Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 17:40
Static task
static1
Behavioral task
behavioral1
Sample
6bbe05d4141beddb0e1c0ce623ec24ee_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bbe05d4141beddb0e1c0ce623ec24ee_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6bbe05d4141beddb0e1c0ce623ec24ee_JaffaCakes118.html
-
Size
461KB
-
MD5
6bbe05d4141beddb0e1c0ce623ec24ee
-
SHA1
804aece98bce47980255065985dd418e849f70b7
-
SHA256
b75c132195c5a55c85eee34f621b832b7628dfff05e649fede42ec7d3308fe0e
-
SHA512
708273074b0534d3d2226e83540032f8d6a0dc4470f6fe79c3d56b4b1b4f038fb6b1751b32297d36c9117e987fc42243e2b86f00833cf6ff1fe43b88f417d754
-
SSDEEP
6144:SysMYod+X3oI+YFsMYod+X3oI+YgsMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X3b5d+X385d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422647890" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e16d5e92a420e94b9ef7592065aa108700000000020000000000106600000001000020000000c1d55c0b92a9222cf286c6081d2f5c1941ae338e4ab5a561c179d2b60383f491000000000e8000000002000020000000b5d8c7752f4dd82424ddc710f99a7fdd1d84cd698e9afafb6f59d32a44403e67900000007173807036e01fb14f6eec618f70a6d85e42c5031adccef74f79972c3c94ea9a2683efece6278dc3cb50cb30c67d4aad3360d1bade05bc22e19e329e169931b86c7ad839e2fc3eebd95d5148fa2ced24965b25ecb0a2c493949e8ebce95e2aebac60d0eeddd966bfdc20c8a6fe75bb5557dc3f3bf408c11324d71938b19d47698a9293d9349a9d2883fb2512ae9eda4a4000000059d65c57d6bc5b2108b8edc3fbdd7f1a77d17d11debfec690d40c3c2e1396ce833f708b12fe251ef441f0468e843dc947b5abf0ca6c3a773c2a6b16a338da371 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e16d5e92a420e94b9ef7592065aa108700000000020000000000106600000001000020000000622953816c401e9ee3588abc317e5568851eca89e5965f603c9cb1f82fbd1029000000000e80000000020000200000003256a5e27380abac704c5a1edc021afb74d6e3193bca5b562e7efe0b4435ace620000000ab2847c55213c0a487fa67360da1e5c688f8b72dcb1a08f8afd82ea8dca00e0a40000000d8743b479acc561e58cdd997c2bee500503f7feeac6cb621690f847bc7448f17524677b9b23551ae0c674d885836b2edc445b1a5dc8c7a3c24be7c4608574d0a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8092e45f38adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87132651-192B-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2764 iexplore.exe 2764 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2888 2764 iexplore.exe 28 PID 2764 wrote to memory of 2888 2764 iexplore.exe 28 PID 2764 wrote to memory of 2888 2764 iexplore.exe 28 PID 2764 wrote to memory of 2888 2764 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bbe05d4141beddb0e1c0ce623ec24ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553da16970829fcb946d07315d91301f3
SHA140f6b06fadda37360ed54bfb7b1314934bc95545
SHA256d2cdaa97842152069fa57bfce8982ba2c18a0c1a31f5726f8022763ec39f1781
SHA51250e0ebbd96f204a3c7b4001045f2a27cacdfdd1cee326948e1d9fa045dc3e36f07bb21cd2f073033658d043c75f700e7444f0287ac2588d0c8a1fb7132b6be1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0aed8892d60e79029a7cd463aa74e2c
SHA183c1460e9d57bb7287db0752b28298654aeaf56f
SHA2569928af49b7c0cf7098b9d1a9e66a97ea39b4b0873558222ef5c1206ee855e80f
SHA512bfda886e8a2420a5e4e333fad0dc9da50b3221b71d5fcc4e3406e29d66245f51494f5782369ce350bf03bef40f333ac5a86df6a9d5776ba2588c79800b8df479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8e729f2fa11269019361982b897d567
SHA15b77337ae50bfe11640f75c042c9202c3745dfe4
SHA2565db5284f52ce97f107dc6a783a526189c68304a4fc4c814a5e93f6d06d6fc632
SHA512a73f51efcc517ccdf6da2a8644bca890da0b1cb387fb5a5048f575355e1ad38a4b62c16d1e3e605da6fce71b3a82a51ff1f5d4dd952a0c4daf76c47209a17a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e08ca6974549a15fe3dee3a431510971
SHA15f55ace078b62031dba33b272df22ac959710a4a
SHA2562a132040153672f48d305913bcb3645cd66243ed0bfd817d5579280b37f6675b
SHA5124bc0862a7647c9da2570691b8979df38623f408b7b269b1da69bb94e15c69100f5df421d0b79c939f5858e9752a4b7381b76088dde3c0e4c013e84d437b995fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505239f5b58cb2a989b5fc83d7d84bd2b
SHA13ddd1315d4fcbeb184a992d4f7d6a8ded228815b
SHA2562727c9e50cad765823e770d4cfafb4432c9e712a7818395e1756467482c6f6e7
SHA512b006a6f14a57719f7836810e214587d480d6dc9dd42eeb0e3a2b6a082b3547a3f916c78c5fcfc9e23451161fc3ba9c08bd12a8407304ae218a2737518b1d46cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2f7db8947c684ca228375a5aab2cbf5
