Analysis
-
max time kernel
138s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 23:20
Static task
static1
Behavioral task
behavioral1
Sample
abf6440351ab34abc425dda7f333a08e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
abf6440351ab34abc425dda7f333a08e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
abf6440351ab34abc425dda7f333a08e_JaffaCakes118.html
-
Size
159KB
-
MD5
abf6440351ab34abc425dda7f333a08e
-
SHA1
4ae17048de18d8adcce76b75c5dd2c9ad6bdcdd7
-
SHA256
f89d4931e212c1bbd7a0b39067236b6a8020199d793f28243eb36bb7817f21ea
-
SHA512
c6f6fb83fc9854ea617b6fe50038a09d350745b2d24ae11ca9b40148f22dee3a642546b96da25c51dd4dc235762da7760ceb3d3cf08f018f18845859a1c89eb1
-
SSDEEP
3072:SDQE3aejMG4eyfkMY+BES09JXAnyrZalI+YQ:SDqejMG47sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000df164ed2c826fd2f7aaee4e39d54ca390962ee86661516246efda5c42a7cd9ea000000000e800000000200002000000032267ce22a2253a0bfa4994f3102a0a56b6bf205ce7ea456e48ffcc71227b1962000000095cc39f8f1dddbeab1fe852c634a3bd46e5508920eee042470bc8b4518771cda40000000cd6b802d7142b11169e304ab94cb88b25479659a3c7c3170bd1ef429fc51701775fb66466d2043c61d000456385ece0c281cd292d373336355281d84d1baa002 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601a65c4b1beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000050185c2af8b11697cd8b01e558b9041440fe03a2840061ed51ae233f8a3ef27d000000000e8000000002000020000000a071dc9aab05ad0f65eaaeb9703cf7aa9ea8e8917da2e908bff4102f0337fa1d900000009a8b0b3407c01020e8217ab7d188d59420bc45aca6f33f83e07f787f0225dc6b91a47e1d4c3f035fa1dfc1ded7c45aee32823c026524b87dd1a13692b7984a0d8dbc591ea1fd99fa5b23aeefc99688eb0f7794c1dcbe04e19bc19a9b9e2273e1ce4b2d0a6e94a94c345a03f89f1966d4d59292b8d0df3c23db0192f7648e04997d532466bc1f2bbd42d83a8975905cd14000000093b8fdcd00ccdaf3e059dad0e601fbace7c662505f7228b6bc7745dff0197feea87a34a3f077611ba7c6683c17203e802881185134bb335994e085637053dbdb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFBBEAD1-2AA4-11EF-AAC6-46C1B5BE3FA8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424569097" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3060 3016 iexplore.exe 28 PID 3016 wrote to memory of 3060 3016 iexplore.exe 28 PID 3016 wrote to memory of 3060 3016 iexplore.exe 28 PID 3016 wrote to memory of 3060 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abf6440351ab34abc425dda7f333a08e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b79dde20646a0d71024de6e30bbb780a
SHA13e9f763e716726a02771a85ce301715de5d75dcf
SHA2568da0e4ed7ceb2a505a63ca1c96dcc90e2c73aebd8c1b24be89a8d964b2d80e47
SHA512bb908439cabaf3b01474d4431427d5da95b6769b83b114bdfb9bb2fc3ebef4e998c2b5bdaea4c52940faf6e2fb01444ee80c86f1d00acfd34471078e1aace5fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8cf1c2ad07f31d0d681500d17f1c81e
SHA1e053aff3535002be303220976dad257f6b3e373f
SHA2563e6a53df5f8a41fa16f82dc25fae9c805fba002eab70bb24494c27e25cdfde9e
SHA512df48eab2bae240b0b77ec82a14632feaa66dea3668caa5a7459b20633d189e4e5db449600a06e3fb88c3fa6da5a544cdd27b21f016d13a7203b87a8240715f87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd7c8044302f112b51d1bdc839b52526
SHA15fb0b220816d13f67dde168a3132d2048a7b3579
SHA256e1e989941fe5f7111beb795e0facfeb92b46352ef3fe99b970837d90f4b1cb57
SHA512bcf84d7eec2d08d946dddc68ae37ccc97f9d1c035d773005008c1871e1bc167afcad8b71cef63764554fe16b589e2763dddadb94a3b1a064f83cd5c469f603f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afd7ea3bc363daaa0f94114c412918f4
SHA1fadbe1572aceb592ec9ef585ddf901ba90838f48
SHA2565e90d6750016903d981ead6829244bbca7df3d89c66ccfcba9436b3d9b15bd75
SHA512285cf99f96d71146a9d3bf6cf6b47e5318795f6ec7c216d9e50fbd5847911b33ed213e56bfb7f7db7f9f6c57def6d8028525a9063844a8952902a72757bf598d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508017c0d259147102c0c88f018994f1a
SHA16ebf15982dc0ee694a5d1d73bc3302193910237b
SHA2562085b81b095b15f3f1eff01562b362da3ff940348f25f49985cc0ddaa1c0c206
