Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 05:09
Static task
static1
Behavioral task
behavioral1
Sample
b6ea76e5f8beba41e51bed75e2adfc22_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b6ea76e5f8beba41e51bed75e2adfc22_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
b6ea76e5f8beba41e51bed75e2adfc22_JaffaCakes118.html
-
Size
15KB
-
MD5
b6ea76e5f8beba41e51bed75e2adfc22
-
SHA1
7b177e8449a90f39a8571fd42671444bf867a20a
-
SHA256
3e4d996f5c1c1f322510402cc36fe00d34449a90ed4e2908e2e7965acd22d411
-
SHA512
76b850c32bf99f6c1fbfc6be1cc12de1f891ecf34daf44f493368655934838e76c505417ce618464ad00f8dbc17967490058c4b92ab4847dc36c52d1cf092d74
-
SSDEEP
384:CyiBc1Z/3+Za+lmFAi7zy1wXM0p6k+OI+v:Cyim5qOAi7zIKM3XM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3047849374c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEA0D641-2C67-11EF-A490-4A2B752F9250} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000067146f24e9e3640de1a8bb92bdad91c976af1aff48ce45d0f625288eec6f8b44000000000e8000000002000020000000c9b0d5cbb19c858597613e29370d169af219f065855a9568d67a7940e921f20a200000002589f21315113c3e5a7dcf1e242540521aa607a483647b96e902c326a437ca13400000002e1d8adf865db64c7c1c23884a2b921dc892181d34215e7233d4e5653102087435d6d6d834cecf43f7bcfec29daa12b49deee6ec50de11f64a4a0a7ce7d3391f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000005af4c0df69a0817c65a23237df31c7201cdcabe3be68c64227c7135f690c96ba000000000e8000000002000020000000cf3f6f9fb8fc8c903ce1412609a3b3c8829d8a1bae6a06f7e96e5b257eff2f919000000056c131cdbb813f53faf7e32d02f5d449c008a05cea895b7528e1bc34731d655eec4888ef6f8be0f5ae4ca8b806606235b451d3b18f02d1f19f63d99673fcf95b9ff72272b5c59d81a2c7cc8a546833ed2838a73c9282fef3319ee9f40dc544de5e511523c7c2bc9d114bad12bf39149282bc94ec7fda34a7e1a149d80b420c80ddce1514a1eab5be709814baa838b14f40000000a182f1c7a4cb2a8a0f4fe82223440b983e6bbed0298aadf0c14ea364b6223618096314bc8b575147f1ef46c1e542f3b4c4d2a717e188718b2612fb4dbc226597 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424762824" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2304 2108 iexplore.exe 28 PID 2108 wrote to memory of 2304 2108 iexplore.exe 28 PID 2108 wrote to memory of 2304 2108 iexplore.exe 28 PID 2108 wrote to memory of 2304 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6ea76e5f8beba41e51bed75e2adfc22_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d21244c818e83faba159ce0053f1e577
SHA176894adc75bda642b0919b3f50aa243cfdef2d64
SHA25609ee879c5795da0041374da9c32791b36f62c6ff8a33bdfdcc9e8fe753323a60
SHA5127ebabc9a8eaae3abb1a5ae21170f217d0ed3027a7581a9635487d635080881fdd819e5eb619a53a4e4357b21ce4a24a7bfedcd035e1e50bcd05d99838b4205a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ce35c593dc7b54b53a3f748db83018d
SHA1a0d031bde675159543ac1312c52ccde4c8d9af1f
SHA256c9d1e01e1150a4b43fca8e9ad78fb17ca2c97e2518ca4ec103a969c0ad402896
SHA5123905555506eb5455d1c9c6dba11224021431fa0f9f9ef158a1c2da36b93efa42abc4820e4679dbb00b19bdf00d2ec26ff47494aa67c60a53c363b0105daf6cc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ed684a4afcb8a555ef97950b166bf1f
SHA152390860eba68bd6b2c030936573fb9b9901f4ca
SHA256b609f1926226dce51eaf50eee62a10b248f0361f07c0a6e2ea1e9c7dae95e72a
SHA51247dad6e9b2290b2c6c47d76a8b882c38282404cfe6a8d596fdb176ff0e69abd29b9115098aec5ba8dcafa3539c3944de19350e183ebb9b535bda923ca34a116a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed2b6c9f5ef12ceede86bcc0b1a321c8
SHA155d6dcd509965dc415663b9daf7cc13d35125e77
SHA2561c08b3f0e2b3cf9c2dd54422ea164ef30cd52c483b58cccbadf6a1551ef89589
SHA512f38a765f05a884f15bcfd78f97160ad4df112a11a23d75356bee1c000eea71f873063648de9e02560cec3e26273702c5a1d9a12d301292e0fed16015d88526ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa37a581951d282a10b92e8b227a40f3
SHA1c0e0e6e089d0e212af7bc085bcf6e4ac3d65be2e
SHA25665a001809a51c95a3933048c9097168e12b20e1a8a04215852e8e70c4d335541
SHA512ceb82bf0ebb690487940e46ff07fe073dbfb0c1f81640f25fc79767a84111163719eb0cb81b532481e29cf4d911785f046bd25525659e19bd9c4f2998de003ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e91b8a12a760b1890aebb5f48eb71a0f
SHA1c4ffb0256e1f1a9b2902583c68a88d76a67dd2d7
SHA2564188d91a70b5e5b81291cb4f02949d40d70dc6de6cc3c94aa813c22cdd78a56d
