Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
44c900e628994e0f89a2b3aed2c4dbf6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
44c900e628994e0f89a2b3aed2c4dbf6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
44c900e628994e0f89a2b3aed2c4dbf6_JaffaCakes118.html
-
Size
3KB
-
MD5
44c900e628994e0f89a2b3aed2c4dbf6
-
SHA1
1da3a80b7fefb83dd2d1b8b4cf2b43a263ec15a5
-
SHA256
7659a9975766fbcef817f79b72696811d59024c4632fb32dc2660ac755bb824f
-
SHA512
629e976f600f6877205a3242f16fee79418c810c93d0a4db232f25f1040bc6c34a22697ee6cbcb8ec9e32f291a7ce7bf4f77ed201894cc22bd176c7d19aab112
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3691471-127F-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000bf95b6c313b822564d64b55a7ee8f14445498d76d03ee0d46e46dce5beff4286000000000e80000000020000200000008a3a233f1a3cdc3b7419609daf6f1fa995b27ffd10fb25c89468d7df95d46c67200000007b58e0d823dfcb00e29f62c626ab190fc3d3265b5d300da1483c04b061289a59400000006abe13182427e9ed03433cc6e51a67c331b00abc9f1efff3401c85ec7aaa8c651aff3efbef65bd30de7ac7badac0a57b26bdea608384e837b35fee0515eb503a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009ff7778ca6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421914355" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008936196a2e1f491824497bd96d0ba31468d4c0ce858674707d7e3de585319390000000000e8000000002000020000000e9a8dfe538f4092784f6b79b9fe1706c495c2b6d037a91494aa165d9a212968690000000d2912180feb8bb8c74ba48de58c191353e873644cedc81fa6cf80e23a11ead7365dbca4ed629da9a67abc11659ee9e9f67e5b07ad04ba0a360ab41d7caa856596114f367904f79483a22a6bd99f3f72864b1bb0a24f1445658a34fdf36d6f615008ee9ba2d00e0c3e25d347bcde66e39356f06b49197aec2941345b3cf50ef8579dece672908ed854abc5a4797fa28bc40000000f4ff457d316887c2309e632bdceb1ecb374345be620cd2dc7aa08dff1a59a5cf017deab480ae9052b1512260c1babf6943b69de0c5b48464dc8c9b3ef4d4e382 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1904 iexplore.exe 1904 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44c900e628994e0f89a2b3aed2c4dbf6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf99f37255ad7ced670aaffe284e87b9
SHA1f33db2f3d7d44fd91aa9ba147c5fff09477dac22
SHA256ba8a649adb03ba17f208ea6ada58816f092cd9c3ab701d6dba22c62a01963d94
SHA51222216ae321e08b468872925023458d4b40bf9aa2aea02010cfbc76e0a75cd70e0bb2fe1163310d0654a88e9011eb541b24b923cc3e34b6ed253bbc6296df4916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5780ac19ef500315bed45645d3b7b4d36
SHA1a93d9cfd3ccc79ecf4f1779be8284d23c35a4d5d
SHA2566d3d5027af1fdc667582641fb069e1ef0136a897590946ac33c78409f5a069aa
SHA512152a2a57dd8e29f58ae2bb808802cab93442e99a12ead620033dbf664615906241daeddab52ff2b79c947330b41ca0c877ca876471b4e12c1bb2618b0c5511b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad1e48c10b19e24a1fa1a6e0e73b933
SHA1e0dece36b70a41ca42eaf3577e32cbc86f17f609
SHA256b91c5c6e13f85d70fa0bdfadd8294118480d81d5e68820bbd1039330a1e7e99f
SHA5123d340e3a4d250ff49a715cd83f6252db0fd02ad0a494772944474189dc954e1ebb4ffa2b50323d48c97538ed365a3143894d3b23383682f9f751753213bc0c3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa44f97bd6c906a873852473efd617ef
SHA1eb76f49278e722d33c9b1f7386f1a5bdc176d851
SHA256846f9a7c1a88cb654939ffaf7a58db5b69de9748f42804312790ea9c5c4e35ef
SHA51218fcd94f8c794f89e01bce4cb2997ad85057b1b31da8ca0b7f014c85fffdaa3f728c83244222c32a3bc279881a3cf27622c6375f66b7e8571397b1ded8dc8139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c3b4695c26e0e51d626163e6129be1f
SHA1eb06d231df34d9af126560819115711cdb3681cd
SHA25679d2a214439054d2f667db34f3b4e1a8c505f39367365a8241789b61a8fff553
SHA5123cda2973ade9a79a024e9872d3690869ab1c5035d9668cd815a76e73884737e786a228fedeccf9ebee93e646fc1c89d8357b4b5ff69b12c59e9e3ceb0e3a8563
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c30db4d326ea3f4168cc079acd4517c6
SHA143b1a04bc7ac8d2464f4306f9dcb07b61aa7ef78
SHA256dadb9c8cc1842a66d9e5b526d0388a988b61f2ac284210646111922bb49ab895
SHA512a4f868dc6252b24c47eae43e534a232c3dd5e483f9565d20a06c4adb4597268ee284a21c75ada6f4c863a82534c748f288feeb17d428697ab5b5f26257ec3060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541b2f0a90ac16b2a2d1fba08f741f7d3
