Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
6b738e881d17d20cc4960d5463281136_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6b738e881d17d20cc4960d5463281136_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6b738e881d17d20cc4960d5463281136_JaffaCakes118.html
-
Size
460KB
-
MD5
6b738e881d17d20cc4960d5463281136
-
SHA1
7db8007f91f9d82aa7ea3c4a95f3227494310d99
-
SHA256
a946bc75b5682de407f1be627cff306e6925c9c9278e1a8a14b6d65dd0b5b750
-
SHA512
75def25963b0485b617df6f86b6a75b3294895de0dc084033b886339e79f7895c8258398524474f51574ca614dbb2d04ac698114a7919182c2ee20987eeb7674
-
SSDEEP
6144:SLsMYod+X3oI+Y8AsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X36u5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F2E5901-191C-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422641299" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846382aa723aaa45a1607ad13335e71f000000000200000000001066000000010000200000004e1b69e39a75b95e65dd9e4c3c556b46a6a118f51f5f3ab7ae22e40aaa14a12a000000000e8000000002000020000000d9cbb7a3f9db37b4b4998ba838c3dda7c0bac6833fce63365fa13610d358f78390000000081045446c42cf21b1db89545df1bff0c36bb3532b04266661039dc2d6289c813227d59f1bfc8db0112ed670fc686c45d18597cb12f98307702e30bd748168d5cf5c395d9cf11487853eb62c6fe6332d83f53be52c2b4c3fdbcf9c5085f66c8f969931254300fb55d70581efd20970ab746211c80c61e87696c74a98f59d568492f030daa83a1a66745d60daabc2d70e400000001b3b1a8b7167132b74eae21adab99383009375e873000433dd8507c2e01cf939a90f2483b31a20139b5e85f0811b5d5798a927f3552e6c74836c2faa6a6e1c9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c7b70729adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846382aa723aaa45a1607ad13335e71f00000000020000000000106600000001000020000000dbcbc1c54ecdaf25ce161773620aeb2cd4b5d2a2bab1152701ac6c8e7799a90a000000000e8000000002000020000000eb88c815a5d1bd670a1f348f5fb37e5ed728ebb4fb2e54328d8b4dab96ac7b17200000002c0f6738a6aed6156441074e6f48e2e4150832023c908fc43130c8e441200ecc40000000b71a13e61423e5ace63f473c6cd38e45e5fa4f7979e1fdaa166541879f67de4d795322b9ab4386c6106f20824131761739d032932a950d1f71ff8f5c487516b0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2984 2276 iexplore.exe 28 PID 2276 wrote to memory of 2984 2276 iexplore.exe 28 PID 2276 wrote to memory of 2984 2276 iexplore.exe 28 PID 2276 wrote to memory of 2984 2276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b738e881d17d20cc4960d5463281136_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552263abb8a49d509bdf042963d9281cf
SHA14006cad14901cf09cd1b37180a521fbf823d7b42
SHA2563b888c7a2849258756232d2369d5a53f141f4b1b1bf222e162ec6ea62ee8f608
SHA5122c68dbec25cdd4427c407113c5d4385aa401d84757b5aa97fd867751dc80f4c4199c76e03bc829d7c8fd12f3ebfc67a2a1a06928b182b026e52844974f05ed0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b58b7cee24839c94e4303584ac3a548f
SHA1ddf510a894657bed0f0a4e17b14bf7f0707f61e3
SHA2568e3d3a2deea97205c7b7228c68865fd972fe4ff4ee6d372fde68d2968a3746a4
SHA512e7256bbf124e3c4571a232fe478513d92d7da5dafa6010ce6e6a41d920672391a554180cc5ff958514af31a265c1f89b66c995656757444a3969582c6f3318f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc89086f4cefcaa996100025915a095f
SHA183eecfa586f53ff8e84aab68f468b8eb469235a6
SHA256d15196ead01e9db2b9532ba2a439beccb881691339658e9826afde474bfb23b3
SHA51280fe2ee1ffa0a2d711e052f2f0378a7dc530ac44a39fecec5b06022c90b7404e9d4380a72a9b67da0d565d828f9f816854741175223b1dff2b5a0a7e63e718c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51430b6d5034f97bf4c43682c264f78f3
SHA1bafa09ed72e18e78bd94cf536d86ad1d3b339f5e
SHA256bab1c22c49e4b0df8d6530de91eefdfb677a3bca64fec0ffffe8b3badda24405
SHA5123456171846593984114bca68f084de965503e3885d2e3bd87943aff5761df1ae9455456812a948d101f61597d6a44550598d4fd60142c9cf2d4df895bbd03da1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51125bb7e006b01d161d469abfdd6af2d
SHA13944df907960dc8a6f4e60839b798b84edef3623
SHA2568e03f71dce3314abda639026634b66c4e95fe521699cd63caa483d39f73392da
SHA5123e305a8ad58f8f3bfd5e21def58d4bf74400b02565e838616dc9f8225caf4940823eba4243a743ffb155630c71b73ebe0d4af3dbb80843baebbed433ec4e1712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544f8d42fac73763fa512efcb85b2e272
SHA185a7d603e47b53a98a8c3bb5f4b742c5fbe6f64e
