Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
6576d2196c6f94149737287e3c1c503d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6576d2196c6f94149737287e3c1c503d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6576d2196c6f94149737287e3c1c503d_JaffaCakes118.html
-
Size
6KB
-
MD5
6576d2196c6f94149737287e3c1c503d
-
SHA1
1b44e8173fb1cebf10f82cfd532944a8385478e9
-
SHA256
17dbcc48b13c8340d7a591a3ba76a04dfbfe39993df05125f3ea7970003c871c
-
SHA512
70022112c7110c774b46635771a00d49d4c36d238839b73d68263f9c4ae1ea36897d103772130a6367e5b2b667bf965a3bfc130e26549b60c56460727b304d92
-
SSDEEP
96:uzVs+ux7LHLLY1k9o84d12ef7CSTUarHcEZ7ru7f:csz7LHAYS/Lb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{590DBBF1-4895-11EF-B507-C2007F0630F3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000028082731b36504d46349c287073a427a1d2eb97bd76ea4e3f67718325d2015fa000000000e8000000002000020000000cb381cb7ad81ab0dc24ba8b1cc0e015426178641542c92a8c98ef083fcd4c821200000002f2953e5c5bfd23b7fd88309e6a95c5ebbf7a0a1fee604b1ed75131f24a6c62e400000006511fc883eea909dbfb2b6a6f546e2a9ae349c87cf9a67b59181146a3c58622cc4b7af6f60b33982db2125e9c2ff72fc4e7e7718450543b6186c9b58bf722b52 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b066b32fa2dcda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000001f01d1521b8487db06729e171fa1098c335804482ea12ee8b61d88dce8354fcd000000000e80000000020000200000002c790514ad29755c49ccc6bb4c77c3fd64ece2004212da391a2864490243a60d90000000b87732434856b7f5ed0524da1be6336e54530a2316f44de6076b251b42ee2e88fd54c44a82753876a8ecda5f56da1cc50015aaaebb198d66c4000bdaadb25a5a5e21bf6b098a4b937a101d5cc919bdbb208803091d4470b0ba55b3eb41603fc13b021333286ac2f94fabc0021e2900a71371f2d6414bf6c07e68007bc2002279f7e98b2c218b65d5a0af33b9becf1dd940000000c19116613fe4bec04cfc931c40a7c54b7d4c83d67cf629c6a1e695910cedadba206410ec37f758465ae341e42a1c02403d9d4d863afabfd2088977bd1eb76207 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427861043" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 iexplore.exe 2040 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2304 2040 iexplore.exe 30 PID 2040 wrote to memory of 2304 2040 iexplore.exe 30 PID 2040 wrote to memory of 2304 2040 iexplore.exe 30 PID 2040 wrote to memory of 2304 2040 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6576d2196c6f94149737287e3c1c503d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb94b83717ab6cccff2c683534bce25a
SHA180c0e3d9ba2f79623cc32e2ab5980da03e8666b3
SHA256ff44d038d4ed9ff1131fa91272c7fe642ef8c3bc71e84bf6d1012c86830b7962
SHA5123e4366467bb259ce18cd36524d484d91904a2eca72053ff3e6ca2eaffaf7f73fad1c9caccbece16e3b9398632d58cf00885a8959a1e9f85f4737067ac5c7ed44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d8bb1e96929af03100b1307fa768d47
SHA16e3d3ea76cb27775a7eb32c814f6bae0cc468d55
SHA256439cf4d147a0262e78decfa05703729bd6505a17c537e2191cbeed2d58dea60d
