Analysis
-
max time kernel
119s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html
-
Size
189KB
-
MD5
4488f8b8dc21b9fee4f0d647b21a736f
-
SHA1
525bc9325dd578803733e34659df936d9037e2ad
-
SHA256
7976423ef2b390b790b243b1dadc69c1c80432e27bd853ffc69f58eeea7f77bf
-
SHA512
8224c2e1fa072b693024e23582595f67699ae9a211ea03b5a7522923f38074fd8d0f0f26f84f8deb71a11f06035d0e3e76c4157cec0d2e062395b9ab295433b0
-
SSDEEP
1536:dEmNGZqnIYnyRZWS5ogpuz4fQpp1dVWHGZ4srV2ERZTxAHxLcZ3xt3VSmFgN:1FkyZ0KNSLcZ3xt3VSmFc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a75dc50ce5c9e787dd569e419a34b845e1ae673d12282aca3e688c17e5012921000000000e8000000002000020000000ebc5e42fb9b4da5257cfb7844d22107c13dc78c4a0cbe33c00cf22d92fbee7ae90000000a723931de32bec593ea6ced5a82088c800a16d3917fe790e31ac3b9ccf080f354977d76554b5d42016395ed1c31ce08eb80136c1a0bb08d3f88845adcdb413ab5f78fe9ec19c2a9caf45dd2a20a4edb6123985e0a29747c721752e38b57d69944550adf00bb8319048e982f4cedfbdef7d82a98e77b1bfb359d602118537156eaeb0fa63d8e716bacab9e3aef588d90d40000000e22fef37df015827096f5c59f8ba8a3fc5e2e35e1124bb96de191a081bab58a5313b660a592cb6f14b045e52704e255d4d3b6fdc4180b068e43de62d4c1f7927 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3DADA81-1273-11EF-BB1E-6A387CD8C53E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421909336" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002c5767d8c9ca9ac57375a841137707baaa4cdc22509e56671203f4076464b7b6000000000e80000000020000200000001325e01d6258a9773c73847e3fb40e1f3fb3ab1c091c796868a2887356baaae62000000024499d07c18e23b74d55e703575456041032b5e40dbb31410fceed56b57ef2cf40000000e38f8b2333e3fda8eaf758fcd81939f37a2c9056f440930b33c1589d41266b5c8bb0c608484153e3ebc1d04615520cb819303804a54d10857a13a8b68c2d1895 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7085c4f680a6da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2584 2280 iexplore.exe 28 PID 2280 wrote to memory of 2584 2280 iexplore.exe 28 PID 2280 wrote to memory of 2584 2280 iexplore.exe 28 PID 2280 wrote to memory of 2584 2280 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56919481da0c62e8b85851eefa0915004
SHA17e102aae5bfa0bb036e3ed159a6f89c71891923b
SHA256a03ef6f95fcd0f73bb24351e61928dd8fae95532781c6714b000bd5127ddb998
SHA512c1fc61ba41cb02c8ee723900259861043e711bdeca28364225c910659dc3a4d0c401698d27ad3e263a934c9ff66214203c8f3effd6212ee0b25491941969b539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d1079699608185cf852e46887d53ae5
SHA10a86db9cd75e2becd150ed95f29a42a1a94f17d8
SHA256c203525ef6a0110b5b0a170b7d8787b2f53692cec4f0a85522ba915975795904
SHA512ba8d3863783beb38ad7b99d4fff992e25622b836030a813e60cbd24b642a9ea612660f2d9d1ed4699426a8a94adb900702f778e6d6b42c86da97573e6247f8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2082c1348cfd35513dc2616846dd7d1
SHA17da1b8cfee2487607c1ea955d1b7be5439882a36
SHA256b19728425e0389a1fe7680da18ecef2897d47be9d9f6302dbc3ed73f45f7afa5
SHA512186df03527f24a68e8caec7913e0630c01cc29047316fb3030a107f66b19e3740b299535367a4e3a5fddcb796ca31383b7d697205a863f765da9456eca041017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58efd1707cf3e9c6d6c23dc33fe122a3c
SHA1f7d8d205fea4a9b3ed7c7e649dc7c1146239d9f5
SHA2565e13b50a58d9f43a72e652489d685f3e8c44fa21e6818da49810d2d0a1153c6a
SHA5128f730e509c65be7f3550dd2d4241fa4f67fb64e99f7040473cc9e980c83b42e5fdaf9ba8a531ead72eb41bdedaf3c62a85b6137eddbe90ce2ac04f539967cd46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503c24a922abc0f884be525a6b1a86767
SHA1fa9eb18d2be9735ed44c3d8f76c14b365f8c88fd
SHA256ec2c1400696c0b2fbad0d70bfbe07355b948087592c3b7495c9c76638c7f1b1c
SHA512d0eae8f01aea622d1d698c0dc9f7aedf8368a69915499a23473174e8fe06e61beb0d591bacc67ad1c36e05af6a7946cab9a0ff4ea477831a464d814c52ddd3cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f31de9ffe25a700cd65c6cc2f29a1f5e
SHA1753f85913e91539697fe330c6fbf9ecf2a84ec73
SHA25613764c4fc86fdb166710ae481fdacb34c14b619b189accea0f722cd425388434