SHA512228fd3d8e079e71b2f5222a7b4bb354daec7e75b48dc6bb872cc36e8539c9f4ab0b045f415c3583f2950c4ab907ea1cbf1fb690f261c4aa07186c1cbb040871d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a8f46e70869148afc4f54e6b76cbe16
SHA17327c57a16d3ca47608623de65514358d70596b0
SHA2565d05b511d0f3a11076e5d09943a62e7da6b0031d002d62075d6bbbf47967e5d4
SHA5125ba4250a19a7f00afe728d80c9eeabd9fcf3b1dab82d07f00873e175980b2ce0449b14e5e9f7b467a0e52c79035befdb502c9d0d0900d27af6b6a7ad1b282e42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df8fe993ad78f23f59798d80067549e0
SHA1f5e749ab342207bc6b0fb6ed99a4ea0f4a8b0b0d
SHA2567e0ca78cb57ab689ca36231ba146db7d21f746cb18d011149b1b0bf70528d96a
SHA512fbe347386b64668cb302bffc563db64a27b4f5399ba4c950aa70e416f7f91a08a62d6d45dd22740cebf57364500ead944a16e4b8d91413a592cb758c8215f6ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51061dc37b9921fb22f81555123b27ec6
SHA16962e43e71e3f57dc8e07be7340823d849aec0d6
SHA256506d16d416673aec99e4ec2880b5b295be2ecf8f65bddc3eb046207a66a3ae3a
SHA51243245efd17a625a6103f0cc685a1d1c52e7a035e8d8bb98b659c23a3387345a72f7beeedb70382f15cab877edce8f44bb06ee3c502f00e97b2ac352fd193860f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d1bc5b61ea0eea0e468ac2f0c7f628f
SHA15c5a2e4b715079b418d452073535e6be3ba27603
SHA2562e7873ac3271a8271ea2ca904b7f23e9dc75c66c44f1bc916297c12eaf7376ac
SHA512db29682d542c2505c536649f6ae2ec84ff69e5a1e51a4eb99a29ce2051f26663bf37949caad95349bb5ebbf60868ecb0a8e519cfb443e6f87eee418ac7dd8409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51df3f645da9003a1bfa0891400e3b1b5
SHA13095ea954f16237682cfc3b1e5655aa6ca1baac9
SHA2563890df950cc27d92ad1ef9d58b52d5be0acbf2a1a440da57fa20d614ba260faa
SHA5128c3ca8068747dcc61795f7f086cfcbecfc5cf61c48992551870a58b9fd270ac09b0afe168f23a1936938bf0a2ee41afba69ebbacae0ed77e955d13474ecb95c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5312683d34d701b614c4841dc10a7c18a
SHA12352b681e6721af3a10bb93acff7de07828481e5
SHA25631f2b546f5e5cc65900d09de9ed753278b27d6590e72a1a7786068bb8542a6f9
SHA512d05acfd2699b9946297be37a70b97bc5ebfcc664314b1c1025e6896ae0ad8e564b54a69e8eda3bed22e25e8c72be2c4e76da29faeed4c075e32a5bbb25f37a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523c09748393ca33bd6136c0b62cf13f0
SHA13fc54727e71d9b9312b4348515642afdfd45efcb
SHA25637fcc6f12a020e9d9eb030e861270e7a403363650ae4700b8a23972c3448d37d
SHA5127aad0f440b4f6168c26dec4e21dca71aee222c14260056620bccd75027e0b1a0b1354a9686d3e663cfc63fb09bafa510314e9de4cb34712481f2aa10466a5676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a79e8059d7ff8c354f6f1666a76cbf9
SHA190e9de80ab18e98430c2d62867feb80810f0db02
SHA2567c90f4a5923a065bd319e284d006e487b33d83fba2a81d31c73f980a251027d4
SHA5125d28a6c2b1eec61d179c3ac9614917a6f9cdb7d0011af49b5dfb180e7ca8d1d13542c80df5192ef06eca0cb25f66e5c8259beaefec9693a6fb6d86018fdd170c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5635c65daf9186bf35782ea5a91d80636
SHA1e0bfa51817baf6f8a5e886dba674976f44de02b2
SHA256d6069f1a1900175635895c7644b7b4b8a7dc85a7ffc856378b1d42c7f9dfe574
SHA512529ef2ccce40dfac1199bd4028d927fff8029dd35b4fbee5abdcc1c3bad55ed140830491b50f27bce8a9137378cb9547dd1dd892c1740001d2f44f0c70cd4e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57487f8e69332406040ad62a3189fce72
SHA186c680220f109d7f6c63e1d1658e4383e843b00d
SHA2566c7cab9a9298a2d82ebfe0958d04be515c6792d6391214b5c5ce41aef1b2b385
SHA512839515bcf69250d65bb768859d1fad9813d616428b207d20889c8d2c93ccaef63efb3f5235c28a18934926886d0e61fbcbe40f05562049ac5fb7071040467d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c807bae7c9ef079c44d8dd23e86d6fd7
SHA196c925a45af19a6665a7b2b69c5af31fbae96c8c
SHA256b17a59588c9b93bb3c40a235a7cc2f1b6d05da76c3a99323106c9e02bc7dc389
SHA5127efb05a74103ae7db815b49d8e55d00388a2438fdbb720a6cbf891ac5948552d9512130f653b45685883e384c01ce973085d0d184bf0e8799df5a2ec92ae7a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfdfdc36d3e684aeb76927443be529b3
SHA164c732948e13b7b2fb88a3a2c71bcd202c7860b2
SHA256ff7139a5185fde38026f60c99d816fcb613d82b7030c5e3031b1b6bfa3ae3adc
SHA51214afa7903ad8b92bdd4421702ad5fa8130ff71fccf89948b031aa4935dc62f4258a3619a025c3dcdafc2dc5499b5c632d62c3018dc157732ea1e704f160e085e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b