Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
49ad9ca452720980e12f07c5673485b7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49ad9ca452720980e12f07c5673485b7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
49ad9ca452720980e12f07c5673485b7_JaffaCakes118.html
-
Size
460KB
-
MD5
49ad9ca452720980e12f07c5673485b7
-
SHA1
b3a932ebccb008685c785b119d750664eb2f9fac
-
SHA256
117608d692499fdc5fe61169ff84ce7ad1d85aac3d0ae42721bcb0e9485854a1
-
SHA512
19de713acce2c28bb3bab5746d9121a431a87348f5cef067e05854922dcf18f71c18ffe298437b490ef05d7c929d95057b4f13ac00b92bf11a4c0713d8f27425
-
SSDEEP
6144:SvsMYod+X3oI+Y8sMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:k5d+X3g5d+X3Z5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422000698" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000563e7b7af27621244853632e053595b08442ffc3e790e236d198d5276e24c4c4000000000e8000000002000020000000aad0294662db9866cedb3dc3cfca7a5cbdea6c202502379c8f0308d478c7245590000000064bbb61be1aafe1c2b228699e37446edc58c1e8cfec425b30b5f29b933e567f9c64057b52890586c3e10b3cdc290a9d19a348518f7c01c6b5b0640b847ec166dbe59662c1deb5c126602f18437c2f74d77ca1770d385f080d29cd8eedbacd52033db7a3b3da716f9b449193d0d79d87aeb5e19a2bace2a4ca67862805b39685147a4edfa1f3c984942149c2108609f7400000007696699e1a1aa40423661a42d59db88448cd9728ee948d48641861ce75081ee066d245a916b43f0c16875b09ff3ccfa17a154dd5f3f567623aeb11782503abe3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB4BE6D1-1348-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000017d4233b69019358b4b806d7cdacf9bc715cc483778203a3bd54ff03faa8fd84000000000e80000000020000200000004cc46359be82e4717116149b8136a257a028a34523f5592fc2879078b57534cb200000006d813b8d4178fed28522b4fcfde5cacef9decf9ab7868e3b33473874112b48c240000000ef87b03c3f2b8a12735ab8062299225d97f695a427183323888a91373286f351856b022e99ad4468a427e588ae7c41f4b16d701ffe84a4a30f3efc60f3457557 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b3d58355a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2520 2848 iexplore.exe 28 PID 2848 wrote to memory of 2520 2848 iexplore.exe 28 PID 2848 wrote to memory of 2520 2848 iexplore.exe 28 PID 2848 wrote to memory of 2520 2848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49ad9ca452720980e12f07c5673485b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5653822eb055112c42c750ae6090b3b50
SHA11c928be501f161df1aaa796fe39141540d6b5d34
SHA25660b4ebf76bbab5b0f5e03105fe7a6b44a4bf2c503116b5eea291fe6c447b0616
SHA5123ebef8115bc58b014569dc62a2736738c18706c4dec4758f60c089f95361207581e56cbd16e892fda2782ab98574d7e229e6d082f4072b066844d9dd5c6b6a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e17f6dca236473a9cbd52283166ceed6
SHA1fd1d3c9985d1f8987b28b8f0c1f1d550d89daba1
SHA256fcce6bb599f101137d6b769e1e5e5bdf334357c2f41b90225dc210faf2800e75
SHA512c59b9e0e61b40c90a94ed6bf645a701909d130dd9ab9f143030b897ec382d483fa161ea27c117a083d3fc3c43f0014b01ec6823619fb5c5f057cf5d422002267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3b30659b29d6ab45a1911f69118f19d
SHA1138266393b839664828a325f44bb3fd53997f7b2
SHA256c9b2e2584647e6458a1789e8a67f257e25adc9d6bc6bb761c55ca407f47a03a0
SHA512abbd616d42486e3210642df082bee925b6361157b687c2fdca34c001c781962701b52f96d4ac1a7da4fcc59b7041424ced6344fc0c49435ad174c2b571268112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572c729f2087120e7d4898ac4f5320a40
SHA1e1679c86bf93d852b9d7419031a88aa54e223984
SHA2567c27b1c7196c1310d06abd45ba24d0446eb056b1a54d86b0ac8f097a9a064e4f
SHA5126f1915d1ed2956088e8acd1bb5f45fb948ee4a7d143588de39f90f5544afefff460a81552e4b2bc11220cc8973c17e7cf520a846a5ecc177e164837b5eafdb08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ed47c7563d45626957b1976ae557423
SHA118e2e56fd188b38716128149ca9971bca3e44d2e
SHA256031dd77b887c19b2bbc9d1fbf22711010196eb90605fdabef4659d51f21db844
SHA5123cb773eb0434b7fe91dfc76012552eaa50c59dd5c418754c64e53b6d4b183a0f20245db2cb806b6a980444565c0b134c231c86ed218fc63e8474b346401c2fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5071265d3fe458ffd407a067f2ae8ae28
SHA1c88cb1f7e06ffa609c23b6459911bec67c914f14
SHA2567a5702d1676ae8555146abd4005812649ed2dfc1229d44307a4f49841f06801e
