Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 20:14
Static task
static1
Behavioral task
behavioral1
Sample
b9d5e8621c27f4812cf92dd96db6e52d_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b9d5e8621c27f4812cf92dd96db6e52d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b9d5e8621c27f4812cf92dd96db6e52d_JaffaCakes118.html
-
Size
16KB
-
MD5
b9d5e8621c27f4812cf92dd96db6e52d
-
SHA1
19e0f745bc942688e5b55f2e9b6354f146e36732
-
SHA256
b38e9fb626f6eb4dd87134bea21753c28d26b3589c6469e822aefccce8114241
-
SHA512
f226042fe7bb28201108b613575962dfd9511e5d87e1097d0004cdb8d7f215081c13e17e6609a647e58e8c37f6572898e90ef61b3c37c819681b4998dbd4d4a3
-
SSDEEP
384:SI9qwk6zDj+xNVc6OrVFFUjBQVxkHudBGVlDDYC/YjX:SpyzDj+nVc6OXX
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 6 IoCs
Processes:
flow ioc 14 https://hi98.cc/gg.html 12 https://hi98.cc/gg.html 11 https://hi98.cc/gg.html 10 https://hi98.cc/gg.html 19 https://hi98.cc/gg.html 9 https://hi98.cc/gg.html -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424817139" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34E41DC1-2CE6-11EF-9A67-52FD63057C4C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1680 iexplore.exe 1680 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1680 wrote to memory of 3044 1680 iexplore.exe IEXPLORE.EXE PID 1680 wrote to memory of 3044 1680 iexplore.exe IEXPLORE.EXE PID 1680 wrote to memory of 3044 1680 iexplore.exe IEXPLORE.EXE PID 1680 wrote to memory of 3044 1680 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9d5e8621c27f4812cf92dd96db6e52d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD54ddceefd0ef25ced3b0b752a4c8d69a3
SHA1d65d85710397b0fbb027fe54d74b3f0c89b261b2
SHA25644b2d139a2813c06ff917beea5863fdb39522cee0dda778a4298c020a10c073c
SHA5120ba808b47b3efd39a3b4309bc09a96f5a01ac601dadfddc4143dd6528a4b8ef5ee7862534940dc0b40d85f859967c75b1b0070b2cb4232e47fa126fda4f4f218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50ea8caff9250a3ba790e1fedf16c556a
SHA18e5d1d428db253948ae0b27304a8325808c21639
SHA2564e724e18d81ece2824ee8be2d76eb12a3e0223160d8a3081119af4852968fed4
SHA512d81e8609856ea09e26a75ec04ee28f5bf4e4ff333288d0b29afeb68505e3f07fe666eda00c99fa493400badaa51951a3209ca47ccd5ce91a84efeb5eea21e595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD59836ddd41d71db8106622afa9d3b6896
SHA1abba6f6f1508c66ee0d07d55b18d1dade0b458bb
SHA25651e3abe9d8fde76784872804135e14b228456b0bd772d28136da68a5d896932d
SHA512bcc010424dd5b09c086cbc08e0784339968f3cac2f9bd25085734edb13a3c278015234b5b57f21d8888ee836d062cdbce223a8b7b5dee93f76642360e2bf1433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a5e6b069dda895e0c7c55a745e78b43a
SHA138688e6fd4f576c4584df48ea3cb192eecdf3263
SHA256ee3a386ad56c5b28d290046cd277069546b7a85cf6fa1e5b370776ca072afdc8
SHA512e6e0224c0483aa6d81ca3fc30f4cfeb2f6745f9548433d59782958ba4afebd146b0a0b492ef16569b03ae47729cc355c69e83b50523ce94bf1a41afa9bea9bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD505850aa1c1c8a8549631c06c8905e288
SHA18ffe94558edfb77745aec4b566766d590aeb0178
SHA2569b0daa63645009400002e0698a9074b4550581aed26b1ebc75ae3177bee0ed55
SHA51242fb7bc0e0e448aec2a0864ca0d9bef61728ffc28bf64605f6baac6cc34601e041992cc9c06ee61f8eed024ba82009f93875f28c5040f41e75c2a70250a63275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD562a020625acccb701df556a7c8ced304
SHA19ac558ac08c55522f2cd26efd3284e8a203da76e
SHA25603663d415ce357abca659f34900d07f4fe91825876c9dbad1d853963239a7b58
SHA51289d3fc8cd2e20b094d273ffc031d17bddb2c235f0dd6ed16c715b6c116d4657743781d14350d2e21adc0a3cb534437fdd10f279c4cf76d034f8e0bac07717c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD57979bd72cc0d9a528789d5e3ed912f99
SHA1187752981897994add9d35a8eabe24a065093956
SHA2568e9b0c13f45aa40d832996a2b0b9561080c2583b704c098da979ac4c837ff57b
SHA5122681f2a4dffa5158be158e0c7382858aae19f4bc9babd1c7aa8f6684c88f2ab1580ac20de44be235e7128c8ecbae720dded27ad8307218be1a988c98d76b646b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD544411363b2f0676a81075311542b3cd1
SHA12025857fe2087c032efff74b23eef380b2b1fe9d
