Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html
-
Size
39KB
-
MD5
48e43eefb3647ea5e40dd9e21f472673
-
SHA1
bf7e9bb76aa01ebc40debacf7aeb0ef485d3e7b4
-
SHA256
ef2543a45505b5e507f4a4b12396b0c23ab88a69a72d73a791dbb80bd018922f
-
SHA512
049bc92241b670022029e77fe83cb384b2a6e1293aeef28915daacb5be2359c32b2a5c7dd7b6899ca9e572c45b0b4b2fdd0ee2502e6405d9aab4448e4f0ac42b
-
SSDEEP
384:Sye6CfiAW3Z6k0JebeYetede5eRezhedjRdYSctShqGq0snsx:SoCKPxDYBnsx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421983788" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b4ae2d32096383bb2a99cd4ba79d5db09adf0329338818c22b675bd569c31478000000000e8000000002000020000000ae1df6f65dc0bec061a513636a77510cdeff63390811a05330fed9c2dc5d616720000000d0d7e3039d1845a720bf8f6e27e23fcb6d57e240a6d290a155e3ac6ef117e47c400000004042aaed7cdf3fcffb11b6f734c2a1d55184459f687263cd466b9ee549528fa94f74797cbac17ba615c11cd8578a879e54fe57bb0f19260aa1c042fa3fce5538 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405849212ea7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CB3E041-1321-11EF-AF3D-DA219DA76A91} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008b3c85e6bbce42ae6dce4c4439e7b91ebdb42629c5fc3dff1889c2c1977424cf000000000e8000000002000020000000110b717f1f7f8fb81996c630b6a24b93959a15c0324187af1970410470195a1d90000000663b63359c44c703d2517acf5ebe4a096438658f7ebd1e16265e1402f465ec293f32e96ff0ba50c7f978917a23424a167d703c9a2ae4af5bfc0823f8dd7d1818c584b076c8e8aaaaeb7e39814d63db566deb128de7a2e4fd3d59d38df33b53cb7950e5bafdcd73a25b31d876abaa92f729cc48f7d163830b48a6afd62a44b74a5940bf4e14b24b09a565f047ee4b943540000000b799b61cd1501cc467fa33daab12369662619d149c9cd25209763fe3ae8e704d60b97c2e10fd4a519f96eac9fdb22382a957b5a321994fd7ef795c1ef217b381 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1684 iexplore.exe 1684 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28 PID 1684 wrote to memory of 2600 1684 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48e43eefb3647ea5e40dd9e21f472673_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50583587a4513d9b4fd17cdb30e26cfef
SHA1b4a2c1d05cda327b273b442e013851283e710a5a
SHA25652eb045b28fafb89d19aa5710dede2f3b6e19c94b28c770b56aa01bf906f21b3
SHA512e9f4bb43ccb696805d92326ebbb48b7b9120f0b5a495ae6cedae8552d45d2b7c83fc101b3285462ad9e3254fe378214850b1ddf806a9b6212bcfe749a1fe9810
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fab1e8a70fb64c6c679ce4246baf9cdd
SHA1d30c43bf889937b1fc9a6d8219f97c6c77d7c3d2
SHA25690c99d9bfc21bec8ce954af3d8729649a3bb76fc51f1b0c9ce77b9abe217e4e9
SHA5126f4de940b19d85e2564181fa048303e527a26a499c0ed2e273b6ed1c4f6ae35cfc09c9993375b1b0749938926c7d76e44dabce368f2dc5bf2ffd41f9a69ea622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cd9c9f8c55b9fa830b51fba7a141507
SHA113e78e4ccfaef92f9780b74c01d62534ab2ce264
SHA256f2eadfa3f30dc3bd637c7e1fda7975303e946bf5094d257edcc46eb1b882cc05
