Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
0ecc2ffa7cdf9e9258c27db87daee27c_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ecc2ffa7cdf9e9258c27db87daee27c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0ecc2ffa7cdf9e9258c27db87daee27c_JaffaCakes118.html
-
Size
53KB
-
MD5
0ecc2ffa7cdf9e9258c27db87daee27c
-
SHA1
ed5ae9429d16d2eccfb82e103f80424b84cf229e
-
SHA256
49177e122a52e753d8711842df9e83b3f0ce26e8c13d668df8b881a72ab1f128
-
SHA512
0968186860a36268b6631f241e241b318571eb98d191ea118af8ab13aafdb97fb40ddc812de876ec6e07903890bf8d4cbe54d061bbc06efb0c8246e9c467a77f
-
SSDEEP
1536:CkgUiIakTqGivi+PyUyrunlYQ63Nj+q5VyvR0w2AzTICbbyop/t9M/dNwIUTDmDL:CkgUiIakTqGivi+PyUyrunlYQ63Nj+qp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006ed6e4534d8fd417aa820ea913e373564216684fed4450e41d4b2bc75cd4826b000000000e80000000020000200000002c7a6e999cefb31b52ac4da360fb7fb62f3d48fe8e58d313d17c8b591cddaf689000000008b6b61db9bb4cd4c93e52b3d2aaef668611a706fe1f46dccef151065094e00be5d65a6a0fc5b693a45111b834050aaae05396057220607341a552820e090b39352ff8cf2d3c1c82b10f92de610a90e234fc7ecb4207cc7867e234bfcaa60e9bc2f87754d302225e745a34ed8cee75384841165f2c18a9a039a60678362f45d132d8e2b5ad0b2beb240232564977891540000000626100c569b6ad560ad0b8ff333f1840d8a661df8d5e7695f1275a269c99ef6854852be7bb56fe0321e3a4fcd68aacdcc57a90b185048771114c33080f0b8919 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f064fcf01ec7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AB5BA81-3312-11EF-9266-767D26DA5D32} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425495705" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003ad3471fbdd2261ea916252ac07376200f6215ea8aff9b282a3c552df267d797000000000e800000000200002000000036bb0a62756f01c2d005d5795d0b0c9f89b48d7b27b0e620c89c8198f93266b5200000003f67509c95bd54c675442e0ba6719d7cb5cff28857ec2961b0509d3b427088b54000000010319f0fa5ecdc37b43084b3f35645b103b2b203d38fb864032774717574f25dbb04f3f524b9a91858b3a79899c58f18bae180ed7842cfc076abb067b4fbe9d7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2840 iexplore.exe 2840 iexplore.exe 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2768 2840 iexplore.exe 28 PID 2840 wrote to memory of 2768 2840 iexplore.exe 28 PID 2840 wrote to memory of 2768 2840 iexplore.exe 28 PID 2840 wrote to memory of 2768 2840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ecc2ffa7cdf9e9258c27db87daee27c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a30ea385e8905dcb3d504bc44db3fb
SHA1c84e0f646677a8fbb01fc0d82ce4bd370ee7f3c6
SHA256db79e78636966a3208bcacabd8a7a511716fc02fcd7b143ebaf7b1cb2ad210d2
SHA5129316d270f16d9b839a4bc5bae68bce4a751ea9cce67af46c0695ceff389ca4c06cdbaa7021dc2643b45e6c61d68045d14376b0c272df654e943dba2508fd0889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ada57d9c55c69d311ec9f69f5c0ffeab
SHA1f83c43e5bf49b792bcaca40deba438ec99a6eda9
SHA256d5497621b6172e5aaa8767efceb0022968f8149698bbd3ee724586610bccfd4c
SHA512fb7844d135e1293b18fbcd0ee6a5bcb1c18350294ccb08c8f38b0a7b123c87eb5e8e5f8a880fa6f3ed021082201c02b6cea9b5cd7fcfb1490a805c2c72127e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fad6375c378884f150b18c28ea23cd6c
SHA113dfd6c084d9456025a060ee639bda224f26ce27
SHA256148f311c84c69fee4eaac2f092c341b5f199c4c7d942e9ced0157d3109096c10
SHA512fa7eda141ed0217fb1b8c8771d3c979f4dff1b487963c8b9fb5869bf5767aa6e7625bd341773875017446537d98d615257330c4b8a031afca8f012b71eac9f6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588ea4d497407b985547c0bf59dc60a61
SHA173ec8f2dc97d68b34a22745f5de979627ec3a8c2
SHA25698843c295051f8d37fcfa61e6e108ebb8e5a7b2fd8e10df1147a6273dc010fc7
SHA512e45c14920687e0a49b9f18e651eedeb19089740efe2b259ff5c09975528f3cea4a101400afa04bdc5d60c7a39f45efb7edfb38eeb4c35bbb55809ca19dc0c00c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587b45cb5b8fc336f26c78553833ad28b
SHA153f9228bc09168a89f5167271ebae9e91332841a
SHA2569ba7795d678557caa36d395daab1bc8a0f215c30d2663f6e879707814517c5fb
SHA512f6f6ce64fbaa7166aa7038fdcff376087a601622e7ea029da4aefa310fa7d70eb379bc8e7f8919b0fdc33652245d2b80dbc8a7b822ad62b6c32aedfeda2345c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7fe590f677153d8ad80138a9c0d35b2
