Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
6ae7db2757fe54b7be3e862d2b4a47c7_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6ae7db2757fe54b7be3e862d2b4a47c7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6ae7db2757fe54b7be3e862d2b4a47c7_JaffaCakes118.html
-
Size
70KB
-
MD5
6ae7db2757fe54b7be3e862d2b4a47c7
-
SHA1
c7d3920d7bc17286b3b6d82c167d942d3d46d479
-
SHA256
aea11f80b6cf1f3b174332ea54517dd7aaf3e063e4ec59d247254d56879b1899
-
SHA512
86f0b0cdbc1988d4b3504565e2b05016882ddc68927dce14d112fa87458861f3b30bfb7d26a16d82bb7200df3fb0d47d087c5052618b799e9a2d65ad012a66e6
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sD6FcLHoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J9u4ITzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001835cd552815c64c9991c99fc757b4c300000000020000000000106600000001000020000000277e3b6405d8f109a4dff42d98231d252986a56d8ba91299203c72bd7b123647000000000e80000000020000200000001c24328e9ccedde2080546a981e2fde3c997a5d3a574aa830eaf797df20804ab90000000bf86b4f03901007c1c94a770dc9b70dac72858139d38c31a9315bf1c081b45a38a6fb647b4c80070f058b2acb1a413790fa1c3257466030206e6e6068e63492c94173fde28ec79e6e1176a6fd06d7b0cf7704a5b00d56eafcacd3752fe88968c3ae9ea75c35fe98da12f9223af0211a8f4690bbb0ad1363f2c5af576e2342216c5b47d2600a20c3e2a0522e333113f0e4000000076435a5f05e2f8505dddec781eee35bf938c042a77478d6b758b45cff05e9aaa2099a9722e23183dfd545c09558539c0c3b380d9718c7fdaca5a84258d7a176e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AD22C21-18FE-11EF-85B9-4A8427BA3DB8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05e7def0aadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422628381" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001835cd552815c64c9991c99fc757b4c300000000020000000000106600000001000020000000751b718128d5c3d6ed1a7926679bd3c808a82e4ecf1cd7aed8d5fa97e1f569d7000000000e80000000020000200000003e942b1edf4e9c9e7c8638fb54eb74d533cb2c7191a0df96a44320920cc4cafc20000000f3f26d7237e2ea777ab65441ccc1d13b7c7e662753ddf13e7b372c07471f63cf40000000c0d3d0b8bff7852ccc8631d5af738e0f40c8bf9189e75cbb0db4e66de6120a908a2093c8e057a1343f7eb097ac8661db860b369d81cff20f540abbe5c9e907b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2396 2356 iexplore.exe 28 PID 2356 wrote to memory of 2396 2356 iexplore.exe 28 PID 2356 wrote to memory of 2396 2356 iexplore.exe 28 PID 2356 wrote to memory of 2396 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ae7db2757fe54b7be3e862d2b4a47c7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c13e62a01c456adca3e9d06e80064d92
SHA1886bb913c055b46e713612a8086a051cc4cf4772
SHA2565bf326c7243bb69179fd7a9988e701fb46481a91096a1b3b08a7d2243f22d449
SHA51218a301aa88b7e8279d1b28a4cc69ae87e77c51ad7e2dde7b743a110cc5a47aac8becc3413e534545e082120315e43df7da189acaeb5d43f0c807c3020fc42a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e2b8c960b64d552cfc629723342d73d
SHA1a2035ebb27a0acd239d8d8824b88d61691115bc1
SHA256cc6aa8a502bfd2bd0057617a6ff40acb5d4e7489d505b4875383ef34b6f7de9f
SHA512d02ac43a3757f28be12a0b64c6a8ce76a69c227c628afcb83662590b34dae33c4811bda182257ad83326a2a8f4f31228a7df68bfc92de1f9b1e3c7a7dc1c0da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578380f75e64444b72c57fd05f5087187
SHA110939affd8c311b80c8b0d21ff511a74f1855acd
SHA2563f27418d7f9a09dcc0c1f47773ab2877c4f8ad41c29c443e4f59dbe80d3faf17
SHA512d9a6d48320b1f58203cb2932447ba6d51ab8027a5e02c120f172a8e43bdb2ba89c6410a0ac855aec2663e0e541df2bce7dcc774d4259698434323cd1ba5ae3dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533fba4042116b5890d3eaea1abe6f9da
SHA147ec0e3efc40f4a12d6a71738654bba38ef5f556
SHA256975f9ab65906f36736ecfa42a7acf26841bf4383a0993e25c562e3637933624c
SHA5125583ccf2492ce9bac104db2854dbd38d49bec22ab78c53e9835a67e4f53901f1ab2b2c3b901669353255df9841c4dd8b697deca53a5478345b0f69c3276c9ce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a949f19f80a5860ff881e70a64272eae
SHA19dbcc6a02468b18943f9f3962530169a6a34d081
SHA256f78e6338a0cc6d6b13a53e85d8623d73870422a0a1a3ecbca1c4340982410568
SHA512427c869cb2707ec3f6a9ff861102aa968bb91916e772b52a57641007db496d583e167172d03ae8dd98c231e5a1d6c1197cbcbf4f8bf1c64882dc6ea74ef1080c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb2b441508007323a5ff84cb6af2d297
SHA13489677705e4bd963a895997b5c45c86d0f996e0