SHA512be08687c2408d7b85782d06ab9e1149472e8b47b5f2ce429ccc9d8ae0ad9f8f2051210b5873200e8adc18aafce43ec4e8b9d1786a2fc00de864dfb9233fafdd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5830283e14d76583a9dd9b74c54089b0d
SHA1fa321d3c950005b7d561d556be53028f34914b65
SHA25664ed41c34914daf053ee5976e1fa3e93056ae0b0035c27b39144bb47eef3c4dc
SHA512f55999e785d4656a5749bfaad05f1b02d31a40bf003af569192b33d8a91f9fda9e04a29ddbb8d419eefef4789f413050ed26514482a80df2642d98e8497524df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58251cd24be6712b5291f67283cb7050a
SHA1724ad9b6fe6bca7ade62c7eec7a58a3e907e4b88
SHA25661fb7913de8066cd67bdb1bb95e2afb881c357c553bc732a785cfaf950829310
SHA51291bd074a470a049773f8910cc3c093f6cb41338bc81e90ec9101b004bb867f902b28d8b15d237627c685bdaeb9d23f998f0c63046f629db3e82e69a6d2647082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599e92671cbc6feeceff18ff843ce8d12
SHA1277c36597e43b1d3e9244bd325b78de826bd161e
SHA256f08a683bea840d99e1759eb3715a7e8d9b532d0448469553e6f4402c12427c08
SHA512ca536588539cdc58df96a4067126813adadfbe5ad0825a2a66a1136a3c8637c25ea1fed80dd3fd9e45549e5f861885765982998016605d6c30f3a4a78f3426ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d8cca21401d969aed90e67aa2c01a66
SHA125c26c71d6ce6b24ef4d9778ed51b47a3447d78a
SHA25679914b796d61cea629279f94d5e523a09497fdbc0756894ad8b8b71a0ef53f3b
SHA512afd083ad0995f069527f2f94cb5b294f33812e26f1d9ca7b35bd4ad54e7a9be39b8526efb4d1d75d3d413a4d56a552ff568f025662f684711679443f94fbc8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510241cbfcfed2b78bc68794b6afe33f2
SHA197f42f6bddcc7a37df9b7d6906858ab391317ac6
SHA256bd3016d79ca1b954c79b5d29c24ac70088b48512abd4d7f3dc9398722252a76a
SHA5124e2c467f61c5cbf345811d31704e7f98423a007276a04c6d9d4105181c7fd9e4cf6f78d7f52aa7a94da1c52630a8a3bbc032fbaefd6212ad4872ce9228b4142c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5065bbb1c4abdf10391731c2dd28fa03b
SHA1ab62c8e79bce29c31c8439e14c0175ffeec92cbf
SHA256d2292ef22dd2b7eefae58a90338d77b089e839309de88e248ec981023a18185b
SHA51269c3bbe2146c49efc0af20abf1b520c819ad94fb78d44428b02aa87854fa9b76b39eb815f5a44f96295877549e0ebf9be1311ae87d1f506d6442a13a27f4e081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fae945bafbdd870a65afe4fe6eb21d29
SHA1597a6c8e8159ecc3b06809d0c80e5bf8b9736ec8
SHA25672155c7e0c4a7befd8ae4c3d299039c0f754295fc90dffb599c11e5455e3e264
SHA51266d4661fddd2eb3e5f938526b9553437b99aa17122ef663e9aa815bc0f2441f940572d55e5c502ba47bbcab1ebc64d298895f79d9e0f4c687eafa117ce084b89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d33e658bdd134c3cf0af83b40a861832
SHA1b93e05485de9acd3fddc05d6bdd1b7bd82555908
SHA256fdf5008cc5d8df2fb6e751501a10f62d9b331b88ea99b5605df6fc9d440884da
SHA5125aed31bb246d83eb68fa04abdc6d6111b454f2590d639f900b15518eea9b039920fa35cd8a5179b80bdb42718b2fabc8d3a9f5797e99f1b343e37d3e5031fb6f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a