SHA5123225bb34ac9c381c57c053ee12dcda6ed5d14fe6368829dcc0e54a18625094b3b69797a72d112b168fcb9b113bca8417f7a29ddb77816925ee0fcce079f80e8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bd51203bce973a8ad7141e48ae4dab4
SHA19e09f70eb0256bfa722cc3858a894b26acfe7a40
SHA25697ab5d58fba98b5fdbfcd2fc6cac3509e2a5a901f1893114b324591799776d2b
SHA5128f26f62a36f042cc0594c58a21a4bc76d8ff40ef25eaa4a6f9272067507c8f9385411b56ddce4258f92566b5e9c70a4a40e10753a66421124af7767417578903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5881821c00e9742a8d64420737ce7cd13
SHA1a5b4af2bd4a0f0d31bb42ddfa509bb0497aa071e
SHA256d9d2210b3715d308803b3a3ea994c24b6d68e6d8e6510080dab76b17252715ee
SHA5128dee9b73921cbbaa2f89631d3044bd42b45ece2a10a566971e693e15d90b22db24def3bd4ca79129d09b46583f76e80c68d43f169a23078f105ece919e219ae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acc9d35b5873d3ce2a14eea60d2ce5d3
SHA104bfb42b5872c63c147f9dc449b0f0ccb21df081
SHA256780c6dcbc09c42fd2c0694b11af25ad6595e7d5f9aae97e516468ce807f30506
SHA512ec7851cd0018082bcb73b8ed99a345d46c6c2ce446c0c82bdf91802450e18d330cdc955a3425346bdb0189dfc8fe1fbd6da2ea65971a66a8b7c4abcc5240d7f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54450c7617d14360777432863112b69ec
SHA1c84b29121a42610e6b63c7f4b177049e60779a42
SHA25619547e28ee959256fab5f21ce4c2b5cecfc11bd83552ba72e5f0e979b6ff4630
SHA5120cc274baaeedfcab5b3cea04a39ffa23f740444fa2b9372b261f02af143dce10c9081c823f82faa603c371854d3ed99fb5be748d4e7672b648071fd6d783ab76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57847e1b588dbbed3360675c8578aa12f
SHA1a1006e750a6b97d38bdc89b3db70ea4ac894dcb5
SHA2562aa2dbc287cfc43da375ebc001c5c225a4119d16d70fea7b91a048809b926cce
SHA51255d6f43139f70eecfe75827795bc7404716db17f6943fad52e0424d7391f9745f3359b5fe4da07b832555632e908cf684c6598dd4c4690f9c3ec8093ea63b4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5135df6989410146226958a75972430de
SHA1e5a8d1d441ae59e1b958027b1e219dddc69183b9
SHA256b247af7976039fa64988d8f21f2c46cb091478a58eb99bb0faff5c84838c36f0
SHA512f7e462c4bd8b6918e571ffd4f0c597c52f66b14bb3f0b8b976c6e0d637029f7c35e4de7154bb919489fe98f824c3531164f589d24f0c04c2f5dbd2670e585bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5affdcaa3f2d5a9642587b5f68f42bf6c
SHA1eb8a31c3eb897170c5a51265b08744772fd7d425
SHA25649fa2dcfdc1aa85d221ba36619c5df7504290cff8c654a675ecc1dfebb1a5861
SHA5120934a5367af3fb501372f498e2a9c08de08846895f5677e32e69705226c339abd6580d3a7f7b078abee1c537631f3dced948a45ada620b2493c9fdfca27c21f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5679f9c80710b1888536043917d9a4dc9
SHA10229f24881916899abd16c69456400c0c0b61a5a
SHA2565e4133e5af279d1719d380f6cd9412f941d1f28e474bb11ce046746c91cfbfc6
SHA512fea2817f874f47474c4eba17bc0c26ecd1929633a4720791d963ab7b422cbca8e811ad49b665440eb500090fa6bb370acd2b467787ba101831b38f6a83707a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57942267c9b2afcea399f7b8093cab395
SHA1caf71caa37a222cc0623c2b35d6d6cee6cdc2763
