Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
b60cb7b8bce567785c291da176e73264_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b60cb7b8bce567785c291da176e73264_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b60cb7b8bce567785c291da176e73264_JaffaCakes118.html
-
Size
1KB
-
MD5
b60cb7b8bce567785c291da176e73264
-
SHA1
6be800b578a387871e3eb87b8fd15a28224c0bb9
-
SHA256
84b2691f39115181615ab30ec731aaab98a1b6d3b2db681e8beb2706b143eec0
-
SHA512
5663d64aef8328a9b640600112d1179de7cc987d5c89b5074d8117bc830534cfa50047de041e42260f45b18424d016b7722b859e3af67b104620cf24d387a5be
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD4F9D21-2C43-11EF-A1F0-7EE57A38E3C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424747414" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c4e5b250c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000719fd6b49da5b7154f7ff5ece60e9eda40841366a40b79a196a71c9dbd139d86000000000e8000000002000020000000807d9ad96f4d7e0e050b530a818ea4ab04e8cf5c6094e1df231c73b4c6a15d4f2000000007f276ecb09a3d54b83e845f4ba9bf3fe35497cd37789890c3548a08fd7c796740000000c226cb849406a0dd4cf91260d20f65aa8ad7c776be4f13b74e7964346741579bcb45e09a7aa4b77ccc87547c495915da506d1e65cb094ca530291a9a7316bdcf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d5972ddd34f8ce8404a527c03392bc4fba8ec69b8e7c7ea3950b788bf61d5bdb000000000e800000000200002000000070f4c8ae6b7eb0f8052ab979c1837138667ee2b37782ddba53c34c3822f4a95c90000000e04e33435c60899f9d27de084ef9b241ff638751ebab8f082eff98c8273cd21b55fce838c1882c97cde6692ea92064a1e210f022c6cf9bbed2c6d7cd5f95770c9825734731b0bf4dafe30d497cc04b8b533d431b7a8bc907976a556428855e5fba8a0f9dcc98eb773f869080e175d2fe1abb7f155e2610e274be97896b37fc80b753bcaddf8c4bd11ff0ceffb9a3a96d4000000048f3e989990dc31022df33ba3737dd16e77bcd49dc02fc9ad1130fdba147e4783099d08f38ac957346d7dc6eea3bda7081fae4f2a7ab5c03bebbb5c32199327b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2996 3008 iexplore.exe 28 PID 3008 wrote to memory of 2996 3008 iexplore.exe 28 PID 3008 wrote to memory of 2996 3008 iexplore.exe 28 PID 3008 wrote to memory of 2996 3008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b60cb7b8bce567785c291da176e73264_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5741cbb163a48befe2cc124e753cb3a64
SHA18cefcec8938cc592b765dfbf51d8044c8bc63446
SHA256b8c9b4f6b2e08cf87b21310cc643c6107883b77486a5d37fbc3f0b65a1dd943a
SHA5125920fdf61688c5b8906975c3c26ca65fd2441e0e807f86079909899d0c35a40c56b8b605bad5ac8076e96985c3a3dec90a3baffa82553a25cc8ac8144c9ff1c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588f0609c315e0623c04093202191d902
SHA1008e4b2caddbfa462d7fd1ced36d69ac0b6481c4
SHA256df8426277178d96c84c8dcdc2dc274e26f2f49ad84a316c56fc1f50d04847e37
SHA51221ae016d2cdc4d393bf5398425b997b509e6238a942a74f5e04553dd639d1ef10d9ba95f6451f2842c5efdac6b6e32f828cd84f17af993fb7f1e8964e93cedb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5289d909506d4e7c90e962ea512429039
SHA1438e25580045a6f3d55ec7b53e975731a8d446d0
SHA256d54c4b67356e40e4949466dfa2ee7ea9ad67ebf40d464d0b2a216906ef74150c
SHA5129ce58cedeec87dafd40e2e5d22fb48286d144e624134ac675238d137d039a12ac3690465d327955dd60e794ebefc650315729bf5e7681f69bac11d51e524a0da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573b921caf65ae851f3b98bc0cc0a758b
SHA11bcb741575526fb1965f082c246f337819d7f882
SHA25668804d4e1a0c35445dca5e19364076135a04148a2624276a68205fa63956d03a
SHA5122e9cb25b94a729fe926b6a36675af728b316b4e85f4b3adb002b6c3d81f3a79c6cc163d631dd18cbbc156e9b7ade2f5cd28bd2820d523abf73ca323dc6078807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e81945e854f39deb60348a68979db158
SHA16bf6fa261e0c8852b3d53098892ed5500103170a
SHA256d32250c42734b5d6729eb8912bd01746fcd93f2d096d03f4b1778d0e35c130ca
SHA512fbee3edc2305dd22119c2d645eec683ecde50cce4dd3fa0fd07801988275a3393649f68d4ac356d392a00ed3713779ff84ec417fbf17ee676613059fe212e269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54447362559711e2461a52dc4bf550972
SHA19ff30e3d6c302395df57d1febccd02df0341a7a2
SHA256397d21592b06c56f59c36534b66015bf1e3c84b0901718e0316b966ca446a9ac
SHA51294a33c13d90363f44483e8105293a339fc0265c8a6d7684df24541c91710b976492f2ee2bacf4c0aaef541aa92c7965d23277306b4b4b8b37326751d936a47e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6a3ef114ef6006e1d158b0b9d5c4fe9
