Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
068b91faa24b0f6bc7148c769f192ebf_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
068b91faa24b0f6bc7148c769f192ebf_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
068b91faa24b0f6bc7148c769f192ebf_JaffaCakes118.html
-
Size
13KB
-
MD5
068b91faa24b0f6bc7148c769f192ebf
-
SHA1
4e99ac50edb18a74af77d70d79431c2ff8a63205
-
SHA256
e8b419edac320b24f384f8ef936aecb381833f27b0af5c3cb0a9cf81039ae853
-
SHA512
ba2f861b605887c8e2a5ae141f4ed88cf0c1dfb08d31eef1667ee401e3483335e7f3a08db7e2199538b993e21ee3e0f6108a85944f8be46d8e76fa6806e2691f
-
SSDEEP
384:cCHAY8Ii4Oo+zOoO4Q5naOo+zOoOmsKPxZOo+zOoOms2HS:cCHGcwy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f26f5d18c3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425053073" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000008699226059418c3abab3ef2ba5fb0329557782be33bac52d7a826d14233b2784000000000e8000000002000020000000881da6fc22fd639030bfd4475220f17609d51e3ed205a21aaa22b2c3e8afd50920000000f330fd11af243c9122c80d0f942e8fe330e797ad491c4fd2c0ba504a2a678e6540000000ebc531fd64ccad7a35d2c8d22bef7e611176b8827443fb86a924a01bfc6cc0de90ce3872817eee6ac6a0b6713018d34681466ac3c05255f0da4c3bf1b6d52895 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000053d833dfdd54d48622b4248664c351f91587a8519fa512322d50ba1163a743d6000000000e8000000002000020000000bb6cf1149abb24e46d05e60db8c6f59eb8dd2ddbbc3060a9b112751e09caab7890000000ba93879efcc39387f4de5d390a7273bff875c8c67f95dff7f78b90da3d648d78db0441bc74be5977eb16e9ca3978626b369735d1fd4e9bc33c71f7288ac55331e8ff3183afbda20ae18f15c403ae98704ee305bad17f6c48be1f5cb0e757062c8bc1f92c1990975a5171d0f63a4807d74ad972d0860dd8ac3a042bd051c9205c41faa6f063c261c419f0ac902b21db7040000000280cb4cb10ae536b3bbc266e6d2f2a5dbc112971c5deddc7d5d813395e0f01689b5b8900a3d4f7b4b89f0c2a1e1798380911ed4bfc3ac0e276972c8aa7f757ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88821961-2F0B-11EF-A5CD-D671A15513D2} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1800 2032 iexplore.exe 28 PID 2032 wrote to memory of 1800 2032 iexplore.exe 28 PID 2032 wrote to memory of 1800 2032 iexplore.exe 28 PID 2032 wrote to memory of 1800 2032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\068b91faa24b0f6bc7148c769f192ebf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fdfafdcceeb55273aa1f42dd1c3b008
SHA1cf4c3a68db2aae2e640889562955cee289ef312d
SHA2564a39797af087716106a09f5953f1d06ff084080a259a185f4483ebe1bc524040
SHA51228d0c3bf1c7e492f8af67e9fd07dc873f6a810bdc575b3568dd2431833cb58d4eee08f00cc4ce1795d7b5add5d33fda1f53853d2d944ab0f5385d4df40be27cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52040c7be49572d34155c6d8fdc0e48a1
SHA1b72716a07acbf8d03b5a2c384ee832750b13a009
SHA256e546838b6ea2af49601cfe51c01a5d438cce2c9a7a97212bd85f5bb3b252e70e
SHA512af49cd224af75086466f733de1bf59eda7bc167756b395aeaab415b5d33cfc865f625044037c32bec5e3e3c71fbf798e7af89ee69b2c06129d5a6f04d8120be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c93a7df12b9825da70f0a9013db290f9
SHA12558056ff534ad859cb1acd3109a00b5c38d9ccd
SHA256422b78ac711de2860e8bfa6673edaefef9ce340b0f8692ed2d57eed1527e337b
SHA512a397499b47abc0d3551806cbd56060ec2cbc9d3cd8b9f8a5fc89ae1874533369b83c44799c911b462718cbf82fbe07a100f39376cb1797383c8ab2fdf658bf18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5136509ddc16014e18493506f600c5648
SHA1f48eb8b472b8f00e7a6d1e6ede76e3e3a88d10d8
SHA25636b11e5fcdf20059abb596b9824b1144d8c5a4560b720253e9ca6483b4445684
SHA512f50d6709105e001c58c19e69333f84c6dcdd9e848f3d979ca95a3efc07eb58f0dcf3f520a1f0d8596fa5599856b5e51fc44b8e342266ebb7321121d7da11535f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e51ac98ebc460849e120ed496a871158
SHA1ffbc3355699f5a550402bd0a433a309fff2beaa8
SHA256449f3f88023de8543e2ba13cf67184746eed77d6402ea61a956f720c43f550b5
SHA512cc5e290ff078c9cfa240600a1d4767e434859038131fdd6f60f1881c4a585753e2e8484b17c3933e8dedfa4767772a69747029b7fa16fae09946670a2cc7356c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57486cbdf635b7ca3ea9742a4fe4eb92e
SHA189aeba462ca75b18301849e94243e1f5ae4e45ab
SHA256cc6302bccd3b2ef1d0d61f491a8994fb86bb216c1fc389492d771d41875b7117
