Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
b7008ec6fed8152e87d6962072e96952_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b7008ec6fed8152e87d6962072e96952_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b7008ec6fed8152e87d6962072e96952_JaffaCakes118.html
-
Size
24KB
-
MD5
b7008ec6fed8152e87d6962072e96952
-
SHA1
0ce4508b4944f7676e4f6ce83f892e452b8f14b5
-
SHA256
422b39b41def833f71b2081df9802f460cc7d2a5bdb28828aeb6a8d5813a9ac5
-
SHA512
1d9e1ebd6dd4490cf8494b2a4623a01fe18bc16c15787d504b093813c1a4b4742524d7cfc7dbff3e52840f7187988b409987546215586e78a7ec56ca905736cd
-
SSDEEP
384:q9euTQDmkaAPAvtdbsb22/1jR5Va9vr5dXcIHKK:q9eudi4vtdb82iedXcIHr
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424764371" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57E70F11-2C6B-11EF-9266-767D26DA5D32} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0073b2e78c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000959af3b5c064bbb047b31fa987b075682a14efa536858037749dd6696077217f000000000e800000000200002000000035b0d7d93061c154cd6a6f88dfbc90d1e8c137b18ff81d235c7df161b275688490000000cfefeb4665c2d3d1df96696804229cc1840ba25cd58ddabbb70a90773b2bd51328d62beacc03dd3ae503f83ab2230ce434ff74ca00afe460299cb4d87f0801adf2bf22900db4eb09da3ae7af271e7478e40d8d04d7ad0cc2f272b83f9df5523732a4e5119cc22747fa268e974052262ac81eb26fd76d1e24b983a8aa998fb9ff73a632f67abb9c86300ce699408d643e40000000fe77d03342b9642735d4a8fb879de75ad0210f3039a0c85caf3efbf5438b9eae3c19c102f2483ced37d4af643383626d965b37b464ea27aa9a4f053f8cdb0cda iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007c8c27eacae3a61255c1e649b847488a9d636adf09ec015ae34f94147add4611000000000e8000000002000020000000065855645c3ac5f5adac49240decdcb0bb3ed9f4f800ac2318fd14bf752741a820000000f63ca3f760f31b02acb65e6366e579ad636bcf20731a69df4f8087106ec690f8400000008672e4374d56d029dd8a2a20b8524a1cfc7c367f61fc4d30017e80428a1882967293fd389544b53d90de066e25f8dfad08b42879f967106ccfc87e6f71a7bb13 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1192 iexplore.exe 1192 iexplore.exe 1888 IEXPLORE.EXE 1888 IEXPLORE.EXE 1888 IEXPLORE.EXE 1888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1888 1192 iexplore.exe 28 PID 1192 wrote to memory of 1888 1192 iexplore.exe 28 PID 1192 wrote to memory of 1888 1192 iexplore.exe 28 PID 1192 wrote to memory of 1888 1192 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7008ec6fed8152e87d6962072e96952_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5c980314d29513e4f97accf042453fd04
SHA170a18e8b09150a100d1d79b52c37651d62a44a19
SHA256dbe50a7f8739ca2840cbc32ce104bb7d287c2ac2c21be0d99f47d97fb8f444d0
SHA5122754222d5d968a4782adca7497274f4cd8575b01827fb938d77f1760543e7451c364d264e84d2f547ffaa776bd336f07837660ae60ef9f597c28744c08049db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcadba42b82900ccc9804c96676eed14
SHA10a3167ca55cb938325da0cd848694b7730028f8d
SHA2568f960b827828cd164a9936c12bb994e096f3808ea6abc9ba1e33a67839c8d69b
