Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html
-
Size
50KB
-
MD5
f5c4a4896ca328441590e8663405cd80
-
SHA1
44588ba21c6ea19845d3f26b64d9f723a051e859
-
SHA256
4b65ae395d1288624dbeb7b7078396aa45d4e1bd955a86389fcb855738ffb438
-
SHA512
6c62bc604987f9dd4a8d950475b55d79d6683a1cc6fb889116590472b6cff61f3116628d8c3ec3786be44894e14cb403516d9cccec5345af7019d3996e4febd6
-
SSDEEP
768:q5ugNV1qXwEQkrdBR7L0d8Bx1dsivSCoOUHLEm0a99999999998T80smWdNoZj:0u6iXwR86++1UJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E11EA491-FCB5-11EE-8D9D-729E5AF85804} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fd30b6c290da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000061deaa95b974abf368c484144f7e1655884dce64aa4b44865bad9c2fb370e08e000000000e8000000002000020000000389e19d1a962dfef908ec31ff5b2618902eef1407c860ed814a88932e8f3960b90000000003ded9a98fa8d0184b07d52e0db660e4277c08eaf6c9b7115b309bb9094db919595a3421c599348119dac398e4a7d2f8f42ec5b909a8d79ff38d112800bbaf4b9b9203b9a222ed96388a3519969bd98a31a99b2d3050f9eb50efb8a0620057d0e56c1a4eb28ceb72f5f11faaa1ce086cd4f2aef35320dde2a5d079eaf951c3e3bcf580d022b6d2045fe7cbbfb5be3334000000046db6d1c0f37953101d13c6618347d9a66b82b89cb9968bf11a909392fb2ad03969fa212ac59885af35f22916c01e7db59f7552fb8bad80610e1fd411d97056b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000004f7d18e2cbca856a9418ee037cb1e976636ac484c9a088f1a6076ffbad29695000000000e80000000020000200000001f7b94fb936b77eb895f9d773ee0bf688e4b29684de4a4c9138f0cacb76bafa7200000004b3f54f0db5f39050458adb231774d51ffb00d8f9571998ae83cbbaf5ce7eb4340000000edac5b7afe5379021cbc87f41079c617ff6af9cc4ed51c7e81eb10c1fa80e76dc49e0a6fd045ddfa5fd09e6a4cb9dc04bfc9348e1f4180d3a6659d153b07a5ad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419518728" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2952 iexplore.exe 2952 iexplore.exe 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2096 2952 iexplore.exe 28 PID 2952 wrote to memory of 2096 2952 iexplore.exe 28 PID 2952 wrote to memory of 2096 2952 iexplore.exe 28 PID 2952 wrote to memory of 2096 2952 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5c4a4896ca328441590e8663405cd80_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ecae24d6edbf6cd158139b25c582d96
SHA1ae98edc895940a21d59062b4a9a965a0ab5e8768
SHA2568a57290ea888aa9b2b347ad825c338eb9fbb180bb064e23935eab7d0360ab292
SHA512712f3bce2c60b408b39ca6679d5997348f1ac45d4fdc19801a68052643a1a96f1339e8cc566f99c72df252452a75d47f45ce89e176f2f3ca0848c6b719331560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5713f085681f243220f8a2d4559469bca
SHA1df048a0e1e14e32e2b7a493d22edb8955038d792
SHA25692b203af1a8a7d5e374495ec1b8a93eaa2a91092cc62cc66262c1914e601d899
SHA512fc18a40565ae8549a93f0efb0f08a3c892e4665900f43a3f05c55fd27f8004b5adb9383e129f0b647288d5b3c0e46dfe24c9a6c91981e0e3028abc07f9a03a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9a15c87063f61ad1c07f2808b233aa3
SHA11769bac7f3a40552be3906c9d4b5a52e4f85dccf
SHA256bf5e6f989c35d0d3000e31b4995af72cb3873c723a3c4138fecbc952b976652b
SHA51223c5ddec484ad2c6506c70e14cfc559a408481cb9af17463c570cf81967d76d1ae67c921339e4f2a68d7467129341b8d403daae7c8098c2d32c7b42ea697c305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad7802b30c3c120864fc47ce1b36fc94
SHA19755d7c8eac6e7474d323501ad4ae8a6b24c0c2b
SHA256c31526d64daca6a4784ebd48ddd1798d328c1a5e5e9a5fcd4fa4af2b71be5038
SHA512dd8be7ed95ba822f869fee089e4c4307fed8dcbf05bb65f8cd99bf250417cfdaabfd7e97e9b6959c53016fb39f7d92378e3ada75ac857c23d2839bb3a881d755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5357d69d0c3ffaf4c724398f5bbdfc237
SHA1a62080cefcf70ff395283c75fdbed3de8972b94a
SHA2561e4d142a5d4a2beb6affbddacbcc8d69bc13c9858dee8f039a029bd0b0385bef
SHA512e89c31ce7569a9a72aca8f8e20b5a8fa114da92a7bf30dea4cfd159fb1c2135cdc26ceab905ca4cb0cb5f702a7c41f38638f93abb7a99f00c4279d989d222509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574d0397c6ae60abea77207f33c7c2788
SHA10cd3ca8fb7007851f4888912c9b9d1c9672457da
SHA256d5175ad7d7519f24ee6e5df3cf6a984d1313182f607a1885502abcf82d545253