SHA12675834b67b1d975eb0733d5b6370af6ecf752a8
SHA2560dcc0f857d73842b72cb0b44b7308a9acf09d689929fe7130e923dbec754747e
SHA512c65ae7098543aa36b3a872a6c793d1bd066238ad8af90e3720b3e1dfad764dc2b15395682ae6e51ee86c26d858883f71c0803201ff9b45d042048d3f6f9dfa7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8f296fa884aa9825a33de2da19e3a80
SHA1e207fd3d1c59083b30d1c1c3efce2c2fda7c5c79
SHA25666affe9ec17c343469497e44c4419ef627d6fb779f855a49ef564d46e88705ae
SHA51290362d95314cdc8760ca277f1690c83fd8ceb2e54111124708f23e3868943e6234af36cca4f45f5cd38e84af8f0d25efba761b558b9fa1ed85c1fe6dee9f2421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5795600cbdcb793b8ca7d4378544c82aa
SHA141b8836c666f81b5453761ba40206802078c1f00
SHA25634455495902ed1bd9d37d3ea8a581c0c728f0568a0c8e9963610abf428d1498a
SHA512b605e8c91fe9415a4b5cc7d910cced57889c4e85b02f717ac3bac401162fa3952784421498ca9f5406d635b884ec217e99dafa063579ff822c2f3789957c8136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e34187652047f2ed069acf5bbf36abf
SHA17fbe995659553a9b74747afc0f61cc8331ecc202
SHA25623bbb2a574957ead1558d09356dba02b06cf94996246308cfab9c42ac6e234a4
SHA512fdbb1288b7c217a1836bb4d80ad62437dd14c732721d47cce239c64fee9546b5ff1d3280d8daa2633db06cfb394e43beee4a7306a44377dbad87db3cd787a25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ce1b2f676638d82022ddf7a652a2d3f
SHA1e66fecf3136c6b892e67ed067e2564d69a842221
SHA25671f1baeb1d0950d54a50188461183948b62146ac4eb52420a5bd4679808a2898
SHA5125fa410517aa57748dc3663d0e00f1baa957e4d936bf9e058567970b3039581b702cb71655a9a5b72a41df10e8a7b36ee36b37ea1475719c14088fe90334df463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55274fc02d95da21c985509d931ae5d85
SHA189ad8fc3455352295f4e7f12707c2a0a63917d72
SHA256a42c25b44e601cd27641fdac3d4c600c93adeb39a40f044f3ef196306cbbb0c5
SHA512ae5beb68342d9b56da6747c6dcbbe5b3f9194313427fe1c2706735155b36ffe42670b67a88dc6d59f14061657ca45a6d87ea673c7863f10f76f9921a2b842bba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da5dfc903a9e8f5aa69489bc902a3f43
SHA155d33c4a7289120a35a087951e8be6895eaa84a3
SHA2566d2e5609dec70983fb5f8e8dfefdb6970731689c1735514bd0f8c9ec2e033add
SHA5127873f526268f4a903c98d5e0704a4cb069c457d7ae347a3ce0e2dc677c178e0c8eff556c6d1270e837b40416a09534d8e415a9cbeac62a2f40ee38aab4a39f6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b404a6cb08d982e3788d4bea9e4ad0d8
SHA11bd269e3bea7c7bee840fe9fc4ee2335797de21f
SHA256675b673a65b3493e55649844e890688c8ef68a0b773e0e4ff3d0661302a33b7f
SHA5126672360213321b7dffda22561b053d536cb7a10fbc30c2dca838ae3979f3be283ac69d18d08d738b8aab27022c149c5e48506ce222547859de4c09d0c11805dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abf394812554b3fc3b516c869a19f393
SHA107c33727712de4c64e008c0041a8954a8d36883f
SHA256c429a35478198d5d6b4ff446259f82fd8c277459138c4f54b563fb9ab00c8696
SHA5125496041e7972b3e9ebb8cc8302be4bd73975fabdaece06dc8eb96aeeadc2ce7f78acb76fb8045d0b9750a3554d2ae3e43ab43a4683da74fefb2e477aeee8e3ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afdf3cfb319f3e3770885079cc0241cf
SHA16282c8be5b1f7c4719b2f57de422d6e5e98e777d
SHA25681b02d0a7817af675abb295ffed8391ef42e57cf6cb4528f53cb7b93dc997a4d
SHA5123505457ba9fb2479a1181a37e1ff72e1aa7389231cf272ab55043c9c529fe1301e0c5ff3af613b1a2c94caebb4b23f3cbfec96aefa48a8cafa1cc298d87448ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5123a29d732e5e927b5ad1743f0339820
SHA1328f1411e0ec5273d0fac39cbf9f506d24b4c9ac
SHA25607394aad0ea587fbb84cc0259aa7ad6b2f9c1aaaef6756c4a7bdfea14b23e392
SHA51298bf250592052ae60978a6fa747e8a983ba7d0226dc6b7c3bf70b8ab792c42c655ff74b41fc9a8866694489ad13301a1e6fc2722b5aa01c3648b6a01120b5dbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d736ce1a724f44f41a856bfc166b851a
SHA17a0528e5f2044613b96169149eca8cd4e3e29fec
SHA256cf25a61b3e5c84dd5511f79f8801dd74da4118b95eb58f811d9042e907b4ae0d
SHA51203f21e159093759a5e08782283ce5d232fbfad4e658c7f9d0dbeddbf28deb7c2bcc76e32074a99f8c17a010783384ef73e23310618ff2f0e343bbdc9a448c9a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc45143cb23c17cf6c890e58f675c046
SHA107cc5ae9498c4d2773ebd2d9d4cde3f9ed37a2e5
SHA256f0b7e3eedc34e922c5521a64eb26c6d2e08a822a914e38060bbd0b15f39a81fd
SHA51237ae88c0a4623618840fd72ed2f192b62a44bbd042988c395c55079e4fbfeacd65e6b57221b4de0691911b77f2354338e454a62fa3c78fa87b6ad9f5d089e197
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b