Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 20:42
Static task
static1
Behavioral task
behavioral1
Sample
1c6ec3a35ee36a08f6c2432be1727a27_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c6ec3a35ee36a08f6c2432be1727a27_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
1c6ec3a35ee36a08f6c2432be1727a27_JaffaCakes118.html
-
Size
6KB
-
MD5
1c6ec3a35ee36a08f6c2432be1727a27
-
SHA1
9c34ac8867bd32851ae8cf152dea3e03eae5f018
-
SHA256
1be3c3c5d92b4baa74451d2d669db554c1722540ce72328ea79b433c71e7f19e
-
SHA512
69c0ac6b24829616766d8e1d3bba7ac1804d0571db03bfe105aee0d65a555d482ca0dc3c86540a459cec12cf1d34e7bbded9b62cd2a8eb15f1566b377c020329
-
SSDEEP
96:uzVs+ux70xfLLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz705AYS/Wb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1185C151-37ED-11EF-BD87-DEB4B2C1951C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c8a426736438bf1a69812fbe5d07231475de2e87bb9a42f33b6e5c01c641ccbc000000000e800000000200002000000086d06d72455b8f548b4fa52ca60cdf55e4f7ac6fb16a8cab0433485019b8221a90000000ef2537abceb2411c6205b56bbfb67252f180edfa30e74b8620e9505d7df355d8b0a76de0dd4695dee05fce511ed6b445e9c4ce3fc75af71f53f65ebc6f62cd325e22e96a6904d020e4d0a49ff3543e4ba03ac257dea64e947cc4e543b97aa07f454f03287ffcd5fb814041d9befde64bb1e022176d0d884b5310912299c86c7747404850a6a6ab7d7a0e8501c3fb143d40000000f96d597d221ca3a88cfda101f7aed7696ea52eda44502a4019713fd8d86bf48250ae21b386cdcda940cdd34fa8e33f19c0f741a44cf987385a8374e894e2e524 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005b5189dd2c14e878c8f0a676130a5bf7f5e26e8fc3c3b0784fb4b1af2ddd62fe000000000e8000000002000020000000799d6570ea524a082d2c260526e5ab713c60d3b8c416b3c5393c3a90febc4e69200000003dc9f217b6dc725cd47d40aaa3e7ab9d0cf86b42add511c18676d94a1bcf0ada400000007df24432912745415ec3309858e9d16af3c5052bf8df2a3c6841f052b259612bfdf8d87eba4196d9ed7320d4aed91b096855d7caccae2b40934caa8dc4f684bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301de3e6f9cbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426029550" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1936 2180 iexplore.exe 28 PID 2180 wrote to memory of 1936 2180 iexplore.exe 28 PID 2180 wrote to memory of 1936 2180 iexplore.exe 28 PID 2180 wrote to memory of 1936 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c6ec3a35ee36a08f6c2432be1727a27_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c0456c8cd0e02fa5025013627672226
SHA1061d59ed00a5a4abc7b83b66d9347723c0aef0d6
SHA256cbd6048ed4fa073348b710a6902ec128c0a1564169540309dbeeeb61f8b40d3f
SHA51236ee40d51ff7e280bf8773554837eb3f7e1cce499ee3d53192961389e48668649d90b42c69f17bae470afbfd6a80eaf5579270a2fb0e8526dbf92367b075daba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512c5dbb15379bf74a80b81ada0de537d
SHA1a92f5c9ef50c7a302bccb2f59cd9ee0e6dd6396c
SHA2560decf3b8e0d761803d7300756fb7824b83cc0efe6e795f56f38cedfe085cd88d
SHA512b79e379f17057527b81c1e0f22d5705cc20a9cf6f66298b2db5e34f571c5889dccdff644ee872377f4d25430ff9d2c91c8e0d708716bd013ac607643431100f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7d668ed0d37df5cee4c5764deef8307
SHA1f3c31bddbb94c29e1e32842d31d0e72ecc668b37
SHA2562f02240a11a5c48b8954ed2f79f843f9269dc5039d08783114eaa446cb6d4fd3
SHA512cbdeb82cb0f0afb06f0fa3533059468a8d2964b1964b11536a59d75f16dee4f9c8c3108a72470c1c808ef930bed59f5c5bd0b65fa8ff2bb8f5de9940e9d67856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535097404bd06b70d4cceb291c1f85c77
SHA101ee969a2c810c087b400830b90e93c4c17effbb
SHA25664fbda1566ba107f17ffbf9f5c2bfe4985a355ce89899ec66e062852bbb7f339
SHA5126942f257fbb2ac73a0685e2fca95057e892156cc08af90109f8e1edf1308747a8bc69d0378b0f0d160ba6e83b5ea2ffac1796de12ca74deeac6f678326a0a958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d6f1e02961b03a22397aa61bc29d00f
SHA1fc2e7ff2123c82996357b665fc3fbb9e1d2d0b09
SHA256390777b434d50c5549bcd1bf3461173b4be010e2b409d1f4fced9a352f3fa46a
SHA5126f1ad1e3b19f10f644b89578f6ed8536f2c06ca72efbfc5d86eef56241c77a287c02a27831d74c4bfab85ec696f446cb48cc7763fb693d0681e66af1db6268bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592672d3ac931ee2e6e0308c4c3c9b07f
SHA1b0167d68f06c552ffc39ce71d1c4d5bc8ecf04ff
SHA2567421d7953159296ecc0d68aec90901a38a7f40820244ac7c65bc5fa328c802d1
