Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
43e5aa2535ca27d43fc500bc4a82fbb3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43e5aa2535ca27d43fc500bc4a82fbb3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
43e5aa2535ca27d43fc500bc4a82fbb3_JaffaCakes118.html
-
Size
15KB
-
MD5
43e5aa2535ca27d43fc500bc4a82fbb3
-
SHA1
f0f00ca0939f92515aae288afb310d42671d7254
-
SHA256
587f9901f214695bf5095486c1f7d238a78ca499fce1916d8a8e679bcd6a8b0f
-
SHA512
2fb390cd6206bbf6efa8633e7c0ed789eaabc1bdfbffe1f4ee41a3990da576c201505272c1506adb533fa47fd44d403bfee63de621e80c9255f5077585734b4a
-
SSDEEP
192:mNdCHhx17FvlrlUHdWqJlJGPASLdyLcaJKZRYgPtvr7L8kr+Vzik4sSlDFE:mgpURHL8UJKZRYeAW+Vz7slZE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421897037" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{510B6A21-1257-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e3805110d025f249a3baece928021d8b8704aa9151b8edc0dce161ad9aba0523000000000e8000000002000020000000a0814d5eb2eefc1ee5eb277097fb4a0dabcd73b8fb30a6440187c36ef10b12539000000093a0c4c9d753b858348a1c9a4f0026d99f490d60d4fec723ea4583a4e948d38c3e893ed8ce3450638e036c7a7d4038e2141215d3636b086b528c5c43c0ddce8cd572382e3f1efa3315f63aba662af3a313abc05adef582eae4d34fe7fdf254a4531032076402de0041d4dc92db961d1dcf9282df19fcf3a28662cd4a4a95c5a6199a0254217478c8e8c8be25242cfec940000000870fe89edc092697f286f6af75dd075ced0818e8d9a9406c4aabff04e7941f55878a1492da43080779cb6abce2ad67931c7d2b3f0d524960b8c1b1c6f97366b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7028a12564a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004650129719dd7fbe4c8e45f440e7dae3c7fa2beaff4f2d4e83b0f9472f77374d000000000e8000000002000020000000f9026a544c511eac55d32ba0cd9dc6ab46e2f625ba226ad1d24e3042e0f9f9b7200000000e707f3d1ce302e3d96c645614a0f97d88b9769f70ad97f2e5285df21cef93d440000000b64873359a328f418bf428a57b90eed5792c5dddf2a51e61c11190dcfd0986b4ab55130769f526d2420ff949beaef5c0fc428290d889dbb2a518d92923e32f5e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1916 iexplore.exe 1916 iexplore.exe 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2796 1916 iexplore.exe 28 PID 1916 wrote to memory of 2796 1916 iexplore.exe 28 PID 1916 wrote to memory of 2796 1916 iexplore.exe 28 PID 1916 wrote to memory of 2796 1916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43e5aa2535ca27d43fc500bc4a82fbb3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b342a5d497364472a5406be34c445554
SHA15da6543acad5181bd74353f47fe65f56e30c8520
SHA256e647f197c933d77954680d3a03c6d5354c9927db09244a07a96a053d295142ac
SHA512edeb0b39298e6899e519967b29879104d3753ff3774a007e6c3abe204f379cda327845b593aeb1e968c6178f60ea6c79e9d4ba387218dda6294b22de6394daa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a19772985aff1afbbbeb8da8893a7cb1
SHA188d8ae6771a6826d9e6aec70e59e2960a5953514
SHA25623d2ceda8281ebab0d392614e9e21ee4da445f9f700f6c4f74742eaf39a14eb6
SHA51275717d9b831ae3dec700e0ad6e598643008740ea9170e33890d26fa0d19e3e4e4c4653ad95e436c1f279e60d7ab49c10f999ffdda3efb5f4a728bec67f60b8ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b06a0edf9fbc95554cab5ce105c6c354
SHA1a82f87fb7e614700855b968bf66e1b4da67dcbc6
SHA25680e5ec64b357155a70626a39985a363b940b6e5be63006dfcc557da7add70ff5
SHA51242a339e76d76a1ed61e839f0c977504587ea46e271376cf373f1aa68cd04d6a99b02a5ff77d995ecdca08d1e8f4ae65c81ae77407d63d596bfa5d60f2b1a3788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b16fb07a87a4d27ad455f02cc5ffb49
SHA182bd40aae35d576a55a6dc8f88391e12b8d6c99d
SHA256c421408e936a17a3da7786eebe6419723c423435f39c78a21ffff729015b1e1b
SHA51203960f39efa789d75cc615b0ed8a1f5830a4f9a67944e4c867b05fb81185b6cc48a278cd6b2ab749c0f100cd06c8947f3083afca12ea018b94c16546e01ef5d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9156d9e7452ee47cd6f856b20815c9f
SHA119a3b6073a02e96fb5a822520cab93ecd4a03424
SHA256db3dcc3b5d4cb5296b690264a90b8ca01ff58d5fc00384ea86796381b90e5de9
SHA5126e1c3abc3f6ab1e9f1021a3bfca0a3063f748860fbf604706f27f95070a6bacf6f18928555b2c89326c246a81ce46e802df13e8d6b96e2edb75a0232fac9f32f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a8850c68fd9051376e49caf547ef9a7
SHA1bf6e63578a0d9617fdc0a725d543b85dfab513bd
SHA256738e3b0dbd66bf72af63f292135178eadcdfacb1c7e8a0e368e85085800c46f6
