Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:17
Static task
static1
Behavioral task
behavioral1
Sample
6bd619fa699f1bb477f4547e8e0aef8c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bd619fa699f1bb477f4547e8e0aef8c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6bd619fa699f1bb477f4547e8e0aef8c_JaffaCakes118.html
-
Size
1KB
-
MD5
6bd619fa699f1bb477f4547e8e0aef8c
-
SHA1
53dea80cf20bf83f07c7f809ef4b0f4b2512bd75
-
SHA256
7d34d09288cb8a86ccdeb1705fa8df87dcf33ad766dc530f926ed1fb49e40999
-
SHA512
706a2ebebee15785343765f41546bb9deebb590a804aba8d12b7426565299fc16f103016105bf0ca6459f3784cf5d2a7ee66dee2dc5717bfb9c91aeb90adbebf
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e453813dadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC29A631-1930-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e38a51e1bed66a4686e78c2313ad53ee000000000200000000001066000000010000200000006408ada2b181d532bae80bb1790e9e3cd57ceeac9120f3afe316c052f3f27da4000000000e8000000002000020000000363a7181de3e88ad9857dbcbd94cd0bc857cebba4f05403d60ad376b8b025d869000000064d6a8eaea939e8949927c200f717585e897396cd53c2b1db045d0961dd1c8a96bc1a5b66cc9d984b9ac3c45b20b4b6f00fb958ae2b73fe2bdc6e958dcf875e00638bcbb3fe5e89c3893a33196f86a95b5f3a68afd3fd4ca7ae378390a63b1b36056da5b6c559110057a6fcbc2d08d608561affda5a8b68f29f5808440f35a45452d9739ca05097b4b1231c5189c23bb40000000906fa3aaa823dd06064fc00276e391a4df27b1231fa99775557b710ea76c4bd86383f9494526dd9b889725caa990a887cde5971856859d96abd3a7c75c565193 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422650100" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e38a51e1bed66a4686e78c2313ad53ee0000000002000000000010660000000100002000000048380c8a2b6c0493cacf39080752cad2822b9b561272c956cd0ac9716cca942b000000000e80000000020000200000008081cf0b6b1189271245991200576ea78206a5ec82e9420da9661e9297406dd22000000094162581c81f0d2f5047d4469cb4874a34762fd36086555914ac8808be2cbee9400000005ff5cb10fc963492f41832568c991eee8a74e80d7a48bfcb3bf75256f937d1b2d8a67a9271e49c3781f6f0e399ded4c232c2168ddcb9d731130ca9950970a02d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2292 iexplore.exe 2292 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2292 wrote to memory of 2304 2292 iexplore.exe IEXPLORE.EXE PID 2292 wrote to memory of 2304 2292 iexplore.exe IEXPLORE.EXE PID 2292 wrote to memory of 2304 2292 iexplore.exe IEXPLORE.EXE PID 2292 wrote to memory of 2304 2292 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd619fa699f1bb477f4547e8e0aef8c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD576cd61aaa5b7d2862e031b4788136f41
SHA14ac922b8724f18a1f5a3446899b86247fe02d047
SHA256116c37f53b045db33598511e86cdec781ddec560fb9a19ac7047b791a1c5bddf
SHA5127afa92c9d0f068807344261e75442c06f8112d03bfc11c5e1798d5d5359e1a14e54e3e896e2879bab848f84d08720fb46a029de32b991b84ff5a6af7528d768d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD511d069db096dcb03c7e96701b8058ed6
SHA1d7e5a82ae761b991169e4baf3cbd572fe0725d5e
SHA2567545f66292ac9ad326076a6995e222a3e7453d1f8bec5d1ecf6a71c844d9f2a4
SHA5121a6733d71745f8ce196d26ea1aa76d05d8d927a56ad7eabdaef5dff8a8d27cf519824120b2580ed4e366860c9e1a38b5d3f917b944c43048e28cf59f891c8cb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54ec9e0f7522f994658b70c3a04befdda
SHA1de7026ce270e8b60a58077886b1e83883d2c8e94
SHA2562e6930b5d05b0e88cae4cf9b7e047971a1b7c6895a161bc6f3b3c77431563e35
SHA512bba6f9ea26d12eaf508e8c748da40f92d17c31fda6cc3c2fc15cf5f24e3aba26a5e99d873bbf938e609a3bb44f24ab2414b50e98fb0821494be657ae44174e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f323d1c0764451827958ec8202ed799b
SHA19b0dfc01116804522b05b4dd80b6695a22d50e50
SHA256c1f8225bf05f7a0fb0d012c2d42dfe02292b351fd495a44ac8cbe3c70f71e9c5
SHA512f0f7ac55eee831bc4f5b0a23ed5225f515852d31bd1ce93ced8a37c75df1b4142a74c6ac3f63e5b6485af641eac7ea5f30c22a460f53e21200df1cb0d7a87d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c8e4193efbb345fff3942cd3d04c173f
SHA1074ccc71e54015fe5aaff86455aaf780ad941868
SHA256892be35a4e933f7b0b8923221b97b2c86665f6943a37f2bb8c5a2b283eb60528
