Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 12:53
Static task
static1
Behavioral task
behavioral1
Sample
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
-
Size
215KB
-
MD5
6340ee2bd800f24b0494d7760df62730
-
SHA1
db6ea78d9c138bb81d1b79fc6d69b8f7fc46b5f4
-
SHA256
cc569ac81fa88dddf86f9b248eda60516659986027ea43781a6970d7422e546f
-
SHA512
6d97dd098f72ccfb5a11fbfa9cd3c45bab17bd5a138225c405f8a4f078aaddbbadf659fc496ec5fd7a4c6ba8d76e86aff9658d17ed135851715e3152082eb392
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcO4b2HAtP0L0EKSdBSAcZ/mOUyp:sfMsLzBSA6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66891E81-4829-11EF-929A-5A77BF4D32F0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e5501138fe14c227ddd01eb0921e0d7ac77cac22476a0e7234994f736c49843b000000000e800000000200002000000021be55a40a46fae1541eabbacc4a8dd7f47edba3c3c6286465d985d037cce39c90000000f61f4d8617b790bfe4ec21e32774edd1d7ccd3700efcbcaa252af2b53e5d52e8830e35b1f869a95f1cbe305237ebdcfae220398aa8fd25bab07c87e6e742d7f62dd4245ad723f5f7659b71c742eff726464770fe5b737ab70f3467e74c8eca906c4fb0749180ef246ae39f75e16799398a4dffb1e6d4a99f172d5365ae386deccd7429d25eaac46dbc83f567db85c6c040000000317191a0d1d8a68614b1b2bb3d1ad0b27d279cd83817127b6f201f09c14d2ef4da0b6f054885d6f4d068d95e9c21132123d01be91a338d5834fd1e76e6e0a351 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e077465436dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427814681" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f0c687e67352188581ad760609dc7c7c16c3278d81149b99e42a23ccb23957ad000000000e80000000020000200000005e9caebee150fde7019a0670ac7a07383328ddfd2fb9ccfcfabdbc04288b4a5820000000ea173821d300451a79a88d10af473106113bbdea3a8915b8d54b5b55885afe3b4000000026a5adda82365f5528cf06d3980b8f47e4089d51a476fbafffbc1e1fd440b13f85cfbda250b83bc6282f7dbb3070c15dbef21efdf7ec380a77b1fd0c6c619554 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30 PID 2844 wrote to memory of 2888 2844 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53dcbc317daecb79c58ea1e1709ef101a
SHA12e6fecb98c7a61e4f94405056301fca4ae7987f7
SHA2569c12dc2b64e2ddc1900ef106a3a1b00b3d3fd713f742b5acb904e7769def9a62
SHA512e072fa385f44e298bc58cb0375880dfc934611228bc3716dbca16f455b0ca892dcbb5f8195037dce4c1b59e1420842791b0fb5238e77c1687a63c59ad9819de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d5c049c4896ebd89d2e33e160b8d9a87
SHA1d38b165c8c44c78ceb6619e7984af290c6b3e48e
SHA25619e385b3d1571df854241e75010eb69e88bc74d49820b53d55e83042c9a15842
SHA512932ee4306317038d29faddeed579c425a1972ff93a281fea871ab776c020f52dc2def9a6f3e0933b624da19eeb711153c8743e60f39e897bd3897a1f44582335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b8d00edda9f9e1ff6c64c1643177a42f
SHA12547deb87fda8571d66253a70af7afb407ac1344
SHA256677ed761314afc76cfb7fa2d98ff97f15484c40be9810129d3ba39e774a76b31
SHA51208c7e3da26f185ddfa44e13ca98228e76c623272c4891733eb048df09dfb405b47ac23801ddf68c58f0df4111201f3c71b8870412581d2f0db33d416e2512183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b9a83ac4b064144fc3a445b7afbe6166
SHA19fcc40cb745dbe1a20546d7c6811740632e72ede
SHA2569addaf99a137bcad95599acf01f3c03b88357b5ffffacf64951185c12e64b54f
SHA512ecac08d1167ee8670e4872d66c3b441461b4e104fd7af085c0cf9676a2ba862ce40b96689a2d21d0c666c4a4c2900c735f3bfe7225a1723a75c3c6209ccdfd2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fcf912ce86f665d09af7698b27de4a14
SHA1cb31d00f336a293525bf37eac60e4464da26fbd4
SHA256ac52373016090c97881f2de95885db3eb79e5a1009ac12aa2f121aff07d9b0b9
SHA51298e262bde14366fc0f85bd92d67e2cacf93ff052ac8c7175d5d4b737d686836f27d7b736aee6345673e0d84275b65770ce819af77fd11797d1a0b28747feab8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50c17fabab7f8e12a54a725757abcf9c1
SHA13871aeb0e2f59d5d82d244b6e781185e8f128e42
SHA2569b50bd7f83a4ac0c3b3838cfb74fdc9e73c32e4708028ea9630cd001e8a1496e
SHA51275bf5314a6166298c286ee1105305cca824aebca51db6813ad8ee3c9c17ed176ea9b3d65658a9cd8a1581a9ad313307703e6f8654be0ced00b9baa12bd3376ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5153f16ef088a18089ead1df8db9d1dde
SHA18cb8d249d6ad48ff9843e601df7c891ded7e3952
SHA256e057801b308c6e5ddbb95d0bd39fbc10d3bb35efe976fa7d2c98b6809a3c0d00
