Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
6ec458144dc70cb1352e9f38a7f45a00_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6ec458144dc70cb1352e9f38a7f45a00_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6ec458144dc70cb1352e9f38a7f45a00_JaffaCakes118.html
-
Size
460KB
-
MD5
6ec458144dc70cb1352e9f38a7f45a00
-
SHA1
eb73d2e05a781a6abd592fd9e5d624516ce21c71
-
SHA256
6ff7fa477179d83382ed67fbca4ac5cd392e24caa6502ae0695cc5c4859f87f0
-
SHA512
78e544b1eab54dd31d75bc42b5f889b1b535947dea590da728f728fc60c950fd919cff19bba20c89f7f40a1db8c70174745557033ea01fc1e3fa0c91a20190dd
-
SSDEEP
6144:SBsMYod+X3oI+YmQSsMYod+X3oI+YhsMYod+X3oI+YLsMYod+X3oI+YQ:y5d+X3k5d+X3T5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{872E9F11-19D6-11EF-A649-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c1ce100f950352e6c6c1405dc964d5800179a75771d2d3263218224542f6a9af000000000e8000000002000020000000595c04f369c381d43d92be684a135a02a50b37ebb69310ec8a1447bb530c72b390000000db2167fc01a42cf233f597cd0768101d3e314e06d0c2cb65cc2887139201cb5ccfb4248d9fe4afbc819a91ee291be361656bcd9c5572cfb4ae7d2682f492886cd38c28cba43ce799171e15cb4280d7972c0ed1e6bbd055f991aa2cb7169ece160241946ebaa2bcd019eab3e0f97c3b6907c5987bcf8e4391a005c9e29c53701a3c745e9939e01fd1d163f3d71de92d5440000000262c279c8baafd033e1b079f920221ff545732fb0af2bfd50f5847b3cf22e0678e3d08671d41416c10821df71ca0cc10f2551c9c9ab498031acd25c75446e68b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007627cf3c4492c37c35b883fc9ccb4f9b12b7a6585f54d488fe07e77389775c56000000000e80000000020000200000005f56a3c14a39a3c9f63130daaec9e3d69806f5bdf66faa28c7bc532176848ce5200000004274465bd7b4caa8fefe6e44378da738359d580ed1ef9e3907b4871ab108b83b40000000cdfe5f5319bafc494967f8152c7f65b0fb7c274e0aefd506b22d9997baa1a9dfd726c476a4ebdae8d68968622b20759ac6cda5e1c49534bacd097bd520ad9e21 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001fb95fe3adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422721332" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2884 2416 iexplore.exe 28 PID 2416 wrote to memory of 2884 2416 iexplore.exe 28 PID 2416 wrote to memory of 2884 2416 iexplore.exe 28 PID 2416 wrote to memory of 2884 2416 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ec458144dc70cb1352e9f38a7f45a00_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e59997815001a04bc9eb551e41bda4e
SHA175dcb160eee66fe48b17dc8c94663705656a9ebb
SHA256aad2037307c87c3d316deeddb4eae939f32ded8ba9a32d59560bd23732e5b630
SHA512eebbcd7861f4baf8db7eb0f762652ec3b6bb36528c90dcfcba422088279bc2b3f9a91bbb9d8623980d7aeafe2a9aa8cf911e1eb5698102facc75ab8c210b1249
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f233b18839636549f1bb44838655e49
SHA1842c2e72ecdf0d92de36f18030c14b4e5fea7241
SHA256e020bf4510b14b1284efa5d9fb16bbf3761694982f4605b026de07b2104a136e
SHA512466e3694ed29f0e2a2b27c9499d31e52b8ed82692a94aa48b771fdb966be14b8dca843ebfd7c060a1514ec086b696ad6ea56ab142b4a5305379291e12fb0da96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d210d8fc8e9a559481499cf315d713ce
SHA14977d657542252e544c8b98a53bdb19e044ae697
SHA2561a65ee18057bb46a36966c2e1c2be2b3a71d4940ef6ee143846e6e6c825e7ba6
SHA512380ab9a6b19ac13d4fb802c3402eee5716a9890f40488bd41d0e0d580bcb91642fa616deb0a9221c2058f431e1386ce320c1a6871bd944ff8c110def49dd9d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538729b8f34592756e28ac106ff2a9514
SHA1d45695af3f896fc1c157fdc33ef50f72c072b67f
SHA256e5eff01800726a9b8aacbd3bfe69802c7a825fd493da31d54e8d3c45b4d25b5c
SHA51290a24cec8aabfa6bb44d7a01c597c62403a6efaf20230b5e0510ee0105fcbda26de7c12891ac6abf08c8fb5c98ccfaf56c241fb2a38e08ed14c67db30cf2d76c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b78d24c46473625474f19b82d1e4bd68
SHA1e53010ceb7a9cf97f0f3316fa0b172b48968604b
SHA256e16219aaaa0beabaa03436745304eb5690434c069ba6b17b9234e094df8ba196
SHA5120eb9b6e111a8034cf1b0118b9673f2ff2c6ccb7ffeaa521b522f3e5607041f828ff987bdfa7577ad2cb1fe36cd2be50488adad31fe7febe04913cb4b7d241ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda8f9bb819f0cfb18e59ddb669b4c40
SHA1d3acdc45015d1c73d58e7fdb2650d22158e7f38d
SHA256971e4d07e45d0ebe7c57dc5aeaba3c66c7515ae18ff18a2b1c7f239a86aeddd3
