Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 21:05
Static task
static1
Behavioral task
behavioral1
Sample
48083ab744724a0df63845ea3972cd5c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48083ab744724a0df63845ea3972cd5c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
48083ab744724a0df63845ea3972cd5c_JaffaCakes118.html
-
Size
11KB
-
MD5
48083ab744724a0df63845ea3972cd5c
-
SHA1
3be3ba68b6d06410d9da6262996be8a44600afcc
-
SHA256
67ee538d888b5d89a898daa0ef47bdac8cbf975d94eee2090fc6d7d686578ce0
-
SHA512
04381a0d9c30e035ae9536a5b4cbcec911ed959eba12eb3f989321c743fdfbcda5e4017d4239aa8ef2421298bddba0a0cc70ed76ad1f9c6cb4565dcd19f28db2
-
SSDEEP
192:C9AMgBEOks1QTxE6av//G/po5IZrz06rf6sH6/p16M56dv6UN6wsc6A06V5:CTOkjHav/O/+Ie6r6K6L6g696M646j6T
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1D70EA1-12FE-11EF-94AD-7A58A1FDD547} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06768a60ba7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004b7afe35ad625a026dc239faae708a2d7ac5ff42c696c0c2c181630194bc683e000000000e8000000002000020000000660b6768b96505326c5e53d6425339bcd3a8db6b3c70b6eb3d1946f0bb28f32e90000000638eb9d0e4d0f7b023bd560e1202e63944a6997397f6b80fe421a21dd151daa65d2fa0a91aa8a7e407bfdeb3af0a7c8a93750d593d196eaeb63df8ac0ca9fe42db583e51ecb14464ed377b76582424e013fb2e0165c7f2a2884495d059cdea9fa8b695d781bcb03ba3f2e77795a3eff8296fe989847b703c506ae13d7cc627f82c46c94b07abc264102552c81d58e54b4000000091c804acf9a8487f274bfb498f425f8dcb296452c3d2f06abfc19c6cdd4f3308a200e76901526e27b97f581f2021310115406fd1169cd2dd42c714a7de306a53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bc199da09a3506c25054cf0cfbd780b3605d374c47cdca732d359ef8fbeedfbe000000000e8000000002000020000000d94360af006fd559fe1f03efbecfa073a50b230cdbd4d3fcc47e44d3e2da4ccd200000005e93c139ab881a242e8ef16550f0f107d29cea06019a81d66efbc44cd6e5721f4000000088a3115c04af22be03629a3f52789fa947d02bfda91598656e16c3b2680a8e8ae97e11112809aff2d85e80661b0571e57e9f5e9850e7499ca98792d604dc4b83 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421968980" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1960 iexplore.exe 1960 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2476 1960 iexplore.exe 28 PID 1960 wrote to memory of 2476 1960 iexplore.exe 28 PID 1960 wrote to memory of 2476 1960 iexplore.exe 28 PID 1960 wrote to memory of 2476 1960 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48083ab744724a0df63845ea3972cd5c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf96a0b3125fb4ccd38a413ee72de497
SHA1aa6ac3437a0c0efad51e8b11b8f59c2c2f39fffd
SHA2560f09abb67564a24ee11859a963bb799a85daa98fb2c225d7428c0b95603f4fcb
SHA51292ebfecf4954263b4c0e8ad749e116b017da7bcaef608dec2b34425ee335163f2cbb71de3854aba7962889bc7abefc8e8b1fba1371ef2371398963d182c83c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50952fb46a21c081477e6549f5ebdcba5
SHA1fc256a56d9854e9e89288f520b8fd70a90e19559
SHA256e190d74000eff79b0a213d69b73ac435bbde75337e8475d8d862f70552edc0dc