SHA512926581b50335df08c20549919ff169812000f943602a8eec190ade3f38e1cdf996c618f722d044a01f2a79602a85d0b9e40946a9ef6e0c23ab296b7ea5faada7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5faa83c7d6e6ba7c6bb6790a6c2a18abd
SHA1ae108d754637cca2897696e5615420ac1a30ba36
SHA25673a4d0f6a92c20a176fb4322c3b8fa83ff55d8abf5d47dbfb01d0dd1d863869d
SHA51260efb1c9a8e92e353b3593b18d28534dbbb7582407ff4984572bc910ebfba559a5c6d05fa91194512473fa8f6c4b6f01a2db584a234fdcfab7e14b4b9133e8a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD564c37e86638d7164846cd41ee3473863
SHA130037f05aa804ea55d087854294c060d2f20d2f7
SHA256b96cb1ab4039dff1d8e050cd84ec5a12344d8bc377a19e3718d662995157978e
SHA512c5caa6f1c6f6c4a8c75338abf3ea598f18b54262696795ee3d902ceb9194b6bb8ac34b7017887cffdcdd374efdb5d904c3977691e6d4e8fe20c4f1b7e04d8eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d534a1c0c3563ba47bb8755e5107b034
SHA19fea9a2c1d320a0ee608e735259f705eac4a9ad8
SHA25605b181058649fb1ee2ee4da07936bb8626da0f4a32448f8e3056f37062b9c967
SHA5121735c45c760c8769787cd06cdce5e3ff8b1331e26232fadf187d384983831b36dc04fb7d196f993743bf73bae25b1feaedc5458f550afca922082c8e633812ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50c8b4408bfc3e7e90632fb48c4cd4f6e
SHA1218d467aa8a6f097a8ba66c62f1d478b5b5959c9
SHA25613cf87e311e7af0050ca42d2bbb3f6138af1d886120ace09b005ae971f875983
SHA51216f4890820a8714ccc821490e7a2d0d9e44a254d1fdb7e0cfc8c50c030bd286b63eaa8f2133d8db22afdd0bcf51a83fb3886fa7f5ea9074050204e28b81ef124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c46ae1da70660358835357a5973899b4
SHA179c472696ddb6bfa65b38e75a0993f0cecc0ecf8
SHA25610be3c57d72802c4fa36410d84ad8d68663da9f384c6c8a33130098a9c5690f0
SHA512b2283306b56ee02eedf4608ef79f431d6723cbfb76142473291cc9f04f8122fe00fa2c6e8860fc528dc550f1d413f965e6f2455bc57d30717f8994b1da3d266b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5287c61b134305e68394b2855166f2ba3
SHA18f7e83ae9783ad6877e7cfcb693bdfc8d15b410f
SHA2569080bbb1febabd7efb6b9499c84730ea57ce2bbe46379cf97284a5e90a0295e0
SHA512f123f8a14c6f3537d3931e97346c611724c3b8a9b3e378f82c0f95072e94ca5e8e5282402840ce4b9703bff9efa6281a2b441cb4369eb4993fcde5b94a907b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5be86f3c9df983fb0a3b6586d3d201ac9
SHA11ab6a6eae49ea0c44f7fb6d627683dea96991564
SHA256a1a4bb56d57bfadccaa4dfe9f9fa3906c92b56e9ba82bc00d5a9f9db4ed519ec
SHA5128ff1832f83f472557813acef41b303f9e140dd7d922111a95f536cb32430b849590a7079812a1a79d965474d0b8b94084854b5150f9d0c861e3def91ca2542ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD500a309643514e4abbce9a2a159016a45
SHA195f34968761293777532d605eebbd30e919642b4
SHA2564be743bfdc64d317af5e9bfe9339259f08700b82b28469eb1dd6d5a93929900d
SHA5120b7dd110264d9ae8daac90993c6be5a26390676e81d5e488e7793257b11a3523fcfb576d0ec0040edc144ae6159bb9af6c76029be551953eb5c723ab2932815f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52f63ec48ea2597e51f0991c3cb96b507
SHA169d623106b12c89ed4bc9aae11eacd5236b870e8
SHA2569601f3a0209125a8c7817a1eac8cfb625af64a15c961cbec4ffc777d388fac27
SHA512163833e7caf3ba7fa60c850405944e5d494a6b20ee686271ad3b6e22c14b80e01d199a8699f1cdb25595c48695b70f4d30a7cd9c1ce5942296e69ee8af68f448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f80051a03a8673b406379509e9fa1ac7
SHA1b02f68644c4fc7fadab49e03de5804aa16bd73ef
SHA256a7d1c2e1d063cb4819ad5ed7ea07ba07685a21ff393c429c68c148b648bf99bb
SHA512d67fde34e88fe8bf1a21c9d7f7142c648de2a2e3b872266becfe41feae2d00067a73474b69dc59c08a52f607f731749868de4a80802f29176c5071912b73f072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c8ebc026b432780b1c1ab82704e92719
SHA117a159c47e9cd90de9c2954ce4b80bc53f9c41a3
SHA2568d1b257e027614e86ef4553afab989ee2dad75dfd2137e3acac5384547b0eb30
SHA51244b11a4d257abd02e9811cbeeb5d02e1f88aea20f273c6108d4e958cc15a6e7e1a1bcd2f3264dfc474049f66030c90180d6f12bc76aded99cf9dcda4c8810584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d583438d4aa789ca96a681bd00c934c1
SHA1794f60d59d6ae5ec449e1b460b1c85c91e656fdd
SHA256018ab466a4aac0974069d0f03460131dc8ab02ae7b4008cb1f25021a54417add
SHA512060d0ba632d91bda06ac233084e8a111d732fcd098ffbfb84a94ebd85d1954156f3471126ee873e809048ba6b7fa0a141b32874d08792531900561695d1a54da
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b