SHA2561e8bbfd834ffee9545e6f4509db0373c63cbcb809d63f364e68684d8b5de5408
SHA5122145ce7f981f62cbaabfc2cd732b009fe7b5990285d6bc4faed92018fae9ff55ea05e99cd1e441e1eb709aeb2028ff4161f7a45f2102d107dc8b5daae4952842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5846c69de7fdd2798694ba4e758244f7c
SHA159ac20378ec160bd25ac6d6b349955775de2815d
SHA2563b0a9bcf6143753a6f70d76075b392e898bc1e204ada98aa4408e6586a7be595
SHA51295be267e63166199b8d13aea9e890a623290a3cf2d4a2ab7a08f220f692cf2c60cc67b58232513ea5a5653a68e824182cfff852683ad6ce1784192ee0748f47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5746dd2f170419eeedcc9e23f2ab24046
SHA17cf13fcb65246e5a6c400505f2e88b348d46698f
SHA256c99ac56d1e55cf0cadd6473dc1a96df050b3070b9a82b420947b64939f93b5a1
SHA51250e3d23b8046a6ef1e0803053bbabeecdd8e2e34e4c1c93b6d0c1d837993631692444c425d3b4988b55e0937e469c18ed23d4d0c254fb22530d16ba75a9819db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f1ec1204f877c427e4fbbe3429c9418
SHA1c23489034fe487ba8027aa9359f66ed54c277967
SHA256b6ae8116e1e77783e98866aef48d54f83343d5b46a3f3a7d1871b224845d3912
SHA512c4cf908cc9bf2927df956bd49ce10a915eee6356e985e8dc1863929d569e6c9a0feb144177762d5a76435a6d30e5192f12660af723a957090ad5d265f9cfcdfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e79b7064fec287079769d56ac72e726b
SHA180f2acd446a4a621a05d2dc6eda1b0ba3b490d80
SHA256d5036d9a7d85ef58d8ae4a3fe2bd0dba973d7cb1c8278de66ca326ce88b89ba5
SHA5129a7759a18825f3c5336dcb528f26b95bf4c8d8db85e16bb07bd7bab2f27eef72eee49a139a3ab51ac6995e87440f426d5c32ff08158c9e09b758781860b2045f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582548d8ecbe0e4f2cc0edf50225cfd15
SHA13dddec0fd63aa438559a1575c192ccdf63ed5976
SHA256509742cc7abb3cf27eb3cecb7e9781f13360ca839955f30baf5bb61d408bf8fc
SHA51214ba56bbf4c9bba59e864ea52c01c73ad014c967236259946d857cb92fd68d013eea054b90a2ba9200a83ba6312b53dbfa90e5ab298dd75201186b7bccceb1bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b5ec7b162c1d923c078e4744d2b6e5c
SHA1a87bc8f7cbfd7654b27a6007e8b4ed9922d9dfc1
SHA2561dd6cc1544374d6118101f9d98d4c460d42a5d5139bbec868dc29899a4bb26b0
SHA512a4a3c9be60f50e572eafbccc02b5071ccc976e70f660039863aa09f580b4c52af3a09b197e318ba3e7dde68d97409e5a850741c1e1b4f675148a62860dbec615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcd98861069e30eeba0fcbaf6a5593c3
SHA17eef99bfb9930258c54b573c5b9574b2d4e7b161
SHA25646d89595fa27f8434a844fd4876b9fe2953cd58580e82538dc9a56acc12990a5
SHA512ce5706e0ac598c3e5ed505bb406bc6b7e7f613a56ece11914d22f32e5aebbb143b0ab80ce0132f56ee8ad34e2e91865082219da31a6242f8c50eee62ff72d39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51067e2ca2bbe46a40b57f2bd1ecab3a6
SHA17287b1cf621af0166f2aa461b430c5b329733fc9
SHA25605b5717f4cfb5f23073888c4fca26c73571b895115cdb4fdd4b84bc6183633ba
SHA512040db4056d7116ed47f48a98dcadf514e891ef4680e8cd03f78cacc890dc681e235191da158772901ccbbef9c58a83f57d1c4bc882df57e008e52a602a62ee86
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b