Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
47ea25a8a4d70cc4653f3387f9c8a51c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
47ea25a8a4d70cc4653f3387f9c8a51c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
47ea25a8a4d70cc4653f3387f9c8a51c_JaffaCakes118.html
-
Size
460KB
-
MD5
47ea25a8a4d70cc4653f3387f9c8a51c
-
SHA1
3cd06490fd8b505c10ab59086f77895fdc63211d
-
SHA256
6c1e8a612e63024c7961f906ee7d9e83054c91a8a2d7dcf523ca2213ee0b6c38
-
SHA512
8608c9f08f095139927538dbcbb907cf149ad0d1b88873fd5c70a146793a9a34a214c2c5536aa4410bb1063dac183ebf0f4b8cf431a49c9932d9144062689ccc
-
SSDEEP
6144:SYsMYod+X3oI+YgsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3I5d+X3q5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000082c9ca22201f17ca36aab080eaf879101fb4efab2ab7d5e200cc77fa1fc607bd000000000e8000000002000020000000460280f58e6c01d4f77b279066e136e45de0f4267d409037cf704a99155c1e8320000000cc181de254c3b3ce62f7a26fef21b950e43908482ed29cfba4b692634b592f5a400000001b2a795cdb9435a341a9297c9614a405960caaa579ec4e258c613de586ab2f791eb806bdf3069dfcd36cd265dc3bb8f67871a962b3f3349c45eb581c7a113361 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f490d4b6a842a5983e8eafbacf9fd797befe0129815d2612bd30fa949d7447ce000000000e8000000002000020000000300e150921145d5388cf2fe57ce28dee59874ec4e96de76049048571b643112d900000003974a45a086300976439072a4bc55988827f0acbe14fbc0058a5f8d8428cf74c45d025577c7d8008b37dd34dadb0d1a54f2bd1287a987ccea7efa271febfa8cb8298239f1c68acc3402706450119574f76479d04d7692b3c59312e7b0984ac27ad0583855a3a2b1f0aa1c4d97c03e5903ce5c51e29d9e0588bbc24f55158242654f1366e1ea196e1a13197283de14e5d40000000a4095bc36c589ac459718c692080bbaa0d3534354d726a358c2e39d0bf906055f6e0b19d6e76688d5284e0fbeff37380a17a12b2d7a834d16162836abdabcfe9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421967067" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E354C91-12FA-11EF-AD96-EAF6CDD7B231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b2b93607a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3040 iexplore.exe 3040 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2832 3040 iexplore.exe 28 PID 3040 wrote to memory of 2832 3040 iexplore.exe 28 PID 3040 wrote to memory of 2832 3040 iexplore.exe 28 PID 3040 wrote to memory of 2832 3040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47ea25a8a4d70cc4653f3387f9c8a51c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b96b0cac49a4e9ad80ef6177a3f5086
SHA13f0f434bb0e8cd7a7cd4ae57d94d89f8b02b4926
SHA2561ef135f1c737a6cc89a3028d1d056f051f884f343531af58c8f3e83b396fa39f
SHA512d85157c932d25bad804065a9c9e5dfb457463f89e8c1cfeebfb9ba1d50a3365ab7c1bc25cecd35614f59bfc86385fb4337335950bb6d41aeafac317573ecb1ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59860948d2c1d7bd08b890ab41ef4a3eb
SHA1ddd92b56f7a1aa23b97cbfa8626ccad501268a1e
SHA2563ba87603d6c817185144a5ec0eab38f775f64d80bbd72b88b58b8fc245e053d8
SHA512dbf31715e79f53573d0e93a5563f77c05a600d9e8d534dcde15063d181b1d02e88ce0177a34b07b27a18d4005ac95423af7340974e9be9b0cc8b16009851ddd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571cc11bc7a1c04f8a80d566960937726
SHA14c75c0f43e9e5c75f0c56c6a4a958899f3d4f9c2
SHA25653f8ad9724b2bc4aee97f1455df15c1dee83b1decb629ce7b4f9c44837ba3048
SHA5121e02886900eecdfa9bfe9fb31c694a9c9b9bdca377f32f7b8de310cb815f7b17b4ca1abd6118cf708ea6ef56062f9f96113cb1b949ef922d10aeb82a50ee8f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef2b04242a6bf72e824e7979da586102
SHA1214d7521e2d39475d4933c536b7a98ff9878f009
SHA2562fb3024557f3aaa58bca499d09a6fcc48616d48f85ada2404484fe6b203254bb
SHA5123b06c54b763ef2418c03ca6b0466ef5c41be813b2068663015c7044fdbf38a1dca902c1433f4c698b405323a0c7fb0971f1d1e80f47a3fdb4a4a2315bacc1965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f517cc2d8bf8cf0596bd51f237c95720
SHA1f54cbd29f29a8e87fe4979779a24d35cbae9ae91
SHA256177e9d22c41bede53aa963a1d0f7df289d8c6fb3b07aca0bbde30bc95268c29d
SHA5125ce6da8bf8978416261d222b2d13863dbc0294cb82d76dff6e982efa10eee55c273f276075c9195e32169c1a774027966ea3ab2f05ded5c9d1bc50bbf31c92e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554ee3d5a405a88b55b319f499146a273
SHA1a15497a19df277f34c68dec1273ec0bb56823227
SHA256cfa8e6e27fd0b8ca6fbc297002eb86d2fdf491ea7d9eee65fc586e29b827137a