SHA51247401bc4215a79447cef7b948a465d4306b84f1119966ac29a682c66da5d00781d1cff0587093d67d748cd04cc8888f85e5bf8406205a99fead3949030cf201b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573eeaaba09e330b15117ac99298f3a7f
SHA1b40e6a5fda7ee85ff54a41c4161ad5713a892e9e
SHA2565bbda44251423d623f002483c0bf7d12abf8f8f94572d1c69357e165b7ffdbe5
SHA512af9c46ba291d23d3b4695efa8d33a0766a90655ec931c8e4885f79b00b3261c248e459da1df0e5f4d90fe1c62800ce1bf0eb8b95ebb0c33f70c90beb5c4d7c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f76878107ea23a876308d035ebab0313
SHA10c0a90d11c1bace23a75d850a857154bb997c68d
SHA25660325d8c6a3baad2ff3767dee16dd5c522d02ee559200633bdf8cb428224dddc
SHA512b80059b85d1175a2eedfea07cb0fdbd50dc288b42020f67a2aa041d018dcbb631f0f091b11762639ba24ef24c3f081b1aa5c6e1af6869cb417ecb494f3100826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d80fd0fb847ff7f55b0b70af91d39d9
SHA13c6071b195ef65b96701a49d05619d243985fb20
SHA2560a3a8d782023a40fca83d1bddd0e7563ff961b1e6f8099295d28ef3884fca83a
SHA512a7910e88d4f9e59578f5f609b6a64af7cfa9530208f5038539decffd753d057825baacb6eb43e830e32de1ac64ac61d9c79e9794e3d227d5b32eeb104fc64b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb19015b8ec0f76d8c36c4b28ff96f0
SHA14c084e5844251863bc24d09d7e0e335b6113050b
SHA256801f4057048dc44e8882aec2b099c74d8d8904433642faffd2bbd173c1568438
SHA512b245f2680f884391e86fbe91c6f304321b3e0bd267dfc20e4900c02e8de6214add34b06932a5dbbb4745faf6a0ea968fea579b28129892c984e6bb54c5ce021f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdf63ab89b993ca5b44c51472391b421
SHA1b8362574d1a0076c184ac54b337781960cc95159
SHA256a5ead774c6d926b356ce4532e565f8f08b4cf9d1c3aa1e4a830d73b26baeebd0
SHA512d079ff6a04ceab632ed591f85aaa7ad950df798aebc744b11650cb1350a06717de47ab0b37c52f98201a06ffda78539c25b8283384b740ff098e814134909548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a66999054a6d07a8376e30e66c39e5d7
SHA120c49ff1eb90bab59e18be0d3a96c2b1d7ef1cc8
SHA2562673c085481abf92e698507152b436c3c78b34fa83ace009318431e5a85571e7
SHA512494ec6cb8f88b744549ec22255c286a142fe63744c292b1e92943c0f6a128694e460f9285beb7a029203cfd1ea2730ce6fef20d79336a874712f0d538a5474d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a8836c439b9626b2e141eb4ec692e90
SHA15ce73a0be6a9df897c042e6f8e1ce5eecd70ba92
SHA256e95d96650bba9fcf55960c9376832240656696e0da443d7bd8aa3dc1957ef8e2
SHA5124edacc5999df8f6413b0b59cb15d58ba7c0f283158e94ba7d25ee71e107ce14a3c1c1f34736d9a98fb68b488824bce545dfd5de279dfc7f3e12ab8e63a733596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5323da68914e050f51d0642cef322e5b3
SHA16ef004ecd7b53aed73ef73ca00e65c931b2fa2d9
SHA256252c0d62a4a033d50f2878e52e6d89cf2ba5dd63d6075fe075b49f6f7d03b896
SHA51244c0e5be9d76311d4439efb6009d5decd649b382e8ca3bea1b452d99afb233674fe41e590ab0fb6da81e77ed76db0383b24ce1bfccdb9fc7c5818efba162ac8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51124c844ae15a77e93a9faa53758c518
SHA15fe78fdb1aaae63a14b1183bf0762d9545043d74
SHA256121836dbfc6a68a052e4ccf56416ed32d5461e73ffd2d530b6a5eca03a730cee
SHA51291db8f49945b9c9d0025d36af1ec86a8c56fd916b0a699764986ee11a0ebfa70b584d827e5961da2e24497927c6c4ac9e1bb4d8fe5148204622e60366ab9ae49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6a5ec8620f53f3c7f6401070b7bfeaa
SHA1a854b39df631b36bbffd0afae3dadf86aca2ab15
SHA25664bc39ea0e66d47c4be21e95f40742a62efa7090060f5a31fd2246de25514bd7
SHA5122a3aecb45866ff3fbfdbbb2db491f51fdd88200ca890c2030526559784306b6e9cf3297f298dafa767576952851c10e7e6e3d4ccc17d66e4836e3c3cd83123d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd97f88d73611c608aed9d27b560f6f5
SHA174c4bd1944792375d41d1110f663ac3d91c1dd8c
SHA256a5c279e036c945efcbc570008eeb21ce9306108eb4fd5be463ef8db826c3bce0
SHA512054c4538ada025746444ceb840debabcd8266a858a8d26baa572419ca24a43951297eaf939d9279614f76d5e543b4854fae82e11545ad0389b98ca0f2ffaaa8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598928a25aa22746fe382e2efe6a5e35c
SHA139d7279aeabf8e3aaae7a55adc16b3c3d13cf2cc
SHA2565072796aeee623cc5128cbb6b9307da2bb481c8816bbe948c1df531661ed0aa8
SHA51232f94ef3a2fdd5553b20a1e092616b49322548277fdf6b4ec806936f903409aa1746d79b98d897b812180003868cfb20066621bbb0d3966d988f28e6ec874e23
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a