SHA512faa48df7b23ce8a9c7027575d4cb1c9582e868eb46adb0f2022498447364051cbab678cc96bad4d8cfd4b84416874f09c9d6b2d8023c7315f05687d383f531b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50df86744048cc1e103c79a3323bc17e1
SHA19c7ead37f2245fab0b297fac021322d57d313abb
SHA256c2bde3f6e1d961e6d17470cefb0ba324c9128f37404627eca6940e7520f3a232
SHA5120358747e407c36521ffcc7debf067be83753953f04fba0ed20b288c1ebdf6c6692e770ff636b51f2da3e72d85e7308b9566e1bf9d812debd8f787e33f903bafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56252d0844c9025ce584fcac62a293b1c
SHA13189da5a11dd8c58d1f4843ca924e4fd4cc419d3
SHA25618f9b8638170be94b0fb763a5e220af3df2bafc6ad466239547ae4f9edc5b1ec
SHA512c355e054dd32922d9404986e3d4ff463ac544139f972f36cc731040ba0a008b5c37cbacbaa2bc6accbd5aa7c158524670c49028f9ab38cad5f677916b35f2609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1af3854e67f7f9f303a875aa8595684
SHA1315a906c6a219dd85dee3d75b3d238ba4af3ee6b
SHA256eba218ea17c52ad7c40f43f3f4abd589ef55f88fdf2bcc11da6c9e94f14304cc
SHA512e5ab835e5c467f25065ecf0345c66b4e5a58a83cd8e88c78276cde7735fba437d5266842bb06b3c6f527873150b48783b0c0e12974df13015f656c2cdf7b323c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5741bc5f7fac8af4523d608a7aaf81406
SHA1898de34981c678dc2276e07522fb67f730502bac
SHA2560293df73766f54a0e2a23aeae4b55bbbabca117f94343c56a4b3da43a85f745d
SHA5127be885f6230d6856ba3ac6ba990ab4c1170fab02ce64867657302f7772ee4d04c92606ea1b66a24f71e1f6fe4cc426d8b40494c45a0f19697e40b4a61b068e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5663966d4f4fcb27253d5dbbba95b72ed
SHA1f1216cee348969e65fcc4166b33be97390e26e9e
SHA256d616e14d76cae2e77706e3fcbb8a65f59271463e1483f05f21990225fda76782
SHA5123a03520d1a436387dac170cac1667f02287dd3c67797c289d8e4657444402a8ac59ec5d17ace53e646902e67a8c74466ecf855d2eb2c833ae8b48eaad65cf1d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cc0d970be11ec44f2b0a2b4f97da286
SHA1180d538f8ab8a90490d69ef83e328a06cb4e9262
SHA2564b9955791f7e394edca9668631a4ccf905a41d5034a14904aefe9f1814de2110
SHA5122b555b9c586f30136025bdd3eb71b4341f1fec742fc1b8d54d17e681ef39f56214a156008bb893ecddc9c157cf81cfd3da9b165313bea27d15773871b9020028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5765a723c072d2bedd715d45635acc8f3
SHA1e50edbc04871b5814f8deafbaba13ca4fcf30b2a
SHA25627d258cf3234649f1c215062c868b903f5a4c99d3f7cc095532e7c9eaea0d3df
SHA5120737fa516c9b3eeeaec006f42d6d0410618844a1c629bcd7ce0f0ff1f923c95dd4d527883795c88e4beffe32c78ec24958d103f8ec8d9cece93a7c80a8f9ba61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f91bddc4d2776c2535b61740b62c13de
SHA1dd4e0d4418ed6c228dd5e8413771247043aeee56
SHA256d783a56e3a02419b4d859fd8131542ac6cf38e187fc13753d8773e7d25d42707
SHA5121e5297af12142359b5ad4d6da8bdcb25049534bde83aff530b6feb83e8aa6e20ba71afdb33daefffd813974269a13bccd9f361fc73f60c996c7b810e66228641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cad8b00ad13976942b1061a15b631b33
SHA1024a11669db5623de498d4a2d2beb3fe5693f30e