SHA51210f2a6ba123095d6bbea508aa59f8649826973bd4a5baf85dbee092fd6881d38cbb7f04fae14de066b458b30cf0fe2451917905bc241cb98eacaa240331e2cd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ad107357e9dc297d21eb1b3f0eff9ebd
SHA1116d8dbc7e4e90ed40786a8f8347b2ebea16f7ff
SHA256a47b91f75eac60cc2955ff3ea5d8352d894ffc5d92ae572b92918019c1d1abc9
SHA51261727a078993707f909268a0396fe5b8abf2a98a940ae5ca5d2e2ef73b719071437e7f9f8da9ab9e0336adcc81365d0726aed62a91174b7e385348265e16d110
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c4a964472c6cf67d511166c9cd5219ac
SHA18fe35eb5d2b751780ebfcbe8f309a64bdfac34a6
SHA256cbe6075c9c3498a3c95784a61a01da056ea4a46847e9a90f81339c8759711ce2
SHA512441afbd8280bd350fe9bdc7bccfe1627b7df28b8767af06da2b34091eaf74532810343edc1618aa26725945f88ab2ef534bcddd63c1ad82e1737fa969b1d45e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54650ed8a3a71a073b6aee46eb6138652
SHA1131cb2a3031b0a905c94fdff50be7ebe511eff43
SHA256ccc9e06bcedfca73b636529da1bc3c93d2087b2adc9f54780f1d5453c3522a8d
SHA51254839d2a429ed960411daecc66faea591d2d8daffe22ad6872181af408cec0ae6e675c62a8732d8d6409863e4db7509fd50a6c17b2e85b7099b3303f6d08ed14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58f85ff5edcfe7eab3f88b03b0b012582
SHA125a20cfc3757cdf415cb3c5b3f25d07296af5403
SHA256516b180eb1718b192e75bca8535e77b02be28185b054126c5b3c52065f8a1223
SHA5127657576946a31087f6c737c8fe8b3db573bddb52ae85f8050652dbf60eac9c5ae7146d5eb5150e50b132279db5f7e58941c23071ff1c3612dd4dc51fc01f31e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56d9aef77dd042b81ef97cf3f7238da29
SHA1ec0f8736335703535a9a1778b0246cd66475329f
SHA256a0617039505c1539daa0abed499617b272695bbd50dc98cb756d7e4a59868d04
SHA512986de837ceb5ac64e4a41e8cc9f2f85ea3102500e19f8936ebd3068fa06d75f0c29b13fc4ac9add955221f46b581c1006fd522585a725b6d11629544afda2f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50d54c10be37f3b1c13443f3eabe1e435
SHA10c972a8e18d40fe8320046f53d212eddd34c36b7
SHA256c9c09df50595411fda150880af72b511bbe89dace3dbd9ac647daa4baa913f73
SHA512ef346682836553a689fab4cd0ac93836318a33b4c2c38deb5f3caaddfff7349af997a9fb87a0b91fe0e64b0cf0529a936f4a7dda5264727e917746e0d6dba87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cc16c6d3a2f53fd46665468bfd372609
SHA18db5591f3bbed1f6e274279f305179253828cbf2
SHA256aca738a6e8c42c40becf370b86bd3c572fde21c811fe0ae513ce7072d7077930
SHA51288c9cf6977a23c2d421c698b2911c35bc7f31f014b951d9b1188cdbf401917ec2f5cae4b64119577824936f20a03fcb0f4bb184d3a665441aa6c5728d29005b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a7351c9138c42f02d6c0f553a03c4c5c
SHA12f03d356f0a9690a5e10ce1ba299694039bcf0be
SHA2561b58bf4266db19f3f24f7f397730292c11302765aa181cd18e412deb1dd31edb
SHA512c1142afb9ca6b6b8ad45e2c57aa5acd11f59a2dbbf34a69ba57112c5883dbfb1f73346a23b1d0eb0325e8a7ea2489006c510abe0b57ce9b6b8426770555668f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b5a364b097364ca66764aef2ead43f3e
SHA10fd18df26c0c4a4e91024291415d3834efa2420e
SHA25620fc9df2a93c35703606f7a86623f0893815e63d6ff1bf7d355b9a5381921465
SHA512c6c37c6ed96b9a693a1e65710f2c3765857dc413e8da75d7f06a8dc356bdeaa8304ff0c861ef051e57f0c2a51352945b18d7d1bc7bc9602dfbe35fd165d11464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51ea860278a7c7af9992ca819e2046e4e
SHA18a0e913da5e06c2db7731b189e0d2154b8520d78
SHA256c9bd3172d9f73f00a898d5d305e936f8527e60b85e555095125acf7d40897c3f
SHA512267ca4610f52cea72f15302749cb43984a310d6270858d0c4332f42887cd9ebb7ffcab803be8120747f0365363413d79744f53f549671b06f0eae727d671bbca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51ddda4e49ffc16554847f553ec48b7a8
SHA1ab1d5a3dfdbcbbcd8aff8437599c17bc43f2ade2
SHA256ac8f89c4babad8583efda83812c9fda00211a8197cd739ffba39f5006fbef52d
SHA512d6e3170db576b11bf0e4573332c93f94cbe7af6096c603a1828c23a1e388ec7e1fd024f10462af0aa9e05bbcf93ebbf4815cbde7a12a7bfaf9242711e1dd6f80
-
C:\Users\Admin\AppData\Local\Temp\CabCBF7.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\CabCD16.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarCE32.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a