Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
6173dd1d1c7f112b32752a897f1f90b0_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6173dd1d1c7f112b32752a897f1f90b0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6173dd1d1c7f112b32752a897f1f90b0_JaffaCakes118.html
-
Size
44KB
-
MD5
6173dd1d1c7f112b32752a897f1f90b0
-
SHA1
74d3852745ca25e7a1c0abf9a37b88f087dfe663
-
SHA256
1678bc38b1d96cb43a881a3467df90c1a145dfdb70e8c39ccabe7fc98c649a54
-
SHA512
556222f6da582e24d71dc7492b29b5eac8d65ff9a79aa545d8ef2b147f683041f56c2d0d4ecf94a48d97cc57031018ebdb518729366b6419790749daf9696573
-
SSDEEP
768:Zcd9QZBC7mOdMY9pC5I9nC4tsnyjl6QPd:gQZBCCOdp0IxCCsnxQPd
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000e107780f11e796801290c633285a24e2ec94a259dc430f94e2b12573d77afd81000000000e80000000020000200000003e72b0bef591ceb625424964f160c42d7d0fa0e4e92852a4be266b964cdc38c6200000009b5d177daf36934f4134928f62a83804f6ba4bc45921983a9bb5f8041c9ce46e4000000092fdc351ff1e41769475b904b1bee84d45f9f564613c489402a357f34d89f54e4776d6d9c13faacc3e3803bb8da5cd8daeda05d3623d561904fa8f79d1c7f0b6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FD12231-47A7-11EF-A0A2-EA452A02DA21} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427758861" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70656e45b4dbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000008999e437f1a7170f49cbb3f9e6d00902796ca111a6c20d3d72342a34e52ce58000000000e80000000020000200000004a0d0079f4a75b5bd8fea61d4e49e0b07f2a5764342fe270be51941626e819409000000089baa5bcdac6d60e11e1e097c1161ae36912e371088ab827cf8bc406e2357f6772516c378e0886342f518d9a7ce3e0899fee6657e254102e86d53a9b087059c31961f8191e1404f844564598207f911caf650f07b5931542ea26a1d824128d08c036975a41ac0a4dab9522089d7f4f3527e656fc1fd3270628a16bd82088e42d4bee13b71b32df45faab579bdacb9380400000001f621d2ca3ea5c597ddb008d4172a6369e7810965aab6c39910690cb1ec9f1eabc96913a5d5cc1133b79cd37ba178b8078e091355f05466a73a912e99233ac01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1432 iexplore.exe 1432 iexplore.exe 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1432 wrote to memory of 1444 1432 iexplore.exe 30 PID 1432 wrote to memory of 1444 1432 iexplore.exe 30 PID 1432 wrote to memory of 1444 1432 iexplore.exe 30 PID 1432 wrote to memory of 1444 1432 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6173dd1d1c7f112b32752a897f1f90b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ade846af78f26905a989be3d8b9e84bc
SHA1e20066cc26f682ef283e400f8bc9079d55364195
SHA256de0fb3465f0ac10aa853633debb50d45cc22eef62df548b1d427a2cce54ac338
SHA51238d501394b6187e4e94b2e8cbf8e1e7f82f02ae6ba646210540abc1e8af752a0fb67737b16058f79b99f302315552280f72709a0d1f31315fce32305e21396ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5807e0551c5eff521e1a49d494e4adead
SHA1d68ca809dc9f9cba265fbf83346230911a181ad2
SHA256a6d5581e116c4b99038ab39e13053bf117ef8aece2d7facca2ae5ee92d8a60e1