SHA51249bc518a02e0cb3be1ca5618e3f56ab384bffcb44048e219869b67475d9edf5f54aa51ba543dbddc073a2760768e5fad7eab01169befc8a648c337fafc0f5175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5646ab84b200294ca5c1a1dd65952fc21
SHA16bea5911409e2bf61af85c282aabc4b2a5bfcf20
SHA256e37611ec92dbe6d9d5d55a2756cf574675ef4a76cf0de78794882dee944b5143
SHA5122fa2303dd10ddcc1a786fc4f5072d54d9e7277d78811ffda4f587e76513a037b94e49f7caffc587a61716e5ff6b9f48be62bca877699344efe1612175e6f4fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d3a4c2383ce1e7a018ac59185d9faae
SHA1d2b7382313743fae5bc96a763f1e6342368ab3d4
SHA256e83b4cc85e1af3a8220af326ecfe48cb028402b4eacd047c4ff91cdf2f1e57c2
SHA51223c591111b6b0afc4f20ab79de519b1840a912e7e70cb5e0a5e40b4d412f9c4adb50223600e0a0640e861afa4a17113cdef8133f932f3db66ceb485dab6a9d1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4a944c7f6b64d61b91b3a118def2b37
SHA16b951de245f9229a967dff6bfd5e985890535aa2
SHA25637dcbc9420763a1cadc06324e707fdc534409f5e8543c857bd2770fe5d11a54e
SHA5121e1144ac31e6be45dd6387b7845a7444543f75acb938b051d09fde2f65ea91c1649617bf1dfd64f5bf3712923c8579c395cbb9d03e56c40571a1ed947f62cefe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac4f23bc4f4e9a089f2998a39feae33
SHA1555a7dbde5ae2c6fb87c762b4144a56502aa66c5
SHA25660fddca21a35c6012c13660ab796110f835a64fb5eade2644aec6e70c2cab741
SHA512c0795bdb30970d53ef5b9f80609303013c860b109c5684892f137d110450366f643ec5e238080f6cb3b75aa52318f16aad5bb2a2db7a4d3bc73d7004d6cba03c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5537443855c0be04f713c478f6873f29e
SHA1b4aab6d19667c713c37e315d964617ddcf943777
SHA2564943963658cb69895e68848359042f971d04e6ded363dfc9fa5a6b410f406c6f
SHA512fed4d19fc63935d4eebacfc3d83c04710e87b033a1857a004900e1a271361bad83e072c0f37650580d6db79431b82dee74bb179822f10e0564c9ea683e057f3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51af18cc9d9ef5b5c1ad3e08747fbad0c
SHA18a7944c18ff2514bb6101f73a9105e08ca8f7301
SHA2569ba284ace794375e46e4b6837ad8dd633160bddd7ab8e14ee8ac0e153aaafdfd
SHA512677596c2698e1591f06b3013d7a4c135872e38631211bf88f969878907a0b15bf6d3cf9cd6050256ff4ec0ac91d83bf1aa3530991207d954e692bee260c3cca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d77447be368e7c4822a4a75809b4c37
SHA12596df7bc1f277cd50b153414997cca03b739034
SHA2564c3d092ec4e0b7d63ad997a150de82bd81bbf766ac31370158b12541b9864cca
SHA5126bd8e0bf54ea410b4bfbff43f540bbc2c80c33914c0c5425dc5f33e366fbce72f94eaa32ff3771b735151f7de4192e8fc8d518e8dd148ef77f095a26ce736d82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbc76b15a28fef6bb6e48c3fa4ac44c9
SHA1f6274d4af355536246b7f31358bcaf7f0405e1bd
SHA2562f75e2e0d434c19ec7655d817ea18704045f71dfb98121bd805494969830b31b
SHA51289f3b1ac4fe5b9afc21f3ef681a2333f38a0b01f91b96389264ca34627b95ca211eccfa982aaf6ed3e94d429cdb1f77d9d5190fe6703ea600da165be41bce1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506df4f2f91935b067d5aa1d4090371e9
SHA131a8acea37116c15a5fe20671818a77542c21a20
