Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 21:49
Static task
static1
Behavioral task
behavioral1
Sample
a6bbd0aba8f9c07063b374a2551a0240_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a6bbd0aba8f9c07063b374a2551a0240_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a6bbd0aba8f9c07063b374a2551a0240_JaffaCakes118.html
-
Size
72KB
-
MD5
a6bbd0aba8f9c07063b374a2551a0240
-
SHA1
72c6f43a57015f162f041516313b614f542cc050
-
SHA256
3cc3173f753bd9d7037eed908505073db676c6541284c36c59d3b18dda672fc1
-
SHA512
91ae8922603565e3fba21dbc365783c76050329ee59cb4c616d369865cc465d501ece27dbb390fe1c25e17e78d1c45fca6b73b0189689eaaccf96270abd00864
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6sC6Mr2liZbwxoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcc:J3oF8GTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC77CDA1-29CE-11EF-B3FC-D2ACEE0A983D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424477233" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8093eda1dbbdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e4845de738ee97d22a804a418bda2e4a1d8206a8f18494329d6a8c7d0055a2b6000000000e80000000020000200000002574fc0b1782dfcab7ee6055973359208ac02861a2f98d248ea89b05ddb64d8d90000000cf6023a7a52eaf045541dc7fcb743713c678f34d6252f2c25df2de4e456768d319342d3dce8e3476e445789fcacdcc0ea4601f488a0939ee6e880e49889412d14d7095b6b96ec9bb1598d15c20684fc1f319dbbfc67cd561dc4b1767312f3a0a1f5a1a265e1fa2ceca58dc8e1b5151a60150c99ee5679d5a995cc34e8a759547f6c8b48bad72b216ae5eb46686337ffd400000000513b54ecf51e0bd2231d39666e006c1e70bcddcd64c42fe8106aa24d017c606618d8591572b0418debd4bd176583272d62c564f422eaf81a344bdf9d41da73e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000079a7785b8a62117fbf1833f46bd2868579cf1623009d0637e7ad691bfce672fe000000000e8000000002000020000000699a6e8c56e3829f126000f1c98bca6104586ce3eccdbeb504a30e2a24860bc020000000c0f6577b89d8e38a120afb19aef0dc694dc292b282265c87575459b09cd2159840000000132925978db47c705fbf5c87a61a508a6b2374516e223f951d25d84c9e9a1cc7cce1931c7c351ba2505bf3868f17c45eaec11c3e5d6fc0c872286dc65155b960 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2552 2860 iexplore.exe 28 PID 2860 wrote to memory of 2552 2860 iexplore.exe 28 PID 2860 wrote to memory of 2552 2860 iexplore.exe 28 PID 2860 wrote to memory of 2552 2860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6bbd0aba8f9c07063b374a2551a0240_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512a3b1541339c3a3d4ece10a0ddb6b7b
SHA1565ce6653ccbb390a165b890ec98267927cc536c
SHA256f8730dd018254bf3333d8377f9c31b00e586889f2c4cab0a9454fc70d0cb47dc
SHA512e29e79ecad784373f9d8fdd22064aa72efcac5f17414f74d15a32bf526959172e83d474cfaac628915ed687e481837066ae99155e94ced61afb845ee53591c8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e17779b57475e97ec80ff1672ca8b18
SHA10f9d263aa7b831f5d122c01e420b1f1426db0cf9
SHA256376be8a186cc6887b84bf29c5d651a4d3b388b595cc4c32764ebca8a6e8e8dfd
