Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
6a6bdda6d57873bebdd1bf993bd60273_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a6bdda6d57873bebdd1bf993bd60273_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6a6bdda6d57873bebdd1bf993bd60273_JaffaCakes118.html
-
Size
21KB
-
MD5
6a6bdda6d57873bebdd1bf993bd60273
-
SHA1
ec7c00d66d0a5eda12b0abf6209ae977cd2c89ec
-
SHA256
465fabcf114c4cfab041158825f648086f606be87ac10c9334e61b322287c816
-
SHA512
c0c9f6608df16490d13f1bae0d0da8beae9da75730e37e3a7a4678057ef228a2d5e03ce822dfa28188409bc8f771dc8e50ac4702e6e33e7bdde9a7c4af2ac350
-
SSDEEP
384:zi2QKcRAa5r9DIiXbWVBD8c03RYhCdScmEfP4ycbp5ezVcr/rDJZTO4us:zi2fa5r9DFygc03fgcmGP4yDmJZTO4r
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008271efb107d7e541bbcfd0080a72fcae00000000020000000000106600000001000020000000b11592edfcbf431293e81c22c7279618a90e5aff903b9f19d7ecde8bff5b3fd5000000000e800000000200002000000060016f6885685e1eff81ef9dc6a4db792bdd98a0c4d5cc0c18d9039ac4f2af032000000068617da860f9e51e4c0b41a6f5dc5f12255dd103d7e65a86bfa930243a6392c8400000000e9016949152882daf33f7f8e12a0e3aacf9e8fe80d2cbc39a7e8bf6b860437d62e4b3a5aecb780c3447873d04e1bd38cb6c020f52543171a01448be7bd4dc67 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008271efb107d7e541bbcfd0080a72fcae00000000020000000000106600000001000020000000779e7674e6ed74885177fd90111d963aef78850bd76a4b37cb8872cf8e8cae75000000000e80000000020000200000003606c50c1e4301dcab11d6949ecae48b5d1ebd6017c5f5512d006df4f068a8d79000000042f2c39cf86db191506d9e7a6ea4ff26929a932c3af91b0354815de24521f484c23bb41db89a17d8feb82486a22a993dfb92c867e3e08c5773ce0f34321860f5661b7db8e5ade68b916b9bfd07314e3bca20d8488226870c916321d14d138bcc5acbd4a76e197f400b8c1b72f4ac40d6e6f7cf5e5843729977df65d077fa21afaca0d6324262bda724572dbca5440c894000000003bbaf2b3007caf9f149bd16a1f020800be8f227720bfd3ca55a644fc5238704b02dff658a4438b5af465514a7cc9a3512ce37440a8c72a1b27d63857c0d0b2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422616837" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0db760ef0acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{394B9441-18E3-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1500 iexplore.exe 1500 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28 PID 1500 wrote to memory of 2828 1500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a6bdda6d57873bebdd1bf993bd60273_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a06a63cd94ff75c6e9f6f2898b0bd61
SHA181e82258f546a3b1dafbebd20ff77a72d1cb3a54
SHA2567b01ab094e9b75b23b0c95f1f3c2732123ac95538b01b3398c41e29cd766cf8c
SHA51209eaedc6c9b697eccbbe465f8fdba99429fc2f8b8062123d9c3031310380d54537ecd6868c2f046182a107c0018837f0662979d32945e614f20f8d8e886754a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aa5ff0bf6412b5e85f7bcab64a16ffc
SHA15e0c2b05be06b7aad15368d877f7762f7a78fdad
SHA256e503c5ffa1f2c1ef1d138c762251bcdbcb500d7c2f550b8e2fc8d5d8faf5e510
SHA51212cee7aca9daacfecce41b1f6360c69f79fd1357c6f62679ef012988a3eb4d1502a55dcb00e8b96eba57930f722eccceec1fea20b32e5293046428d40c66cd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d9f54c55f54dd59d2a3f31e835ad894
SHA12bcfbf7c86e74d32192a21ff63d2b550e6a53a97
SHA25648d57ccbce1f28290f158d1718db65452a8c387db017b3a7b66c50904bcff935
SHA512e147bc4907679d5590b528db42a565aa52eab1d9750da1b023c211ac5289bb31bcfce51e494c2b2e9c408805dc535733606e4f8cc7dffeceb5881ef5e6d8488a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac9b5af188477a1440eef5c7f8f142c7
SHA15d34367bc1e43f20eba8355f4ca5755f2f9cc545
SHA2567fb3b306a8c1c6589a063576b8015e19eb5b2d1eea7c9bc514d059952db4cc58
SHA512e2117b166edd124a51e5fb45056cea87f9196b6d74df5ff9ec4e1eb2ab89b8c418ff127de7df982b735e73c0535d97cde9cf76662fd9a77b9481e95c4dd21059
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585f84f2b08df75bb0c9452b658e8889c
SHA17059706f406d9ea381e3b2b62e5c3bfe79de22ab
SHA2566e0c8b065803529e3a46087f70daea5d3f5e6fbb6210aaadb896227be3c14938
SHA512816e461d4294ca204a4f5fd8ea7b2062e39dfbb04bf6f21d334e15418af34a1929ce65fc4aa7eb6a04c24d3a492eb99d11b8befc96dde4b357df412e9fc3923d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7bcb8a3ab8c10c3c126a86b65ebb33a
SHA176088886689297642a052682fd6e2f489a236f56
SHA256d3399cdb617bf897c078fd461b7dec4bf101c9dd2ab17e742c22182310b415c2