SHA51268569fdad0f19fbf109699cc83f67bb8add2bdc5afffc0c35371d3d363cea29768078450120dcfb30f08cf983166fec8f1a3707ae57231883bb8452a196f8181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f250777a75f99fa8f18013f7eab8ba55
SHA178516ec9d6cf05cca985a74b6b932feca4e26291
SHA256733b9dc9f8692c2a02121a2913c1e5d5a05db4b65ca5753e13fd1b05cef12648
SHA5126c45755ce88b080084baf978d64848f691a18f182b349d3ad4a29fa7a4fdabb391f909de6bfc84df50524bd1bac8e7328649ceeefaad2306a7ea73ebfbf2d27a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f23b0e8b770e92e500aaf2a44387c00
SHA1b8bdc398d8ab7872dff67b854c907eeaad6df7d6
SHA256758bd7e5393123b7c515d3692ba1f6985923d0b00c6176f5ec22d9e3137ae6a8
SHA51236620a161e3b4118c75c06a064b5736e987e79d1fd0138fad9de939cfbfe08d3e9d74c1ca9a9fc1d140f35070a3ae33e58d1df868cd878ec51ecc2272e2d5dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502123845289b2b833d55f73f714dcba1
SHA176a9a9a5a368e9ac47a86a9b94859c8e6fa17618
SHA256310048a5b754f25db8071a3d7ecb1d5cd83dcf13689a464ec5d56106c6b1e049
SHA5124ae7020d08239b7b25f1b7fec29a74e3e766c5b6055a1c61c35d653d178e666c54baec57cd15be7953184c299f5504f0d9739651f40b2546391adf5fdd01d746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6d70406053ac51029b8518fc42221db
SHA19591e444c6d6ea667c5b8e9b15bfd12ca3bfa0c8
SHA256659d855f2220a819fb58766c36d9a63ff3b7d7198d4da00ac1588f4149209f3a
SHA512235bb4a7a5cacfbf7bdd2538dba4a2719f2e079f1a09f9d180b28ed7c3e0fdf73ca5da9ebad64f4a9f43434195866e3bc6f90675c96bb0e8bdb53b73e4521885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580fa2eec8fbc53ca41d700ec2a316beb
SHA17db31fef96a36519f76a02540cdb21ffe84c2019
SHA25603fe9f08b9fa737cd6b1480d490cdd9f90e196556d45eede99080f36d9ac3910
SHA512fcc7f36233db4e47b3f9a9145874d1403800cb49e2fdbd58e3d2d437a799e4b140179744cf2b32cee1b7fe41a638978f4381e445679cdea54ddc2eb9959f524e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a710746b7690b2b2d452d658ee7293e
SHA154bc9da9fbd04fecd667337429dddec4c0857593
SHA2562d0e6dee644dc23a5369622a738ef8f3df5d61aa8190ab67b3f6bc9efdb12343
SHA512802641d48045f1d0536d327f61c340dffbe92174008027345650f34ca9277874d4bb7963032b288fc0ea66a72b486a2789cbe30aa288749d95e33067cc1805fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552fa531e5ba2032930a4a56d2ce8c049
SHA1ab13dbfdb6b21307580fa1b6053c04295fddc9b0
SHA256b10c553d7eceb54351c9de614030ceb31aab49e1435ab1ad89b26d589a9adc3d
SHA512aed79e7de5ab4f14c2deb743f16d1b303f62d02ca88eaabeeba310039984eace75051010ce1d67ef0263a8f62ad232eeb79b15b7b8a8dbfa70298cbb102e6642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f50bef19d0157d89d0fa5f748a238013
SHA143e6508eac6c663eaf78cd9619329f26cfa2b3c8
SHA2567338d3c2e586a54a3c97aa583c88c7afdb2429345210f3eddc64c1534eac49d7
SHA512f1d4257eefa6727670a4ff36a45cac5c2eedd6734a096bfbf07bc1282a5a34d8a83bb49bd98bb61b5484dd3e93bb4eb63856d804ec465a2a462b775a748ed805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5433c3216c6f59dc9e47e6903c76ff563
SHA128711b3df6b996889f44ed25ff7237f0871f64f3
SHA256a53c18fb70ee21aacc8fef2b7c2e834ba414259be8b05e0aef1fccc29aa1f05b
SHA512e96551aa51e1a51f3b17924a2a1213839cfb2b5c1afa56676a900c85ae19a690ee3dd09c850bdd4ab59daf23c8b1613106deefb3f07ed2b221e6027d6775a6bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519e8469356d5a1fbd55b4163ed33ebc0
SHA1f9e30b9142b89e9b9d3815180434703116104c60
SHA256a97441af49076167c8d3444d7477f0bde01a477aa877947949e2eab6e404da9c
SHA512cda530140ec4a2c225b64b594c849b34ccefd3231d7c835fa160ba34edaac14f603292466fadd42df300e33165c7fadc06ecf9a667d086aea2b97329340c4f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb9efc5ba88ec1f33ace23352f1d6b24
SHA12e91178736d043dc6a11263f26103fcc8d4f45a5
SHA2565c5d40094429576d6efcca909e642fd2280b8a6612270637f2b9ca8e0e409045
SHA51245a2975953128f0e5e7953e52d024d3d2cd883981ed3fa3fa86c6fddddc6bc25a55b4d0271d6e2a0e8c7a98871d26be65e4c64022c5201ae894321f3ef801464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbb995d25d893796038dfc2303cff16c
SHA1c46419b6880d2c096a1ed0e2517967335eec11a2
SHA2561e575ec1f35b67453fa2e544fc3f308064362cbfad6d7cc98c253e1c343a2350
SHA512546582aad93fc33e8313c7534ffc4d35e833f448b141e5227bf3112dbbc69d0b83b58c0e664a83bbf704a25cf90a820b71def2eb7c43f6e746b0136dde22689f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a