SHA512b9b3480292dcac407f948a9bd83855d5538706dfc6d0f00342a9213ba7b6afc20e8cff949047069f289e2c93f27c573b4b8dce992300da085a2b2ca4c1f5e606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517cc439beb0562807fef4c7b978f57c3
SHA1212ae09170b8d9396b4ef899d00d7017760a10fe
SHA2567a7f5a743b7849b6d343b63407029ad1d55bc3f2e7e7fcb49bfbf3c300878562
SHA512840d30b4b90fe233a0997a30f0956bd4f04ce1c26165ac1c84512ec226c35501168289b0481f99cdeaaaa7489e982975db83e968926f8741a49ae89d3ea8fdbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c923eddcda621d5c71d773092ed460c7
SHA1dc375af727e5471c0375c2ff33d39e596fef3c53
SHA2561876cfad419181abc7e792598bae4fe7b219e9970767865ea26868273b2f052d
SHA51299cc6faaf626ccd8f7f7a0a085eb2e93717a885a200a10dfca5b47b48d3e21b2c399b34b7bcc37b308ae1a39b88eebf51f8424666af2b2edaf7ff4cbc19818ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4b245d1dd7b5690afcaf89395c8b4dc
SHA1b6d3a08b38fd79b07dfb36fe275419f65ef23d09
SHA25628ff9123fb0de6a161a90cc88bde8a8cec74857c767529930a96d7f5081d0523
SHA512ecb244eb0c8720f0eb8c313bcae1fc0368bf68eff8f351546bf54317c2ae44c858851dc1b3d773045003732e16f67d2a895d6560af9a1acf0ceb2d218c5fb9e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fec5766204ea80ca70f92dbaa1813bc
SHA106673876efa2fc6e4c018577486f49eecc1b5846
SHA256f31b9a95780c3ddb2f7e14840b325344b0cb563369f2cef231e0eb0ff84b0ca4
SHA512555b3121366c488f85d3cfc2c1299c2214398bc8c10ad6e17e3907533acfa53db761f03360d8e6519526ab56d7838ea154848028ca374ebeda6640534da79f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8e1be66aa20bb31286574ded286f83d
SHA13b8616420df575a62ec0c57676685439bd67c170
SHA256dbe65330bbee39b853ed7f8106cfe7e0dba549b7227662adcc039f30dd0ecc9d
SHA5127f3b15e938b2e0d6025517d02f75e5c7b64986b0fca8c096abd966c1b0ba94cabf847afcdd6c31a22c91be397546a846fd9c15860ed1bab970b06ec0ecbb84f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7200713bbc924baf40b887d41691b64
SHA11bac56559c92ede6b1d357797cbf99b1e61b589a
SHA2567762586d41b676bf1b62fb7aa2a9ac35894e2dd5ee34db031bb899ea041dfc99
SHA512e7f1a06982f8acd3ecfd8b5339b8694cacf9589d0a93bcdbf3f8e67fd9423ffdbeeb97f0ebcf83be1387a73f430c6fdc82fa060bf36d84904c3b790a72567315
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5828ce22a58b57381eb2e8ba301215300
SHA1a235922f31694cc5071a039355149d899c024771
SHA256ed99c95d2db0debb8edada6b0d2f26474c17fd18cf61b5df9940ecc28e60f2ec
SHA512b6fc6e7f0b97203247b9a459b8ca4f317e6b7eabccd6be4e52b4a4cbd10edbba2312fc9eaf82777ae2ac0f52dd6131948a3fd61a74df760cc687626e674f7dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511c8b01ccac8010de821e912e630d04b
SHA1ea3b2f15e76680e2eac7c1599e86f4950bd99546
SHA25605897e8f3256ccefa4af9aca582dca49ef98f33cc3995bd7a9b71b7d29a8ccb7
SHA51211eb473c8463885ae3f1c800b140474b2681950a0f5314b0e8f3d1a2b07f6b0e7fd88bd3de5894c8c72775061039699b7bfe37f2ed682cce63b33643d3924f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d55943d28f8d078da081159082f115
SHA13799f7298728f1b633cc1ed2495e2fa64a74982d
SHA2566d7826a52ce5cbccfd409c5cfd95bb98c22f758b3b8c35b8818266cf0e3893ac
SHA512f25c45cbe9b836a04ebbf868abe748bcf6c5aff73af738fb487589ebe6108df1c8d0261da6b6606a7a4eff8fe4cd009268068c065ae1b17f4da129d95555a293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fccfa6d9313256c2352e5d52980529e8
SHA119302f2f6c9bc830987d5ae355759e453dfcbb02
SHA256c18e8c4a8702f332225e4f2eea594f8c930c1d974f69a4773f910bc604c9866d
SHA512300778c57e8265746019c5276b590eea038b9b7c64a99b00cb2637016a364b4e32da2ad6c24f75f34d44c823dea92b41e6e7a831964eace91d7d41f99a6126fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56703d966697b6d2bd60994723e84ac38
SHA172691895453e1593049fc51fb240bd8018918afa
SHA2562134c1640ba4326c07a513628d96ecc46f2406cc98697563462126383c994f12
SHA512cb95c10ddb40720f8682279c98393a0ec72ca4134caa34c900d6a4103168892e2483f9a053f57bc990f7fa31ca292d02514f3bfca082b72f873c9eaa406a6255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589c000c07cb1e3ec0d320cb8a531c0eb
SHA11678f538dd0ed748f18459359756bda6f7d6d9a9
SHA2563290d904b2fb4f13c1df20170d8b30192c8e038c37506d957447261308f309c4
SHA512eec5c5693d3391f30e1748bdfe3778f31873afe9d5a0750fafb9e5a5ff959f9c782333d6f54539f82f7ee788e339c87e4d6d8a12e455cabcd6bb67e3801ab9e1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a