Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
6afa4cde588c448d100c315099df4b26_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6afa4cde588c448d100c315099df4b26_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6afa4cde588c448d100c315099df4b26_JaffaCakes118.html
-
Size
4KB
-
MD5
6afa4cde588c448d100c315099df4b26
-
SHA1
3326b332cb05337f533a6baf32928f576b877c4d
-
SHA256
951ab215131fca3eed1a19e7787c8d7879a5cbc022895be615f99a3f18031f76
-
SHA512
99f88f929374042b0f87ac7b9fe74f5f40b6dc9c66e7ada38653ce3a5a3928c18e7fd53195d61834c0cf2a70ea5d0d083f4af61332096460e4427d1d7a4d033e
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oeEi0t2+:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004e69ac4d1265971303eaf96253a16f282c32b72fe69636686984734b299e29c8000000000e8000000002000020000000de1042752ca5065be9d0a3c69aa11e7e9885f223add9e16358efbbd2b23b46c390000000438764d8e127f44c4c8003c556d7dcbc14f2a00b5fe600bae3772f2f0d9ce575a27c3fc30b49430497a5d7fa651fb23f8870dce9793fc3c5c8e03493f33e971477a23ba03a15efa1853341d03cd85bc7be8ad74d62da01691dc8bc98de07cd7fea2e6616cb1018003265f8d80544640d58c1ff4a820d3cf1a74430bd24b8086b1338fae172ad731d5af9b46a654f9e0d40000000f81cd3b98abc0aa2ab5139d7a55085673b8956111a41663b1a355e7e4012fc26af86d71897ccce4a02ad2e1afbb90531ec0b060561339d1902cce0b2134394a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ad63df0eadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a07859ad76fc492aec342c16bf347dd7f9717a0048a6ce663d669ebf52b508a7000000000e800000000200002000000054899bd3336b6c8d6cf12b78d1b1cf26a16df2c21535eb029d291e1074d8bff820000000327601ce50f0b8644fc6164c7e7c742d4560316a66a2ad837fb29ac0ad592d7d40000000d89a5c544811ff2414ae0ec3b560655a6e4a6e474981088a6808034ee759e7295164a66629319ec71d0c1601516c70a360e391d6b6e006c9e9fbf7d10334de52 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422630070" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AC94BC1-1902-11EF-A04B-4EB079F7C2BA} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2632 2084 iexplore.exe 28 PID 2084 wrote to memory of 2632 2084 iexplore.exe 28 PID 2084 wrote to memory of 2632 2084 iexplore.exe 28 PID 2084 wrote to memory of 2632 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6afa4cde588c448d100c315099df4b26_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5901d4336372cdc0583cb3c95d24fadae
SHA1ff925eb3459d38cf4b8a5ba27e83067da4528b10
SHA2565615bd8b9a9b0030b7852ac89c7c37974c0f19674f993c99b2263b9b6e4ddca8
SHA5128283895355cb84870ebfece5bc7e66fe74c6f7865debe6df80e4ea494ba1bc42fc5f7a11638b2bac990be736b0598af654197b0a867642545fb56e1c86740252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c6d92e2a203bf0bce133fa47548c34d
SHA1be160830dc5171a7af4e6ddfba5ce8ccbf05be98
SHA256b4babe5a56e33e597a85bc5e7f139e0b7232830cdc30e65d1f98966c6aed65b7
SHA512bd68f030c1d982d9f2a95c1893918fa661625b949ea4dc4bb6e70d30e9827e85b1fa0fa66d3c1115f5660e2d81824dfab236b35f7ef109ccb643ff03243b29a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58da38b0e637779c5abc3eeeaeb91237a
SHA12e4183f0012dbaf744cce7472eb8c70a489ef3b2
SHA256d2d29d8b164d2d388a272c809f2087108e0cb188161d2a2d7593768e12b25c0d
SHA512c640be74ab2838bba216e55e95dbe8fa2e9d0cc5c1c1fec286397e9b2fe2c4701f5679938dba3b5b69556bdd7ac048cf4fda2e66d2ec7206f65805b0ccb1ff41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573adf50df590aaefade2c36e1ac18e3a
SHA1ca85fb578de2bbc0608e69b9699b7a1659eb708e
SHA256c5b76e4509fed7be905c61fb6707a426594d89a23d336e9358a823eba23cc683
SHA512faed9058507e517a543c1e0e72bd8ef5fe856adbb911304c35607114c0e81be5de3651c3d3211d4cd7f398f4dd5c72759ea124aa23c878f5af4b6f2ce7699392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d201042dc3dc62a486c78c698921232
SHA150357a552ed4cd6717c8474ea9aec36ad8596b4a
SHA25686b6962b4ce1e6f7ce043b57eff7519e9c5c629ca72054ca2c0659585cf2a257
SHA512af0c81379113c6f96b688792a9945e51e9a109205ddda25d7a1a41b58001a9ba979f58142890983acf8fff28ca59effbe84245de4dce400ad74f5a1fca400358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5106471e9764d752176ac67a426b4526d
SHA1382cad36f52bd5805e112fc2c6d6236e99576eeb
SHA256662c46d0bc5e3a52af20798dcef765006034859df687523f5168c271e9fa9353
SHA512674aa3a1b107cbe5d3a70c248d9e5d4b79b4a800746a53fa81db80df7816fb0ac568e08455d3c549c0cf5c37bad6e81584a7226795feb6f628f9fc7d183cf9e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcf822d9edfebd646060ce29ba972545