SHA256d8fa99231cebfab210cf8038cc43ec29bc33e87661460497ccd041af2bc0d47f
SHA51247735ff968f7fc2f71b9cab5074734ae8ffee28597081f264e90ee7e66a38bd4494a94cb0efd8c7fe59358d6c353bc3abd8e59968bf1af05559c0ce5f1cefac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0dd118c5d680e5504af7e4077da21f7
SHA1d2e12ad1d0f7117f9236273acac5b20299b4b513
SHA256c8fe549a1d873eaa4e4fc94f4d0219a566e46256aec4d4943f8793e1ff9c7e6b
SHA512a0bfb2655080bf979a8237fcaadacc1f94fbdd25758fef5d1dda4cea45be50d536b5161a9493de70ed2a9c669da8901ade1ba1dc38784ce3fc05d85e45b95d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a1b13a684901720b4511e75bb25ef0
SHA11641fdb34a0c605fe5a678867be4f02ab450e37c
SHA256b76ae6a575006dab05e8251ea156fefbd67394c43abb30199c04fb415a0a5dca
SHA51287d738595d21c7913b260fb8091979de668faa24b45b967b9c849f69190cf4f35b87c03032af85bfc9da426ae5b804e9c391d044170c68826081c927acdb2cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5384287d28c065a90925334d9950ad66b
SHA1f2fce6dcdc09e348f8a8c2bb2ddbbc50983a8008
SHA2564f3846322b5b03a458185ae09d0584aa9678f0c6ff863b66892bfda9f607fb47
SHA5120264fda16eeb0389fe42cec8a09cceb59d8354c9cfe9de96d0c194e89b99c37abcc83765fb7382826ebdea32e9b883eb94e21b4c7d9f699abcb89c54af490ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550f94cd649ae1f552e9bfbf36068893f
SHA1960efedd09206592bab63506856c0c00dcb9f3f9
SHA256a82eb170d4175ceeda622fccfc4d46ef21b81a9c3848606777a3376ed51dd3b7
SHA512687f8726a98d07081df8ab0fc861d5481cdadfd0371aaa3d2c7299680130942d5de253568b3ddf734aeee4f1a8b9cc701cc7ac751d6581f6769193e6b86e9f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd1bf3b2068248a17449afb83048da98
SHA1682d11f6dc281a4a7658570a6e5dd26a9930bad0
SHA256a23de60e02c11b96fc0a77ed3639323b6eac1a2916b567ec8c21e7cd4fb0b03e
SHA5128cacdc2741c0b2391c1d8de2232e4990a710474db4034088021ee7aaf1f6d30e21f248ce95c72ae5853bc6876172dc2290f3ebf8dffab853c61a3525cb75328e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5643c95291411d08a9b7a4b1441b1b557
SHA112e896f6ff606df7395759b5551a75350ffa5992
SHA2563c97260c36cdc1a2a3d5cb0a28308bd46b9ea414699ec17cab015434298edca6
SHA512ffb6a2f9dc7b626e5117063a7ee541c27660872fd5bbe44f00b6d65a939e3a32bc4c76c70351ef1a6c7f4a5ec9425a59b67c0e771bf4c8a7208cdd1fb3b6c27e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f1dfe3e620fbe2f1d443daa42a126e7
SHA1d11e7a413c9b4726a7bfa18dec16b1b93e7c5e27
SHA256b191d3702e3b08ae320950c8307675f64c1565dbed45a08bd660483ed57331e0
SHA5128096fed2c7a949eaeac1aaeeaf487057e34fd35f78cad927daed527f3f420caed9bf9f476cb8ed5f3a5b2d3ffc59f3d206be0e249686769445902fa310282707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fd591ab9b4be3cf1df95ae0215428a2
SHA15e74bc1c95729b5bde3bc80f99603280a6c5b4d3
SHA25658b492f585f4b9aa94ecb30e2d87ab469099ad7655e695c611537cd26966a60b
SHA512dc6deff2ef29d96ff6e6051c58815c3fd7402aee1e8767a480631a840699cf46a25687a806d079de0505e524acc54ba649fe02eb7d544a7e0f46beae1f1f802b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b