Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
6b01888afc024b893669e9c91434991f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6b01888afc024b893669e9c91434991f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6b01888afc024b893669e9c91434991f_JaffaCakes118.html
-
Size
67KB
-
MD5
6b01888afc024b893669e9c91434991f
-
SHA1
5d1ed69588f7e4f956ed949bb5dc92a8ea07b7fe
-
SHA256
0293de460cc4837c750664d1e0066381695c2cacd49db8fa6e8f584bd43dcfae
-
SHA512
e8618e80d8fe5f43d2be7aad4feefe5a0ee71f0174fe3ffc910328d92d4bf2d06c0c03110256882e29f38d4a2d36c34757eae84746d65f801f858aaecfbde0b7
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6s9DMoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8s/k:JnTTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8004cb6b10adda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2f7c905e48a084f94169adddcb8ce92000000000200000000001066000000010000200000005e184fc07046b5d8701ce2df2901991003d5979c8c9f5dd5d423f2f14ab8b6a3000000000e800000000200002000000098e02e14d4c53144a2387b5ee4e29cc7e04696d9bcad8eefcfcd35ed12e8ebec90000000b16be8e31b2a2d4c0f5d555c437b26907cf3745e6379e5f920c1f4d3a1f54937d9103afe9a0072767cad1c39b20b739ec42c1b9259e8d54215290ebd33651046f00eef59fbc055aff790289a2cf86c1301b58893ea194622d510d19c11ce2f9888dcd71ee4596050940b877bf6c5f85c73cb698eb80aec90a7816956ff87398e0421646d72d458f5b56b8989f394f58b40000000e5e313bea45af43cd76a86b8f0528694a73002647d65b263aaa9f6d61afdfa299d45b8042e947ea8a4b0e2063ef2bdb1108ba50998cdf72b19c7ae7c055cc73c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422630736" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2f7c905e48a084f94169adddcb8ce9200000000020000000000106600000001000020000000545ad102b1f09105ab06a35383ef93846ca3badb6f79441093c9d89b018a0900000000000e8000000002000020000000112c3a771555d6140dcd66b8556d215575fea873355d888a3cacdaf5d1aaf74120000000d4bb1771d044e56fbb3a65bc1705f5b42ebef4e169632b471bcedc3ff67e72fe400000007856feadb37da86b3ba03a60e2a7955dff4e177c72229deeb8a043ef2b732b10b9054d60f4635a9e67e602d79e36e58c502f5a65d71670cc5d0a93acfcacd85b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97275BB1-1903-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1972 iexplore.exe 1972 iexplore.exe 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1200 1972 iexplore.exe 28 PID 1972 wrote to memory of 1200 1972 iexplore.exe 28 PID 1972 wrote to memory of 1200 1972 iexplore.exe 28 PID 1972 wrote to memory of 1200 1972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b01888afc024b893669e9c91434991f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5941a64c093007b6acaf9eca98cd4bba4
SHA1b53c8f02a353db2c4ff5d521356df5ba8a1889b0
SHA256db99ef548d0ac153362240d38f9c036c29c7064f4d8532247bcf7f749f075608
SHA51245e6ee009efef5ea5a1f04f7de4a34baeba322940aa4081aed79ddcb554bd0b16e1f74135434f7f53170706bc7b4d3ee20512a50d1fe42e8b756b5a46a15b7a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9908c2e522d1d8dff2925b3c9ff25ae
SHA1fd6f70e865266dcb7f084158dcc3d4dc17278cab
SHA25653c970fe1ab2fbfb97d8a218cabafb0896d57e7ad2c04b6c1793f35614c864f5
SHA51266bd03a11bb7da66b0dae092dfcb8f130d58cddf7afcd2e54b78bb53a245ff2fd51ab2295428f3506f4ca4dd3c4e1dbc3e9fc82a06d44a09dd89ffc4dc6aab9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a2cd704298d7357776239e7cc891f1f
SHA1208b57963ab953c1df81f9650a0ec8010a64f88a
SHA25696702cb21d571a8a498b115da52d96d3945510890c058916fc35af26c03c294f
SHA5122092f6f79228535e9d5f22edc210dd69b288714cf07580d5a147c7fc72658707d0db06035b48da28d0920947ae3e83a083e162f13c817c8ef068939707a650f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53426c72808c8cb97540d6b22ca02bd1c
SHA1c28e990a191a776c39bcdab27d5064d97f727456
SHA2560369014c1e9e239be3d07c267f70275750b7175b264252bb55d1e0b427bf2cda
SHA512ae5f4f89666593220576fa6fb41066ad34a36d5793d2a43b351e2b7426457690ba067e69fa173cf4780d46d9e10b3e2cfe7fc0a1238c486dc8363b9742b38bba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da160a554af6e64875b24aff1678eb26
SHA1c8cd8025f35dfebf6f407a62f26d998f57cf4060
SHA256418e576629a0fff287375190be6b926fef5d22d4da085456a97e33fc985a6e35