SHA108af5adec4dada5be451b582bb3fee55b3c44b54
SHA25684c61bcf04c66fce2905d7647b523906135507101b83804119840357efc4b568
SHA51224af2913b910a3bd6d2d454348834f6f38f59f2d42ce99f545bd84f1b9b969d77f39deffa3ef8658ec861b25c93baa14e2ff7d522ff96976b933e4b0448e6ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaa951397244db830e7f1e5ffa89c810
SHA1c5dd30b5ccea3cd0cdc379eb1e5749876fd0191f
SHA256cf9994b5946d956e3cf9f496b54f57b6ce1bd0ea787e0984934d3f40abf4c310
SHA512ac00bc3af1e59409fb63879b9dccc4a689fb9cafec64ac68c9748e25edefffdd7a359af36a4d719ba59553f9b2ba320bff0aff7db11b0d28f26da55de05beb52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5271499acf8e3917c4aba2c6c158dbb7c
SHA1d531dc6a996d79bf6c59d1def20180cf1c25e59f
SHA25682a8cf06ba0cd91397a886ffb7ba2e97ccdf08fd02a1623fc8f03cc5d24550ab
SHA51257c662641be5dae06a3795b5f942875d3b08fc132ca1fb619534e063d8ca032c0cdf2f8a46a4bb469daf54432ab38292ad7f70e60332c76ad153761245fea144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f21d78ad1f04982200394451b9dd84f
SHA11c08a556e68a71f1a8a08144c0bcb78c896a9642
SHA2560dcaccdd735b9299f68730e7902a0e0ad52cea199f5374c85684f0ad067790c9
SHA512e2998144751401ed76a301fae7ec7787b3a1cd48f37c562d2e01e74e50903b4afcdfc75f0e0031d4499fdea8bff4b743f4a5fb8f8ae6846885853d3cf94ad0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521fc82b6541f2123bccd6512873a394e
SHA1a2f4cdb1b4e2716268394776de46ee965a2818af
SHA25626e678cd7b6f43456a07fd0839f8943c22f424adb8391f5c7c1fb5d550cee0d8
SHA512eb286e472296276e59c15c2720cfab173a79af7ab9f6ecadc7d6b427376b765d37d6554fa6058bebcaa77afd06b14526c94b9d1e8b5c1d61eed4f0c45459b9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570bdc873f8c1752219009f92edd77592
SHA17a4aab7f4994d8b8f22add9772e1d1642e1bf1a3
SHA256e28dec39f7f0f7a72f25e5b16f38c278311c3089b000525e99da0db200b9b1fb
SHA51227ad88fac88eec920075b471ba986d5bc19d580b4efd34abdfc13b0783bd007224f635c521ad10e1b4b658fd06dc3bb979f4d40d76bcfed792afe137a16689f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb6c2ebe4d60b4f346455633c84f9b07
SHA1ea60d1edcabdbb9e2b3cb7c0eb3f34d26c929bdc
SHA256e5e71cda83fe7310c221a3ab050cbfb9628b403befa36916bc1ac0931d845530
SHA512beed7aeb091fc2442d4465b955ed1137bb075bea99081777f3a1cc4b30ad5ecce4b4cff4a00adfc15d56526b5dc8ed84f681026d1512714eefd2a727de35a0dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1780dc4c10e87fcea766db465539d31
SHA17e58ff74eef02520aeeda6ae3cdca356fd61030a
SHA2561cd1525645a1462e1170fdfc538f3be63a91f9e71373d8794874e11bbad8c0e0
SHA51293060236298b9ca0c32ea6e17c1daea56a225912bdaea6bb359097d1a1009eaa8c3f3587892e064659b6b5ed68d8e0c4c483519f0b4a52e815cc5d5fc42a3acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551c5ac0731bf7571118247979eae1628
SHA1e6303d2212df37c54233958b7883ee45ace75727
SHA256d1dd84f6501abd6f534ab93f0ac648fa43409961b50af427cb308cacbd4fa8c1
SHA512650cd0a34fc47e92908a4ce460c2d23633381f8892f3d511a7fbb71c993aff645af95272e9bbeb0332828bb7e186e4b5972cc9d3ddaf40198b3fd4e9f2cb2f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f4becd5768bb485ba49558e24aeefc7
SHA10807f8089c4892c5f42d6c0ce7f90a2354d8f8a3
SHA256069e2b2e02d07b052b5807a9da196062fc7f60c32f59928c7eadb0b4be12b1af
SHA5125e0d7652dedf7c4c530f4b5fc9391f61d1d7f4b1a8774fc73e96369244dfe3a643a9b5adedbf996e77efdad1cebd6ef4ffa8de72d086be20376683c460cc6c26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3c51b3a7d97be3446328a62956236f9
SHA1f902cbf125d77e5a2b040ae73b352a27019d6915
SHA25689eecd10e9061075a93604036c375fb39f4f65d16f9e9921334443ace2eb5114
SHA51275fa96b7c0c2e5c06067948200afa86a8214b766478cb6a84a3335739ff24b08faa322f0b479bdec52eeb6444443b51a11a0ccc516c3a0160c15c3957e7f2a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc70d076fd7493efe6a1a3c1ae286086
SHA119840b3f4d2b8b0bdfcd93bddeeed9e467d7e1b3
SHA25691f7b2c0b9959cd0d7e4f38b6029e7690fe596ad3068dd232ec7910614ff7155
SHA512f7faf472e42146807139995eb1b81481a364715a63c857bb6bdb227a7d3fe6e38e2b601909d6f4c5496f2f30c3729755732570a018edd23144b88bcc0dc832f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506cc1ca105728ea80e4acc3f5f668c14
SHA182b32b8b0499d9ab220f27b5b59f9674399b8766
SHA256ad372676d80385acc602154dfa5ec6a645cae83dc193b629870eca25c0ba69e6
SHA512c67fdfa8ffa06263228a544888bdcb8ac45aee3c605534603b7bfef4d6b0134c3d77518d5ac21af7cf8c556f3e0acce3b171554a7252e7150ddbad4b028305c3
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a