Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
6bd9a3c5de53127ff3f14e1afce7e79d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bd9a3c5de53127ff3f14e1afce7e79d_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
6bd9a3c5de53127ff3f14e1afce7e79d_JaffaCakes118.html
-
Size
4KB
-
MD5
6bd9a3c5de53127ff3f14e1afce7e79d
-
SHA1
71b791617e59ad92c6a755dd08bd52917a5ca76d
-
SHA256
7e251035fd73aef7eb04369ca99a28ecf48e022ef26403655b0807bce34f1c4b
-
SHA512
143f614b1458c2ef2275fe87eca7b0b2a4c8820fe6057ee2b94e3d05f5285ef72bd2f84593ba5262ae61b0a14f3c6009ea049d8f0f0d009b7bcd48e74a93e37f
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8odzX1mQd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDQ
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab000000000200000000001066000000010000200000008e0cdf5ed296a3c2a53e487cf44c4ec1c283561893ef41fb6c3b994f76393f01000000000e8000000002000020000000bbfaf032950d3f834062ddaef1f4cea4ffc462f82ef6c9cbd2ecf64f70bb5f01200000007918c85652c2c966b632874c70db5f86b0d7fbb971f8fc0c7d8b1b347463e2b7400000007d8e877481261e39c749a599b138f076c9f9081aa545694baca0d57496fba8ab43f7f1a00fbd351aaf7935fc71a9371a10b7da916e3e0e257b5d0be1ad4432cb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ca06303eadda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422650393" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f5c840ad97b53641b564d0ed693251ab0000000002000000000010660000000100002000000025725215391e1c8f83a31bcf3965378d0d9d909cd3d709e38e6ab376e6f9427e000000000e80000000020000200000005daa3e2fca59a0b978abeabfa7be573c15ef1c845237f932503a4dc68d90975890000000d174603ba298acbcef2d7343b8240a800b427370230b4c3c024a3326da5a28f983c2018a46aa7a0a89e752bc3a426cc4b95266d7203098de7e1c016e86df7fe40e00e28f1debdcf4f8892082a811e99af0c92f89a3ee48593d6c606505c774f76add134adbab67664849204232cbbaf0313c5b611bde6f5c59a3f4aee143418f0b8832d48b72b61e261d83b66239400740000000d4e6058fd1d3ab5a92de258a36c83fcee9953ee230b85a00d4f97e96b02ed031d25ca731b3d6716a9d269f6b8913abfe03a44d62dff545da6f390f52fbcf66da iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B9862A1-1931-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2956 iexplore.exe 2956 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2956 wrote to memory of 2800 2956 iexplore.exe IEXPLORE.EXE PID 2956 wrote to memory of 2800 2956 iexplore.exe IEXPLORE.EXE PID 2956 wrote to memory of 2800 2956 iexplore.exe IEXPLORE.EXE PID 2956 wrote to memory of 2800 2956 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd9a3c5de53127ff3f14e1afce7e79d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5cdbb6961864d49347ba9c0bd262979c4
SHA1e6dd089120bb52ad99e9431c7238dd3f3ced9f36
SHA2563a3a83b053a941a370d5b3befd5398177bc30007db935e4e4695b1cabececb83
SHA512aecbb4bcea2cd582697ba57073948042ad3a9c073d1493ec6ef0659dcec61e256af5122a335af949d9f1eeca559eb68a2f3c97c66db3f64aee477c6cd0670b16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e774da9aaa5d7e528e057e00ae086871
SHA103f07f7db2352e7e8f4d5129d45a7bf54c9d0b47
SHA256a6557d353edad37be3e5c22cbd56c28a5c844c630ac7faa73f06751894f7b01c
SHA512b705de707453c88dbbb70626c1b82b0703864ae7ee70b13a74af9757cc7a2cdbb025a20f8f04200b959c260c02af7e666f0299eaea76e40bc52ec83d0d6675ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD520f28f4bb208a7f47fac296b71a8d795
SHA1633d07fc7c9f7582723679ff1ba56f1a8b21d036
SHA256da0c076740238dad9cf6a283c7cab1c1d2b784fbb20053265820ac1e0b9b379d
SHA51205992cdd0940c26c212e330a883b90fef8e91bdef4b489db2eb24c21b78ee671104a7d5142b8a7f69eb7261a3783aee82c67c66f8c055ab34603452238169d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d214eda2eb7e11ac5519863505416e62
SHA160e65b24a8f456cfab380cf6da38f498fb3f599c
SHA2568db2743f9cfde2965657b11d55e8ee5a5652b0841f871005031e98b67c439063
SHA512e8555c5197b9cabf3b10d06e0ff742bd5801810936b5e377d96d2e4bb2a1ce9e85faf44fa0be0a1cc7a6e4fcfcfc4cd4d046abcba526283fb7bb3f0e219b4dfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56bee8899e1197957f065120db05ad4c5
SHA1ea88d0120b7d2671938ea418b45e20d93741339f