SHA512fd544adf693665b41d72a412683d9caed9ee59c49b17fb9f90cf99c74b090d099b8cf042a787a5a3abff0a4651200b2f87d70a98e6d7f4900b6e217681f30c1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b75c5d6a3b09607437eb04d2459a236
SHA1f47e199ad6434622dbf12b12332284249cd003b5
SHA25637aed74e8a8c15709d9ed19e440b7e6e5621633c480484efb7df3aec4c0e8b50
SHA512dfb78fc3788a2f0a37dcf260cfa29f0b846c6c27dfe312edcc5d88ecd278cd730594f89443bb87fcec3ed47d47f9f5b5cad2c707f985fb83ea94d091f0dc97a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff030ad8bb301973fea0e8556b610bd6
SHA1f8fd5023a8ed3df0ee805b5d78fbabdfc0f27678
SHA256982da0b6398f6cabf105158d6ca84ce9690c1feb42f216b3ed4430ded5ddaa78
SHA5121475260f39917acf8e79bd6ee9fbfb88db5392b404de52189f9a1c843d904e71e61a131a4fe3f33eb765e43358a8402c2b139df85457ad484d2939022db1a0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a98cac8880441d8e110383dc90311342
SHA1881b7136447e73b8225d5a1d47ac7794f7682dd2
SHA25686734b417baee9674011ade1696cc7f7a80ad585460e3f3e89d68a799ec98802
SHA512d23cce5d27bddedbf7b339ef5e49c29e8765d3b4bb38dba7fea3dd6ee54bcf0037804baf0e015b7e0ae86f3829522f1548bd0be5b010856225c62879f8570f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50af5e90800511a8260d98225b1fffa35
SHA1649f5f3e5949769f1ca089d5ecf3abebaefd3df0
SHA25660aa96a38c3a0092cea37fdfc1c9eea147fdfa23695fa7f51f490318e0d0efff
SHA512aa3861a3eb204f87edcd93568c0aed3982b7d7d2faa5f152da15d253487ef5b1be21f5e74f672a0f569e1700a0241f50c3ebb4ee3b0fdb2d8b59fc161aaa16c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e71c630b37fe88bbed8b03dd8391578
SHA1a8db5bdaaf46cf420ff42c560999d98dfb102915
SHA256ae945fdf17d26e0407fe29a4721d7406496b008122c353effa2ed0e3e89e7af5
SHA5120f1eb02f5dae82e0a945d19b1863cd58e675f030181638256d425faf9d7596d4bc4b9adb3eafaec0e32e8d3ac02911853b9f91231089e0930323cf0a17780a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bf05b5c59c33171f4db76f6ccc25fc3
SHA1b20a86716c76353e6e641bbe8f42df21b0bb8499
SHA2569453a464c25c70c3de30a78b8f0aba259d24c96322b2af898dfe1b1a05345032
SHA512434ce654c2c3c8328257d6f664538e69ce8046651cbba27842487476f1f7c1e4de581233ec9ed3768f7078e28fb468e475cf138fd16a37bc973af588c04607d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59541c4585a7d7f5f4a05a65fd091e298
SHA159e9eeb696e379c00b3e937ed4c876bdd75696fd
SHA2562ef0124fb5f061a50fd1a2b9d27755d61194cb2bf27e58b01d716cac49aae935
SHA512cb05bd4155f6e7cb61dfad7b7c2ba8009c0d4d25ed081ce6d1b458e33a5da2d757ba15420aa1082b89e6a78ca6f2ff8e6b41ce51bfb6862dc3578287592be22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a336396f3ce0cef0772de849d4a75390
SHA1ee06be5baa228f5042c802b05a19b9ed5dcbb375
SHA256eb3081c9d9df2a4241548e2ad58f7e21492732809eef2ac25c6a0844b4e9c29c
SHA5125e4e5373972a9484c1c1e39f555f200a2f1bab9611354fc79630d7de276a52d47cc7e1610468beb29f15d2c86674e767c0e35ed080cd5e34ea95f5d3a6aec004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5278b04bf5b8d69c2aff71c62d7edff8e
SHA15adf0c034dd3a0823224f6bd5c75ab0cf3102cdd
SHA256b716438539c5ce6675dcfe3803018a0b364df1bc279416857d4b1bfc4b7e3da7
SHA51292423c36882307220dd95aac8a9b1a57af0994a9a5da2a18a601bc8fb694c3e5a217df778eb1fe0086b5aa6296ecc953518a9e3222804b02a5a316910aee97cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd8d060eb7531fa1fd90dbe806f8ef91
SHA17c3fc682ad792339bd18885d1e4f55fa6b1e9612
SHA25661af9cd37903a498dc0bbb6d0cc54f8155108f9abbd59063b2c5dd5343e22811
SHA5124d2a88d04f1e859fc6d93e560b96db895b989f31be5a76a89d7904e7d0bb18a2d5128f8e1a22b50eebe4146472f7ab1d0b1cdeb5af09bcc5c5ef80eccb3b5637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a320725ce3b902e8449fd075b709f6be
SHA1529502f55ae156a74df4e6ba3e666cc319359efb
SHA25683c50e90607d21b8301ca07d51b5df498b4772d19612a281c8503fe49961a4c5
SHA51260d60a06f44cc4f97f4f786e4a326c39017c32017426051b87f5c283b82beff656db79d0bc9af315a6841ff1a4ffdf294da937ab5fecd1fa1c23c106dae6e470
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b