Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
6e048e27082de3b5371aa00701f3dc13_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6e048e27082de3b5371aa00701f3dc13_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6e048e27082de3b5371aa00701f3dc13_JaffaCakes118.html
-
Size
3KB
-
MD5
6e048e27082de3b5371aa00701f3dc13
-
SHA1
eca6236bb8edb0501a5eb06695295d2644f3f6a0
-
SHA256
ca6670fa61c1eca9cb9670488b9be771fd8583594343a7930a0c56b6fc070500
-
SHA512
8bb9873a329d35f3aaef86a9a2992a8d1e33caa0477a252c14daa45d0e51399db981d179cf659e11d3937b7b2bdd82d440c428d53a3eb78bdf3b8490f3639ee8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009c60305fb6758241ab41db828e104617000000000200000000001066000000010000200000008deefa9c1e1f2b56232dd21baf35647d98e05bfbaa08dd8899644e334b90e711000000000e80000000020000200000007dbe5b1637a57fcd50257e1b18990e8fef31ca014dc96fd5ccd35c4ad6ee2c472000000045f76077a63b6dbc2f418d247fb85bcd5084addfab5bb3be380b6d74756e42564000000080c518fbc994a910c7f838a834608add122da4cc6bb51a4f265ec74bafd1ea70f769ec94189d6ae004d652d83c6cd75692e7ec8d9b6b04b14eefa4dda9b56b4e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98EC5DF1-19AE-11EF-B7D6-72515687562C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009c60305fb6758241ab41db828e104617000000000200000000001066000000010000200000000e91e266f663a4e54ec7531366fe1ed05a5ddefecebcea1d596f8ef7126a059b000000000e8000000002000020000000595a3cbbe784e7292b07dbb152b4f6a252a0c16d0ec430c924522d156947252490000000ccb023b6d8712b4aa649b90b95c27447899e1d2b81381c489957c62469e925c75745749fd52724eab0a4f4d39e5588a79c06a3b5d1293b41faec68d8f2e926c73d113b69943972b82c81514345c569826bf20174eb5351e3ab621e4c68d946fb48fa44d20ea8b55618bc12542a57fc3a6baf92753a74a96824cfcb8972727f4e50d5e95f81db323b14afbb53154bcf5b400000001a67c0e937d324e99a490bb7fae4494c8809633ac666711d818adc02ece5867d16ad85762e5aed3c437ac3c3cbf384d23637ecbebc88012c9f03d1cd27ea9bd0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40578d6dbbadda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422704183" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2832 2332 iexplore.exe 28 PID 2332 wrote to memory of 2832 2332 iexplore.exe 28 PID 2332 wrote to memory of 2832 2332 iexplore.exe 28 PID 2332 wrote to memory of 2832 2332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e048e27082de3b5371aa00701f3dc13_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c2ad9a6bc60270cb568a17837a0d3428
SHA172e0189136de2494e141991a4eb8e5883389a9f7
SHA2569b6065c7fa2dbe5f68941a9c8da4ac958f9958ea744a1bc5d0fa1f1aa7a1d06c
SHA512ce15b10fef0dd37c41f61c108b4330b1debbb51839584629ebeb63a4c1ec255cc0d7a3fd295e64a13e0482015e96c1e9d17ae65f9991ff9e97d534e5f1d5ef57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507da4e9c449966197813c635e3b15a81
SHA176ad81501d65a198b9caa0c3d79a5834dd508ceb
SHA2565ab9e8a07735b8a582431b439b1d375e1b9bf0cf4570d46a1f00970ae07b3cbb
SHA512950de96ca049c871792616448388b8213d88f56bf453343bea8660974841227085712e2113df46da1963cb920c7773c398153bd02d0c0132815bc59e36b93c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a3a50e2c42de82b8ee8c7115f531e5e
SHA1a898ca891362ad9813f6f672ee79ce7ce2b3151f
SHA256ac6b8de8253ca461e973b217072208e26aace4ed0089e818a43e82ae8e5dbaff
SHA5121463d8276b8875283ae8c3d85a9e04bedced2a9aa67a73a783c697d424f18115a8732e2d4ddb836dbb07e61855f877c78583867547612b7988eb66584c066de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c1375085a26e3d653889669092b4c2a
