c71de43555e32aae2c21102559dacf48e
SHA256919145ede6482d1723185f4a286670caf92ca4ec9175a5186b544e4cce5d5dee
SHA5127c365f260be636ed6b448e2056806e28275ef6839d7b4b36b427ca6895ef6e56aa7ff9304b7bb8da9bcc5c312bf407efba7b6641cb54faa6d413497c9120bd9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae74e3b4077b0d27fff7ebea1f6d9d93
SHA14c6c74ea688c326cc194818e12801fb5efe278de
SHA2564a85071f78a4d1bd3bee11546c224937389be33b124dc1ded86440a83bdc9cb0
SHA5120808eedbf58de4f513c450b190cdb7d2dfdfde6451bdbcbef8cd1bd55eae821d6468356da8ddb7a1e36978c8a2407bea0c855c0cb10c61adc745315d97f0ac7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd583e331feb9b4852e66bc54f545a5b
SHA1ae9c4765275213ab882a521007d6379fcccf32f8
SHA2566bdc333e634524a538f9f29622693a120f579aa382073ebdafd796fae4f2e421
SHA5120bb1d5365fa9e5d25f491697689df80f8e8fe02a43a5e36cc313bfccf77bc59176eec68006b41ee472555273bda3d5169ecb73948e27eb9d273f346044d341b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa83f80348939e29b29f552d563afc97
SHA17d5928cd113999e367bb5b7e8fe75119fbbdb342
SHA25613ca11722c2434b6313374b36edab1a5a5df53f0bb280f43c7e7bed40bf9eb95
SHA51247d69eff62377b4b99b0be30d27da0b8fa435e0eda39078cdb1c578bc70f130e6acacc040619f4b44c81b930b7dcdfce6c6a7c43440f90b5a73a735786887432
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551b751588761e78b738a3d989f29bde4
SHA1610daf7179481b8ec51808fe13ec8da6d3cb4771
SHA256a51fba3bd39eeddd2b916edcd8155553c87c14cf5cbc23e50945a57c80485b42
SHA5127544448efddabb827e347871128f15eec804b04949925ecd9f636a27a6ebe12974b73b0474b581c720d0c667fdd8d410226bd5704c58a9b0c4205a98578adf16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ab8cf0c15805549e1e06deddcab7cf7
SHA120638dc958d2454daf24fdeb767df37f1e2a69ba
SHA256716ab2cbaaea3e3d7247951f9aeb11590a3f54202b422628d24a70c49980e93f
SHA5127a3667dfd599aa1806140fbc4c8d5b2bf557fc19303feedea54d42ff4888a2144e4121895955b35c80367255b9d5d840dae876b13f458fc15f2a71d9b2112c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fa9db5eb03d68577fc63864e2097f65
SHA1cd6779517cabc563a6cce6c10fbe72ec2424b8bf
SHA25612b747eda9bf9d4bdfa25a656575f047f1de99a77cc7ce85b6456f9e2dd53c00
SHA512dc29305173af9be154d1b56ef02aec03e86426d4c5fae4a9cb7d8caca038f59f4ea136b14b1f7084c5f42efd5052aa64f2d684f9cd0c5809f84c0d6c44339358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56297484baf05063e3007799f2d2232a4
SHA100728e91d1b7d6bd54d951a5e3f108e70e6aaf6b
SHA2567b05bdb99a69d358489b125931d3c2a92579db4acf98c6857b28af9a8ef07cd9
SHA512ae0db1febae3b9b829bfa8b7316e3b63b82dc679b7164aa9610a988ded33a6c2ad600d40a09c30a12cb74eaf517706dbf947c1761f048494bcac9e24ab135066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b96f39a510125aa27cbc219390ccea7
SHA11b91e7d5773b57b97acb75a206d9dc7bd436897d
SHA256541a1e5a572249de265d2d5dbc36082790a3a90cadef17fd27b91c45ac39e2c0
SHA5123d505de1742497a11306a9cddf06118ed522c1a8b2e3748eb7664e254800b4b4310f5611faeb73376bc6d450cf102007300c2ef2b17bdef113ac9168284f6341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5074d28856ce7299a12cc34ed58f8fe1d
SHA1cad29dc92b6aaba8f1dc7ecef0b8e5766c9e076f
SHA2563469839767d342c60194f1bae314bf672bbf36fe9d1c091fe26b73653d76a79a
SHA512a630bb266cef838b0dc6104a7377b29f263717dd1ff81b4eaf418957ca5cac899aa6ac55627b36413dff0bb712d3ad7ba36a14534032240353ddbe70e95791db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beac99622d8fb37631b5715aa6e6f4d5
SHA107e7cee8eb382b64e2e8d471ee1953cb2ceabeb0
SHA256b82671ef2c4ff2fbc610def10a9d94104c12c04d85c6a84d2c11ab90b0394953
SHA512209a731225b93c786b2ceadd9e927c19e0a58ed9c5d1d2939d6757a69f9fa4aea4a611a8b3558997508bf7b07328de27ef3b4c7a098930d3f9b6ab63ae5d4d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f91a57f812f16611eaaa9d25ce8f2ab
SHA1ddf48a5bdc783f057cc515c3706e88e5b2c1d71e
SHA256df84314ebc8794f5e0f3dfc238883e61c51c4251df8257c33b0a1048aca44998
SHA512b6899b3001bc038242d9035b71b5b29e8d62b1c3b6953e7f9461ee5c1f0919c1c92cb681f7c662542772fc2340cd5611c0866b6c0c5c6c138e81b49e55dd2d0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ae64236eeb9c3228149c6fe33add730
SHA1dc6bff267d158bc815b924e4f08a22acad388c16
SHA2569934aaf48bf48f3e07f8e311fc54997628540c1fb402469768d604915cb01e9a
SHA51258e0daecec4047212677da51ae8cca0910cb5e5a23436e2742097eae5ce8e090009ffd510c7ba4affea677a1d01adb97cb2b809036f77aed96cca8a8a0809ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb693b069482166aeda49730539dca1a
SHA1c59ff65a346248dac2469172a84fdf7fb3fc3844
SHA2562bf4d02b2b7b09895d52a44c432d689338fdcccbec5230efabe2d50aed06467f
SHA5120f82d76e5ba112fddad8a64f8e367291e737cc4bc07a6108910aac069782771f6ab83fadeaaff476c7e615a56b87734ff3320491d89d150f5c31d0d09b15197a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518c71884bdb9c2a939ed1a309207e9a3
SHA198bf8df740f025b7ad6052a16242d05c68aedf1f
SHA2566bb32f7a1b500a0d764f3058594941150507f0ecc90593adab9e8563d3c740a6
SHA512432c83a208f63cb45ad440e72687bc375b28533789abbbcb9cafcfb79b93ea891941bed39b7bcec34d06934f0643c4ba346dbf5e82df55d97323e65e2487e6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7aec1dc4ab8943eba3f72bfcb8e5b20
SHA192515362b46f2fea14c19af2babf9e11b1e5eaf7
SHA2561da0447aef039f767ac90d97787c1d15a3509283453a88ac1f00e068398abfa8
SHA5122b82657744461d99b9973018912149269b6c97a6f3adde3082ec9423b9f5f24777b9081580bf2ed91e21c1e34007b6b872bf1aacec8f93061549ce3942c409c4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a