SHA512fb03d096ace440202ae6486d67081b8512a1697a0baf9137e95cdac6666785012a05f5a83cc4ed023c4458567eb6e1963feab3edc2d3bdd2210842dd24b7f6da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5a56748640f8409bbe3f3d5f5c864ad
SHA1c747b420927adf87c52f0833d39f073d2c4b1afb
SHA256b23c2c6bb4d8e3addd42407cb502d76604c42052fdf43b37ca43534d38a03d2b
SHA5120fddcc0b82af86dfabf365c8f6f3085d495cac6d5d43d59873a8f703e55655de6d1aac5011d6a8539aa35500fd45c6fe74def90e6e0ac87edbe64794f3708f6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d15259457dafee86994fbcd07593b75d
SHA1df46e77d7c1758554e0a2e2453f176d2b55c86ca
SHA256cadcad0e6b921a222349e7dfaf9043a4f2727851077f88d30e80f15401238136
SHA512ec3a881361d8d7e77f3c11241c1cb48b81c8da4128b293ded775c76d67a5dd5c6f11f61d8cb5aed50c1166961dfcd97b45072a4011a8344e56b66653e2da4904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5165e24f75c3887770a90f098355a4584
SHA17b10721c8219f8fd8bc032982daf425c2312af79
SHA256be11ddadda1f3cb9b5fb4825f3e33ede93d7460bbbd9ae99d73aebf362713fdc
SHA512f0039fb95cb3dddb113187b3087b368d375d45c539646b7bc26a2482dbdc0ab3e1619a445cc01598426d1afb479808c4d18806db105a7624a828cf06a28cb5e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521d90d0c9d5651c53099df15d20b31f0
SHA1d85779358b572da98be279393e9b0e1b48ac6409
SHA2560b696c0c1d1b9ff007006a1109b7fea2a6ff50c2e83ba61d33c9833e34b91888
SHA512a87dba9e09b44bdaa6929fcb0f757726c25ba2b9e632e78eec8cc9345280aa4d5ecd0ec2095f0ea9e86059c83413938d01a4b4bed848fde060a0fdc1c487b536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5313ff6eb102251037c4aa739031a4d11
SHA1d47e5baba96f7ed33e216a04600a77ae5a343797
SHA256750b14a3ff5de9d3ee40893ed47d32e14986e75fb55b555794ce2661dbe4de48
SHA5124f46970439319b412e3e442cbebc61734284ec3147ee9930167103193a58a4393cd29e0e4b3e5c5047dec954aee75410f5575ccb7b2ffdeec678c1cf372746df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5099780b4bfe6a46adc43d048d38ffd56
SHA18549946968ebf109de6e0ebefae95114f3a1995f
SHA2563c2e120ab31c773add566a75544bf1a54f6565f318d939787db0fae0a02474b6
SHA512fbb89334f9dc9cc0557f5a236f44e0232cbea90295b21f1c3a72d428bc4381dad7b2bed6f51f6f022ea642b9e0aa87a30c1d2c15336d55a01269ce3e35ca4be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c077bc37770977cb780afb13b9f56b6f
SHA1d7dab47fa615f057b145f66a7e3a17fc55a95129
SHA256948c73eed49aa23d4a465fe7f6837ecefe7f004c317d8a9128acd871b5488d51
SHA512f8a92e15b485c967f64b65261fda8a04f06c61c2de5b6d9b7837dd3777df7d7238d2ff2f071281443af26a17e6144a8a3b1f8acd5273234babf95e4aaec8ac6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e243f35f31561c203a9c44a1bd9ae50
SHA14ff73d3008adcdcd3f6cad33c0de0d9afebfe22d
SHA2561cdcaad555281a1c04d8557afd557784e19004ba560784f19feff503a035114d
SHA5124a9abdba56ac7bd1613b2e45621871d1e6a20aaac68d33cddc596e100137e4e9670bba0ac80405a0c7c6f07d801508df8cd5579effad979963238f3c0a5efd4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e85db0fb3f6a1ef6b574cbe4516e620
SHA1b3bd42ec441d7ab6293666dd598f1145d8fae5b7
