Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
4450f203255b5313f1784becbdd874ee_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4450f203255b5313f1784becbdd874ee_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4450f203255b5313f1784becbdd874ee_JaffaCakes118.html
-
Size
19KB
-
MD5
4450f203255b5313f1784becbdd874ee
-
SHA1
4cd8625943970dc95e8f67934cbdf756f2542587
-
SHA256
24dfd448ae156bf62d4906faa7c374de83a894381ffda524313aff9f9c7d38fe
-
SHA512
af1cfce25e2396df08a5f9df2ad00d1eda0da501e8cc68ef5a28f811ce9a6408d6cb46505fb6a418337353d2e40b8de99dc2c9426501f0347880e0cc02df8cb8
-
SSDEEP
192:SfQhk2/rszndAurEtE3ATGr4qMx8V6CQzzIW74iIJAkBsUz8QGjUlnFa3JF86340:SfQhsrcHG+lRjM6eqoy4OOiGjRzY
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90634a0a76a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ebf0444e665bc073a2f024f9adb8a77ecd17f45df79b7fa724c3e6c2132b22e2000000000e800000000200002000000052eb19076fd95cfd2f633cc4968080b43525c73364838307fd9100ad67f0ef312000000077ace9be50b5913af481be3abda20f8e38fbd1ef6704e27bdbf162fe8dc0b771400000008ad57d8f90c84d11a581acfcb8a85a95a5ac40e8a872626f7968db317019f004665dc3027610f464fd98de88fdc23d357a8bd81df8c6d840b09dda34da9a6cf7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000cd17530010afe81e9d01d428872e4fdedf7a86eb660ffc12dd2fb28a15afb550000000000e800000000200002000000039efc30cb8d579d18f21faad91c3942a74a5598860bed9e25704f24849e527149000000043eb8165514f9b8b5af08caf582f37d988b2c3ffd729d20c00a11f6972a705e4c2a48c8bf55e4b77a568de347995d8218d72aeab67136d60c49b32345cd27ded84493105741683ea7463339ddd6081e5d7acc9814bf43335398eab4dfbcc6479989e9bf4fa40ee00ff26900211bef0aa82886d56beb2abf2e52e8ab6b8a3be12624e96dd16deee196a41fe04977bd42340000000b70e2269c07a8e5b49fe9aa6b5e62eba96128d08e95a3702ae8f0315f9391e27249d1a0192c4366b84e318a918429305420ec71cd2be7479cadc9237a113c866 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421904722" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35AC96C1-1269-11EF-B082-427DDB91FD53} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 1224 2372 iexplore.exe 28 PID 2372 wrote to memory of 1224 2372 iexplore.exe 28 PID 2372 wrote to memory of 1224 2372 iexplore.exe 28 PID 2372 wrote to memory of 1224 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4450f203255b5313f1784becbdd874ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e290233253a16dbfe32ceaf4141092
SHA186eadfc0a9ae4ebc7d7c110fce075a80dd543934
SHA2560108b0b9853064270d02a66ee08f7800d8cbdc8731d4a5c83162cf524f4f296b
SHA5127761850e6b681b2a643ec9cc01cab528f019282ab0f87d47b283a659ad020e3f1ead45423b99fa95830998a8d3a3b8b01e352b0237d140b542504fb3bf8df4fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f0d90f05e0be245149599c8a5eee7de
SHA1cb38430a6dfb6fa832bb521c6df5bbcfb98a65a5
SHA256a3029e421b8a2b9a8264c70b86ca9d99a8a1b00c73db30c221e6fb7dcf3cb43d
SHA512907f7feca54928600561d4874840a6c320818c72c01c382bd7860ad6655e8424b325a215fa5e3d05f5c965a626b42ac967492276a4f074afa23c0f363d221c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c986580ec8fd10fc94bc54fd9a5e7b1
SHA1e2a68a3f8274578af4d06e7342c8c5c05728a32f
SHA2560abd79842a87e065b678125de084ef21cce9fbcad2aa2193b4edbab03e37eed8
SHA51218d0e33d4134afd9245bffe826342deaae6c353309b0959d6e1bddd4328205bd82ca8e9c075a02e439168ef7413637dda434605e61c651167b205ca57bf40339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ab2ce5bd55c18a31471385c7610fa15
SHA1260f53786b9aa8ed098fceb361b06f61e85783e6
SHA256d25f0e66d9325c1577ee8ffb0298f50b4b26b755c2b6c0eece6fee689c0277cb
SHA512cd2d6929a65d4f7aff4a3355e672043277a595acf633d28d2673effdeb13514123a1d10b7f2976d3f0f7481dce41ce0ead0c6540f01eb457b64be4a33f2da724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ef0a7eb36d8f644c1474699fc319800
SHA1c73f2cf275a4b7ee4ed08af9616f5b513e698c33
SHA256c89b057e27fd4b9c639045ac6fc3ccd37940b425a21e249a9faefb03d996fdfa
SHA51258d378c295fff18115eb56a95eb3ff8db806b7911125e5f75a157c4f5730daf770de46812ebed9e5d9443903fbb001aee4db0043dd6bb86e7d51483674ab6f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59494839d5eb2181f29c8e66afbfe8cb4
SHA1c25aaa46f52c1348b77ca1114a1364ec84c8338a
SHA256734d4eb30b6c68919fd9b9a6a737608e5afabaa36a314cd8b267b0656ec4d8e1
