Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
6b3ad73e40ba8ed119c2a061384e763d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6b3ad73e40ba8ed119c2a061384e763d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6b3ad73e40ba8ed119c2a061384e763d_JaffaCakes118.html
-
Size
4KB
-
MD5
6b3ad73e40ba8ed119c2a061384e763d
-
SHA1
f0dcabed71496cdebdcb1e23ff9e30a3a7319d48
-
SHA256
021de25aa8f1dada47043dd2a07ad6ba14102bbe3cff101ba935fa65c69a5f1a
-
SHA512
ba38073a922a0a91f9b203f995d65d74a9e8315a3155dad8cde1fb3653c38517adba16caad2c744296cccd376317429a223af93bd61bd3ea283a5f2f0ee61a9e
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o6CNuCj4:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000535935d0a58c414bb6ff1aae955b204f000000000200000000001066000000010000200000007464bcdd971f7ae46d6abe7aa07a28141f8f5c77cdf81ec6dd0e9eb650928cb3000000000e8000000002000020000000415a00d4012b04d23cc1a73c2b37dee21ee627f13e94286837d3f17bd97234cf20000000e09ed6d45c6be1a886aeee7379752610a0efae65016a958e927eab827d29cbde400000001c574fae7f4a2a68da6a0571ec6a846a80b1dffd9ca3042e0def979e7070dbf60f5d8e11ea210030563518a0d8618c35842f81ddaf1bcf6fab64e65bb320eb50 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908d4dd51cadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFEE2641-190F-11EF-9A09-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000535935d0a58c414bb6ff1aae955b204f00000000020000000000106600000001000020000000e9ccd4e7971351107adc6b625a68ac6dc074d0dc4b85c9c8ec218fa9cb7226e1000000000e80000000020000200000002f03e620598b7700202e9d94ce12c9becf41ca801f39682a06ae3a4f3341fee590000000d6f4e04f36e55b49d65c6b7be53f8594143cc2f18e70a624fbad52faf80b4788630c28b37f9bb3b154398bccc8deb3bcfe5b1b06a43012fae057f109d790e195e9f6285c1111022eec9527c4f14a6f79bc68e0046615c156c39122ebfc96adfc5b5af2495cbad6b26376e90bc86dd89d088edbb7f38dc2d5c8096550f92193701d8a4ca7d0250b9017fe510fd5f7ffe64000000085b5f50962b4e815dbe218e718ce2b4fb0839032b346e0aaa1eb7f127ce8dae11734e9285a4941fc200e339490683b9d468c2c4bb308b013a7e8a18b82b36fea iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422636067" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2656 iexplore.exe 2656 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2908 2656 iexplore.exe 28 PID 2656 wrote to memory of 2908 2656 iexplore.exe 28 PID 2656 wrote to memory of 2908 2656 iexplore.exe 28 PID 2656 wrote to memory of 2908 2656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b3ad73e40ba8ed119c2a061384e763d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ce1d1ae657ddf791169cc7c73938d99
SHA150b9375b267d0dd181fa36217ee635ec7b006a75
SHA256591a4c48e014758bb5f7456eaac4a1b03fc6ef05c6869fecf38cc6fa13f2f633
SHA512bb74990afeee814cf7dd62f39eff94a4b0c486164b92e93a963225ca4645c67bc693b57a6ba63fbc0bb4d86500660c007c34909fcbf6c8a7da1f20a4bee3e831
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dafdab12c0ede106e7edd810bb761381
SHA1b059e9478b6108a88fc5220b7432bf4e74778077
SHA2569f54717ec1e3997dcbf04febd6c6d90882e6b5276197440b3fdea6a5252fb819
SHA512a08e7a329d674c76aea96755967854bab65687b682dfd0c1fb582054149f453cc989f2e227ed6d387aa06986b097e1d63acde0c99d90e1cda62cb8744a0b0256
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57361fcb52de5187fe1395783ceeb79f7
SHA1fb760993dc35d09794928254a73d3edd872b17f8
SHA25604a453d991f0b53ccef84a439b5f24b4c0b391d4f96ff6031a5c62e7815ce0c4
SHA5128887156e32608094ad32ad60725644b5e203fd26a6c57d65a62f995307427ea41721219cf8eec2134830256d1fdf329aff05b1dd9ee9af8d2ea0e4b0a1f1f551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f9533a091ad1506bf3e16a8ecaec029
SHA1d80020a2a772aff4612cf4ae2b1fa3fbf59b9ba8
SHA2569f66dda92fe2845fc66f0449e35e12c92ad1ae65ef1216ed5185d20e169a80d1
SHA5122a7803f2bbf4707c24ebadc4e47028b8b3ee9971a9950ec52137be4c106074b8660f05b0233a130e035a3728869220f3b0e1c06c6c6b6879df398cbecbff2975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596323f0b5e239726f25d98d440d04e6c
SHA1c09721edbd77b5e983e12b4d66b698be54d9257b
SHA256d54e8fb435534977f96438cd8727075d38241f187fa27f86c851ad6d599beaaa
SHA512ffc72f4cd7dcede2cc7527582483d11acc4284be236ff5fee99677cb030b1813cbd834b1d7e0f16181ade87a7a0ed17f41f736cd6eef3b339e21845d71c026f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af1206d591dd7c0ad9451f0f9fba2a98
SHA1c958a105a548bec8fd763a60cc76c169a63ada0c