SHA2567d70d69b4aad760902956d8c58dc352107236e729f1dd455e707164452cad0eb
SHA5129b3e337d2eea789b29055b91dbed3595a03c21eca94d9f32ea2f15d88fe63868a87f45dee087163b4f782603608637c2dd876df26c5dbf5d56061fb638b80244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56126adf38ee5447f9b3bf21de7a72d4d
SHA1bbd0692cdfdf0d2e2b2ecde1babdfebd16d36707
SHA256ac6d1087284f1f40ce4fcae4f47950aa36f6e34cd189b7df066f0ba659b98798
SHA5126c88db0a6966877c3940b935add36713611d8d1fe5f14ded7fd0f67cc0d36c435b9fc13521cbbbc7b793b26282fbd7ab071387b5adbb55e19155dc0282697d7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58271d59a82518b980b5be7146cc611d4
SHA1dcd913aab1446d20a19cd3fa3540cf6fea1c8963
SHA2563c867cc716bbda1df12a07e2cea0b722b4508f68caffce96e0f4ded997744762
SHA51297d8f0ac756b464101d38866e431767dbc6bc5a59619329666bce5dc4cf0940f57e97b92ba1c63bd97e58f6635898f3a3630562d364b83110b2839ea5f74315c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b58ce7c54e4290013fa55966a6d46e2e
SHA1b3dfb6c9bfda9c8960c7c0aaf90ebac07ad4edb3
SHA256eeb4c2feadacfe05bea11d68f5ddea56b53b37247bf6ad760471c358bcbbcdb1
SHA512dd01253875fc27ee4d7a217298aca008e639df6a7c5e84b0474f1941c258527aa6a768f73030c8617ad0af167daf6c213d819c617f16d933979d825ff606ecd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550b8ddaa366fefc65e7ec275f533cc9f
SHA19ab797b24780928c73e660e31de39a0cde3318ac
SHA256dd312e3aa798c5045d922a3672dfe30fa5f8f77fadd17ec6934f085dbcba839a
SHA512b8c640fad940be90e79928611431e9e0a2ffba8499e7b44c9b433a9608ed1a21b0f2b2294b0ecdf1fe80191c92103435f0f91d555cfd47ac19d5255e966b7ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5175149271723f37fdc2f7b3747964491
SHA1659586e84f6f4f0f497cf292fda637886a8ac182
SHA25692e0e55ccd2b4cbca79d78ea3d083668d5c3569773cc4c50b42063690c110c6d
SHA5128e928609f1809c2ff0ea2419ecd69106d155e85e8d5588891cc6bbc09a5fb6d2852c7ded5f88410b5f86aa2d5290214692cda80781ed8b560055ba72874b6323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5020e2524ac08d0375128007b50152d4d
SHA1433173e0cd63b63912226b20e57ac2fd3cc7c42d
SHA256b6d1e8697cfa799fe059f6677d827a0e4d68bccbe49cad9dd7a83f26f945382a
SHA512c26841647c7657639cb63af33d6fa71e0f639c0e4dc18af182c976948e5ed12028a65d839522073d3a762fcc35d9cd69f5566b107efd0861f4351f8f8fdc44f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553376232b3b793e2805e7f8e4a5dc49a
SHA18c44fb31957ce818a5defacaddfa59c5cbdf4d39
SHA2568cbe42e1a542a5d3d58c6ef48f5438d8f36789ea4c91705db716d51116ed6328
SHA5129b1d894e019e303187c45f8652dbcaa29df5242f30372cf69413a03aa09919f41899480a9aceb57802db78f0fa7ea36dea85a795d6ed783b89977f9388b267e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4f9e88c188bdfd75ca5042406ae9a69
SHA1b4a1aa6ad2ee49e0263c898b1f22267941245a22
SHA2567c13720c25c5621b818b72dac57067b4b69fd0f4acf53988389f35de2ff5e50b
SHA5127b577180a8398c973c1e6ed32ad7f5d9717cb88334babe9777060d7b83e3a488e1f4032c781c1f87cea89a515a240087b078aa1d3a0af337eb82e7ac14919cd2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b