Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
6484a28ab139f88af955afcdff469a07_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6484a28ab139f88af955afcdff469a07_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6484a28ab139f88af955afcdff469a07_JaffaCakes118.html
-
Size
11KB
-
MD5
6484a28ab139f88af955afcdff469a07
-
SHA1
9ea44d863c5e128258ac623d46601d89f38f639e
-
SHA256
2d8f8eb9b9515cc1bda4f82aae7d56a141577800b86f7c4bc3956b0f4adc9435
-
SHA512
1bcaf88c242c2e234cf7dff13187b34015acac728ae86f4be802a3fa7a33d38e4436e14402fbee4f8e6835b11f5b52f4335f29f85efa1409a7c303f7710fdd63
-
SSDEEP
192:2VolIsr03st8k/w1wvqLkZ1BLmnK/xKWN01Psw8uBuLbdU8d:solIcusP/gu1BLmnK/xKWN0Psw8guLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000264e4785e721295669e324bdd1dc8289b58351dc62918a4cdc8d22db9d52b154000000000e80000000020000200000001b4f544920ceeb713c64f06c1b75f42938ab82d98ff56a5e3ca03c78d5608bcb9000000070fa483f5b70afc13a9e6c233d6ca5bee889e1402e7e4b81e0d6a80b42019b62c72ad679ebe8b67d3d183788d04bb4638b8ac8e135630bb3a2e8743be73b38c2ea8e65374ad4c62f07782282da28ebaf92551b66a5b94934b2f2ec1db4c5de9a4f92253d707ddc828d919a69fb734566aa28611b947c082e31e3854ecabd4cf0b334a80bbf472563fe617098199216404000000008732d5e5e94df37178b22d92797380fc2344c94025a410cc7d4c202a667b216a8a1a5de0de946edd971c17f144c6a09ee0b9833ccaac35721b42d716d607db8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608ba4db71dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F57798C1-4864-11EF-99AF-7ED57E6FAC85} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000016cbe968e539cae80393b19322b9b57ac1ff37c755f23e4da68f392f5bb0bc79000000000e80000000020000200000002aa52195af1b7b6b9376cab4d2359fd4fa4107c88ca28e879577a413ea72fd8820000000be46c5fb3ac8ee5be4ba57124b2e2dc4b052b310b25fe93c0ac3338974b1cbb8400000001b016fc38daa9e472904521f4cd03d05ffa0625d0f6d083f5e92184dd99c6008419b29e0efb993b72dc85782f7a8d222ce237bfe10089dde0d8538acfc614470 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427840260" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 1616 2168 iexplore.exe 30 PID 2168 wrote to memory of 1616 2168 iexplore.exe 30 PID 2168 wrote to memory of 1616 2168 iexplore.exe 30 PID 2168 wrote to memory of 1616 2168 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6484a28ab139f88af955afcdff469a07_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5475b378a445d238f386dc6df9865c6ee
SHA1287508908d24472411dcc9831a8b1e91bf72a35c
SHA2568890f17a0808bde6d5aba0522a59985c0aec83877225939f27025d76aeca174b
SHA5123f7895b9bef09e18474fac907931fd80c494eb7b285bf816ce6222f461b5089af5276b9d773ce4fbfcb55019d038bb5dfafa48deefb12930b8e8c29b5382b870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b980b6e3d3a9bf880ee6d02a1df6f7e4
SHA19b0b609f52febc21f5ae97661159cd134b58cd0e
SHA256756c3733e7cdf62a84d6d869f54907cb7fb23ad9c5a979baf631b457ec7b45a6
