Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
47f53b8e6c8cf83b0579486f8c4a14d3_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
47f53b8e6c8cf83b0579486f8c4a14d3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
47f53b8e6c8cf83b0579486f8c4a14d3_JaffaCakes118.html
-
Size
20KB
-
MD5
47f53b8e6c8cf83b0579486f8c4a14d3
-
SHA1
11a0013214395a31e2b308629698e35ae19f7d30
-
SHA256
8ae714515e75aa659fc7aa4e82c697a46c000b1bdc928590bc9b8141f9f61d2f
-
SHA512
012c48dd9f21be399366c72574457ee4be1ceb2a3f51e5f12b34ed2a36bd2adc4632fe1672ca777e1e93a397b32761806be78ee305bc46a556b8c3d183a60afd
-
SSDEEP
384:bp9pU9UZeBqZu0AOtTarFAm9B9ksSsA8kxrPVkl8:7pUfqsjOtqBdSRPVh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009dfa31f92185d47a05d457b2963f69400000000020000000000106600000001000020000000ae49f632b92d53e500e9d4d765cae7c0f834650ba400da388621a1a7764ee971000000000e8000000002000020000000ba328c2670432b6f21826b6465fce5f4418e2de1c6d3764c8d5a5dfac3ca684320000000dc2e176f9e538839f550c0f886bae378619df5d0c962a7e6622d25300967d90740000000b99bb93ae023d13137f7d0edcb0c7045961dc311715e22f9ee69db8c43267cebe8308d217100705088aba0cee15240bd89076eb1cae15191ce6cd20445c13bc0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009dfa31f92185d47a05d457b2963f69400000000020000000000106600000001000020000000f9078b1350668f325cb3b92afd2c3275667126a5b4b25a34508b7552ef1bc6cf000000000e800000000200002000000090517f0d374328a108329e3a7304a9f12fee5af2c978b10bf40bcb2c869f758f90000000bd14e5547cfc4aa16520ecbc7b4371837348df64f35aac752996c90d3a6c4608edcb6b0cf1fe996f4d71c8d8f653cf0e97e4bc5fe3c49c3c2c7794ececacb781357b1730eb998dc8c006ee45c0d17c6caf8a76d36746fd17d5ab9c96421e0f5c249d23c3d1084013ddaf9c59b62f281626fd2ac330c9180f4de13fa4b3bf6e63581c7a189f2dc744c2519a87d1666a6040000000427ca0b7daa9bb0d4912b4251a20f94f9be8df17938af93e19ceb77e5e0cadf8f277de2c89d581f82aaa764f5f7a489daef9794854beb95e0e4e455e37089e96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCD1E851-12FB-11EF-A4A3-CE86F81DDAFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421967709" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202e47b108a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1624 iexplore.exe 1624 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1624 wrote to memory of 3056 1624 iexplore.exe 28 PID 1624 wrote to memory of 3056 1624 iexplore.exe 28 PID 1624 wrote to memory of 3056 1624 iexplore.exe 28 PID 1624 wrote to memory of 3056 1624 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47f53b8e6c8cf83b0579486f8c4a14d3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9397e38a25d045ec32fa10c4675d772
SHA1175cce10bb3f71bb2cac2e97c4ba474b4c56e2ab
SHA2565aa43f03ab6fccd87479b1a7c3341b80857de84abc85a98d7a955c5a6d6d32d4
SHA5129a86a5bef693235bf799fb8d9c7486a08ecbaf4b00c953f7ab450e6786be20b473d22cff569503b64a327135fec4bd10991fc70700b0496313c01c83fe5dffcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5106a9366bcfa2bbb5560c84e3a9fdc96
SHA1615f15ba3365f4bec423e79ec357aad45de85327
SHA256f1c0b791d167854103ec0e700ffe28028ce08bea1bd0f1bf8a3c7b33f94636e6
SHA5124ca3a2106af44dd5c2501753028a2997812d049dcf9c2fd3cccd2c0aba46af89a63a82bc0ee0e0f8a89f47fb9d6b945bc0c79cccc613a3f3362769e87ac4d864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da672ced0db345f1094b202be0affca6
SHA1f39566bd72aeb7694c1a2753a4aed7833e435073
SHA2564dc0a2f5cc8d03fe65d96050627869774a4a7ba4603f5903f24f23eddb3804f6
SHA5126df3d223e8860799e1a4d2fb04d11abccd6be48b0ff5ac804c7c937b580e7d2ca85eda2cfdd371399754602383e9389db520a16f19f9283b7320faae031fa2b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e466d52d619d7ae9f0ef50d341f5f6
SHA12c3c21c4ace36a19e5886b4e6230589bfc4f18e0
SHA256c7a09dedee785349b8e507924cdcc9a31c4c5f6f30d0845aa1bfa94b8eba63c9
SHA512f4d8416ef0f98be7586a0e413f74c668caf06d5b3a2232419e66c7609de676b6bd66d1015e09e02e4671f9a91cf94873973aba025af8abd52e5d85a8c7bbbd25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c5461a358931567e04ad11d3ac8d1aa
SHA1dfa8f489b0c6fcbf6988d3eafa9329519bee3739
SHA2569561f755bf8a25a9b8b84c99771506793f3a37caa7f391a6da4ca38001013459
SHA512b186083bd4e9ad2d8b03cbc0cab9693a615e4b284a96ccc7270aa5b00b28e357c5b506a8db82e796ff48b60f4f0e098a7e36a82a19b46f15d1d20264831df796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5849997083d9407952e148e5768c3e8a2
SHA1fb1b0babbbd0f332a6425fe585f302b66f667968