SHA1a7226a02deccf65e7e3394b18668631b59db2175
SHA256e90c81ba450133354f7e5c4decc6cdec1ad513cb982a44f4e961242b851d37fa
SHA512136764c233978c8893d3d0995d8523f35c806d2ee3f397b44f616c05957763c47efa247d82a71c0bf54a6ebe354b2123b57031a4cc3a8cff88f237fbba4a6150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5586dfd738a55ac7b1722d92c1f5cb166
SHA128b28c03f794f13c847cfe440bb7a734e7e09cc0
SHA256ddfd343b81a8af0215b8901fffb31beef3e649c8c6aebf13aeeba8aa79578160
SHA51264852cdb574bd31bda0957d55561f55a6d5fadafd810a0d3a7cc92a3b7e376fd7d5038d708dae65e1c0c2e02195fbd56f5b8797ddcf5da5c1c35c0f82ba5d82a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53db347b9a00e5cc64f465e5d7347510f
SHA1db5d6a10e2b1195e8eeadde4648309accf41b996
SHA2565d7c9a487afb9674dc2801a7a451b9a6009a843a0a0833e4d6add33ed45e7cc3
SHA5122b35c0984d518bb9a85eb0e357689e3760f1469e13e4e1e91e6c529669610ba942354d65134203e024be65cc7237a8da4c9c6eb9d879d0996137b5b689e5f6a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3563587a2c27f50d3c01ef5df05d9a6
SHA1b76097bc030213841cba3da594d567871d6f9cdf
SHA25697c78e6c3b2a7ef9ead203ac1737d7fe971d591e80b26a88db24c1bb9927f9ed
SHA5124a968d387e864208a8972db8062379daddcbb65c66cd453e2aacb05039128047d437a87435a1c257f7f15183625e3ac742d628f5393bc7c52aef4996e23073f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bce53174b6f5607be70b87b305cbaf9d
SHA1cb628190a158e1e3f5af2d0f6467dcc15cba2a45
SHA2560bc77839a34d4322ffba601005e4e865c43ef63d915e08a5d880b43069638c17
SHA51270288dcb8f71263cbcaad81e6cae0f1f19925c1db70f64048ac986c1139cb9bf372aa9bd14ff39189f59b20dd0ec3114fb37b800bd4046c7f884e9a695ca7afb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a4932da4464584d58912bc66fa22e4a
SHA1ecff0a7b910e58b5dc0f6e0321d51eeb9516af5e
SHA256e8211fbdbb630c3b58eb5fae001a908852088a44a9bf4d67222f059b16204d4c
SHA51200967ecb263681839eb9e6a3100838fc0c7ded28abc2bc29eb3dfed937fe46bddc069969e41fd7e5a15e5b2ec52e391365feff9ab715ced54aa398d1319ccabb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5918385ea29dc56626fb9f4dd04e49ed3
SHA1b4c990379936beabbb398924b5d8451407e69eab
SHA256796028513803365afe0de15d985263240d8b6d7354c900e677b1745b340d19e9
SHA5122c5e115339b2fc50b46bab887891f950cae60ad71dd647860cd5ede18f7d80f73689841b2067e1984a0cdfaef459f90a7b4a68f237b74694115f78bc6e4e8d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567e9c1aea8ea1b0634b1781d6f7fb8b3
SHA1eafbb3b0cda388181da355ab4c3a2417d26c6b14
SHA256e3569f361c0bfd91a50a8fb8eab9ede7552af38983beb2c30506b9cc5aaaacad
SHA51255f103601cc4bf7ca045f4ce9aecc91c603532e1a76cfe26807f8a4d94841db3a6207daa60d7d700e8c271dbc6d329018ef06858d80ce1b10ad45e3396d51a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b5668310d03c6790dcbd93f8967b4b3
SHA1bba67d413399dc4371ba2f0d23cbf6c738a0f7ee
SHA256acc7b924c09dcba53b14208a92890a1c1a4e77e364933b558132ad8f73736463
SHA512020d7616143d9c2590c223654ad76ee340bc243bc35e34a92dc19f6024295ce3aac2675cc11141b402b18b1ac3ec1f9cddfb97630ca7984737063a24830104a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5453149a117e4180e065e10fc3d9d2adb
SHA1cdff4c3bc20d8afae66441188c173840f9b75bd8
SHA256ad821af9220ae6050caff48bac076043829b82c2458d50aff25bf39e11b7fdc3
SHA51249d8ec909b9aa63777d5a2bc68792fb5ef678f8e3b26b3f7792c915d6eb19113de1d629a03614cb4379451fbcfeb84c31ff940afd79191f76b337379cd89f4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bf9953778dd633bbff9f7d37d4bd520
SHA13d122e84b435789556bf925c546c401a76dff781
SHA256c9972b406e121b6ae3f891fae431be602dce991c713b88b4698e7f29ce47bca5
SHA512b45b311d3a3af845091c2e244eb92bb7ffb3e8b5322ba165767c0605e694a86a1108b6883dfd2c5a2cc81e17ecc43574bf3c5fd147d8ac5f3a8788ac2b0a808f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a70803fd4e7246bdf311ad1be455452b
SHA19b5cbcd801bfe2b07894dc5628ebb65bd086582a
SHA256eea1a94a4e0dd8bbc8f49109901cc1689fcb3feb6f1f4d1173dbf0a6f91c23e5
SHA51241d09450e0a255dfa5768f48c61894a9a1a21aedca13e08fcf04343e9f2fdd07f755245812587aef1d93e5cc1ae3f38fa48ccba1ae8a8b1b6849e9dd0cdf5406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\upshrink[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b