SHA5126074fb2c56a3d908f4faa43bd677923d7bdad04159ed7422ccd36214c5b502def83279742652bf801784fc2cd2c842696b412c95abe1def7ef019a7be58609c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee491132b763f373e0f03c8ad1c9aebf
SHA10a25e75ddc10d7121716544f29016e3c63437a55
SHA256c380bb7bbf28f0d29b8dc9ed6a6e3603e5b9c9fd3f214e45c1b0dc96eccc69e6
SHA5125bad91f539dc3c4386fafa93dcf9b27a97b60340a743eb98367d69fab18bf960173e43f33b6c1a23ebe0284657955d76553c6dff491a822590d5ef70c1e1e961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5175ec4c9d551c6421e63f0a18984e8ae
SHA170037d8ae05d2b86eb40d46467d6ca9bf01da040
SHA2561c51d117635c18404c437e612dc6e66f50bd028175ebdb6383b8e49679351f4b
SHA5125c5190ab0c1081aad0b4297843b3f125955163f975823ca2b0861506f5ddf72f91a81a4e115ed720f4dce75b50404669e0a8a244c71eacf9c6abdc50593beda5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557694ae77cfa423452cffe3a70cbab23
SHA1dfce3aeb22a9113d2be4b7f1b31606e67c282643
SHA2564555c1e8d23181888691ad1385931df4910c38e09e713da6122cfd988372cd0d
SHA5124a67d713834a024d617168d857b1a2fb2f2e6f4161949e56637454fb96130d8b15e07fab6c89b4b7b032bb9b1102481efd577e387b37d8fcc775abfc9d6d7ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57906c60834ace372202999bc3aed5d58
SHA1abc998095d0c6b4aa318ad86bd65fa6da29dac85
SHA256dc6fae78da9de3dce69726f08b8a8bb02f71350fcd1e944af0efa8e87fb9e67d
SHA5124bfd6804016af703cdc5d67d88a3128c87b4cd1b1d8b74578320831ba25d8fcff92e34831b74e4443416c50f0f9c643bb64495b1eff3050adff7cb57794cc4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514612200e40e1f53af5b856a9b6aedb9
SHA1048657b38691d0cc1f31831a575c1b9e7c538c35
SHA256266dda61cc7c300d8a03cd057b9798319a10d148adde755242ec28f1b879b96e
SHA5123c0639b181814994806eb6035863ae715a0219d54c7238d86fe34f88165dda2682e5d44e79037713d045ef448331c213e08bcff180bafe5330d531795e897cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561da303cbd4682c15c36125a16b13077
SHA1136ce44b7bb97923998a92a588f21be9d8f566ea
SHA256d284dc0afc4752dd8a077ad81bb7d1aacdfeacd49ea758dcfbb94805b7a8e766
SHA51280867842cc21c0b0a9862453e99b2210da3614bd37650bcb20eda9bfcd7564f34cb5ac81f2bf6b7a6dcd4f98abdc403f70516738697cf6e951c5074cabe6b401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5916841ce4027b4aea67f005a7915935f
SHA15ee92d2ab77bac6336b95abc1ba151927b51e8d1
SHA256f0f0be7c6b4e9c10ac517c63cea1a7f07a3570735594464c5ebd86c301980228
SHA512929680d1415d53d94d1e449a9be27d5c6615b01444755e902118c29b435f2308f3b55160e1359d025ab931ae9da135c51c226587cb564151ac102d4f525ea682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55213dcfc8aa07abab23620ca8cae7bfe
SHA189880ae3660cd8803974b3b90f1495c72ca7be18
SHA256ade792d2d4e4f6098ff6915b0e96f9e390c646847951715098e765923fe68bc4
SHA51284ac85e6de05cc3934957354ea52069e649980937670de4d2431e8dff1d2339d80d718ebfed0d631c34a76505ff71670759881f93377bdbdbf631c36922ed22a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5177fc1f51e32348b4e790ac250bbaddc
SHA1b754d97dafd8a35ba930b7b3adf2a90141006a35
