Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 02:48
Static task
static1
Behavioral task
behavioral1
Sample
7b6d42cc5780cd0949d28fad0a06fa8a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b6d42cc5780cd0949d28fad0a06fa8a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7b6d42cc5780cd0949d28fad0a06fa8a_JaffaCakes118.html
-
Size
63KB
-
MD5
7b6d42cc5780cd0949d28fad0a06fa8a
-
SHA1
1d4b12c60ca1a2a27d40610a83762e66e15ecb4f
-
SHA256
300698877df40faa597c5f5760c0991ee50fac9f45fd0a5f0af16b086d0688d3
-
SHA512
a660dbe8d8bb4954ac149ad045e8042b4fb14b0ce8d91d0944898c58ff3a02f9822d7d5090d76d55550fe837f0659656be00ec928fea2d30ca530e8455881675
-
SSDEEP
768:Ji1gcMiz3sI2PDDZf0glJO6PDoTykyCZkoTnMdtbBnfBgN8/oi2c8QFVGys//IjC:JdGTTFec0tbrgaMc7NndC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b0ee1b31e6aee40bf369cfe0e826b4500000000020000000000106600000001000020000000d604422ce325b0573c54d1a91f34dc8856f6bf8bfac2fb4950320f62ee2c0264000000000e8000000002000020000000a105f8c6917d26c1bd39226efa02bc1bd9a25f77e2d490606b55811788783cfd20000000dc31ab86e091291e20594f5ebf3f62611fb87d8c0c81a18bb7c1fcbd213311ed40000000b6e14a63c5bcc74f0472b8422694a52c4057e0c053df85b80063ffaae00ef9102c11f8b6951eaaa7f1c8013a2a07aa3233997d35ba010ae587e57ff903717e9d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cee598a9b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C386FBB1-1C9C-11EF-9FA2-EA483E0BCDAF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423026378" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b0ee1b31e6aee40bf369cfe0e826b45000000000200000000001066000000010000200000008e66f6ab54e31b35195fb26b913d54481fbcd5c83bcb640114057dd75f49945d000000000e80000000020000200000007c0db85852b025d8f0266c4d1d9f57794e7c8a18ff74cea05b9a5223442c4fd790000000ed198f2a19dde3959e3e542e44f72e1400d8dd3188deb98f980f2d52cf40c0027c492e8fbc64b9958f20af6ec81257f584e1f727bc78bfce6c7af2dbd6835cf32d4b9d6668e284421fbc9d472ec9994e889e939b1eb4db15c0e47c7ec08f1fc42ee45ab6a62a9b786a17cc927320515da65515f08ed8534346c3a5f3f183adbbed022157664fd28dbcabbe7169f27e4a40000000b24184b03db3bf48f10a4035faf570988261347d2b25d49c8800bf0cd1a78c94759fad792156139a1d987482d17cd957751991659cea26ac7b679ba17b665634 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3012 1612 iexplore.exe 28 PID 1612 wrote to memory of 3012 1612 iexplore.exe 28 PID 1612 wrote to memory of 3012 1612 iexplore.exe 28 PID 1612 wrote to memory of 3012 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b6d42cc5780cd0949d28fad0a06fa8a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584d43fafa34229897907d5256ef787b5
SHA1e084a2391e4f77121d38296e9e0befe812adaff5
SHA25699209e73510de549e29ea79f3aef9e8311034c6986ec2301a1aaa6681f131172
SHA512d42a84a5a8ac72751912709add59b60e1cbb168dfa4440ee9c1b59e0566cbff0bdb80773688c340a0e64b79ba905664f1244d1b05b47bae99c816d5a15de89e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d760c6df2be03d0d606c4c56abb35f6a
SHA1d9232bc5e62bcb21eefb840a0408446d3559610c
SHA256a079215b44e9ae5cfce43f9fa62a8bee80528e1625afd5804b15e93617a87dd8
SHA5128320efd3a796e584e050f3c4e87f3900db8480668ca26dc2bd5a4c180e929b12af03f3c5b0d203b8ccd2469d959a85aaaddfd1e18c1df3b02d797e9a4f6c02d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae37b50a46897ca5909e8c4b121176f9
SHA12d582783994ccce269ac7a17567dd31503b5374d
SHA256a32a19b8c226ce2f4c9041b0cbeef83df375555f7eebb8aa23e97c5cd821496f
SHA512b6772b1e6bc6e0260b4d035a03f33d6de5f0c18c08425417f970f53f8262e1aa2f71320ab4591b4872fd8f565db718154122df9241f2a525a3c61b7e0afb097f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a54d2befedb40e62a67faac197ff83d
SHA11274d0d036e2aa4debbf127626de07dcc9e81d41
SHA2565adbfebccba6c1407d9778ee43cabcc730a95c1423c1df18f3939efc7dd2b24e
SHA51293da4629a0da97d45f9c9db4261152b44811a7846a55a001c28590095c005d9d0688eee928c7cba8f5bcd85448309ee744e9defc71c73b8c5468efda25db838e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d3ec93919c96a7163d968c98ce14d92
SHA16093a6367a30ac74027b3d73b623e525bb1ca226
SHA256af201a4137ac54f0878615737808d881039a8bc16d5fff8c8e1141dc0f89b972