SHA512b80f9df7f4a8f15bc016f3d0051ac900199bcf08dd0c33e78dbb6141217bc4b9f0c9359034eea4ff11d86fef818560525de0c46abc58779a7ec6b515c0b92de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a4f1fa95380bed69ca6c12ae74c29f3
SHA129b5b872c1215eccf45402e47bf193797c27f736
SHA2561a3b03c6a5e328c33405f6d3aa382d36b01763575f3af9c98250e6dbcda94daa
SHA512cd187a4c7f48078123f2f9c80868c89dc5ad0ab80d83e798261c3578e501b5c46ba471af801322abecbbe83cba0f8229cdbaf22d4d253566018459acc3b97a84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3f3f06284613c2bd9cc4db15e937aa
SHA1662284871cef56d561cac00b54bf55491fd1b51d
SHA2563c6fb24f405cbc3d8895bd722b771385274c6acc42f0aa0bac0d18c4645fac61
SHA5121aa09b4a92be77367d51198264f475d540302e6a1ba7655d68d1d1b7ef39383801acf4d9f6ac8f976d9d6226f45b677c90156185ddfa3131c2aa1080547a6187
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525dd832ac196e5c99e96a30c3444f723
SHA1f28478943c3b1f7d5462dc8918d33ec80b8a43dc
SHA2560b2b7adaf34bcb67653db387cb989e09603c6f9cd718392f48d261378ffcfcbe
SHA5122f4ba13b6f91b3407b2aefa17464cac40bcf3807d686ddca421f381d340b42d565127e662d3b788b74e82401f503ef1905c65d88564defcd6500434d62c409ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515dfce122ce197ca129604f973c89107
SHA1bfbc10bdc1d7419839e2d45de34819c7f6874117
SHA2566090a62ddfcb56374e4b3cd6dcd013221c70bbbad515d7bdf191eccfe9bce08c
SHA512dbec2c947b3d524721fc6b8c72e99f6f60fd05ca9dfd2670c8e186fc0eee9a54047c86a1a19d9b942b582e2527801d62581f542c159a365b8899949cce924edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5511f5395ab0ffa60b271d58493cf4d89
SHA15a1b16bcff6b23723ca11bfb463736bce80794d2
SHA25629cc6ca12945ffde96fcf5720da7156dc67c548e7895eece07fb06add7ad43ce
SHA512f666ad739ce083243b6d02e0a59fffcde0b09b3d5280e14e27a3580a186904ab0b9ebd1d2bf1de0a5b9f828d5e97d1081a515b23b77c087392a3977a7f315856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b18a75c6ea8bb0cde9bf06ae4c99ec9
SHA1cca99770a1718df5d7d9e62a42a498df9f7de1c6
SHA2562cf20beb1866ecbd8dbd22d273f1797eaf35ec78fb6cf6f2408f3887bbd295ca
SHA5128ac0cd66d0a4034a0b8105092e197e2267d8b75a26957d1285fc8ecfe6783c07ac4770e2f063dabfae39c86218cde63c315e8c536babb8b7929ee66b96fb4a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a096b653741a964100478b6af44a4b21
SHA182a1d7444b81d6fde408edc9de03c12951cdeecd
SHA256402a13105f535ce1da17afb7c52bae5417f42d2c7add5de8caa944af802a673a
SHA512a933e83d8942a5f579cf678fb2e751fdf7d6a25fa90b35dde9b3b6f9c69343fa2990bfe642ff2ef6f1b5b78c800e2af4f9af184693475efdb12a55e10b931c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd92acb6a856ba89e3bc183d80de864
SHA18463e15e0e9e3ca2b39c680bec83e3d41bda98a0
SHA256423af104aab233c1812802b45aaf69fb2aeea3cfeeb6333d7c7bd0b986e213b5
SHA5125897a420ef7ac44babeb0ab60ecac4eceef23b9be980d8c96ad160830d92dc75f67cf257bd94fb22848d072bc8f128740259e58317e0b03f7d2ca0ae939ce47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a21c5787a7a281275f0cb0c409843d8d
SHA10a1692ecb6088f4fd165207bfaf71752eccccccd
SHA256bec49dcb3abea679322d3d717debd58c8d7a0c65821fa5f428a2f350a248592d
SHA512a9b4d9b9dfc8bb78c7d3e20c3ba72a981b837522680eec24f1898802471bb678b6fbc2511d5269fe954ad7b5582d79966a933facb91b13e42dcc3bef35eec01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c798a5d4966bb39a139d2b61244e48a
SHA1933357e3af59180b57f9df5dcd0bdf2beb17da26
SHA256d69a36e219f94eaa8413aa7120c7b0267c5b32a21c21c65e2ceb25e17d997f8f
SHA512e73c36a4844ce97ea12eb5baec83164982396a6349e42a9ac2cf29ab7bca0dce3bcbae9ee9fcafdba1c42b5f14182ca872246a8e2426c05e5ba5eabe509ee020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bb713126fc4ffb3b9fd18396500f950
SHA1b6a97c34a69f826783421ac19ef7d9154d1682b6
SHA2563817cb7fd036e1fcfe70cb8a67cf5a7508bcd0d7679f25184b02067d14ccb921
SHA512863ad0f1e9b0cb55fd4f588edfdac061aa62772a0aebfb591d64afd660eb6467e384ae6ea0794df4bbbf5bb37ea92d45efc35d224ac5cec7c1d3dbc9647ff5a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545537c2e792d55884dc4792aaddab63f
SHA1e642e3903a6a507b5777195681e2034d90f27573
SHA256f583f45020b5d5216c36aca69ccdb1a758429fdeb48d13ffd177da93addc7b11
SHA5121a138b2dd93975c552d2a75f2b72ff1142827f9dead94e3b886a903b214fd623c3762da3b68f49a3763bb996c702f8c59efe9ff2697f738c601c6801191aa7a5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a