SHA512e8c902e9970fec7ffc291411e0d82d6be9e8f17804337038245b7aaddc48bc9eb72dd130866aac2b7336923272900a1e8fe2a1cdc7c6fc9db0f3c40722093c78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d2d542becad17ee9ad69d0073da7917
SHA1e226fbaf6463f83e27736bfe1559c22ae37f8499
SHA2569b4a03c478650d12a8740db9fcc8976d264867ed70e840cb3387b376b64d75f5
SHA51236e56a601f45dcc4fba2743e5a473581f8730282aeb103f0151017d53f6ff8f245849a79c1618a287268a25d84fb34c0bdaeb4a529fb56e2d33d2fc35a154d89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5353351c10ed35e0ba1f5c3daa4bd140c
SHA1cbaca187779ce4c81b46bb3a40f535157b564dd6
SHA2561ba68c45681798ede2998a3e5827eb42fdddaaeb04f5922f086e0b4f48a09f59
SHA512265cba3720e29d61dfadc4868f25dc7ecdc099e5f50f16c95342a674fe6b6acdebc3b86acb50151f22e83e0084101afeefb55fba42fded64f694c254fbd9f02e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d84fc97ab780d8762213297d2553b8c
SHA124a683c331b94e9a2f3029938d023ee1a5cb33f3
SHA256490f3ae1b47a4cbb5c5f22b69b62a263ecf5b96cc194c97ace93f55da5a8b4cc
SHA51209d994d5c01df07f275ef99bf73bd9f89b1c0c8a32b770f678d59069e015e992956062914eb03b9ae92644df632b0fa7ed494f068902a52b2f7b1128202964b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4684c6a0dd635ab3836d8ece29e46fa
SHA1ae94f2398c90d6a14b1a3db91953abff7b97401b
SHA2563f46b947520c3c57157de535ab9ec74dfd4c7fe49d3ada520c00c1080bcf450e
SHA512d707d31d4ea8411f44c043916531d300c6199fd8c428f987ac4c718eee3511f32330c3f1a224dc52aa35d23cc0ae19370964c74d5e2d9bd222e7931978f0b997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515dfa4d04eff7205e5ff52315b0838cd
SHA1c5df55b32de1b208cad9d20b52351618d8ecabc8
SHA256a9e26ab16018ea31c08710ec2b277bac6ef3b99cf8ba3525d0e100441dd66b18
SHA51280824e7c8ca501b42d079f739311f987323cee0a0c6287b5b59d774dc096affd2ab4ee31311b8810f6e3797a1dc549be49f8e63973938d9db51e911e71587ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56946cdd017a191fd6ffbb40b22f9bb72
SHA1c8589975d72e9fb64ce500cee62f393b608db19d
SHA256117b9c4b2f87bed3b28e0511f072d9ce07825cf94e376f7f418845cd35754505
SHA51264359ea4b646467444f7c5dc9da642e973a8d3ea08897a212aaaeeb41b2efef3024ad3c8514a0ed9e4c65b1f8b518629fefdef6e5d36703186d4be7ce16b9e9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554172e61201165cb71056a7069593719
SHA1e6acb1b4fb6d4c87901fa763e957bee1d28fb1ea
SHA256ee439f453bc16e4d73a107dba3e68645a1c5e3e50b129cc3b26c4c828dd9b392
SHA5120812b90d964a199316aff94eb3333d5c2840ee2406a1028691a3cbe8863fb9c49bfe9d04b9d8e44201d686a4a24fe0bd8de46732c1779e39bced7ccaf697bd26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e1803744f0a520a18e921c70f2cfce
SHA190f11129a894c3adf11704905f02d92f5e2d90f3
SHA256a2b36ea593b3164ea85de8c2f709ac621acb3658e3a52ef2012ede1a2ef9563c
SHA512d58a10dc1b6b1f6fdf8d35309527b04b6ad901b9da7ac6005d8f5fec25a2e0e3683011341cbcdfdb1cb1d4e2c4b3ac66bdd999b788be740ea8bcfdc1e1d2e1f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596b9a0f76c22d57b7f951e8a533fa4a5
SHA1d72dd25fbe2b63ec1896c3b1b40e94065511b6ec
SHA256820bc504c9e61670377143f24b6b7acf124ba22d3048845c3d5cfe2c01c0a91d
SHA51299b54ca70416272d25f47c6b02621e68322c3335fa9314aa3fa31d14b9a2516cc00801c543e6a20997654c6fe9f1ece256425f8c22d63a0b954b1693a7a53e49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58aade6e7a8febc3b4ff5e66761776eb2
SHA1f4c3c8254d4e027ad7e0b63e989d2712fb513bd0
SHA2565fb909c07dbdb7f380522f3ce186456b676c5c6b9394bf35678cd8c34c1b5661
SHA5124ebf6bc9e711cf7ca017083061506e6789b34fcdc531f7d664bcc939dfd5fcc4785c6da39e8fa689af686de212f2a1e0a7bac65020fe8a815cfa165501731d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501f8ce2d29c4cf02ef2533d88d5dc1e8
SHA1e6a26a1c265fa1ebdfe338ae4eb970826b41ae85
SHA256b8e5e3370d0cbec77e26ab168ca100b321de30c88940d67241ead5877247acbf
SHA512f4b44f528c662f254df4dcb086f570d4fff7ce42f776cccd22c396706dd90794a4ea8c165bf47569ee06b2ab28326567dfad496f28b412bcad9836fc99ddfbba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53faf61a4c24f5fea0ca372e0e02f8e34
SHA102c1b15e62f93f9610658f8c344c9b63dca60c94
SHA256846a705b8872319986b48104219d9344e1ae9ca20ddf0ff5f2c47b90c0fdd9ed
SHA5129251c16b8086b351cef5de5cb38b8075d2f272ac97c5bb62e7611edeef69859f6fed6bf65d16fe15d19456063a2d73083d1c78efd39eef1ed2c35bb98f2af1ee
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b