Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 09:41
Static task
static1
Behavioral task
behavioral1
Sample
4592e5ccb2782c192c4af2d68e39ee9c_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4592e5ccb2782c192c4af2d68e39ee9c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4592e5ccb2782c192c4af2d68e39ee9c_JaffaCakes118.html
-
Size
3KB
-
MD5
4592e5ccb2782c192c4af2d68e39ee9c
-
SHA1
f2ce0e3e4f625cff333bd19222e80a94d9fedb7a
-
SHA256
3316aa6581eb2cbf991b883501e95c5f2af22b1a97acab327fa7b2eca9adbab1
-
SHA512
9a987146ffb2b958610ac82d9a9d82d3ddb032381e82584c0d81853a4f9515905aa67433608d5d9147b02f9fabc18c8e1b0184cff5ba660232c1ea3f18ece1bb
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C8634F1-129F-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500ad221aca6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421927981" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000021aac30114086f8810d22e1d577647ebb7ae2f74bef3e57efd460118aaf153e3000000000e80000000020000200000000ace3f667b77ad42d71086dc0bde4dbef26c72830f321b3888331f02b2d0cc34900000004baeaa0ea0320d7ffa83eed99e23ec21ce4d1059ba5f68fec400e43894b15e3e422cb0431e23b5e41802465c4627c49af5e13aa24e523257e763163059c80c2c1b3bd583c01c219e1793bb1b1cae0633349416ee773e4b9b95f232c699e5e836a707a77912de7f7027ca7f9e21b880c60ba92cf0c990e04495033f482c49557346ee72c02120f374a074a168a03493c840000000007918aecd49e0b48c47cf074421873076d2b01f7851242d47ef44a4ada523e2e76e5876f6bc09e914ced667abbc53e3a6ba63d15e5ac3d2f5e87ee441742750 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007c7ae684439312ca2ed105793126e560902c7dcad5aa3b425e20247cf71dba29000000000e800000000200002000000049f8d8db499cf904388e9f654a60560831865678aca72ae8a98079284e2010c420000000f6015fc77f43d5d2cb76513add1e6e8a3c00c24ce1121ba9c6d8e583bb538b6f400000006bdacdc7c6f3604b75f36c42f14f2b35d7e4644eb5d4dab74e93102f97ce23f33e705b9c3243df05119de288b6eed007c11c248a71a325ab4afaa6322bc65b83 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2264 1732 iexplore.exe 28 PID 1732 wrote to memory of 2264 1732 iexplore.exe 28 PID 1732 wrote to memory of 2264 1732 iexplore.exe 28 PID 1732 wrote to memory of 2264 1732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4592e5ccb2782c192c4af2d68e39ee9c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565140697fdc04da0a8f7c7b9a91eac10
SHA175b0e72b38f703850232838f04f54fa96a85f276
SHA25619b85cfbbd88bfe7237cef5952df44e27fdb90a54ec728557e0667b9868281af
SHA5123c231e3edbf98d0196957816b3d6b17f3a26e3211799aabf01d45a12fed7dce635dec6979679a25aa47a37abf96bee78097b38b0cbc9ad2e1154b2e9b89a0571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593396eba85033b3f81d1030acf543901
SHA171be933ab4e47e7a1e9e69c1a0cf6213c22b8f10
SHA2560d736c5d5846e2bfa8d2ad93d892cbb23a66608ff875258bca31e0dde34aebb9
SHA512cfaa5d2f6ffcbe5275945e1d10d8dc9cd61cc5c1cf81cc24fe3b093627376cc9f4a057550603833ba2ac21fb94b1b2ff8431ba70956836d1282d7d29189ff540
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5180857e18fabd5ada0984a2519b74e1c
SHA14f76e36e50b3e68c045a8920164fa92f7fc334f6
SHA25608007c1a8bbef9629c28431cfa8d0a61939130ac6ed24aeacf2adf8d13ab543c
SHA512c1ff527c82532cd51e4b9f90cdfb53398b2cb111449047221ee321befc47c90a90457af03909dc15896aa982d5fe22858a35ca07c46a56ba86b68fc48c1a9edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f61daeeca0bd0bf29e48d96fda74e61
SHA15c9e3958fe8743d57aafd1bbe4ab22f7b87fdfc1
SHA256dac8aeb0ef8c94f6896cd47df5a095f1bd75b2b4ab6f7493ed4b0174ffe93f0b
SHA512a37e6ddacebb367d0a1d8a7a4bd509f4afc135bc8e217c889e029501645b37bc21bf0a255d7a724d40066ca5df0a9ec2344318143c79d5cc3d119c0acde9b7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5940c4244a87ec5bd31167d2a9fc5ed7a
SHA1791a67ac18bc82b85063bbb5d18b71fc1ae95234
SHA2565a5a1dc971231e577b035adaceb656c28e7cd29fdc570d0ab8542e030e8d4dd6
SHA5127f8ee92c9ded6f39604f1818faa32c74211e3bfd56ce1ba39620f9e62102bbc199f63838db671f52adf04bf262d99ef5862c7446761d20f053bcc280601f0f89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d626d07e853a4202fb18d4dfc2311cd
SHA19258f104d5fc79fb77b9b159bf5a0fdaaa6e3956
SHA256305219561928483a710f7be385ceb4b4106011794b40f46ccf74eef0cdcfe658