SHA512c07ff13000d91b65cdac17ea5381a69c1277423e8f77206a6b732df9468d6d0c44648cf36598823715b37b55f8cba1e161bbdcce91b7a0ad30fd61c887c1867c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57afe11b704201c872727f328fe0994b2
SHA1a5622a87488b2c1b8719f283df2cfce44816c657
SHA256f2b1cc8527c6f653c14bdc50b7a53a0ed3b70939c009b6ea10b5c7034fd2a32f
SHA512a5786f62dba1f11a754527b32107ab31123d09bf0907c9570e551f31a63a59388336ee071f39c93ca6e801cc994cab98824ff898eb1b9f9cf89cda9308986074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517ccae19c2875e7b921348367eb93fbc
SHA1852824abecf606f80da3927e95923a056a8e9767
SHA256a51fc2b487e1f2121aed89d2fa63a71965621773f7a4bcfb40817b5e211ed308
SHA51298afb9c152fb9dabf2d981d3d33c13e36ca2e458f9ef036c8677e08d1c392b4974123078adf2e686a474b0c28f0b9570800284d77446a9e601994d3708a34fdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9814b69273963eafdeeebc12257ac9b
SHA1a61d1f60245dc4c621ba573c003cd7eeefeaa793
SHA256a8f26b330845467b0cccb5e27f702ad105a1379c7b8502a78036fdd21f4dddd0
SHA51280917d6d2e6593b7efe55b63f14d7a4a36cc94848b9777ddb68345df3d7b99ba8f5129935ad143a54c9c828a94136fd5c434ffb1eeb276f754ae4588f2f465c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57889729865d02a1e382492b3e1af5eff
SHA174ca05d793a0f1676c0b8497b9ebe28b3abae18c
SHA256e28a07c14f9f65cd5d5418baf6fdf6d0e484d14e0070022581c2602e66c9c800
SHA5122b6bc675392365dc29cb3bed2c2cf85df04f2dcfeeeefae641d43af3a8a77db31e4cbf5b64b6255e6b98aa92e87cd23fee173bb6cc32d9142b74df15e9779d8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57643f4b1cce103c1f6e047f873f74775
SHA1dc84b12ba557d9df92c42c0b7037e79c9d7f8f88
SHA256a0e57822fb61100ea8dfa603d05ea42805b211761cb1f2063f1f1af7a300f624
SHA51276d8896971e389305aff2073c36de4adaf4e29101259e752bf75f32da8c8cd38578179bbae6ea17b0c693fc0b4eb83851a93d8b15498ed35a010a69b50835c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c2484b976902d02878b40d41fe9faaf
SHA1eba9f9ea9ddca523c550e877c81b43c24a9ba4d8
SHA25663423a5af670fe11bfab31d61c92c7228286b27abd11b54ce65b364c0c15ead8
SHA512ad7ef0117ebe19e915d8ffb4784024cddafb721641c9507f01197f60eef56cecccadfe6d73ef5a588eefc06c61832f68173cdbe609c6a0e8bd3c8b2999bb14ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddd8e46cb18225de218e4fe8c45d6e36
SHA1bf80194076891c6f0ae5a70f6a6c016410ca08ff
SHA25601114e1d920b8e215349dd46d2ff360a0011ef14d3f106095c61fea533c5b6da
SHA51253eb69e51e2f0310bc66fb466b05f0612031f4252a655f28b28ae8d5ac338b368e9b3ba9fee97892fab73d7c06df9c61d7a528b84ef5c351edd8b5642a9bccfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ff82951df942b85405d29b99948b27c
SHA16a87adfd2ab57c6d7697c3cfa1e8525c44ff7974
SHA256d261fe451f9c11f33661b7cbe719ed5693308e4552c9fcdb8fec198953d1208a
SHA5129e79b9427213d3fde0925f5abf47489d91e75fc1db9d8137e0d0e543e7cc955ada7f03e0b0cdb0cf28801de33d5b90772dc655c44485bc87e909909a21db0690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c38c8e393e98dde2a8d9086c6d1d1e2
SHA15e498d6594c551fcd171f16e0094ffcacf968c84