SHA256405eeb28bb712319f997b760dbd198f5134d417e123d7cc5d2121b774e239e94
SHA51211686ca6e041a0d082a9877b586386fb19c07233d080eb274301fa19c10e24f48ad28b4e7c20b1a7f7f0cba418fb6de2b150a1ace4c27ecaa2ac65a24b726c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a52078acc85493935b3e5694de02b9a8
SHA17ab743dbca4ce2bb8570e440301ed99ddb9072d3
SHA256bb8644d9a022d33d4f84de489c1db93230dd0f876e70a46a18d809b053c23c73
SHA51282465da03d01d3854acf7ca67f9539eae534c9d4049dad60d1098e4dc9de1962210a8623430c1f0370be45cc8d07504fd9c288e5bb49de545a06734403b22b52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b0108e54d1f14098447f2854f14c77e
SHA18a6873605da7cf4afcd47f66cfeb5f86a329b08e
SHA256bea29ab4632069f18dbedf398a4bd39d4e2f065b6ca93180da0146b496629dc3
SHA512b825f54dce884cf2cf3361b5b964eae20e2e90f24485af853802fb229d7091cc21ff03e8a87f29e33070277540492ecbe63d1a8311002de54cf18b29f7817747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fe32a39f39d52be28aa8258b0bab58a
SHA188247f633a9fbc1b6ff82266dc189a0620b9e05c
SHA2561ba9ee5f263edbcd00752bc70eebfbf646594afbdea25e3c646d9a1b82badc70
SHA51276df4f61217a793ee6c3bac259585905ba182ff3e2f83e6ff9e557cd6a90be78ad21d752294fdcc775c7dca539da4373b43229ccff7425d960d5e8fbbb1e124b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5b01dca504486c89ef04aabb34852b4
SHA15f0b93477dc60ed1d65fc15e453e8a471f91de2d
SHA256a68f1831a7ae74e21b5beacc10c1d99ca5ffe80c73450120edab055700c4a9b5
SHA5120e43a8750080c4d0a9c736ad7d454621ade8ace2989adb57b48266471293f0e3e7d211969cd576dbbe5ec576cce6035db55bea59b6f8937a6c1c2d0a7d2cc9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4df545776d9d17b015beb6d1edce1bd
SHA1e318c3b968f654b40eb6bd6c8344a6515cdee974
SHA256d66d0cfe2211d39bd1c6c5f58ca026ca8b7faa66a06c92f029f44e4e06d1c52d
SHA512f8a9a91ccae1085becc3fdbcc1e091f6736060110df509272b80ad07e82364347d8dd074787cd67c4ad3b342c9ff135e35afcadd3bd27b013a53646d0514d8c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064cef3330344a14e4f9462515509d3d
SHA16cf31210d3f72e3764014124ca6403c52165630f
SHA256c280d669c3bda5b1721e7c94b34a7c788d4202c71c9bfdb5b9b9fc99935c583d
SHA512add7177e96941c4a03fddc6040ad20b0b4ea05cbc00d7bc6d8ddee7a31ee4f26b331cf35e008ce35533ce249ab4188785fca1df45311b8887685999b434fec48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8304a56a2d1e6b646f89316a5d2a9cd
SHA1383133851b6dc003c560fc4be358dffe6b54a5da
SHA256b6dfdf7991724d68ed1b65d2b764df25ad54f2c9d760b2a40a4bb77aa87da47b
SHA51253ca2217578e144091192bb8c66f8ba334d2fed32443ca0133dbd9a88097b2b10af109882421e15ede6211ae2817d1960a398e2a9b9b06ddf19a48edda281687
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9626df51f721e43f06b5b13d094b5cd
SHA15b74e04843bcf82e5967c4ec09ff0e8a238322eb
SHA2564d8afff564326add2f4bcdf8ecb532b8631741ec967d25fc64642717709ab322
SHA512e97ef639d44e163a4c2a9e88b21e8589ad8e3af64e199935d73e4d2039d5a6d24154458570f53b09743a14841a9cb76c1676dd9edf22c0a294928dc85aac86b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5282d128e3c8acf4973d6ab8c55d3cdb5
SHA1c2c29a86fa33c910033a70c57fc20d36661b80cc
SHA256591064f930b526e02f2b3f8df8e5b3c7d497921c1fdb42e8bdd7571b42b0ccfa
SHA5127f3f838b868136812c6a1bd7dcceaf81595169fc44872c8db27310e32e55c1ef98f93684fdf5673698ee5f9a0136d52b1ea93924e343dcf9ce10d5cc807c56c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc0bfabd216ca550a61385fe2c38b3f0
SHA1f55adf796b54ef61648c8fe2faac647f944a2c22
SHA256b47f4159e7ac363596411060c763abecf27f2de0f4eb4d4dda3c4f9fe9275d3c
SHA51210b73d3d4c0e36647898ba466d01ffb69301fb351f8b4c05d216ab8e649749c46cc4c8f80a4e4c7541dddfffb84ef8599ba00eeaf5ae75309ec7ad50a86b4aba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcce1cf622adc49225c973aa93d26488
SHA1cd187f74bb99f7b5ee2c9aaa8c40af1d4fda41c8
SHA256e74db7b81634787cd4de4b8bcbe3370be4d89f2ad2800d0fcecb9a6fb80396bd
SHA512c6553a905be210cfd5c1673d904ec4a2d3dcdc101fc224540bc9eee8286fed0bbb9eaa7bc1f422c6c52db8c4840f953bb4930fadf212ffd6a37f26d2ff4ad283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec5245f3216da00bbd1fe0611cac53e0
SHA1c8ae0a4ef89577f1ad331472b2b471d8888815fa
SHA2566e885a1561d0be853d8c017cf8594249829195780f2cb1ceba3490fba46a2eed
SHA5121518a2515d554ce2c77004d1681c0b7f41d9e6f4981fccfa19096fbf7855b91a0aa290974ba08319ac71dcf615aec79092448c7ae1c81bd1a7934cf435b549bc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a