SHA256e091b6c3f55e55af671443bdc3a73fc1e28be86178179fe50c8e660171726624
SHA512f33ef1c4984cfdf5522f722cf411a8c21b882b10c79cac6be43a163f3fcb2ae04c932a52bdf5b9e2868a2ac15b5996ce6671284de143a9503c06088006330cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7584fdd8ad7466456803a592914defb
SHA1f8ea0e672d4bed2bbf569a49460934f2d831283f
SHA256f13d9a22198a1de812767dba339ff0ae07ff93102f754aef7886b6ee83211e94
SHA512e650fbd697ac264e7f129463a43f2eaaf6b97e5db2791facf1cd8100f874cf643b2446ef78caad1b1a8858b55fff71e8ab728c09e4bdf9a3f8a8911eaaf14cb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5126ad3386833526291c06c1fdce630a9
SHA1b110a9c76e57270dd6815e815c212d439bf8bcc9
SHA256ed2244b2e3a008513426fdd25d8bb381fc8005da8043cf8ceaa7b7058725ac68
SHA512a74b45c018b0c0d1288c1dbd7456f07eb756c3be09ba326b547827f295e06e2f1c4416b5e004d6f0a61c4f07b8a6e7e7a0c05c8ee7ea3914dfbf48192df23d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533d994f299114e9d67052020185e8e11
SHA1caf33412dde87aea8e25a412c7e98db379b51389
SHA256d072c57bd3dd4e863862930f4747f1b97d319b137f2bd6a4f81cef6fde7f2c4a
SHA512bef70d1357b25427a0fd20a3a7251e5b2265b603c5a5b802ea69e7a6e4f93b086c3096ce07402a617c0004140c03e8eb1092a01453cb1b5713a02632eea17c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3e2fa151c6472738efed19fb373c918
SHA1fb965842f279454902b7a1f3662b91a538310f64
SHA2564009e38dc2e28ffa755f438ed33788ad517ca28e33f623765013750b973ebbfc
SHA512018a348df0c84ba4d34a55898f764d3f45538afe14ad23872873ef099cf0c2b43a2ebf58a3ad9edd30847a8cc09c155a811c6c6ecabe4a69319599c9bc6a3a0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57564edb151d8342a828bcacdc45750e6
SHA121f5742fef33f32b2bee388abc5fa140b4121464
SHA25667090df6ee84dac83aa1d850136b1cb539e09875d128bda22ea94d69975feb26
SHA5122392a45464e812af596516389a8ff53b9621bf948591cd54e00524a2c1e17d591a29d73fc50b3668c407914451e0935e590de8efd13db928ed7cb99213858df5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e3e9e32000c626f2bf295c621134990
SHA1ac58f2d0282377f42c78390e30f90673bb5d4816
SHA256fe2be0090035e55947a5d88aa451a9319c8ce44d9281ee5e79152e2f9d90d700
SHA512022cf8fd9137fa1df8f94f73c86ec0a0c3abe9722d5e572f469e26c4367bce5f43a8c39d94309fd35dc6e2fd8f2b7852f6feccf34ca0caf3fd7eb6cb8f7e61de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554aaffd0cdf7b8415c0c11cb871f0ebe
SHA1185b4bfd2688aea8f4e1a9ae0ea0eefdb6deec56
SHA256f0c85cdb7ae0b5a3bef8c58e70fe51350b3f84d48b941539ad7e387313cf49bf
SHA5125bfeb9163555c964b3863aafbfca726d33223f7064cd0ca3a375909208899a782fd097829b3c93765a2811a3971318abd73b73618b01a21d6f242ca29f1f0653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f91581c941458ae352b5351bd41130ff
SHA16dfc2124b01b51e7e5b369153863ce57072140a0
SHA25617608934e5c5528962c2af1c113cf1e3b1ed8b75540116bbf63d8a16dbdcecdd
SHA512fb4d706ce6d4edbb2df9314fea169d389485d4b719715278211ab773510e16765a4b28f8d2807e3eee9f2ea74224ddf3b482e0d4dc7a81d10b2509fe296c10a7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b