Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
6ea21fb8fe6d82a48391043beb465b8d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6ea21fb8fe6d82a48391043beb465b8d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6ea21fb8fe6d82a48391043beb465b8d_JaffaCakes118.html
-
Size
460KB
-
MD5
6ea21fb8fe6d82a48391043beb465b8d
-
SHA1
80ac6753441d8c436549f51796701a974d59d6c2
-
SHA256
0f8905520cedacedecbf898f74527e7db66ed8e64877dcd885a04079538fa486
-
SHA512
79df69e0d74b7db9f0def679c3969639827345b05268602af582f9347b5ef1f425498d05fc0cfab63121ff422e506e947ca65f13302133ba1533ef8bd035563e
-
SSDEEP
6144:SBsMYod+X3oI+YPsMYod+X3oI+YYsMYod+X3oI+YLsMYod+X3oI+YQ:C5d+X3V5d+X3o5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cec19fdcadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422718434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d163b37e049d15409164406e67940c2a00000000020000000000106600000001000020000000fe6a4d644bc51085b645f1a23fdf2610268b50eea5aa96da2857305f51e6462d000000000e80000000020000200000006eec29f35ff5be10a7f31cd19a00bc4e030313ea8aa76ee389af1f66d28472f790000000821f482953b9822bdee4ad6ead7bdb822c95d1a8f6ca167be5baae7240cf137023a988aa5e3ae64d3f22e51b8c6a87a36154e13cbccc96ff526eb17e18bc9e39af8410f89a5934dbb4f2ea6ebd3c15d895d5584fc071d69e51e13da195e9bb10949682bf392309259c9eaceb125b1e44fc662fb3c24df9086ed8f18677a1faa3261fc26e32303cb87f91637873ab4f9a40000000aadc60c9b2122d0a7043cb29edadb05c23b4fad5877a9dcff73e249164bef5df6d2a9af05e95f0a1410be34da2850b611c61d7cf365a0d42c3eecdb77ae2bcf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C73F16E1-19CF-11EF-B238-4AE872E97954} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d163b37e049d15409164406e67940c2a00000000020000000000106600000001000020000000214848ebfcb6254fdbdcff120ff3c1298007a329c6a22bae8526325bef88302a000000000e8000000002000020000000b9fdfc5eea007bd3a4cf06084ca7a86b7c0b3aef931fbc3d133585182b78ad86200000007d463a79dd40dcd4faf3444699f4674ed29b24d2e90d6d11cace6210ab07de93400000006d679afe537e463eef273bcdefc60278cc80efd208846034a9c530ae0f9591fabe4bfa1174ce8d4b54c8c4ed99390447ae715ddde70c755725d58847ad66b36d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28 PID 1848 wrote to memory of 2936 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ea21fb8fe6d82a48391043beb465b8d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58445e7d2e767900062f5cb2db8f2bddb
SHA1aa25dc060cd90c59e1dac2efa3a336b76cd0098a
SHA25695b2b6cdc2a0b9a3a1dd4772164d78740c4897fa0784662b00ed21647253f6be
SHA512d96185af5a5716bf82f3333e29170eeab20c236f25aa15c9092bc341881be3bdbb951f6d6b0eea499da4da9e1e6a0b04a05d288b74369f97cf41764209263493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e85dce9a5a182facada1bb7ba3668b7c
SHA16d3d9cd25085f06d95d604a0ef9db935e0b0b5b5
SHA2566f58e144a02e7d853bbdb595c4683602ba391c6c53573ae431e48bf92dc81613
SHA512cf2412d0192c037d61c5d2fd7a3605115baf7e49050fa66a680179060e6bf93ffad6c6d3505e733a02222147864b3c47fce20762ab5a69677009342188399c6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5112861090ae04556f889316c36419015
SHA1f463c86ff3b3b242e34f62505df0175e51fe0fe9
SHA2565a00f474ef768bbab21e872c4445bcf166d97985bc76dc90bebf779d0182c5bd
SHA512307d1446e32a97a34206a70ba01d03c040cf605b679964b03abc9b826cd8837242e931c3f32d85e7dc9e995da54fbe4cedee0d37aed80fb6ba5c1a47a0640e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df3e3137127f632492964e1bd99ec3d7
SHA15f4dd53af94a5a482eb9afd936c95be15000dbf2
SHA256dcc5f4af70b9aec7f5ca59d944ef3cfacbd0ec23e70aff9167c6f37446eaa251
SHA512c6ecb373ab5d9eabdc6383033b8319b7e994bf3a9256b036064afdfe4da94b272c8aee2dce4c644b12056b9528eb4c7f4ad559d09dc35ab229218cccede7dfbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3848437a2c65aa9f1d6b917cb9b743e
SHA15243e24721618dfbade5b124892df1d62ee8eec5
SHA25649d230241030d0e820fe4ad21c0e7ec2fc59295b9d8764591742b7d7009966d3
SHA5122bd209db8a313071375ceeac42fdfc85e0adcb61d15a1fa7be3e5ece206cf86d380e5dabc4dff6c6c5e1ae2b9b21a1215b083fcf7eab63b32827171c589ea25f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5733cb3e6ca0157bcae1def84f40f6257