SHA512ad0bb95844ba0c1abe658095800890333072d8879d9b5a1d36f3955340d8924210eb94b2fce8d1144cb6ff60b74f059a6f2c22a9208d8b3f54eae555804506a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cebf2e3278c6520d604258ec9ec41bf8
SHA153b4411f23f308a1eb51301b54c2ec6fdf0bab33
SHA2569f2a690d417e7c6f355b238061cab4dc318f42011ab143fb8e298194af9db40b
SHA512276e799d0795f193b0d3d64ae0f895d55bd583e188cad2ff5c6bc84a695f261dba1006f443cbfda4b0a5363c20170e8d3e2059bd60097dce4f1a55065f8b185f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e7c03d7524e29a527134e82d40c6766
SHA14ff36a1cf672d7a99e56dcea05a93019d3bba8ec
SHA25675f5bedc87b7e3d4a1241134cf6eb9a5211b52db0c548079c1b4814c23bfc3ef
SHA5122762911322168c000d2acad3af3717f1b9d03b016ade09b93786cdecedb06323fd7f54a6afdc8335966b71065749fe8c1f9e065336dd1bb3c3ea12d535cf4171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cdef18480611ec53a6a8c568a8248e9
SHA10e4b6c587e9bdac3356ba823c1f37711cc5615d4
SHA2561c2a858ca89edc823f2f975f5d181b318b1a266b05767dc5694285137e061546
SHA5129ef071fd8e4964e35a1a26672eea1adf31cd1fc965bda31849052fce6347aa8907aba05aae56e983629530ef5f485b23740f7b908d2a86adb8848aa5d7a0b04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdf8284f111f76fb47aa45521adcaf8b
SHA186d5d363eb49f1ea9bb2863bd385b8e91f308fd9
SHA25689803bbaeec6de902bf717e19d5e7fa949ce52d65b6272046cea6be84580ada7
SHA5120756842d09488a7529cca16c51df3dcb22ec55b6404bc6c1e42a42d42064189b0d3c8260e7491071a3c4cf84a47386742692ccb2669a69619a503d84605955a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbf3ddf35f6ce386a8f169c014f83649
SHA1142c2dbda791f1ebf9d1077bfa168228e726a898
SHA256f916e35838e49625584f9f281965ba443a92671a947ac0d326d8bf846b28f9ed
SHA512c745e5dd7116f5a8f7f534b5509ab8144cf1743fdf366dd56bc9beaa168bd1e57ae445ba3aa9215d6259071ed28befc85347b26683b7027561a5115b2e45d24c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57381d61fa6357f019c9a4afde1d7bf10
SHA1797e2ba98367b9547fd76f4295ebcd89043c3723
SHA256361432cf3aaf68391f1389ea0c7cf87d1595e24bff4d5f119b611663e0a42cef
SHA512486bc3c8e51f190687c1a0fe624ef4529be07346b8a298c94f2b3b5cc6cf8c3d9f9a4f95de086e0fd1ae7c3f46632c7aef6c9c20f9815cc743b976f5af6ed901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5882bc3cf941a7e312e6f90016e14c1a0
SHA1743a1536407f48a1a820f14ce57fc5403705c2fc
SHA256b9a1706de2e1c6c620a58700a293060aa94d5fdc2d90c03f0db94ee0a461fcdf
SHA512e250deffc17214d5a165366ef5e5022853407446f3a7f76c41b5efb7bc9b2a2c139a9ec65a7c8e12b240931b3cdf8b254c5900ba61cfd9a243eab25b42e4bcae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f67ca6899d327ddfd4967766233ba53
SHA1cd438f18cfd657186cb2e7a365a1c5983ece005e
SHA256d1b39acad822fe852613f5681def9d56c845a4d3c20bb3961b2d03fbbb3c4043
SHA51282f3d44a62e75c025204d0603df7851dee6273e3adb1ffaa80c5bb774b5f30d090e606e36c7c9e8ef05b4c42c1513c73802991b3a9ce9ea2561d09c1980cae3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53892b832da6004f73c8718ccbf359ad2
SHA1d7cb614860b6e53b123c85448b53ef24fbaee030
SHA2566a09bc64a0c1c04cd2f95db8e7a6e7bc603718e45b60fb4beb96b0b0eb4a1b09
SHA51273f01ad83526360bbcb4276acdf54641ef87bab1bd18be2914d4a1c9df5827a29a1435dc2357e798a31673fd219b145e5f51a8609b9bfef31dd47da80c2296a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d49416839315161fb5d758dd91f0656
SHA13f5e733cd6a083718c6aaad4efe4ba1f79ee0ef1
SHA256f44d539585de690be30d5909eb11c1b427b2c17ddcf47e63ad840bf8dc71e315
SHA5121cf8534c86d02a3878776d305ce17d1f9ddd3b0e4beebc15fdd48f235f257d6b21b55ca77c9ccf176967e616720e895d1f7db5cacc74f57ad3d00b6bb5a167ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c259ffce3a6bc8e61aeae5511d701e13
SHA1bd8d3ce0904888a71a9a7cfbdd7e91609f2a4e2a
SHA256bf8d00da8c36a02c477845ef02bb28d495ab8b5466b24cc4122117cf9a9f54ce
SHA5124953b15b4c22ab4c069c87dfadb39ffa1a0ce277c8363c5f407a329f2d9419202912eeff45b96c07c6e58c30d0f2ebda9c20f786bb7fb9cf51603ef68df6c87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aa8b30f96128b404e3086229dc341b3
SHA1cf4f48626aa976d172a7dc0522db07c1c11d23b3
SHA25687537a4ffc5cb06a58f6b04e5d8e178ec90ca7cb99ff95b2b0ed50317e9bf776
SHA5122264b42271d04c5007078e48ef76524c0ad09183f10a5d257aa81352b71e662035bc783fbeff3ce2e5d0114f2f8c2ecce34f32f732e89544341d4befa59b71e1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a