SHA51207bde4354e4a0633ca36da4c4f465da0e450d4933e9f415ccb048e2b1d38fcb4b7b146c78c1f3dc64dbc4f1fc7ef66ad04c59098c8e6df3814378957600b6662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54de7d43fbaa7aa1da64863e1d5194f08
SHA1bda5567828d3221a009faf465891f20743ced5f1
SHA2568efaddb67c5b7eca2412986b166f042a5a00e6be7d592d59a660876144266f9d
SHA512b2dac1e5592719c6cb7d10d2db6066e810bc366c0aa70f23692bee43f5e693ad053bd5d9434c4885d20d48c22c2d53441fbc23c240d26357687c7630075ed44e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527e878a364a61b5427634be08122b299
SHA15de493c2e91dfcc70abf423b25ea613b4a962dc0
SHA256e43dd5313ba0267ea8cfe357bdaba54e5e90ed7a495b1e2d6571aa4450f19143
SHA51285c1bd416a937ba50da723517e504cb7572b72b67fa6b611d39772bea9bc4107bbe3c82f96821db76fafe55b336911202851e7a69d6a547fa937880950c691e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57605be9ef33ccee493d0c72813693521
SHA170f42cfefd4cbe21c0f4ca2cf7070b1d7a4e92a7
SHA256c0255802091faa8b0f29d4ab388a3f0adae1c1e0a42eba1c17e4d619fed137cf
SHA512f292c7ad471c02e4da07ece0307815245409ba6a2f4db52649fd8478477fb9cf0b65d399f472d944b3b64b324d1872cf94bfd82cd72b17097b918c3dc1570785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564c78cfd3f598a912da4227d117418ef
SHA17a2d687c9e07b401f3f3ae5305f2cfec4c87df83
SHA256f4107f47d3e7b21e8435b8c0d70d191bde31b64cbd59533219cede95152a7979
SHA512b0d7ee8dec61daf8958a4881c91272090dc76c02a0f8c2b54d89456fdcffaf4d29513d7f9b67fa841fad63baa50ae7723bccaee2df83856f76300aff4aa9aba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5606a297e70fdabdfdaa069535821d326
SHA1a46fa145221a22ca25254577ac85461c577c9b48
SHA256400281591a7a7b83da46b8fe978bdc83fe477c6611a71025f2d32f5f0ddb3f15
SHA51294f8719a5a2945e8bcc1c0b27ac35f7b240daacde8ab53169a337529743c1c7e2b6afaad361a354837b732e1f55dc3638573f5ecb2366222e0a7b23576045fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f8d5e3c0bcc87656de1a94dcf1aa060
SHA1cfdba699916bdab50a8ed1c1ecf81609fd8417f5
SHA2561a1b1ec3675809113340fae691062a658e66f47ac161deb59fe49b72f5bba929
SHA51205c57de8ad427caf7be4a95c278c80974df8d0361473e8bc09891b01d2985925c66322787cdeaf9fc9d6b2ea3bd531629668a783dd55dd6dafa2ede0cedad98f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ac32b7a9c1f1ef1d4aa8ddf4d17bcb9
SHA1d134bad6a069a343cb225d52f8449f228a0ec80a
SHA2569c8e1693460c419425af8feaa6a542e60ab4309b572e908fab3d9211a2dbf3ef
SHA512f1cf38e3679e6fa9d8fa7d203e6d41d41d92d1a516e34819b5f5017811a756e0963036b709f3fdd6c9f0d5bea275372b1c5394de1d0033505b4ad6a2473913a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fee7f687fb0a172a7aabbec44b1d026f
SHA17cac557794c5e0b1e753eea613c9cf2fc5fb9300
SHA256e7f8980dcf615ee5b2a0fe1df4db2eff51ba7e071b00646bc428f63b3060bc97
SHA512837efe19b9fe289e586a74264b18de4bb13286fa21fc51bfde19f3aa16f24fed2f9b81ed5a14aedbfb38c6dc5717322f85c403d119f9788da4f45c4b40a31f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4a8d886ce275bf06ecc2f939bffb901
SHA1fab8e022766c88a3b3b96e193b6c6d1b1235fd0c
SHA2569911d766dd4f1a4f76912784a7552d409756e8a2e9a586a30b5f440a8e3dd26d
SHA5129b8bf933a0b331e5f093974cfe391e872813cd4d85780d873c0b23b22daa65acc9274f4002f43482344ba959b2e5a4ea5f7d8db4559713ef94425119f115ad09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528628fcaf586fb1bc8f7d97551a4a639
SHA1d2869ecd655d06780a8df52c5eadbe2c62bbb4fb
SHA25642209551c94f86d3496e52d9acee6156ef6b54ee7e478262f7c4d850c07d39f8
SHA512f7780534bd67e0c284bf2060402d4c2a268c6ec9581e33a8984fc1a47613c246488009a1ef63345faa9e7c72419922e12102c22783d27691c2239110fe0641ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b9a9ac4e9c1ccdf1fc3ba08245eee63
SHA1361bb2804cf4b21657863afcc0d05c9adac4e857
SHA2566132f370a0c32ef3f31455384ba77a322af18e3ed80b8057a30316caab7396ed
SHA512a1e05a8909e7e64bf5fa67631137da3a9b48c14a910665be80a800792d4b66dab8d79819da67766b7005b6ea4d322611f9c5517c8660db40b0ede4f17d8df604
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a