SHA25608c3887fab39ca1c6685cade0953f53914cf4bcecac21685d318f7eeb9cd4050
SHA512151d9d0f31a7225dc3c69f1a8481232ccbdf4d9d08472af7ebc93cb63da93f7beae536073ee7382ef8f417f766e0813b2355e1311ca523075f6788b287591da7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5777b79ac4038fdcf317d26ac9fb8dbbc
SHA17c04a5b6dc31dccc43121a68476529e992198a3b
SHA2569d34b6123d8d61ee2f14d4fd84a1de761e3c4b43bf3952452f5e8cffdc288400
SHA51235cc87854d4d613d5fe2e3f79db9922fda73e5e5288913eaff17ca37acb251a2527afba12a0ef4c512dd13ba8536d7009d300e46616b3cffed649e0cc2fb5e0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bf2886c069042ea43912186b09f69b1
SHA13206c10e593bd455f21158443a70b89c091b7db0
SHA2561c7508b1188cf6bde2db3290e4526aa84a3126910ad4d937fcad2cdb89e05bcb
SHA5129743ee56229f4353cbc8b9c512062c138fe1879aacb5dc835114cda570a4a4b90932c4f58dd05fbf40f69fc0d1622dbd37b599ecf40bcc5fa3dd03dde166bd3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4e244e3ad2ae1ba0ca7724b7f4ec63e
SHA13c08efc1d9dfdbad8aa61658d0cbb215e3922a59
SHA256ac2f07f01515efee7fd3747cbfa137c1c36fa9f8f781488a51ede5e64097f98b
SHA512ea3ccf1fe4ce8b332e61b1a53df06232b902bc3e348c373856491024159b914593907dd04514cea01ee0fd1d530142f8921a5e3fac9af1a88351fd03cdf5d3e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e2175b4650511960371bf8e25a6e618
SHA16ae4e47404355951c7dedff08d8c32d2a4abf8ba
SHA25666bb84f1df95fd6e865ae14e1b18b83d3d4fc2f9bc96dc816531e3ad81a00ec8
SHA51289ca9b9295e4b15820beda533edcdc9d6a165df445d81266ac984315efe90d7d16b9c286d337a7a7eb6197781101ec9ccf8ca5abc505c5c0abf611c983005e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a509eb0b6c7dccd4c8c6e469798e2f29
SHA1490cc876b3756c4f1d7760702c72e485b62c09b9
SHA2566184616d0c0dce7f4dd5cb1979d9f9ee8a67fbb757c342d619b99a7e46effa5e
SHA51217377fe4b442265cd30684f3fd9c13c4b4790977d4007c12c1aac35412ab3ed8f9dd61e860806402158b2cd09e05b36a039dd505690bda147640de8b42c0135d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56eff3be38fccc7a7ec2ada4d74f12415
SHA14cdeb8f09638a750671f6e93b47fbf04f08167cd
SHA256079b16742db4611f95680b785f50b4ba041534bae664eb8c4189a60b599c618d
SHA512d17c018f2ca7ba5beaab0ee4991cdd2fef7afc7317a5d14ecd9315ed412821b1f6dea686828ce8d695ae33181c41b618d7221ea5f47b6861adaa9f382e4dce7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c922290cb044ff12d0cb9ea4ff5d06fa
SHA1bbaf13abef9dc48190e90c87abfbae64322e0cee
SHA256e06413f275c577e07bfbf76cd8922a29f2cfb8b56a971ae1b33505aeca6e3967
SHA51260deb6c19aef896ee6f1d385772391ce12a232618182dd661ac3c139930760fae665985d74db13bf44a22f40f364ca0f3004485ed5727985898540e03f291891
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e28154b65d0ce52ce5c70956f57e90c7
SHA12966b785ecfc03826b7d005a94e856f7b59656b5
SHA2560b2ec441aa2c5c9fbad297dd294ec086faf35ba57958e986a480b7479f383eef
SHA512b670b0851bfb15242f53284a19db40d98598e221b6679d0fd7b41bff927eb2b504efaef1fc17bbd2a6b617dc6ff80f69348118fbf1a8fa7191028733aa1e49d0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b