SHA1076810b19acaba2708a6efd1c9e7bd64d02dbf2e
SHA2565e4d6433137e6932ad1869128687569e6b1445dcb3af52f26d2ac1ac7d32e0f3
SHA5129329ba73d47315abfd485b40aa1b669a0ebffde65243b68735d4010eddcdf0946b0bd3f1fae28e098fac1be1289d9345d465c99638e3c2fa407db2acf63f8295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5081d1391ade4d5360e661e72312011ff
SHA15a590c8994f2dcfc544448117d1a546630af2bfb
SHA25681ea2ac233352bd3fdeb3b37e6cdb96b4859e18371683398608ebe628e2aea4d
SHA5120d13a098dcd53913eebd2c11f49f6401b9ab370afebc2352f01697f12b7ba83d7e9191e81b777d52420f13b3bdd856b1ca54343f3e12f00fdc2a161c69769aba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfcf30b90e9cc1df1ea96c9355a81395
SHA173ade3e7069d00b8d792bf914875434da19865b5
SHA25697ef93916d421512bc9cb80136426a6c591e8e734188659d0c92a3f970ff9703
SHA51260d37a97ceda0cdaadf396b775a620d392f3289b7ca775b0fb8485dc6b56bbfdfa031b85ab552bd7fd3204bae514ac7bcba5b272575217283708ce2abfe37bb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53daca8473f1e4d960353282f69fd17cd
SHA1169fc64cce5a6b685a266310e4a7ca3e921c8bc5
SHA2568fe38cfcf2364bb2c2135794fc8798e8bddc0adbcaeb5933fba80a63a13d732d
SHA512aff49be98b252c848e3ef4f736dd11f477975e0e65e996442f50c60aa5aba6c0c5b2b143c7cd52a92272b270b80da97c943c356ceb1a1d10e49e7e4b2025ab9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d6cbe87c376840367ed2414d0eb446
SHA1d22329f60c281e7837f6915674ae277b460d766d
SHA25677e904aa733373fa16a48a7a122ee898207557b666f4d15b7befb947fddef371
SHA5123dc6fcf11cbabf550c18fe2a90933f41d5b7b8f2b439e714c8f59c7c7796a9038e60d76723ce118089e07626438e88d0e823bb8433b5c430b43a5ec2cad7c0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59655dcbac7f538493bcda1dc53f052e6
SHA19182deca68d4ba27f13f2a662f5f4d3ba4acea4d
SHA256b2a672251123491265a14181133ce3785901b4396ce99049cd36bc4a13f5c59f
SHA51251baf3aabce4453117c8c95f3b7ff43c11ec5db2636373ad5be88f7f8b305aceaf234d0686c431129a375f0f60557d954e2b13f424ae208d6b2c5cdfb06f114d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d81c09b205b7574fd55ad2a20114588e
SHA1f4cff5a1483c4ecebf8107359bc42691af98c0ff
SHA256cf8cc7ef897f5c198b209c617a8e3c24a15c24ec7f60dd29b1e6972a28af9ee2
SHA512875be007c840bbe7ef7db9349993ca57a46d87e750f886809f55d08ab5d1087702c39d07c62bc8e1a4b76ec8038e7fa7d25b2bd59222fba65709cf1a3d1d7f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e02e8768673633e37eaeaccab892ba80
SHA16ed58c2ace6f403b1a410602fe0804ee3a5f51db
SHA256e7faa9dbfa6100d2717391344de04bfa2f37c76b15f1df22dc0eadb6400ffa75
SHA512ce8c8a08575ae439762b113c4e1664686327e5efd957e635e723757a01d15ebdccf1ec57a88dcc0dec44080579e175dfd48474729c02857d415617aefb5eaa2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e541ac04cc99d43e024172084d54a051
SHA12f2f1b24852714a2fceaae64a0f0dd51e7c0916b
SHA256e599d78a25c0922a112a93f9c48fc30ccb9f405b41a7ad772e8e1aab8f593639
SHA5124fd72eeddc21b028f89dc85e3a31757b2ad498fd29d51c6cd48ac78fcb8792c86f1a6ad37a18a11a06edd9e107db4d43d2377fafa8e2a76fc4509380343bc7a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d8009bb19282c6ac6b3bb038851ddbe
SHA1498b4b1511a38a052c78dc991921ce5004267567
SHA2562147a7b426978e51c56cf05fe7593be624a3e09a6c5791bb28f06fad34d32914
SHA512c7bebd61ae1a9a82ff91be72ce4477c1cde978d4b71b1dd3812398db5cc7178e8d675f312d77ad5d5885ec5a27709698447275ed20b647d2b723537f01446cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569cf3bad6762323455017f0a39120c3c
SHA191e4e554b5fbd55e7d4ac132f140254c6d944251
SHA2563906b5a7db13b8c2c9db0a82abd0796fee2ac8f0753ee288b8d81f38f2cf3564
SHA5120035885f91a6b05598a3914311592a9f4ecd47c4d4a80ee92ad47f6be1585042084fc1b3c272ac8b724e69eb5a20658dd2f5e0a0bf13f4c9fba4678069b6bc83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588307493930da615de22f7aa7027293e
SHA13fd6f3417f67070015c7c8cf2c150a43582d73c3
SHA2569a27e3559696ded9b396c0fbde9b213d909c7ca141ac77eb05b2ef20c6572588
SHA512a82e41b6713b52b31af1a1706a7d93713f278fe74343133f8cb23ff49361e7e81b00c377d405bbdd7467d497e9c3547d69b5b605a5ceda162bb71393d97ea566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e052fcea03bceddf143c7502c7e424c
SHA18ab83a32a9264fc440ba9b1d556fff78b3e1e186
SHA25647e03d977072acf33a803bc88a96f4ac4787c143844250b704f7bb4a12e0ef72
SHA512a2f67d3d975d3b9305e52ad828d9b134acd3ebdbf768cb8b0f2a77befe8159a514b211a5bf2ef7142cc50b6d3424def133b28e2c8c2024a313f81ca72ef03a00
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a