Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
44c5f55a5fff37d6750fd8955d6c9516_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
44c5f55a5fff37d6750fd8955d6c9516_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
44c5f55a5fff37d6750fd8955d6c9516_JaffaCakes118.html
-
Size
44KB
-
MD5
44c5f55a5fff37d6750fd8955d6c9516
-
SHA1
f67f8d6de7618441a74759fd41e7d027e66a3a30
-
SHA256
0bc20b92d5f9b0873693ef6c74b5c100bc6a43485200472f3c40705a4e1bc41d
-
SHA512
dcc3c18abe738411ded8977b58c5fff347e251ea7ee32be0d508ec25faa64de881a586337157d1fbef85d5830b801ce5567fe400b17bdc1c6c6beadd5bcfd4c2
-
SSDEEP
192:uwH+b5nSBnQjxn5Q/JnQie8NnqnQOkEntH/nQTbnk8nQmSEZxyXvyePdvUQ6l4K2:EQ/jxxXi91l8xDVkSARDGPvMcA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D4E0E41-127F-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d5d15b105a701486470898b5243df80ecfb9e6782143dec6916cb688cd92012b000000000e8000000002000020000000cbd2e44fa4458866d5f13734153224b236edbd5415f19e8079eed5bd9a6e8711200000006dfe91fbd09a9ab1d7bdc2820d0a38ca1158a99e14eb8e1e68321f372891ebbc40000000645e58474c5c34e696f08790959e65420e4702f0f4d60a69358362692edf19593c4c514f08b66afe7db2c4b5f906b6fc5a933ea22f1d566c3584461e37c82661 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000054a915217b379b41ac0d056aa769ec54504693d30f1061b8977acb1a0216577d000000000e80000000020000200000006929a083e1e53173012bd6f606901a9053c40efde9f2ab70bee4eb5de3d2837f90000000ca69f6127c8cdb873fa52861e01224b7f6709cb86900121a9ade0628e2c0b56684b13a2a590a2169e47ca5491a1b82b1ebb96ab81d8c041aa446b29a345f3f2f6313492bc8af0637097e4d112fbd1642ddf79750277d88c5be9b639ca1878fb03e2a3855b142f6d86699690c29cb45e27a035e03b13c37e6f17073455354864821d4d3141dfe5c5e27eaf4f7e514fc1e400000003a99c8d44f7286a69e2fc36b7259ba0e2fcac4d3f235286649251423d0403b0877ba3aa56c31a42824ea198f01e0c0a7b519ac89d73ebf8b8c6805a451ea75de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405bfff18ba6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421914131" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2916 2972 iexplore.exe 28 PID 2972 wrote to memory of 2916 2972 iexplore.exe 28 PID 2972 wrote to memory of 2916 2972 iexplore.exe 28 PID 2972 wrote to memory of 2916 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44c5f55a5fff37d6750fd8955d6c9516_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d131903f3866d875c974968bdbf5c02
SHA1796fc185e292b2a265e2b249af8b7df4cc8e507d
SHA25654dd86a221961d34019e2571c0c619ff8e8ebcadcbf1d595f425cb7e10ade832
SHA512632b5dd9fd7a20ce0d629efbf5fef18ded5e9452be593afbb5e7e9145f6ffd67aaf284c71cffc76725d405bb92d26663a9520abc4767d13b5dad3f5875eb8681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a97dbbb318c1732d2744162d53478424
SHA18ff4e78375e1c8aba9e77b648f2158b68f8586bd
SHA25632bbc66d61d16102f877550db1a02181fb211130af57c27de796cf23355102ff
SHA512dab4cea1f109f7cbcb09448f41fa1c0902136fd7f17268515e012dd21419dfaf17fd304bd4de1426b6625944c87fb7f877e2ffd1bf7411e771fe03dbd8d23ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c4c68d41549ca12a4f7e0d76fe2fd2c
SHA123fe8a27e7dec57562f9c3941bd6ab0f91a775ee
SHA256fced97db38c730dc2dc8509fb6101381b9fcd8d3dd48d9cbb359a3c52bf05828
SHA5123a751af52f6cdba2b715b480c2283905776e291e5223f3ce9a11b2ebaedee140f9a1f878606b1f41440fb690378791ccede779209956737008470638e551d30a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3efa54aad89f34f29ca903f0cf1deb1
SHA1826e57414de8493429d98bb1d2c8ad3069b61fdd
SHA25690a89f0ead029818f3cc4e9601d36897b9a8c8c0e86bebcd5c54a51002473cc0
SHA512f93ddd98b302a08e51ed6db79303221bdf6666482db6d88831d7d2b882321a39c8fc996d371d79428aa6884111e50955460bdef0f0473d0835e74f59e82f1e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af2e2370213d9de60dd97c21b71eaf98
SHA16cf4fa88cf48eb4c12d4d69e286c24238604e235
SHA256f786f6a336a66c8af407700334021df836872553d65ca95a79f46a269ac9e416