SHA256e07d20e5f4270b9665c9ff45def5ba549703b27b3f981d80bef29130ab3a657f
SHA5127b351619d5d3865ff2d4c28c0e5493e640e2882210f5617562039733bae7e6e512aff722b3a21aa745438b002c54bd35ed78e5fd3927d9fd1f37619e02ebc501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516d450a74d7b889ba29e307e6dec6e43
SHA19053098fae17da20fa5fb53c5769974baedb1d4d
SHA25603cc799076e32f48f224ea66ffbce888faf95b5306bac7aedd66f427371282be
SHA512c6d86bbc3db717887444926b2c63a4c9a5961d50ddcaf693917977a08512cb0162d4a25f3fbd82399f61d3bf215b0854c754b013935cb2503bd3c832b86f2842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543c3ef55cd1983a9393c9ad42d45080a
SHA1d27464ee0acda941b69cde70968aecfba6485eff
SHA256cd714f60f7c6da0ae35c25b6fb15dbacb6d9bc9cccaf2e5d03b78f1c91050f2d
SHA51296c2b758062b7d08fd8c41c1e20c13be180107dfd814e058bbe84fb638c1ef61d543dfd2f7c412b6e05e62cbe9d4c08b61a0a6c6cce9df424a390d6de50ce108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5686b67a51cc92b990336a8c887cf5d82
SHA19b48c962f3494deea27e3b19f6ade18401050d1f
SHA25625324822c795d2bf71f60c4b0b54cfcb2a32fc831903c47805c55a6aa6611c38
SHA512de266b9149fc169d5e707654158c182b495683529ad5716f26d2b8ff71dd7e3f0c35c720dbccc73447c379f931fb0c38cc8cc96992065b13166878dac7045576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fd021a561bea0bccc44f9efd5216762
SHA1b5ccf806430d3427e72bc977c0d3aea0322d4b52
SHA256027810c208735f64a57ef17104951af726eddeec61a68bd3e05f2941025851c9
SHA512f8d81f9a8d0df8ff2c53926e887811adfa96474233eaf48268e32dad3b7382b0797f6f9ae74ddbcd8b76e4012efce56a430ec5fde925ee0e5c5c70bd0d581535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8443e00aea0933e97f4f4b5712bd024
SHA1381e9af7bbb392b642ec92bac2681753a208f39d
SHA256310e0db4bf9a3eef2011bdb17cadc63249bf468a1b6d1226e6d5227376bc0d93
SHA5121ede528a2238f6a0c9e34bebab58650d1af0543e9e801eb866480dd178353dcc7e1febc3015724b16c3d2e266024569f69d65ce15c6cc893d2e6f1d578a56536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bdad4dbf778686531ec29ea6f9d8733
SHA158c1784edd57c739eba6ba1addd5571e2457deeb
SHA256ae98b8084e01e7e1e625afd7ea7853d5ca5a86e1206a2ef80c2d4cd3f0a3e59b
SHA51253091107715b5d455d1bd7c28c58b13309a66f72eb4e0a622a6d674357eecd2284c43f89a86597498cd460e4c552a9f1b36c4a0b32a0fa69c4ef9ed6931661fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f729ea9e87d41fb4011c10c90da3bf8
SHA163d0e62a92e77bebcde2d2bd526bf7583a3f1039
SHA2566d01ad40d35c347da775d26da88b3fa9e2dbbb3f5c8776d52b8a466a79578702
SHA51265718ae48df4ba188f11e9e57f0dffa212c00a204a57dd0cb5207c941c117bec2009b28cd59c95cac4c1e2d8d06cdd7a3dabeb82e248c47d9362f36b74527829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530722e8ad4db5a035edf60412793436f
SHA155a98df76785bf85acb7ecaa580b829f4ca79838
SHA25644903f13978f48a9e627f4260c6b6feff38d1180bbc788074065316484717579
SHA512e836817a8bb0f39bafd30f381dfcc681a9292cd1e836911b4e4c17bd5d403c0e912d80ce33c20677b97415745396c27c6dc06241e5cd564b801a5e87da1fc30a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a