Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
6a5c64a395ee9613f829f8be0936dcfc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a5c64a395ee9613f829f8be0936dcfc_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6a5c64a395ee9613f829f8be0936dcfc_JaffaCakes118.html
-
Size
753B
-
MD5
6a5c64a395ee9613f829f8be0936dcfc
-
SHA1
313eb12cd1b4b85b3e141557b78bebb1a5df6174
-
SHA256
4ccd7bbb75ca7a3d5f471567acde56ee016ccc994031207c35e7aacaed69d19d
-
SHA512
827e34c32afac29d9c60e2605b2afa77d3fc9b04d84c16ecc92e12f0f44b5eebcb5d666c837a34f917fe0733190a6d3b540ac7b5f31ac6111c81e2e3bd72e1ff
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A98A1051-18DF-11EF-81DB-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004c384e3f548d7c286499752fa1bac199b568ce50b85e40913f241f9504f8a86a000000000e80000000020000200000004e50fdf98a40b3883d3f730dc00796daa6012de2903fd46660889e50538ef74620000000715e1ecbc5c7e08cbdd6e6f12f473ac1762f888c71720b5ea2eececfd64c30f640000000f11d0f2a10347c611c01154a264d0ad9965333eeb64175fec16c3a933cf121697005c98c24819b677f097740d79e1e7608a72220e420a8bbe037140e021977ab iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6033706decacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422615305" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000288a95c8875aaf3914a6ff40d8fb50672e6247a4d14636f4c4d56e935481ead5000000000e8000000002000020000000e615d4bdfeec6d5580d74641eaa7304d1e7174fd8be8ed89b1bae3355b434a5590000000b0e49a840f6f69dd0b97ccd6ddfa43ab1c54a291fd0662ae249126df4270f658a69ffe5cb136d7d2166fdf0e76474b1223368374eb58950cd6624f1a0a9bd06b908924fd7c622635d9a2a3a4d616dfda318c75a8f175e9fc1975aa21ac1ec9810d57611ca5c29e49fee7dac6832cb67edaff492e2615864fab41a2c961d1160c1c4aa62884a3e2485ae147dd9e7a825a40000000e800d1be781808bf65c71adfce7c91c16229d04d972bd3f06eccfae01b9cc8f04520ba2e863a566023526c9e61f3e35ff3ce8be4b250d8ba5d1bb249f4dc0cc5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2448 2176 iexplore.exe 28 PID 2176 wrote to memory of 2448 2176 iexplore.exe 28 PID 2176 wrote to memory of 2448 2176 iexplore.exe 28 PID 2176 wrote to memory of 2448 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a5c64a395ee9613f829f8be0936dcfc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552291d2ae8300d10ac9484620bde44e6
SHA143823dd3c31fcae6a7c982bcf2639ea111e554d3
SHA256d278af60121104c41e3d8bf9a88e57263036f568c7f19763ab322cb0e8ef1deb
SHA512f4d512a89a88ef02059d177bbf084ba14761d28bb5804e656dd5337845e329cbf5259bcba681cc806b898c868c454d09ae8c0e8d979b5c21d27eb97c0f41ad30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5707e5a423c1e62d1dab2054625050f1f
SHA1debd7a0b0b8c381a18daccc1df757815c4d3090d
SHA256f0176a40cc5b86b2a3bb2180e3ebf153f51bc6340474084e5d43ab4f772d27ca
SHA512418b8850e711e01223760914da2115ef8615fcf41eeaade9187bee81f5229559735a396b3939d213d122791caf797851e85adab08959563a8753999b6f39033f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6ab157989eaaf1fd41097ad2a41302
SHA1408dcea5b343d23ef48438fc9bd827d6af68991b
SHA256d4a331bad663f6096cac1173b18b13604b8e103a8af464e7f7a213db14de6da2
SHA5124ee91675a29a9e9edea7a715407d3647115286507a195fadd0ef2fa5b22fd034e7a6e83ed567caa0078a634f3f595f0495f5ce2c233aad57e1a607f3a23e6f2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541ea70e3a1190dcd876b78579e348bad
SHA1cb8c4f5681d3293426647cd4a1bb74a17a774ed1
SHA2563bf388ced5abe36b126ce99121f67670a91bb126b33ee50b79ff0f13983259a5
SHA512d123a24399eb788e58a2c4042fe78fb8ce5ef3cf9d255a42cb9c93af9ddfeb06b4e4cc9603e0fc3d6215659506f147acd9080c438e0b18929b01b39b44854d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b15f7c5eac899bb7a332bf1de02b087
SHA18f382859fdf6bfacb344919a6de9d14963aad126
SHA2567a530f35f672c08ae2c9cd0f1b359248108f5833b58b1b82853e8d2cb13e1cb4
SHA51299db19196412aa436c8f4572d52a3cd85a6e46d4412a80301ed1456abf29812c1d98ccf441e4495da0a4956f7f54975d22c3460225b1fe6e26e8fd22ac00376b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c5e13c466092ecfd0ee61aede5f1bd2
SHA19be887911a0d426b920bd3cbaa90a2b49306a386
SHA256fa27ea2acb38c677c299b38a3dc62e4870a334aef2119d56b010503cd4eff776
SHA512f9caa0b869809033befaa0b4bd246fff88a8b066a134b144a39423e36681b964ca6425ddb14dfa790ae5f8b60e7e1419ebe6270e2b418f7d12b59511622d5d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4f4dce630118f71dfb2f1f7f1ef89fd
SHA12c528ee899664b12dfadd6415e0b383126ec59b7