SHA5123e804d68de9f540bacc2d185eb9ec488c2173b5d8f18fef9e74dfff8b87042d3097185cdb6f52e25301de900cb782ea93aaa085bcb21c949d6913500f9b652e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567a41465266e3161882198d693daba0b
SHA160c0a23b794147409a0aca66f5e35d1911b08645
SHA256d9fa02fe62b7c5f0c7cfcd4a754c1378793bf9e18f1e0179e8df728a7580a364
SHA5123812390db590fd14d22d3e94d48594da5aa0379faf4a7a5c4bf5d1523c2eacec309281550154c457c51d96ab2f7e69448d1350177d1e7bc09903154b4716c857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570a29db3e501f1a823a886f411aa861c
SHA164192b454823ef483bf2633c5be2e77fd6d4a9de
SHA256cd422702e28c7ef32f0780b13cccb7c1c9a02520923dc36abf2f79962fe4bce4
SHA512ec8ca1dd11c612489007fdef0a4b75c6052854e1a238e0ae82e99cf24e57e949968f46ba71343de440dee7e5bae5a93d8274d741388d57d83a6a5feaa8bd3dfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ee6738af86cb3bacfcc5d4f41cf5f7
SHA165d06cc3b8558e5f6a445a009f3d24e6211e6339
SHA256059a1f7f440602e728355c1392d693666b6c7150b6b3fe32cdd358ba46de2f43
SHA512ee570e1ff9ef8d533ce15b939a08f478781d4fe961fd949ac6f299707eb9307eb2dde9f507d5166a0bc7266fcfbca2a1167b9e88d95d596073b1afe8e945af6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6b13a27145a72c8b4c8e5e0acdc7ff6
SHA10ba333e9ed030069221312f8042b83cee9cc45bb
SHA25685b4f0328f385a82939a5c0bf775e7774a05c2f2e6f405e7b056afd42f2a25b4
SHA512852492e19606861efe2d23e2765d3947d1ef53a60ceb82872eca8233625ce4354cdfb3084e4e0fcab6f46a8ff555b1efe461969fd83e15c2cdb34fa49208f1a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5264a3be7ff6e93f3b2b6caa116994f
SHA153e5dad98b2877988a5c281884e40ba57f33cfba
SHA2560bddc8da85e7624b1b6286039e82d9792f04f66e98e8c9dd3c455e81b5d06165
SHA5120995eaed181c2ffe4a8cd80fe0626e530f83fbfa38b684dfe983c193e33daeff6fc7e0f55ac63efc9c0b129368d5556b1cb32029d4f8ce47036ffc9e5fb2c7a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d8c9ed8c984edabb3ee73e6094c3bcc
SHA1543378806290964cbf154f7b49eaa9b75dde8fb5
SHA256f3000bb1120c0146c91447f7a9b898e51f11a67de031c749a31a5c423982e8b2
SHA5122a0f6b66d6358b0538322fe1a2dd5e12b7644ca4390ed183bdb714f7fa72a2e7450a9e6af784e931e375e9fc676736a463d1e35617434b9ee517d1bf7a1ecb63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6a541d7983f74ccec929df87f096ac7
SHA15ebe6f8e307de6e76684677bca6ba1906d04a3c9
SHA25677e192a97f220ea5efd358889c1b1531189b066298b44e710957e2ba0ad48e5f
SHA512b315136a84bec2db954204f776bfa01ca993a8d25c9435798c3f7bb8be3acf6646624643e571442bc811ce2af612929dcbe7d48ea8f2cdf19d4952149392cb57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f99a36c5caf9d22a3fc81d7cf84035b6
SHA1ac8420aba03cd710dbfe8ad9d92c182a2f74526d
SHA25603e877f213519437c2c9bc373994d21a2f9585eca913da050663c9ef9f950b92
SHA5127a53e74fed667106ad581b0b7471427517df1fc2216b3861eb4b87edd6defd593761d04a3169efb8ac0366dad827bf6dc74d0a44191476a4dde675da481b145c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3081f21876b594e0ca567e29efc4d2c
SHA1a65fda3df5f94dc146a618da60bcd2dc2b4983f5
SHA2563cbce003c789d3fabe8e1cd637f8edb61675803f04f04a334df91f73527d0a81
SHA5120713480992fdedafb0ac1976833d9d5e5f74cd33f2aaf25927254b64c44126ccda9c42cf1e2c27575f72f5a7c4715f7e81e7dfd46e9f1a3dc5e64bcc4d2344e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab0a7dfc3319374cff4e75cc6cc18f8
SHA1e32c4f14218795357e2d48fa569bae9931577a8a
SHA2562c8264dba822679a351c98c22b71dc17ad98a5e85218b2337d3429015588a686
SHA512efef2c321dccf0707c4245399fb23f0e59bc3deabbcc055e8f857285f9796dd82c1bf03d6c581f1713df7b7a09b8c18dee8ce2bbf98a4cd9dc723bd073a97f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534a7789555f3630ff7d9ab2bdba58b6e
SHA137d659a135e5d9fa4e625b8fed43027f155da6f8
SHA256c76d4a53a1ef9b8f8dc9a4614651aef20ea942e2f18eda608b13aae065725f10
SHA512ae432a06b5ea73125d2c5f8f831a4019e4e249f9bef4bf2f4b8f0fafb1a79f84c8d35193f4e3dd0e97fce9ead377daf77727ccaca9a50a50eb7ac5f1a521a292
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a