SHA160ea62635a7062a4f5c179476b747b1e14349459
SHA25615a846925ab2bdc32b4b49607a4893036dfbdf781d1a0109866f66ab77946458
SHA512f4273f896c974fcca580f3bd6109afb7060a6bde0e4e272e5e502b7415e1d98fe8989c701a0baa7ab1b19626880a05637b2d68feb64d31b04efb9b77250468fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f149b6887fe74eb7d10b55d7d591a308
SHA1f44d43be580ae15f75f955227c261fe5b2333c17
SHA2569244ff97d1fccde55b7369e75a8c6718ad563f607281893e66981dfa3e3f9e1b
SHA5120b460d69333e9457c3b9777996f34f3fddcb9b52a249eb1fd732879962a7f1767def7673aea6d2c5bc47358ef85301c6b03c4e9ca332f262bff488fc3629f157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596b08ab039ac52015b8d09f157501bdc
SHA1090dfe94d28f68ea4a0495ba7eec467e3e2bef9c
SHA2563597f3a740142d2264253af8d018b9797490258ef5ec98d19e3c19e4caa01d32
SHA512aaf75df86796d0795733b833c4f37653ca28fd763293326deb588937e56377f48af5eb2a88dd066431d42b05bebe296bde42798e35429b7cefaf88451954eaaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3f1c5aefa610c340f77e14efeeddf93
SHA17bcaea5f4138c15299e190f37b3de7993c45d7ee
SHA256122445e0eca63a598a93e335546092b8923ccbe06d76f33a825644da0c6fa0f0
SHA512f298a1e0ed54b7e19fe053cf1bdfc9a0691f449f9bb1f827fb531008ab7caca2d9fdba15060f1418a7cdd7ddad57cc74882b3fdf60830ae48bba1db9849e68c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1c968129264a2573df9ed5bb6cd11d
SHA1ab3bd18a7e5ddfaaa691a761d39f493b40eeaea0
SHA256ef614463b9adc123e3f7b0c6c88ec9d718ac1d5d36cad9d03432f6e9955bd6b1
SHA512631246337f9685fac0d4b50ce26d0ae1ebbcbe6d5cc913d72db203781bf19d64e6c1564831fd2278b7b404f416eb5de3ff92435c4773f7222b0f87cf71de46ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2fd21c1677d1a921eaedab36ef8438f
SHA1d0e6ae489d64591d6b58ee5ce5f3557c415cc96d
SHA256f5d54dcec045249a38445e2f9a1d4274c864c6c35223fc493b6ebbe2301c1b1f
SHA51226d31b1fd38f4df073737496170b7d80ef76fd9562ebe2cd7eb10f180211d3da7c269bf9e5284f7aa21c51a7b962851ac3e0e6227cdaab9371882896ee54b617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f936195c49737ab763bae594c25ab6f0
SHA113cb681363b4a415425eaa43e60c4665e59d9099
SHA256f8e1900467b2846dce10336815e290a85d0511aafcc58fa513de6dc48d9d572b
SHA512fa734f22e69fcbfb458e09a97f90a9449fc6e8eb78151079b17958f6479bd6e7fa7afc5b6d2659483fd2a2abc47837a0c356ccf8830d38b8de73cce4db0e535a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5efc2413740c41a660b82d4ccefac64
SHA1f9d05f432ca9efb76e4d92510dcabd17c40fbe4c
SHA256fd4591dd552aed9d8a6902552284112d7c26fa33fed7e52ee5cb24e2dd27737b
SHA51253da6de9a1838b7acb4d3c888cf3bbafa1a946b2c2a8b3795d902fdaae7e350361a2ff53ca0efad6ba39028d34a8302bb5a52389c84a67875931768ac2f0ab3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57641256b5c18e3f71294045bd1e51504
SHA1627d7b3d750ad7751ccee880e4cfc43650acd9d0
SHA2568b7881bc3ba7c9ba38689cb77c29ed24a39a7ccd76ec8586f616519b30dcfc1d
SHA512c85b0f07f9c0660ea426f1bf26ff45603124fa042b4278b512595c9784772063a470ad4067a0903afcadb460f5c68a1d71941cf68ad7328ffa9e24fd9ad55bfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0f8bfb7c16093ede31fd5fd761a5a42
SHA181e31eeff9b3a685be771412ec35834e6ba6fa10
SHA2561c1169d342624056f3357ad63a1f27cc381cf17bfadf2738972bbd2135e8edc4
SHA512a99fdebcc00d221e9631272f3b9e3887b8a6879789a25525cb8403aac82333d7aafbef3cda7a06b0a33085eb8e72cf5ff829730c3a14bca0472c0e7f7544bf42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf4d767d241ab260cd25eed7fd87de55
SHA179bf063061aa74d27a213c3e45fe69e7d4cf3c27
SHA2569a9d3ceeb51c6d2510884ccdd1cc8b33bad38e91605b37ae758ac08bf99c45a9
SHA512c79fe1e655181eaf60c998da5d29568eb3be7b190600f6ff2c26403b97d28533c7b4ca6c68d075fb51d7a8bce5674595b91efcedc8cb7feb51e74fec6e8dbb8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568ea72fe5bc2e64e009edb8fcb7b4edb
SHA162e4ebf631832d0a903d2cebe0a4e967a82b564f
SHA256f0d54e0738c54b98db840a15652936d6b5a914f25a32048e207bc7d371e99e73
SHA512a64b7739c2f6478cff31906563a87edd9fadf580b186e4d9cc4acaf44d7a12bd32e91139f62d1d253cfa3975691c0b720717e5f1caeb9855b6febf04d4f812d5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a