SHA256a0f95c1092aaea9c4bdbc4ac0b201cb9b560ca1e45ac666d3cae881eb3b09cd0
SHA512f3a9168c5b8e9da3c6a871b565a5d71b7a10f45432bf5b6a579ef5f86fb18b3690c8cdc8ed0752fd73dca61e65e171e31da01adb07400d25f7bd0c39e67ec3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6ed8abc5e75b744c83c9b77f429026e
SHA19cf93f1b72b2e21950282e77fb31f16595bd814e
SHA2567692b0fcf85276172cce0cb68be4a8e88c3d17045163e240b73fdcd8fee7fa25
SHA512388f68207de2b3cabe6a879ba6136b7ec505dce9f69e9ee7642e79c0ca3b73779792fbf846388efd97c8fb57ede9bdd1529d05274a226abf14ccec4e25df17c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5995b3a9a4ae2e0c707010d315e2a841a
SHA11ea9a01a995b0edddf2beb5792b4b6bb55ebf47f
SHA25617e39c5e363aa93a21e7f2477b5df05c865337de6b942760e09562cc0c79b908
SHA5124f1af21de6a00befd2eeb05e6c14e7c1939b61d728c7b9f8aaff218a0c5638c4a317c60ec2d17797a040b3bf9dcc9451f483604dc772a88114d3901dc06e0825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59808d195026ec33ba3c695157ad6341f
SHA1ad8b7a5db0aebeead90c070654384dc9c9960181
SHA2563c14c158a405bb87c76785d4a274c4e4cd89cb44d4be0ea7edbab371609c1e01
SHA512722c0d8c3b1c720e2ea09e8613546e51ef12bb4ebf265c3cc833440aef562837096ad695dba52dfe2a81f7c322e480487e04ad92b5b16712b6667715a9b95829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a23f40c575e8f37f3a4ea462abc52ce1
SHA1c6a697a666e1b1ecb8fbdd665d7a17a3ab229658
SHA25603b0c23fb846438781d794911302ca500e505ebe732f7ec5a6242c60fa7537a2
SHA51229dca18c6518b3c434d1fdda3fd2d78508f95a8e34faf7ba76949800d8163d4b04d4f60be2f64751a03f5cb91979c32d3f52040a4526eb69e83c63ac9b824613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba0ff1efe6796944d73e640e37377cc7
SHA14e6b4053dd625e6b4d34cca4cff4f9e557782f12
SHA2568e23b39924150935a05a8e3632971980288696fa96643b17a608f50b0da1053f
SHA512e90dc97eb5587e89e7e64fc00a05a0858b32c80a626b159ba787518fad692f96d7e8f335fbcec0fae5e5a6858e3ac5592ae1455538e7f2a5348af572f35edd12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506c9446a29bba18639c2cf259ed8db09
SHA1c750aa8e4166a24f790e817f67f3072ad455d3c6
SHA2569c1b01415aa16f13408b9e8dedb782c088e078e9e6f0e4519968cc7c587ba480
SHA512e90f17e469c094f5b41f6182977f5ad15904d31a3acef7cd80166789ef9ba26d3827dca7944b30de27450d9a413b4fd54dad8453b1e4bd24f2f6167998d84c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c3c280f7e0ca20e12801da322253d2
SHA1d3054a2a0dba27b8738126724c538a6ec5173c48
SHA256bd31dbdbb1c5628e1b155058b9c1cf4af78ccb0fc31aa437373fd65820165bb8
SHA5120af6a68b3501b19a76bda25a4cdb0d85627e31782414b6eb0c737592515646ca006ea16394372569c7d620d5be5464125219d8051d63455f5c54b058e05335b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54488b96effc64eb6309b0dd41e4ed872
SHA1be5f504c390f720bd8553c47b937d4a76c0dfeb3
SHA25684d041058a91099d87afd08264dd583d50f8e3a81464e53177ef87d058fe3027
SHA512bb6c66e9b6e6f4273aa4da28236af8cb886091198bc5409b33a0e34f801a5407c838744bed8710206158893912fa8673305e9a292190ee07f67c0f612b060099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5dfc480f5c20e78c3953bf8d091ada5
SHA1c9653daf530355cf8fcad875b8dfc30f06cad838
SHA2563a92191db0beefc4c1d7a8941a90d3037a7eedcfe95a7933a1680d3dd6f4abb8
SHA512ff40d5bc42d7dfe9057442389e0611c5e7c37ac27b4ce1962d4935f9d820d800d4cc0a7f15877e4b2d99e227379c0e42a9d3f850e97212ac11fd335b45868e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564dd494cf218fb348275574ac94204bb
SHA1e8b32e2e3aa66b4160e94377ab8ad96c60b19812
SHA2564a22c4d14219bf1cf4fc1980b1491de94a0d856e3fd6bb21d1d16d76bfc2eeeb
SHA512c2db40fb1fa766c68640404480f8628fe7bfdcf0840c71d9d594d232165e4b3d12136cb63cb045a5eac88f139e8c6288ec6aed0f29d7bc4da699d733202ff8a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534743fc017b871e7963d7795ec466efd
SHA163597fa9b66a22ed786f132afc22a8be4928c59c
SHA25642224b6fe196170cf11343ffae7b15273ff80dd498604711836f8c49c8986c2d
SHA51222e0ddba2e48c244cfdd74d68906bc2aefdfe0de5748cc4587ea188a1281aabd938c92c616333339bdde487eb5643feff9349166851b58443de50a29ad5bebac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5a0464ed6afe84ba43bd42b8210777b
SHA1a1d34776819d3c0c9075079a955e4c60ef109209
SHA256acf81ccdb7b3cb6cf2187a47c08546ef46fa94c8572b94e85c9f3267417c5173
SHA512689e2403e482c659a5055439285053866d1e092eeebba961c567b868a1d15ebf0d337e9d3f721815d183a036df1bd22fedf3dce6734c1e514ae4a1934d88b75d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a