SHA5123a60445939e45eb15546f001004884c3f09e2c2468b7d1c4e692775f182b01073e07a11b1638adc45d4acc6938ea8f02b7de2ccf13f6d08a716f74974c6936bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8831a74c2816c20c0a3371273abd1c2
SHA13bdd8264a107c9e172f6f0c3c8a9b56ee6dfb1f2
SHA256bc5ebe9034386375747bbe47005011bdf638c897fd871b27423fc9747ea590a7
SHA512618b9089ce3838b68d0eb1524e80b585490c2668f6b99e8792f844dd0fa5e3083abdf6ff014f790c0719b11a5cf5fbb1af8df1ad8d13cf40b2a1967f06e00468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f985bfbbe9c40d83c2a606be809578b
SHA1dbaa7e98e3a5be5eeb93bf317487bf50c3f6e9fa
SHA25675937069bd15a7c4e92fc9b93bcfdf71e993ab718f5565cfbd2d2856d0d8acfe
SHA5126b675f761ad66281c87dc2618548459ea44509548252520e20b5b2a5ad12574d60155c43379f56b85376cb1790ab3b5e8c3dbd9bb52d1dcf8155c87856845e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a216ef27a6aae48d306c7f83057c3d7d
SHA1509aa9d287cda3dc22e38ba01f34eaa629fd52b8
SHA2568eec1348e6d2463df4a97795434048ee1a113a3cf9af6b5d2e1caa2bc91dab6a
SHA512fe06c84e73080e664633b8ee12ae8369ca9df9b0c0c2ffd5f33b2165733b5f4ed78ecac8aaf41404ce0b4aad19e03840153279406b01e3e99514ea9eb1bd8dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599dc10eee69f43448ed7a700544fc27e
SHA1040d4a885245f4c2c5ff10a57f4d76a2c4bc2ce8
SHA25676257d6d79a3df2f1255014bd35087ee45d4d68a5501d38426d435b43913ca2f
SHA51264439583436a12eb8c5281a0197758053fbb484afda5347cee8889f2ddcd8c9498f40c00f494f5b58f71e2c1e2d76a858afc5ab80d61803eb05b0b1976b8a00f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b20190167abe789e5293c39d59c8e526
SHA16d38b296cb442f9004848de0919a8a5cbb6c9797
SHA256d4174adbe0dab3daee8fefcffcc844aa8aa68d2c0fa972a366ebe0c5eb4953f1
SHA5122ff5d4d664db18c31428bb1a5fa58d516b9a55fd52ad85a260b0d0bc581a66be82099cfb45529438060d7f79df114ce89f7cd61e2129b76689083e697b6eaa0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568a83692c231c8a583544b154b474889
SHA114b75fb58f40524961291d3b5fb1c1cee1e8a689
SHA256985f9246b237e1f3ffb64ed8dcf521ddc1a421aa69ec2d5d41d608b31c17ad28
SHA5128b701ef360ce589a389da2c56789fb01a0f8cfa909299eef099b4a1ec263a8772697a267e67ae1d35aa07da5e12123de169bc7a9a11ffb3d0d7fd2a42f532b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5263f9142f32abd1d427edf400b9f33b0
SHA1a6bdc4370ed4705fa6857aac202cfcbf6c25b7af
SHA256ef299223834ffd7f11a8a75cb283ff425f80c37e238bb47fe53e49cd1c07e930
SHA51260083520baa8c69e4688ffc25c1c45147ab316a4e25ff93267a34812e755adfe9a48ce2c58abfc0e100c29e14dbf3d6cc7cbae22d77bb5add327c01b16963082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8f8a9387d185e1192b236fa3b75d464
SHA1518e7a12957ddc618b3b50f07e03587c378e02ae
SHA256a15bbaa94680b0500198e29c0c624786f798c27321d9c39863d20cd0c702bf2b
SHA5125f195df680417893bf0c29828fd53f629ebb3803177096ed2219055ed7b5002b4a1bc4ef7cd8f8799882d2136a8f72312e06ccd8e799ddf1d211050774329083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9e80528b1d83ecb61e0315efe41dad5
SHA15915af5bf68814a5228ceec3469da357cc8e0711
SHA2565a11ee258a013a781d1074293fdcb22cabb4cd46499a946fc718ac0aefe0dc95
SHA512879f1f2acf475552d643609a28906c6b5c8f38890ed31bfa191659afdd10c204297ec261c213dcc61422d8d9c7177bb32d872c9cd894e1579a1b70141917d8aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507a9e32915131bc3b736fd91c8c8a2c5
SHA1814bb97f7ad006c027b75370ef81c9263598ec4d
SHA25653b412492d1087898a176d8840dd8fa6a5e6c2880e9e608ea245b77744766816
SHA5122c6de198001aaa6855ca973b560099c8996dba0e2cc8a26c1d99cbbfa8ac147c74f860ed38cd0ffd858cd65293c2f1a3d1077f449f443e1c8b2593fb409aa431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5010d8a5233f9b5307e390efcb88fcb93
SHA198327adbe43fcc1e344fdaa8bdd7d19c31ad7ce3
SHA25645845f3b1b3e2eb004661305f95afe9bd3060fc8aa4edca1c891228a1770baf5
SHA512716071aef0430082710f2bc31344115c9b52f3c039a8b12c37c23adee1e06c8dee9b1c735740690d74196e27f7575288d6c329a9fe72b8860b97cb5436e0b49f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448a6931c990d08b9e64b684e0769c5f
SHA1dcd74af82fbc335dfc2f2cc86b76ec336c0b16a5
SHA2568d741df2af682a7c615997f8757b2e6700fbe1f594559b4b106bde8fe6448c32
SHA512b0dac2a56acacf539627c1e9b59a9d39ba0b26eb1713ba3a5e1787c3f0fc0d63f02a902cb4a79ff6339e056374c08de24a7cd61f23ad5ed4817adebbe5047344
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b