SHA25667f0c477cd533bc727f02166fb5301b46d42d4096f12ea06f929f5a443a965ae
SHA512bd424e1014879fe95504f69a24392fafa624c113b417920136f00f2c521ec70f97c2b034c8b68ed55fec6306565b0fa440e5636844c979fbc8207c12209816bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d370ec24080dbe54b2dadb66b6736973
SHA150b4617d72228eee3209e89ee89169c1fb3c5fcc
SHA2569680dff3ed84d00560419cd8b21b98d2eb6ae266a744035c7f9b5cd02d6f66ca
SHA51215319919385619cd80ad5fcf4b35d9b1eb4d5d4dc59951e252378e05b3fe7f04b6c49e3bca0be2cf49b9d1018c4dad8137d5c9c4fb3d9f67d806473a4f0d7b27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5375cc5ec1e0f4eb94fa5247ae4e8b498
SHA1d0fd59aff999e3f6787bc9e5b73a4c827a0bad69
SHA25684a4191ee77aa60c6578dd48d3e6f75d264ba22e11bb2a738bb419153d570385
SHA512d87a91d2fbfea6fcaef405eefb27e29fb64b8b00806a20ca38897dc6891eed7a36b9f3ba951d3af775a781ca82231b5756de0b81b814455727a0f916c827a36c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50c98dd060055f63f2492f45234359446
SHA1620af3a2c46985d3125147fd1fa23e9da8c593a6
SHA256bb9dbf174fe3dbcacfec4414af595e896c1c17b36cb4bcb49f3f9dc11dd76967
SHA512d193508342d4c53100c6aaec8c25bd8c5f2602c6c9eefb21248acb31483d0b9f46fe547a98cb93477ee15a7358eb510424c9d9d86b062d0bba781e802558b929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5f344a76f96c07a603ec62268fc41858d
SHA15537884b590dbe662a1950eb7f89df373b3d62cd
SHA2568af515011eb85579589798ddb056eabc6358da592b488a1a0617095eb7461896
SHA512e8820986cf74cc94ffb3ddb207dae58b8cf49279321085b80a65ded747ef3c5f04319eadb93df6b72720dadc302c9e4c2b6edcec357a199a66feda58acd74b91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD554fffa48476e2f8ddf0bada9c17bcbde
SHA1083d68e12ccc5c2c838ac432b853b83b7d1a968e
SHA256f19cd924e9f7410be69ee2d0a88ca15050985f792f3cfa31bf69ebb8001269cc
SHA512b79c5caf8bde779b890e271c3c7366d27eeded7d5d9344a1f23f1ec9d27c8579902e67181f5dcd2bcda81da463931c332e93c2109d6d1d0f6801d1878818ad67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5e8d372464da2e818c1173c5b82a03af3
SHA12be5508a89f505d58771b506bb53be198035d617
SHA256dc98f5a9ca3ec4545ccea0f53e54f8990f773d665625c4d8e5396b4b8ff50275
SHA5123e1b59e75d0062dec08ff38cde95eb5dbcafcd72591dd22a8a0a01a4f1149fe86edda3548795844f4e78717553fc2a0269f274f733c6cbdc6c282af2f78b36f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD54df441e592e3b0aacbecffdea55f2bd5
SHA1466669bc5306a5c38bbb11eb06d31b7ac36372cd
SHA256c1495e8b29dde30ce493bf38de9c9b037a37dab75af0f5626ddc911c85d5ab43
SHA512200bc636b4e44d4a7609c057f761d6df8b31f952eaf674d6b16c0e620c4d87288e8ba9f72ff27710d9c9e235bd771cf81f1da13c0c6beeff2c34f445f2fb480d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD550cd76b061f30243eb84bb514a6a422c
SHA179d91ae876369c8cd428f2388b9bb3c4bac8a99a
SHA2568ebc00c42758a701b8ebe08d113dae80d489a8dc43bbe5e301aa4c9c581c2173
SHA5126b559455b7dd3798720414595199727d9609dacfc8712bdcc84bcda595a32dd6561d91fe051257416931e74adcbedf57369aadcba1a11eac4ea1c1b7cd919512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD553ba7510253ccc02d9e5060e61b74597
SHA1d4014c3f4343760f7971f564080b592047abb8c9
SHA2560b6f1ca1d61c9443d3dc63ea15390b8e2ad1a2509d38bde6d507b9fd83b218de
SHA512b3c2683b83ed4bc2a481b78f9c43f0ef3354713c215e26c72655898d43db951b2dfaea4b788baafff3f37b2338fa7545fc53634e1066004847d8a681c2685d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b12ab8b5140f8e29f6afe877765fadca
SHA1d2cf1f608319cadbab4e1384271ce6541b51c6ca
SHA256812a54fac0d41a13e97bf79f0db687480f97fa6ca9f7ce42853b52d28ca3ad59
SHA512894cadfe00ac33eb9118b9f29c7671df8c112b00147658f7df8a46f93ed9205921adae64a81c8cd190542e2d37d11e2d8e8e37806d46b59a848552151e732687
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d43285deb80cdfcd9551cb2ddc01b8cf
SHA156b74d120cd24b53074b43ebcb728097c00ec24a
SHA2564f9eb63965a37278bdd84b211e649db8a840a18202c7127e7bc40df62d1448ca
SHA51260fc2b0ea0e0bee734680d0928cc946f21a49b8c44cc35a98ab66af70706e7f7b33693870be000a2afa09c9982ac845dfdcd2ea7e6b52365b25eafd02f708039
-
C:\Users\Admin\AppData\Local\Temp\Cab428.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar4BB.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b