SHA512c8b4995ce7ba4aa30b1585b04cbcf98db26d62a2cbdd3530b2a37e7d4a3ac6585cbcf80fb0edb552d2b5db829e086fa0bd8951f415ec764a080c86abc18e5ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ce5ded9e0e8a5458ee04168caf16f5e
SHA1b81df21751395fc3f93d5c6bffcdf25f0e859a23
SHA256c6eeb04b3f06b8b8960dd22b2c8035c0e047554b384b990ec8f2c041fef19674
SHA512695ae7ad7b59f305ca2c8e52760f0bee64aa95ec0691ff42a851060baf601f2faebb1472646dcaba53e2efc5c9fa9477acccdf5bf8e9e29b1d0d65419fff5a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a49b57b8e9e453fac9c3c4e5a8603b
SHA18a40ec53a760fea99e7a799ea6c531184c552b63
SHA256743fc49cf91bc57376a7f76d6b0ab123b6b5c4ae30f1134613bca1801de5d5a0
SHA512d3a4abbc378c907c3fba93ae2b505004b6b9c530d87403b21a9aa0826f0fd3d10c5b754a5b5baaffe9ded1510551c6883094bdd3a049bfcff6bb8f8ade16dd54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5c020e8cf8ea0a8786bf95b69cd664d
SHA17022dea5a39347700ad848012e6ae3ada602dd03
SHA256dfbb2d08fd1a77ace2e61b94901261ad2296f3101f2c04738b6b63403a1a19f8
SHA512ca2f78c512219a07c4072f5defcf4d28674b17cecf0e21552314f503bcfa3613cc34079d3504f61709fc32c86a8f53830ffb989010e113f39560114094365f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e6eceb02e8847ff3876ce5c592c2651
SHA19bed688b5545b7ca47b9e6af13297faa0a513238
SHA256e08fc66c8cf5f8a9de8175e137f8df6d9d643f48f6b920326c81ba695272581a
SHA512e19067948f3c9e88faa897bdf1c7382865119c9bb7767d9b881c6bf330355bde6058c22f3b905337a12e21b5d4cc370d2b076f3ec9619eadf3dab36150b3c3e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52435324691f347ad6b4e182b3f7258f2
SHA18b74b1821f27b8c9718c61c7af769e7081717401
SHA2565568b1f7975b00970afabf7cdf387692ccf918c6ee0a79abfdd2d57e8a8ee67e
SHA512a05256c89274e724ea582c4302fed600d352fcc899906897f42307f450372244fad8464d7a51c3173b8aafbf55b1f32a04a20b9d5a29afb052ea3c0d4875201e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f434914556c5156786612ba78a9996
SHA12a1a6f6f8c64b1f05c78c6a4894530b90c58ddb5
SHA25628356fbcab0d4b14032e60048ee96476ef4f7488865a3740e6da84e0e65a7110
SHA512c2c05fc4ba0fb52a0cf44803f02654332482505e62da1d9f1b10666ef5eae7a78ee84a6cd30d26c4b6636a1b9168b0c55ecb42584b2096ede12fd031f995a78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55545f47a5d9462d718f9a95b32fd6f4c
SHA1c9d447ef434b1a073ad2c54720b5074aabbe0a57
SHA2568de9facd0b5c5b3a102ed32c85ec5a33a855f6492f947288e8e2d7d91e77e03b
SHA5120fcfcf11657ea4e41a25d365aa3ce09da7092823ac666e44458fa3c38c064a23b37dafa7de23b88d0e1ffb7a96951d8a2608e9e532dada9edeaf5b127abd33f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b279410bf4ce2ef0dffbce60b25a22eb
SHA160b9e4bc3acd73aabe1638469f7eb53962ec94de
SHA256dbea3d280d737fd0325911870252a0c2cb191248cc8d460221d275c4aa3789e2
SHA51227934512be0e84b097b221530645dbcf0aae50a725bfc21500dde943d5f60704221d05644b9115792c1b67579383e84b60975feb72049412cac339ac38cc871b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55393434c974b3d9122ac31b2b7a7f549
SHA1609aef7d0857e0f3da9a734ac4353dbb0621f705
SHA256231d251cfd618df7304e0e726fdd38b8d56ebc9abe42133f3d1427146ff274e5
SHA51250c71bcda7ce00f9550f28e28c9c14a4cd03a641749e0c62b498c49bd0a6c6793743149302523d2ab853ce730a6bf8b63da086b38d230d8519bf04119360174d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502e7d0b6403197286aca959df9b7323e
SHA12e958cad488cb439f533b82a7f7f545c0d38b35a
SHA256015ced395d818772cb1d01a8ee1d7e21493d07b942f1cf5d4efbbc2b176f6a9c
SHA5124a64ab4121e6bc93978278f8929a3e56590a50a0efcdc1806276ce39308f9eff62b3273ad7f67b13b4c560d397bab8c63482687402ed3cdc2fc0bd9ccb588123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8034ef716276e6dd366214af92711c
SHA1d1f0ef89840f9516c7876cbf43b3ca723867cae8
SHA2569c43ef6b77dc63aca6b8fe281c299f3baea0891421f95cdfbcdeb79a45802f77
SHA512b7d04f1976678469de936e048d05f12c9f7ce0286b6f24b910fa19500ba00e2a2de971f0db707dcde1d99ba01d10f53fd32d8c1714ef02c836bd029334242fca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fea179ff01805b5edb3e90b33aa55d2
SHA18a9b2f8436d9f093fc9ad5fe98fd9f26d1cef2ba
SHA2563702270cbe59ade6708304125942bb145056f650c674eff3d876d294513e2e58
SHA51296e89735815ebda32e0b35e3b7100293891eccc1d9081e11d856809ff501599fdc6c2f47d4eabebf9f460a3e39f2f6b2c909e71ab94851d222c6930e8e3d1217
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a