SHA25630ef6fd0fe163455b54d46da17d073b2b010900dce00e2b9850f4897c61e38e7
SHA512b5fc70cc0dbab5f00ec9418f082bdf2a1967698d9c232e809f7b90c54acbc20e5d8060002763ea910c9e411a51ee144efe3842a785065be25534c91b5438f7fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dba65621753730430826a92f0546724
SHA1bf9708e5a024ce39d2771e0e7a045e63e5369993
SHA2564d519af1b59ba432b0c38c210422925040ff0fa32668adc981805e76f386ed84
SHA512d0efc73c7be2ce0e74a65108d0e842300df2891d9b67f80e1f1f198758175fcb799313b344a836a007d16ceeb8bbdacedaaef7c51c6512283c7db91a8d22d721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554aba2b5f06d4d87798186e17e99e01a
SHA14c31a59650a727df350dfb19638168d5e17e1fc8
SHA256885b4bdf8134dfd5fc2f16b6ceb1e2a4b019071e655bf8ebc46c39c74a7a61e9
SHA512bed1c62a49d2efc9716acdd0a7251947651ae5410379d285affaab1d3fa320f38d7bb329b20216ee819ed2c7097207b9d68b3951d658617ff5a50ca5c12313c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5281b59804741c26f8202df6ac8583473
SHA10f50dee78a4e57b2fca678dd0730f59f78b33bdc
SHA256f1a85ef4eaafb720bce8fe00c79d5bc09f7117edd58226f1d3b1e39e61e2a9b8
SHA512fac68ff721d34151db7826adddefa29ae0234903975a09cfbf65ebc84cdd65f412be2927488e143b3cffbd1509c9494b62fc94b0257028d3ceed85b20aeb40e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4b0a514c2dbd3a3cb8780a56a79826d
SHA1aede6f578f0fde361835402f0d326afb45cc4a7e
SHA2569acd21209f47e3ff7b2da1f0b505fc02d2f9d085974e374ee46f5f65c8594b6f
SHA512eea89a24782fa1d7d45a6d99ef96f40d0a7f676822463dbd02d89a77d23bbf0a8dc9db581f5485da161f5323833860baf457ba7dc6bb64ac27af6d0a235e69c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5291dfab98556795bf75954afc59236fb
SHA170f8b09d18d8020230959a52a9593b5522883b21
SHA25648e7d98c1fd484dd4a55e50caf4324745cc9a0fc90de30bef87f74723348b5bb
SHA5120affede2ec7ced1774fb46fa1ec749b6f1c4ce8e7b38cce3f65c0e736675b8c9d02510fa771744ae8c32d4be1607b31701030df28d6036e9e2da300c192b7944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ed8c3013ee13d73118af9100d80363d
SHA17776c1ff8482853ec24420f2a57978405e89bc6c
SHA256ff91c80e90ed2b16ac1dbad4710c29cde0739c487fc9355766ce6baf02578aa1
SHA512ac11a27a98371262e7a61720c13bf6859d83788e268a49570f6b17469d186e56ddb80e7656aa9abe5b26ebd420fdb14bcf8b7f8dfd1daca53e24720d162e2ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56be7bfc36d31697b93771af8808921e9
SHA10ebb880974dfe7a94014451c558d77c76efa8351
SHA2562f960a0b21865506b3ff8128648fb4f37c402395e818ccae82afd32b7df5f4e2
SHA512300fae02eced1f2a5941179a5e5d31637659cde6198a49942e8952fe403c3bec8b6fd80c0bfacff7567759c6111477622a96e31b73cf9b9eccf75963ae8d5d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804b0ad1e3ec4d89acfb665feb0b7573
SHA10e54904f25cf12a476dc90d4c30cb67a7d80c3fd
SHA25671028f207c63b7b7c106eedd3c793ef304f34420a9f1a35b8e15d031d3332e25
SHA512a27328d365523a9e09e4bbb032ee69b4c9ab8a3b8e5e139f70c19537ca3faa80cc27b639b819651aa3ee22050748d58d396f0fb01a44fa546f190570e81a9aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f8a1d5ec47f77389998b8c23df940dd
SHA1146e0c9b54f2d4cae712b6a9fde8e805141ca4af
SHA2566b1b54bc7d254fbd20689a0b14373135f45a9d69d41347500d30a150aac733e2
SHA51274bd8c63ddc6aa961567550f8690f54d8d02c24e5551c35a475b31d412c0f317b14a59d9404eb6746143899bce9d007446d7588769faf7f5de06a4d62917afc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f6ff8eeed1021f2e1acdfdd94dc60bc
SHA10537ea1513b7fd247e1584cb07e874d2627d1a91
SHA256b30ea0085d821a682b8eed48f8038897cddb7045bb882655f07c72b4afc8751e
SHA512ae4373530604727110f586420f01c60bb89cb361bf5ee03828e8f5bc832f8e0c6f725ee10592cf5aad5129d4c3e2b226b74509c2a8aa7d3b617332ea24620eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c80a79a35ba9bddf0ac919ea860b5a2
SHA1d18b8e43d8e84d3a33db9489541f1f9459d900e9
SHA256e94ae87a548ce6447e572d6f7477887743ecadae7e298547eb68893fa95be071
SHA5120edf93281b2898cdaa1d55e26660dec4917ec25677ff221028bf62b193fb51b0a1900d6902bf13480835bf4aecc32e5be219b31f2c6a05050a78b60ee3c8a060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a8139e8f036cb66e9e3d1ab6db9c5f2
SHA197f16f000f0beaa8d0d531e08b6d6ae8020a9c12
SHA2568391e16598f1d1752bbc04c208b98f2bfa32463ba0426f490d6f8d4f3b53f0c4
SHA51272594efc2f6792159601d45be13b868e9bf11603c13ca7f4bec8ccbe49e36a25b1150bb5328bd5ff5d65bb1bbe2fc81a88b59a986c4e00020b31616a32e31fde
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a