SHA512f04ef4e7af8dae146aa78dca0f3eee38caa66c30a18768895fb06ff259c144eda64eac2eee8bf9a7960c596baa3948d78b06dafec542a4b15772777cd8bbb9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e6c167a25a585f2d1acc5bc8ce73eaa
SHA1b384dbfaea4f346aaab09ce785be5e962f9cca26
SHA256fc31712b07f578c9e10713121b084d9ebe64a104486c3aae381f5b6e6920e5d7
SHA5120a0c6bc415bd458f78314d6a332e4525e2594f5aa7260fc89015e0e2233d7702ae30c1743d00b0c18d17fb0c2c70285f395605ee840aaf6bf3ad0021647b95df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ff4e4b1835af56218f50b44cca38d9e
SHA1c2b72a626dc530ac15f3f17d42042a325e667543
SHA25697d352f3f9f5516b100393b2a7fc4911c33db1b4663b3b28121a9d6930fc9845
SHA512f0f08477dc594ee7ab6c29f5360dec476eede3598e34d1a1ca21c0e0a3243cf6fd44e72c623ceb3dbeadc4c5bfd485ea27a1e96b4f7b051853d49b2f4c7594fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572c22048d6c96a87fff76b5a2489c486
SHA1dc030e47022450bc4c94fea8f27e603b4c2c8443
SHA2566922d3b019f244ac8166bdb404ec212815a6abdaabb930a0eac2bf3fae7fde3f
SHA51279ace397ed48252083875609e2e9cbd25511303e9f272550522d7b52348a5c7157f37058ff830e1f3a534749c3ea25b6ef2de5d0150b604b732c0c81cb32b6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c8ceed879a09c1e659bbbee43e7c541
SHA1b305e1da5ec321c44415fb650705868b5515d495
SHA25642c24106def9cca23c00c84b70eb8d9dda54ce8e19ee42fbee845c9e1107930b
SHA5128c59e5ad800721bacd7a982d0feffe07431e1b7cec9fbeede07b79919d3b98464f294a4b65aa2cde1f5a5e0f2a893e3e7b41a738db5f9a2706773feb6fa688a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdf979c13d3023c0f7b56a6a90bad171
SHA1b6eeee50ad0800f265df4c8e992a328308eb1060
SHA256c0fa64af80930a4c8d722a8c60a83c5ec6d67cb17be574e20d84af464cbbdc42
SHA512a005fbe28748db96bb5f008824ce5188651d9fea8e6c1f6e1348422dbe26619750fbecaaeac67b3c51a9b8004aa5307e203151231db973c7994a27be535d7df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5784833bf32b32627302c26e7b1ddc65c
SHA1424afe2b6648582d689721d8b610cd1f57255039
SHA25625a1b77ce10a97e2401e137c687bfe54bd610a24ed83b77ace438ab343072c1a
SHA512ed98e2e2c5c046f056d7ce465bc405b34119ab2773eff677e88c48eb8ad1e1bf32b7d50b810f6f0a2403afc911cd5bec7fdcc1985bfc9c490c1cc5ae8308a697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527ebf4493f9c9515f66d7e6bf5d46e89
SHA122ddcfe34e6beda253615510303ce361df9ef4a3
SHA256ec443ca1ed3e30a176a3a8e89a325eb9d1b8e439d6afa0fbe1bcde8b8f99933a
SHA51233d58ccc4630ceab6bd981d1c9b17b0e3af7483cad46f24e5bb0accaf519bf603ed63e8538586a9aa98ff1419e5b1f09b411835fb8742cc9e61d8a4d53ca57e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588d5b3387576842102e8ffbbd54bc474
SHA18fd64433bdf6dc88e5c6c1850bccdf602b3b4bd8
SHA2560ff1d47ff19160693b1c010306678bc57413893e48dfa076ecc779f1ed40bfe5
SHA51269b04f57501cca5881e191f3d1e133c5fcbe82dd8215078bf9f3227c404065c56f2849567832f9dfb423d70e764f8750ba1cc360f79a0e33875ded8e76fa5998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ef36bc8bc147a7c3757a28cc979db0f
SHA13b74e8d098c8b8cf2e8b81e45c746f75bbcd57c9
SHA256064c6521634741c49ad5f7a808fa71160b9119ec71829a972aa5e1732c2a047a
SHA5124f1faf4c8bd7d0d6e0e61be023f59f29d925fb5dc02f52d839fb0930669f6740625e754c4152977570d5c11f97efdaf8bda477c9986bc4916b3aaa4710224dc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ebc1c710badfaa71207549f057068c4
SHA1e63329751ca086d9adc9522c31b2ccd5280d08af
SHA256a8e146d4b1f0ec85de55e5a30c2719d2b8407e5c9f459cc69be3dbede5b5d91c
SHA5129d20826a7b023cc78b8f0217f627a2d3162e6a8f998f8a747edc32961c33e35494d7146e6245dcd1bed5188047a67575e811c6f3d8c026b87ae2d4b2cea4e690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5753ae01d0207fd31fb3d32a04b97a3f1
SHA175d9ca9bbc6ef2f032acc828b75e7669b18b137f
SHA256faa25218dac21b0bbc6e7b0a599c5402fa7ba72c40577e8930b37bbcfb4e92eb
SHA5126ecca1a5162371f72de698e9dce86a4819ca37ac9cb7468781fd82214b8f279023bbfdbda5788b3e5ba1714da9d5fd1131f9840ced53af26e96c32b64cd77644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5450e74e56c4d7f84e25a4545dca6f686
SHA122576127c222c4e59db502a16a349edcf1a822a7
SHA25626aecef5729be7d347ef57fb5a2c8241f0527b36bd13291a33e061ebd194a3d3
SHA512c018fdab19a2e38138bd885e3243e431f5c96d51ec36d1a6343bebbdc021295407b6f1a69d9e74e3460914970b866c06f4bd5f13918754c5ae53201ea21c981d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a