SHA51200f7540d34a4727a146345f98346cdb4fc084e4a6300f11d754a649e53748a69a870f201324fa3cf9e9407e0dadadf4586e6d9ff6dcb0ac7dbc1bd3a1f1d432c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab15929cf9164b9acb4f32d1ae11d2c
SHA1617cd0e22b62e4c3dc4e048f014caf1caa39800c
SHA25656bd889abeccdcc58f9d6d26ac210ac078067262773599825b43c8d2ef7acc66
SHA5121fd0dc913045edfbed64ccb691df101cab149655c8b3986ab61ba736c6ac0909980b3094e2b6296842cd09097e9e9a8b80dd9c1efff44bda4d85a4d7cb9e9ab6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58464c6d4c7d5b4a364b1a9c1f7e54a99
SHA116c975087c724c1a3abf749177274150fa0142cf
SHA256f6d6c6a505dc606d92cac1a8aab6b5e6dca7604dddfbb8fce7d2a108c139f070
SHA512984312206d2a6685566a6ee0ead00c4b229ee9d4cb712f9437595715333b961d7866f7a4de05bbbf52c3a635fd7af46d69f253470a5315aaf79661c2caac6c05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580e94890dd7cd617f55a118168438c01
SHA1c969de1e6d814e108de50cae8a9e74d7672ec5ed
SHA25674da161c0a69feb86e19903b6657e26091f9650e448f66a12278bcd436bf2c05
SHA5124edbf205da7addd04d3a8f3670ecf856337248bc0bb5d4c4e52d913e75b2c904ee12a1eb2ea79e8f2f46f777d590f6197e7abb11459e9cdbf023b04fc952eef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf27f0c6747293b636e6469531b1f9b5
SHA1da25d26e728dd1af7f29e2facd9ac06ea746a436
SHA2565273a53201646dc328ebf5e7e2b27b5c4f8842df0926aafa055e7ec5b6b3494b
SHA5129ba1512a08d933474d5a3bea5d3968656882162a6e4fbcbda48e6b317e1d31b216bf93b76a1da407b835d020c2e17f940edd961c20534c0a5f325011706adb57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6d5dc5273e56d62ed56b35abc92a387
SHA12eb888fedd81f7d19fbdd6da6f8c992282b1b190
SHA256c37e42e271f9d5b5b715f07c8f8c46a065a3b49f66aa1df52056d988a4bf3d6a
SHA51270fe08bf29d91d14c503a608ce7b1e7639afb03fe88651b7590b2128b5519e9c3a5fa8a1f4c555146f9f9ac07f73b5ae13b6b37eeeef93b9e0b53db7ecad9138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d0dad5d873e8fd5d186cb3133d1dc38
SHA1af291cb8ef5fff0937565658e08b8f55dda7d139
SHA256d46fb74dc6666c6ee06f1bfe5f4db552ee953356ea0b58d7186447c08a6e21cf
SHA512587e6ed47f4a4a71bc425e21560d72fc7245f7679ebb589dc070b9658f58c4beedbee2d756bc74398b682403e150ba8044762b1e7383b0cb198db820fa8617a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5948f17d2eb702e56282fbc7a84594fff
SHA173dff0c54dafb8db2eccf0208168be3833360364
SHA25648a2129ab474c1f67925670384ea890962c78fe7d35ca8d39a6cda49dda58595
SHA51226ff4c29a53e43cf0b27a6b5ae0c34aae2252e66942a83f98d78a854b0757a5c38c91b85763a362a1176fb7e065b8d1ffb5b83bbf9390c27cf8dbdf5c6ad75a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50679837e5bd82e4b5313eac6b10280e3
SHA16455577de1cb1d380ffcc2438adf22e2e6e64214
SHA256c21edc159a4551b5e281e8d6ef88037ab6c785ca3496e699a555ab80dfe3427c
SHA512f8b31330c3c338edbc77acd67482d1b09911c9cd177e45ebce1f22566204cb5659efdd8b1c195360fe5e8e5a09736ff0af7c351155ab195057ce8b3c46ba0b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c4a45f2a9b4886f936f7717ef02ce65
SHA17abe71154291aecaee9060fb39d983a2703a8261
SHA256c394dfc1365464696bb25a1682680592f2ec1f50470f4aa283c615a9d92c9c74
SHA512e0208aa9f412cd1be0488aa1bf4834fc63521f2ad879cca249e44e7d9b5cb89217fe7b7758bbfbd8744fa94e5578bf5e65ecf203121108102554b146f0a06ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbc4c9ce2d052947b7610b623e4c6f85
SHA1311c1b9e848942235b6b254e08200c8462091c14
SHA2567103ba3ae3eef9cd3df3594453cac5329eaebcdc916733f56077ab23d5b8e4a5
SHA512a13b73388421bf48fea53bb98281898597063d0c5e6c4baac2a7e6df0dbb8189e431aa976ddaa165703371dda9f1db026f8b7487a969f479e6711fa889306c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5d55f55b17f323de2305c90249d4ca0
SHA112cb29a54ae6c0ea51863319fde8f3a010617aa1
SHA256f9400f5f13e3ece65f54b1f5f4036dcd839540b1d178761a37f8eb6d712cad4c
SHA5129db5da65499530cbe5f33ffa99c06f9a0c03313a87a157965601c988c2dda986010b82cf850b693193c1ec32c2ad90bf40d12cf0d4dd6f51068aec940528590f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eba9b8de729d4a95f771bff52e2c434e
SHA10f916c00dd4bb8df39b34590d7b1c3701c3fd2b6
SHA256b6ce443ca694dbbb4bfba5229b2e3b9be24719c0957dc787940bcbf2140cb5db
SHA512260d56ff8d2e61eb9d600b4785714dc144fa11c89fdf035af99c7f3cd648213d68eb8d4e2911aafb1338d9ca2ec4311a31c31c9991b20573fd66a0e0e75d292f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a