SHA51286c431ace960508f04b5e2417e2f862cb09a90f519206a77387a7d11704b3dad3a9754c5af4a734ce8bd950b47c3ffbb414c3521cde1780f96af786d2fca29c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54390220782069c32de7564eb958e5d2b
SHA15006a37056374cabf435cab7ac47436d41b66d03
SHA2560a559afee8c0d67684360a021ff0dd1845e844955a8b3478d245ad273a8e5dc8
SHA51235b5f3ebfc4bf7b2b8111c452d421b18ffe7146d558f33b5552fe6074f602da573b0f0b572a4e7edd604ded1ed6802b61904131ecf7bc1bbba727a97c2011274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ba39cb45893f1656b2531b1a875fb3b
SHA1735c8873ba5797d2925013a86853927847025d26
SHA256447c96b203da6c042451cae97b5495ebb31f686f6fd61cbe7ef2e60eeecbfcc3
SHA5120761127dcc41009299bfaf9efec0af1c4b3cf2c6c84ea281635ce300592d20d2e3f23cbe69b3ddab233634673214d03c6425f37d4620857be693e1e0e10fb1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545b016e3d70d91d916a932a7fad19364
SHA1281ac353a3a9d29ccb91b2d35505fe7eaab9a5c7
SHA25699006ed31e21cd76f333950af094e18fbc358170466dfeba01242033019fffc9
SHA512b96331bdd155aaf3317632e5262a605ef88ccd79baabcb8453fb22f78074a0efc6b249331f9817721bef60c2571cd74f6f6bdf5c1a99b4a01fd0c70ce69c6690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f441eb390902c6c43f2e31ad1fa93d46
SHA10983f654fa9e51ea2c6d70c7ff77a4f2d1bad11f
SHA2568e5c85e2ae65b89aa13afc78f9d89651c8d70271546edcc983f4d39e8b0d44b0
SHA51278fc2c1f764c2fad014ea44fc273ba348facb103294f6a3460fdf56a1e2fb1080ae833c9fecaca2b379c22d6446be8ae40dcd8c873d6d6b5369dc58cca74a82c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a7e0c346deae859fc99ef27773e4d5b
SHA1546707f18bdd1965a3473dd8ece92f508d00019d
SHA256fcf1ce58bcabdd5671f0f4ff14df5cc79591e1108b170b050b79bddff84e9985
SHA512a7e4e5c02a84188a6b7a7f6467baf9057ba282ac04a4c5f37104dd542cded7453fc3aa30edb147d511e114b46c4d0f5f7492b34c47906da30665c6311b40f686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0f5540218b6ed044c8e2cececf51334
SHA1fdaf418ab96c4d05d034e85dd083c4d24558817e
SHA256bf7bbfb00e8a88b4f077a91faf31348ddde93cad501b4994f22573a427771d67
SHA512ab2184fe261da076cc45b1e20def1ade97d9b8ff22572c37e42050dcda8039714b7131c2dca8498805da1a6fb7a2aa00014473c65da12118515fda4ca25dab36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd27b58f4084e142bb7742af4ba98881
SHA1cb9f63fa17e5e2f6c8b7ed2d68b8724619ecc78a
SHA2560db703861738027bc780f8c2f754af4b7a41b83c7cb0a8f4ee8cfa8ec3df4d53
SHA512697ceece02afd920074cf9b48196c92efb893be0432c9cf26c3c84b8a5b065c515a33663734bed4e2154a89d87dd7fc6b9c63eda693d1326529a54d2083daa83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b9308adcd956b68a352e96c6f36617c
SHA1d7e45b87679cdf6cd615f65c892a185767c5b588
SHA256759b5f9ca574e57694e64131338e5e2d37930349cda4a7a306e78f6b5cadd62a
SHA5126c09da7e1c62e84ca5bea10fa71a4466c2e49cc5ec7e9cb5d01c95973a5e2a8c8460cf174e1c672e3f506273485b7cebc1f7d0a1a63c0f9c80315d0609ff0f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507df967dea7db7fc8f4f660514f4dc1b
SHA1cab90a0d66e997d0a57071ea1bdc9228be9c294b
SHA256b5a2707ec75d51830c72dee75039e97bbcc0ddb8caacdd5243f0e2957576b980
SHA512c518cfba55a343847f59a84493837219ca43201beea8e848871429ef1671c58e6aca7ee6fdeb1d59ae9a67fb0f5b3094f1b0ac4c16a752db5a6a2168a60abd3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5f602a58f2a05d7eaf55b6a56d8158a
SHA169b262f5da9af9e3046d534ba9dab8934209b578
SHA256a5d66c4f034bfc3b85df856d703908b90c21ec797456b73cb5f2932f68f183c2
SHA5122837f38363f5239a5f29c873fecbf191bbfef3fd51ab8b607e02a2d33f61f07daf3b5f4be72102bddda4ca92cab48b0750ea8ce572dac11142233e1284250d92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ebf291b2b555c3089eb881fab7d8f54
SHA1242031dd71c370288a0fd2d98bf5026f731c0084
SHA256f9cbb1602a65e936ac1a2db963f2711392c1e7e180f5c5d2ccd084d6d682d0e6
SHA5122564039ce6d4134f9c7102eb445cecedccb8234e44cb2bd1805af4b0a822bf6fe0659ac192498124e707605859e81378dfb93ce35712028917a6f30f3715d68c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572151f68376ce6bc2292af4978eea82f
SHA1ef92379bfcab3451fce8556cfcb6d8b2b778865c
SHA2568f29d4a7c0ca0e67759fa67b4b5e9a4f85a25218f1ed4f7fb80c2c21b2e59512
SHA51242643c5dd93862bbcbf5caa6452322bee2f5220ab7039a9e30be2b2c02eded0201dd40191bd5488784657de70b4d85846d979b733daea76e29dea89aa349eff4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a