SHA512a7aea862a5251b9401bcc6928d5efe08adebceb18373f6b0c15b1ace2cfbcafedcc6415ca418341b2dfcb180f03e190e70c631136b23747511e5f644152977bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5443ff51012775b705fbfb2332beb2e69
SHA169fd334883c3d5b8d5389f397f6d55bae81699a2
SHA256106a7184f766f4d942dd61c60a68da43a99d9c23253449ff1b28369604e1391d
SHA5127c95ac25a3dbff0fca9b3d6b9355649aa05b061f5d853b46f641b7cea80f406b80886568c8ba07295cb3192960771aed41b9d455b17f6a7733cf1c46bcd96ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d8df9cc74abc9213f0490958e467037
SHA1d286fedff8da52ec2317c3304ad356d35c6d59a6
SHA2568eb904b3ec30c8145809f241cc73d829091e1f45275314cdc9d4b43ac0cae108
SHA512397282a7db63f440592d0fdc171fe6a829b59349516f5334068db1ef110d2d15a78613cd618ad80738442331d7ed89f6d2b42b74f477724345765b07cf0e3538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d164594b07cfc148ad4403b294eb9d6d
SHA1e049a84cc7e88eaaa6fb34b6e722dc10bb7d605b
SHA256d520bc0d843034749253a6ce706fc7f921caa02ff6dc52232a2ca96e4df4f828
SHA51296896a6c62c5de4cb3f6f97f17136125ee87a29c95d366a773d5c561d2bf14caf2693688e9316547a58221a0059c81b8354f174e530b3a8af12766daadfa17ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a21ec7320b9af9e0de88b48e3815c03
SHA1067f698e0f992527541a0d0e38749374cf4e5add
SHA256d770ace2ffebbfad50619e3e2ee9bc82ac7659000f623a287b211217aee15990
SHA5124426e1003b19e4bb23ccc9e394fba7b5dab4c1e64f40cccd6d35af5cfc1df239642ea0c4da37a6fc6806d64b541afd594a415c8610663041da232b8813d64081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f6eeeca8ab50b8e5fbb84d5f1a8e6fe
SHA11d4668c192835fcaadee634cf7f24e4859e7cdd4
SHA256be9bab5ece5aa9a3654dba91d4f3199e384b42a7c4cb1a78ad334a595aad61b4
SHA512e61cd12766cbfba41b7a7e457b6f7c9881ea5a0f6e00143bae747af60ad24d3ea12488d5dece5657b646514308e6cabbab4b88e75e03e2ac760890b95041894c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b12ce85c21365863ffa85dfcc7e7965b
SHA10d9b0ef17a67311684b30ead6ec3f91cced8eb6b
SHA25619e09bcbbea55b907c6b9cb2e9b6fc52ea0ad66b2331ae7424d22358ca50c8ad
SHA5120024b89e8e882df8c18d7b6ac8dcbe347a5b780e69ac69bacb972b202460be445e20495fe676f435a5c606d366749f912d48ebf94d9d5f541938a04b2b551f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578dd86a832dcd2bb892a75608b7b2048
SHA12eeafdffacde8101ffd8322286f2d0bc2dc93beb
SHA256ba42916d3e8c34cdf7285e163f31d15fa0e75e8163da33459942c09853ecaae3
SHA512d473314a5e17a48cc27942f4162723938a2be44b1790e2d1b4e667c549811b332ff3c7b39e10c3ed129787f008eae96b0ea1385a4d18ec57c5935cf695c1acbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6268a45d17d7ac6b73ddb7e7d05e0ba
SHA19936f8913eb7b0f6a1505f3922d1aa2c4b2f2f6f
SHA25616f585d84c337000ee9cb7fd01684a3fce88499153c86ca8132b64869f1fd4d5
SHA5124c199b17fca95a4609d4dd74ad293bdf3b8875d5b28e4787ec47d7169a2ed6a795094d42fa83e4af3740f2627af98aac1e6406a0d5aefae50cbb436d1b729b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f2bd8e1880e2bce4eb30d965dfbdc99
SHA1715a7bcda78efb78ed5ad6f1e6f85e054432fb3b
SHA256d8ef94f37e7a2298e0e1437e3d363a3f970e2087a3996c49306f9c6a6f407714
SHA51259e9ead575715d97857aaaad55b5afed3139ddd6e0509efed7f0a8311936376d2a77c445b6dabe2e4f6a865cc6325b74e953f7f3dc3aee253cd5a6af810e981c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe34c5bc336030c7da992a5b8be2f2aa
SHA1e9ad83af485dbc82fa7a6ebe0facaf696dee9214
SHA256311753d0046238bf81b72cbae65de0657c1c1334d32e734a94644f59556455eb
SHA512216c5c63660cef7d6708a914c238a19e5999cc69d769d29092bdfe057883fe30a0fb66c53ccd111f19ff4ff852b70c5af3892a86b83009e613e2579e2b2a99ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5223485eb120bca48a37439fbf4148ea2
SHA1c88fb735acc816e99f69a4417abc8b15235c5863
SHA25639128bb50ae06f5389c3ce08303aa53e3ce2ef0504cd37e6977c9ef604ec9c05
SHA51290597ced5cc7f2436b5e4a38b442f753929771de76f4196d4094ad4c2da3c6c7280954512e726c60e7e9cb68cec2e9fe1dc9c1d2cae8f7827d6eebce8324cb71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f6ec9c7040539c23df670e238c499a
SHA13eacfdb92d40f1b72e2b84c388f02a266f6a2a86
SHA256905cfc85d0f223889f02f2c545815a24dd17ed3559b4ac36864a4338dc746c6e
SHA512e0ea548ad8f6ebe68d58f8f58d630c614ab8e71f5b054ce39947ee63943593e92a4daabd01b04a2514c307aa08fa749159e50318df6062613020a44b675463bf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a