SHA2567716865d9d36f88ecddf3680211c356c6ac924ce79502e50af70e2ac3dd0fd3b
SHA512a44a6473ee455d0733a278cd3fb01ca21698419d76bdb28c6cb576eca051a0dd6f59ec61373ec369f7e31bbc28d30759987ce6b1cf74b207caba9b49b34f34b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ef5b2f78dd38c7a359d9ffc676665f75
SHA1e0397820d678ca5c4a29c608f8b1140dcdcb98e5
SHA256f5f0d9ebb20d7aad93ed621a252686325e134ba88f937f3b72afdc87bb74aca6
SHA51274d22c262d3dc5d380494f02df2f0bbdb6a8833a2ba44c57c6517b0a49ef22ebc1f14dc93f49772531f3e1f111c1a95dfd9180d27952c516fc506b2755022d8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f6deb9fd4a42f2e39394febc0ca727f9
SHA14f9ac2ae26723a45323dac8f74fb1852710e1cb6
SHA256612004656dab071868f5a79646b2ba22e670bda49f80cdf97766a3b1be69814b
SHA512c055c6adea46259602b569c908cbb913450d8381c0be0704f60f2613dcad3a8893c80db26a07210ab799b9049a73f3d53a624494c56dc816a6196076211341b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ba46023967683a836fa39d1cef5b1d5d
SHA12c04c3b0b287816a03f47278315dc1e9ad9d5e72
SHA2566cb66d11e9a8da282ba02849cca7d9788573b1c742119e01f784961f8fcf03a7
SHA5127924245b1ee16c3dc109c7a677b5d9549acc61a710960e725c7ec5a16d67600d24ca74d451ec409f8eff23140325a5af6fd009df83aa7cb2bc0f61f80fa2ede4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52414a2918ee3ed5f3ad3537e5539c18a
SHA17468367b29d39adb40b93f0554e957c290a4ebab
SHA25630ec17ba503a252fde4f9f6fb70b0fa243dc8ccb7db57530cb2e9849cda623e2
SHA512aa9a13dc342f65ae0f34330189645c31c6088583d9672525643da86033c96256cbbb57db4cafa4c8c06a819dc850a11867ece150b5004e5f1d58193da2c6e41c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58932606ce2697e17ad3b9dbbea82ca95
SHA15692e1bad870367acf310ed3174be391a3d384cb
SHA256de8fe4ba1da7024a57cd198126aa1a1a37430aedd5748b9f50d94629ebd742bf
SHA512a2227b6b04b30fec74366583b4dcc70ff5beef89660eb7277346f7d98fd99b3f418267de75d8d5c1319f672e7e45b69d167b93ef2d1aa71ec4fea891fcd9edad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d5ad8be91dc00da6aeccab0a5b455b44
SHA1521856c82e44b9a8d35a238cb0d67d4e77c4ddc5
SHA256f96e174bea300bd986e6244f2fabd45b1f7630a6ffbedcf2fb647fc213a991a7
SHA51285250a9ece4cba8dcf872969b821ef077b4254282728fccdec04835e1f0048ecdb5931e7a95cb422bd321a068fca79166c01038cf73ca43146a836f82249705d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5671dcf62a9533a23bde071fec62d7a0a
SHA1d0d8d26c4985627512bec1e9950682958b4bb033
SHA256ed9cd8b019d9f9f389fa26c0975be5e3c4a3e1fcb9e9a279f52a4b5b3d7070da
SHA512c499b6fdd445ed23cb81edc747cd79b3054b6e047a326c34740d40a7f0fc08d03f72828a001e3d2a2eac7575fedf4153e78fa052c12617b04c6dd9093c7e71f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53821ad73df7e6868e3756238e70fc3aa
SHA138177951f91bddd05d6ec4d028fb2860205aa99e
SHA25623dc227afb8fbedeb4eea59b727c02d36f0dedcdb7fba7754f1e0a46cd660ec6
SHA512b9bf891039d95704a07fddf4350ae61aa6438905a766f4cba58e1d5e3cd1c8af948c0ead250d9c46572a6cc72f4de7018272d7971b801113e69935d36edc6c29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c511d7437dd637a0712253a728f86ca7
SHA1a96cf90832061aeac02655102e8fe2e2d398b53e
SHA256a57d5150ddf5efa594b12caaa6c81175fad1b082e91cfe0fd4b2231a19ed349d
SHA512bc6eadc1a91b7ea88785caecc058e7aa354f923fe53593642aafe62c20caf4d13060914385f7fe6e3f7a76f90ba97609982d184112ac8744d6bb357cc0654e06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52c744a3e97b02f883a4c96a45b77d8ae
SHA149ed2e76599162b57b6a23d09fc7b304ad1a018f
SHA256607fa2f7930e325bd0822f27bc91f9d1d32ef53299047e6dd2ace2abdebc3416
SHA512c9d76120307fa804c0245ec554f0847c2d7f4b5d650f78082e55dbfcfcdbdb640b9b95a56a7a9cefd363e6df7a0e003f210462c15ee86a8ccda493c85363c114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ffff5df86daf3559305139f6deb488b6
SHA136c4e4158070d1cb898ced2ff4d701edb5c01b6f
SHA256fcf6a71f7d18c610720c135b70830c88083f1845b7ab3e9b578c51dd7df46abe
SHA512fa2e74e512263bcf7a9a69e60d6ae98abd8a61db8b024b80eca7b01b1891348cdfcf022afa1298141376f3311e886970a9d678aa85bb660a0fa2a90f5939d71a
-
C:\Users\Admin\AppData\Local\Temp\Cab3537.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar3695.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a