SHA256c42d0e6586821074672cebebe26b83c52ebd59da444f0410e3c04966757a2bc4
SHA5124e7be8cfcef606700d7afb8399334078c202b2958676c7648bec8765f8b05e73861a05723431842f5f5af31190a6d07bb13532d174937dcf1d203f1b7a07eb70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea1b889499b017c149a2441e2be72dd4
SHA1bb6249fa97c277d58c5296c9584c35b6290d5430
SHA256b92879962680fd55b7d2de14fff73e3da000c4c0eacab91747f7396e04ff27d8
SHA512de3bd641fdef470242a99da1915dcf4bcaa7f48dddf5cde66065b35949aea0df4d13dcac507a2abcd4ce91a3d9d4e262a3cc3fc7458be4e97cf9d2de043adc22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d90b508718aac87665c85f3e5b51b233
SHA1ab2330566adae8227409f50b0543e8c3bf23858d
SHA25668637d22b4e05cafcfb26ab1cae99b7b1b602b2c6345c0068ac5e881bd82248b
SHA5123bdc7b92afb033603e592905647a38b13b67d4d07e99e3f396a20e40176284327b7364f838d1497efc8fe523e266c5a54c96f8685cf6643af04c9d2adc72f38d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5287094f029bab757e50f78029dd5a9
SHA12a8dde85c79431f9b046b7fc95ff58228fd05e07
SHA256ed29e8b373fc32baca9641f0aee7f8620fc4be4ba48028fcdddc519c58537a25
SHA512433934fd70c0d6746f1e3ca4641d3fcdb5631f28d2fd6af07e7fc21d5bf948e496b2cd0423f9c372773cfc11f46d7a3723559b48878190e37e0e6daab28fb279
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584fabe1a372218e532981ac65869e098
SHA13bb2a6412c72ce51fe1d58defcfc64458b403856
SHA256be6617bee58a966cd1778f5a6630fd8fd32f8d61c8f809a178ae4a5154e09ac4
SHA512442b8f9219f2c2000afa56e4f187d369f004c98e96c43a558382a9865775f77517b3159a6b488a8910d59323b96cd5d46ab8cb8ba8d24f5eba0384762e908827
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a36f8be2109c359429a403c6752225e
SHA16a58f953b9cd81330cac78e2ba1c6df186a09079
SHA2566f8e5d27838d125568afca6b95bb46b5da68bd9a2a9f67999fd78f13af2fb1bf
SHA512b3b57267a61718cf09ea4e8a80e3aab2fd4051feae413667abd13cc48d3fea5b0df4aa101a6346c94bd5a0a12cb4ec943b2fa4b87ceeca0e8e70db6d626e071a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c40c2c16c883120bd0e15250598c7d81
SHA15f14aeb5d3384940001f435618919049e21ea178
SHA25699c426bb0756124df3d56f76b2306b6c5bfcea7dd607576c5675d03980325421
SHA5126cd450924f5b1944f6f134677e81bc4d25884ec3975becf7f1d27b8ed4b18fa359b547fd83551eea1439666f66241d14bc9d1ff93896ab3c6e5ceaeaf66c78d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57081b1cc42340f2e4555973c6d1e341d
SHA1d71e71d3bf833887d2fa596b0b1bdbd2dd9b0103
SHA256f851fe7addd59019e4443f16ece54a8c5dbc9682a85f312d53ea0b80e32ae543
SHA5126bb6dbb81226335ed5ce0d5265c299c44b88187ce4ff733f0aa3eaf26dad5a26458b522f337c0855792c5d27a0f77850aede7735387cbb52850d08e81e524541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523e07e97c43be9347a1349e567800fc0
SHA1531763cb3a7c3dfcd6333b548c2a5696775687dd
SHA25619d6af7fee105fa1fbe5b3eb6a77559463f34524c175828d18173466b8f9f311
SHA5126da1b6945c2506621a88d35f10613ecf3e9cd1ea5aa54b7084c3108738826d68d1f176ee433507c51637e2c823aabea564d5692b988140b09193558167b23f1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d9b49191bfa92e8fddfb21a7689add
SHA14b8a27a3d7345b0e521f8bfe314e8aff20440791
SHA256c9b1ee9ba639375b0a786ec728978df8895a0b91ee068554a7c999b61a5f1314
SHA51230f18b8978b00767fa9909eeb937276aa799cc182443b2e83e7ed9313ecb29e46a8fed43743b750011005ece4db523a4a817bdf096396916757d975537d3dceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd5a2110768e9a0b1864d94e739bffb0
SHA1e5139973d2deb26a0401784dc03d195892228fb1
SHA256663daa068de563f1329a15c8057d72d42ac72c2b3f4d4f14e7c742755ef48b73
SHA512b496343fad7cff06d7e548d7bf34991a834d8f8eab436a85e931c94a753a58dd9d7ca6f647a5cff51551b90240c5f8b5bc74b9760fda3fa26da421d91c12d7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51593fb947c51a00d240ac9aad0a91b5c
SHA107011ab632623ecd29aee9517e542bde58804a4a
SHA256f42c507758c8a70df9156d726cb2a7245fc90393bc045cac0795327d7b5a535a
SHA512eaef50a1c82330f7784fc8a39ea504e7459e99df138f68457efa724a5756a2a13f76cd7b0cf7520cc6435ef2adfdaa8f3750654cdc29056020d009bde6c445ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1a31ea66e37d93ebf9fada8949375e9
SHA1fd78071950281c44ecc7ec133e968b246ce8ef09
SHA256a9592faba890f2804f98dbf7aceb2c37d5ff8b310dc8641fbcf1c29786138265
SHA512a11e584eb8174ba0fbb5015b849165177cdb78645fa46f8d9c2ead1d259e4579831196b8efb7e6bbd53d70baab475bb3b2935a706292246596344d2299398c62
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a