SHA2560d7ef8bb006456426d1d1608674802982976d2749024dbd38584c630b3d56fbd
SHA512a6982b71cbbfc3de61614eede22c53679a7d35ae91055b7be5d889b390084933518442972ccba91907021380108fc9aaba737f6688678ab8b6f18f3733300087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec2e620e6fe3c94e0c09941255a5d451
SHA1f8fb9a174410f377d888f1471ca06b33cc215b1f
SHA256b80875a0266864d09e4560a9f4fe54b61afbafb6ddabdf39b8151108a2813ffc
SHA5121086756acb4cac48bb80386fcc3c2301adc85b625fbf24e8e68a6bf9f2b3a96774374a465d0647da5c18590d42a39c470a9b8f7fc81cc1daf8b22cb8de032be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fad18e21bb51b50c154f9228c9a94d02
SHA19269508de6c6f8ecd8f131223a9fe740f53c346d
SHA256227cc01829df27e24b8cbdb84f437e589a094e6d63da76a15ecae34c8eb93593
SHA512ba6cfc3db1c51eec95678f97895db00a5773a522a3dc858af5aeabbd97aac931e683c65e2e96e3379aa1a5b76845d5ef29222722ccfedf92c1a5be039bbfe1b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5498123b3f1f73af22d6c1c8ba677e79b
SHA16f5440ade2b990baeb4f8c2fd92b4e9f3e812379
SHA256803ef8f2cdc7fab7105cac7ed3552169d1bab749eb383871463664d59facd583
SHA512bd7577553997fa1bea3beab41f3db3c64ce154ea5b1702b00a9b0a9d1f41d38129393e256fe9ab857d1dc1ca758e03c31b7ef2625c4cb045ccd2442335c0303f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575efcbfff608fec35f581bdb724e6949
SHA1f7eb5561c4852cf8b4115bb7d80be5685e5c546d
SHA25679a169d6e8d3c9911be3f805034933282c961672904a9203be227a922f1fd1fc
SHA5126e896efa334248486bce9a246823bcb73f52695e156bbd4d16b0d3179850132671e55893812616a6b33f4fbdedae77c28ecf86ff40ed83edec3a7591df61fb7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dc81ac3dca3393f623bc2b95ecf445f
SHA150b9ac7a342a677d155d4e78e38358b8f885f83b
SHA256e05939afa87e4765eaaab1161928e3775587c560b154e1e972851985e10b1d5b
SHA512589c3bd00a2976a2ffcb122a9d3f134ddde48c78c35ce90a2be84492dfef7829795a43de704cbdb79def24ee81ca88f941d78170e7109994c22213f888b9ab94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aa1a4e1965b8c08e01ac479d1ab1997
SHA1e3b171b4a889c65d00e1d62feea54c22dbced670
SHA256240e8d2c2a75cd40512abf0ab33c9d7cc71ed3dd10e8109d2c27c7b0b44256e1
SHA512a2be7fac3595cc4729f9e2b561e365589313cfd382222b6afc6e83a9c69a12f8008bb2eecc9d928ab97b5ed61f884eaea3589200a6c0133dd8070646f1155567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538167b285e6046a01e251a91cf0abaac
SHA10013a2cf7d7773389999132dea246eb4cd9e6960
SHA2563c2e0e93c63d27ebf42127ceb731d9e216048f106fcc5c98d5bed5a2c6266b94
SHA5124b853865de633df36f917246fd090e2585917d74c07c57f7f3c6367105335a55838c5102fbfee67718d0edb3a154048969a4d8973be4c0b72c52a9f948c45c82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5dfd626a509d4a889d440024ae998b8
SHA17fc642b129b74900b316db77a77e4ca588fe7191
SHA25649c4b29219e2bcbe70402a5afbfcb6c80170b02cc13056afcf642bffd53c51d7
SHA512ed7a04b6e48d78916bdb2e627c0c6578f08ff7144b447bb7fa8627acd56e819be0a5a554e897d61f27ac958e577299ed72ce54218f596de8309d3947462228eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5a75a22468eaa5a3a9a1afe8fb40457
SHA1503a725e8cfae847e2c7e607c66e6f285ccba156
SHA2564617884f974ac8cd16fd3cf2f96aa38d200665ee1b82b35eb5024c4e1e86d930
SHA51271e97252353c8cb0a5c729c657b4a7f37d9e80e495ac19a8c5dcc71b9b4f0aee0e92c3a0340037701275237bb9dd916d6e6501c454be0d3874acbb5f5dfcd2d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1ad16f888e3509ae475477536a88c35
SHA13eeb2947984f24f5f11e2cadb881ed010301a760
SHA256cc96627c1d608f6fdfeec5bd6d7c606838487146624f78c64eea5d4c16a3466b
SHA512bf5a23cf89920659ba2dc8605be037bd20bbfb35f83d8d114dc14784d122fc417225be0c9fabdf3605a1fdd4bb6508f52f66cdc1ec1a343ed9646c93bd4d4930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d68431621df90aeeac75bc8d72b2fc
SHA13d8157e7aaa28798edc96a6d905d5d8704e34d2e
SHA25661b75dd7b0dcbf5cd2cd50b3ae518b851ff5f24544ddacebebff3aae7cdd973a
SHA512999113cb34189035cc9e4ad11b86fc4ccbcfaf7b89549ec2342f07e055e78c6f4c899989d43fe31808d096075ae4f48bbd1d1610747efc802cd2f9063c1b6e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5153e57a906d67bf9951169b87db29253
SHA1ce34810af324fd20a27d06b693efde8ad4cce8d0
SHA25609c13ef4edc9f63450608396e10b1689de212b44505d57fec5aa07e06df18aaf
SHA51204a7e7f4b7cbeaeb495859fe60c9470665304d6be65da1622f84b6ac153ad7b8dabafd2a0f967bd2e720b086234c0c861d74385953688ec82d093ee3f33ff5ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a