SHA1ca624e2056e846318f5576d6f7aa8083ebca6459
SHA256eb2805184f20523ac26bbe06b44ff56e6c3b6963c611877897baa7a48e4ffa63
SHA512e54e4e34bc8e531953ad534a19249851edd8ac73b6e757a9fa18e8da88c48210effacab1ba6092996ddba104b31bd950b14f27bf15adc52b0b11c5d412d8df31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5356479a473fe1ca4af604476cd64506d
SHA1e58382dedea5576e125c24561f63cfad72829435
SHA256429cae66ed0005093991301a596ea3db0a83695d6fb9dd8a3a8180d7bb3c0bd6
SHA512980784e2350e57ef946784815851147a94a05450a8daef0fd5d7c7f8b0266e06576824cec4acd990f7926f980c752d179841f01f776ca42e26fb1aab4b015299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2c89f374ec579da343821126e00820c
SHA13fc728f04e059127efd0c6954faabd096e9f4606
SHA25699c99142309669cdf7da0b10834c5318b0ba317ee4bd53e8adeb764bbfe95356
SHA512f04d34436e0e4b30305a35b9165bd3d01f03d731937cea49ec7a53d761520223f34adb44de90426cf4268febc80190ea35cbac8aa42113ec70394d49de35ef44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fe2ea60ddea5a1c4688d43d89f3cfa8
SHA1c72f1620a324b4c06791f9094d0cd0f585c51e14
SHA2560209a9e88d7fdc9523af01356768c30de000476dac046702f407970c363d1f97
SHA512827ca296b39d34540f683e55625a1088cdc2fb941baefe780f89fb0a4c363d8626c7e671864f7944d7a0d06f44041c6e3a718276b651d0f6d04d6c721f9991b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ad34482d3226033dc461a0e676e38ef
SHA19ccb62aed2ca5bb5d2c2ddf2ff934d6f6f4c3b3b
SHA2561929a8180f366c2df4e777807d8d585bdc11d203123de57ec09c30035caeaa1a
SHA512d64b8c5a51700863af2cd40ad3ef45a71c9a5f27f010b830ec9ce095e1f26d7718583c52aa3ae4ab62244276efbdda667aa3c09db94b38f8d92bd4c4dedc1472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cebb9aff758f1ac2ea0185483f3917f4
SHA18e28d8b36a25c633ee7e3e282d788dae5c7d58ed
SHA2563a7c161c44ee084ffb466ad01c176fcaaf5d4dace8a44098914ceefc5dc32717
SHA51220a0ff152987f806f23c39714ee387474a077fed4145a10e4d7903561d3b7d146dda2b08ade019612c40a7015f704d6e159b7c7b3dbd11325cf9ef690a46d4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ac9e2b51855bd2ce731f07e86c4feda
SHA1d72c858377a69f5a52ee7ad19327a5bfce37a788
SHA25694db7de10de81cda35763db437b6d50edfa7f881265be178c7fd1b78640d2bea
SHA5125893c038aa9c60897e3a4521d47af4734956b4046bc71ccc349b0837173a3197eafbda83d15c9a4b84606b014c2b104711328e22e6b1c6a7faa1dba234b4dced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57041c28c82b2d6379278664240a69117
SHA15b6734030a68a24785f2762ecd3fd5c25acd64da
SHA2561d75c5d7d330774d78d9fac573703f12a4cbad55406306bfc87f1fb6fb64d759
SHA5125933c0ee98000d08710a18ee0daede549efd43037d54be2bdb3b0a518a8818e3809abab91684515e1fec949ff443ce3d4774161b58ccc259638761fa0f899e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD53772987da98241486a5d775a367e100d
SHA10a1f0149c85d9bd2767ae22c6f9d48c49d6e5802
SHA256663e04e2cf1f5ca4a6aeaa61ff74687db712c0a884f8fed2744b088ad9c70c0d
SHA512f6d7601042647f7a608087cb9cf21a9e8d67e8538d2826560a6d8596095d4f0f5cc57af0c5761f3ed3a7fa5fc1aa64739c8cb00b632c9bb4535e2e446ed6bde9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52322b07f56315514c076d84711c3c0e4
SHA184a6a1fb6ca0ee9bfb9b5444380cd00b41188150
SHA2567d66fd4719b725064f7b220f6238fd8cae550271642b99bd9a1468e10415d54b
SHA5123b850c7578d08a2ee10822033de4defbfc8ff76b16a8b9fd2b6696bc0692e17955d39cabb25b43213d48985e6d8bbdbb096a562da9fb5373530fc0eac9c11f02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a