SHA123f48fe7ad07b9440cbac44361b220b07f643491
SHA256606f4751b4d3c7727006d68d24c84e2216f2b10e5159f1ea384804d61cc196ba
SHA51298a5600e71d57a0a03d62580858b7e9733673e19b4fe9f12960fae0fb755080ba32943992b129ca18821d72e0a09cb75d6049dc8a2f0e92eb38afd6e267fac02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589bca73d8e4e74bb061996e3ee6fd582
SHA12bee5c669ded59318bf53a49a1ddf8369f0a7906
SHA2561c5093fd4f8d79b4f915cb1fe4ca572f11eea9ea1f125880df6b8e43641cc8cb
SHA5124489d9faa1002c4304eb9dd5e1e5556b121706c1adb97105c53dfc0fcac1eb775b63a13e350dd3e90e0900e83e9f988392c3ff08fff14e15f90edd3c08bd429f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e759fabae51f75b2d859bb57192cfdb5
SHA12e10241ec7ad2622dda059039bfc00017b5e765f
SHA25607833afb6345dc80206f3e0f9453036b5350dae4b38a9655b58870f0b094c979
SHA512ab792282754cfa46f76843dc7bc28314f4145d7b40d186e29d659783666f6c5e46a1185862557d52e2be4ca205ecbaf7200c05b9b650fc8508d4a92c4371c965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510010408c9ce3b6413f9fa09ba7c76b3
SHA1e8e6352d9190b3f9b916f4fa2fb7faaaa34bc455
SHA2562532b05727bf9fb6b7c82681b1f94d4e8d0ca054c1ec6f16fdf8afafde4c15e9
SHA51200e17b7fe0dbe39e884f42e8b8242f56cdbffad9532bcc17dc968a99e4f8b26eaf2c2736d9686789025aa886d67cb61e43232777c9a3b6ed93802559124e4f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0a1e111bd5d9e2813753a282de0c919
SHA19f53eb23c48c07703065dfe8c193052762c34cf3
SHA25670648107e7443960d723b04fbe0263871506c373e60f24ae17d4afca8f6e7365
SHA5121fb9e90fb9f0d766bb96b68568dd6582fb24fcb86b3f0a4a1e82829e47ce1b73b704ec1e405459a153dac95bd65f312c1d9ddcba113831c19ce96ba8f000ed33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529c12f936072bf9e6a647dfe182ed355
SHA18aff56e700de6ca9e8216005123a6cd738fc46f1
SHA256ccaafe5f7ce4c20d93693f1306b765fb73c7aea5b2dc96f3c34e0515d7055042
SHA5120983a2a9f7b7d44feccf5dddd3a493f6e4401734b804c082e31ba1ce2a1e37bba3892a406b123d1d069e2fed93bad701581a0b71bdf4259f554c27140550e543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a33d7713b5ac05fabcc28b11cf1c3d67
SHA1eab691bf8152239896ec5e1101bde5a7c916bde8
SHA2566b7911ab9c386bf964d4f59fc7e70370e8a318daf299a3a692b16b0253ab7c76
SHA512980ef25d8ce870201fbf3357f45bd223a725f71eeeaa477c9e7c9d25d391d40c0bb4b7d8f16a0f6f78b61db390d5737ff28b17b6304a77d6dfdc9d83c93f9e0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535c58c9df111474dce1afaf5c38ef9d7
SHA14e29a5b8c7be764a36a18e009336e16a8996c8d9
SHA2562aab9d084e05e3dff78999de1dfb88444a0b1db9bd7179345108333bbe664e9d
SHA512dd0f938bd8874de2a6bf1b26a44f059d578c2442cd8075261963f93eb81498e7ae15425b1e2e2311e5402f582be1c43b0777b7a03776ae193410267fe0de2f02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57421bf7f0924e38ea68ea88993186555
SHA1c9a45d6404e8c7cd236f6b86379eebd18749671f
SHA2564592c5d6973f2086ad05f7c4ebcd45ec8ee654391d589fbeab3eb40ebe596b0b
SHA512d4ae961b51596a50bba12258fcdeab15d0496c4a6c5a6c699fc01ca874352f0c0eaad7ad9923a73e3ed15814d4653f02e853e8503b242e3953fe543e3c233208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576d673a9e2f45be0f74a2fd415cc7823
SHA11dbaba1acf2e8f3ee469434c714f121b19e23502
SHA256f20f72b1ff181da572d39927bd0485603ccb165fffece1cad618a338957d5ca0
SHA512746cc13e1cb739a15873f9173885c8c1417aa947fd4b99263ba0bfd4f54ebfd52f3ec8fc548bd8d4222a198578e1c8f544f3c531408e9c5c6c58d089a98f4812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53892770300c7048695822cc0d528a7cd
SHA14653b7a0e615a928af17ed501c1729d75480691b
SHA256b155480878789d3cd9827413ce87ba598d1be3c3218b14430bdccb048807e7e5
SHA51207f0fb841a20e975467ffec858f683b69f076000d3243d3c818949522b42a3c0efe1fcccd201df28078140fa1dcc1b623706992e0a1a88627720e4ac6c9c2538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a31e831ea27dbe4a3fee0ee70177799
SHA1abbb2a1ddf08e02feead53f94d4749a025561f41
SHA256dc80765ad8c8a3226c5256cd927dfcd5767776fe9e189d64f7c11b8521b2bea3
SHA512d66d3d47a0df0318add164ce39523dc6b67448110a42feff6f2f1d2571e61e2e83e4263a0fe15c9a3aa6180fbcb4ee747f9d23b884f01595c9d50972b256e3e8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a