Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
4a19c0ddc0370ee8a3e86bcaaf586779_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4a19c0ddc0370ee8a3e86bcaaf586779_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4a19c0ddc0370ee8a3e86bcaaf586779_JaffaCakes118.html
-
Size
6KB
-
MD5
4a19c0ddc0370ee8a3e86bcaaf586779
-
SHA1
1b1bd0ac9f860eea685578f6c2fd530c8f67c915
-
SHA256
31c9f0176a393d1a948e5da224ef4da87c0edd7c58d914d8a338eedb7bcfbc04
-
SHA512
abb8825cd2e5b7eeb05b6c0e681ac2547c6a8dea676ef012631f6ffc161eec6481b25d5f545d157469ff03a202253c4f60743ee933b04cb33c757d88cf13113d
-
SSDEEP
96:AhM3sHfRIB7TWPRHFLjo5zkbeE4WGAAWhWJhvBVDFYfgv0:AhM32JK445zkbpGAAWo/JVDu4v0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{065E7221-135A-11EF-B6D8-6A387CD8C53E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000376317ff62b40da75adaa9ecd96cc51c8ab3a8f02538302f39d41079ced91a0d000000000e8000000002000020000000c58dc926bc6bb3ae61c3044b9078c76bfe568ae8e7570e0e0c33ed1b78688f4d200000008cef3cd9986ede8be470c6b7e5ab3c8457935fdb57666875624c89eb3825834240000000302cb93bee9f8d93e66b21d21ddabe6140c17732855bd6dab22765e7d1e7d43f8328c5e9cf571e1fc2f7c75e76e754582b87b7260bf19667f23b6712dd8bf6d7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000fd1c8459811f7bb8b992dac146fff8bcf18032fddb360c1b697351200f914b43000000000e8000000002000020000000f9a31799f5cc24b1df598ff61781c7db3ead9dd180aec6ce457e8a09935280e99000000049ba361a46cfcecbc9acd9864206094f0d840f149fa72073ad390205d44e481016569a35897b48f993509902f1211b7eb31bed32cc9da843f9d567ee9d7c563c986a78e8da92a7b5fac3a62a2b9385897ae90a3fc30c18437cb581a20af25c69099de1ef6b826a2d907e76aacfc5b182abc7da5408451d0cbd5abd239a7188cd8d80d371b69a474d967918eb8a1bdca640000000abcae335994f374f9f27240b62d9506f946521f3d480df042c298b5ad2d13717f9732576d040392545b13de9920839416e0a24f54b285387ff02d3264d5647f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c082f2da66a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422008152" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2496 2108 iexplore.exe 28 PID 2108 wrote to memory of 2496 2108 iexplore.exe 28 PID 2108 wrote to memory of 2496 2108 iexplore.exe 28 PID 2108 wrote to memory of 2496 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a19c0ddc0370ee8a3e86bcaaf586779_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e81c0b751063fe27072b2fd240c68ab0
SHA191354703a57a9122c0d809cce2a1dd690593fe00
SHA256ceb4b287005ca71235972c0201eb38855773bddeaa01c103e0344542ade63651
SHA51211f3739bd728b1ec35a0e34e330b103b2ca689e96c624f331a06bf8eb726b844d8f65b26911a8555b564f6d2814ba5a6f3ad3237562a43a45fea1030fc9ec60f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf5d53ce7743b483b2e11a11bdd397cf
SHA1f7a9f59e612d400c00deb3734369f3c678552a74
SHA256e8683fdc2dd62755b46ceae2387574cdd0e8144cad476feca08dabaa3735f142
SHA51280ee5975da0c6941a27a2a4aacda1fbbae1b7e910e4188b53b666e59fc49874c46c88747d8669305f3c5ef65dee20c41c417d24aa73561182baf4e0a3566296f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528d575d0aa600a96a863c57148990772
SHA1f539d6423735b1813fe2efdaea35be43ebce6c6a
SHA2565cb164c9037c6d00b29e75e203adb87a054f510461f660c1b03f5a878207f96f
SHA512040264dce27f37d6b3c7a966606c1ceb084edf53cd0d314fe2c35fccfe943e108267d94a01ba0d7adc69440c452e9e30f1a7ed502518fccf5907c90933e6d605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b7f6621c2ad45620d1437c356131533
SHA1b2a267e24a0ec519b80ee095cf3a83a390837084
SHA2561793d8d85d6a67cf5bfb17ed65096efe9b9dd2992e0abfb18c65d051d2bbbb48
SHA512e8493911d95d29d340a1ad3462dc9b82702adfbe389038cca2a2e1ea33f98180ffaddc1b3f8b7911451b3781174ce8a085e04e83962eb4b8f51be728b5e5852f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c9edb3296c70e6b89c16f28d5c0924
SHA10c2a4a0389b8442c57b22e54cf60f0ae9a3c9ee3
SHA256a5e78a1779a3437ca2f3b8c64330251595983b5780100b5bb7dabd4d3ab3758f
SHA512bc046294b9bb47d9633bfe3031d6c1c14d784d3d85965b58ffd67be5c72de0c2068b8138c5fe1fd61cf5280060aafae9933cc2bf7006175a7224467a610bbd29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3a96790854da890e32909e32010b4ee
SHA17e36d70722162a4b4cab60365cdd746336f817e2
SHA2568bb933825b21d28214f23552784b54c6e59a7058c3b482805eb7cc471e1050b0
SHA512bedfd38932421f49318df358f36757d3d491e214ef9555dccd9b151d5204cff53eeb0746ca220fef1268b3879d20d6589207008fbf732d82b4f4c6ffd984093a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5444d8982da3bd9dcbccdd9f3367d758f
SHA1bcdc668b60c9ff8d892ee3795da784233db265e1
SHA256f39f689b95f431bb2a338ac7b2c7e4a5229fa119dba607fd53a249aa17a12b19
SHA512442689e76c73456f8ff9b9767c5d7e086c736ad4f65487ac1f959e520ca980abae6b809a2e50608a3296676b13b021506dd2117fda4d582e3cc290fab9c93953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56635a8b7b3ed89c9dacefca2b51482d2
SHA173ebd923f93ae0daa5d70ce6cf5902a63f133b79
SHA256fbb73e8b49d0fbf0848105387f5994a7fb921025f7f8322cfb0717b7eae8fdf3
SHA512fb5dee16fdd93812b40e700440bee1ce1a6dbec133573e89212c07ff087601e0036a04d4ad43728dbd2464be1687488eb8f6d3d1e846d5d9957d264e925f3f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4ad6687fa04bcffd3ba5c9fdaaf59d1
SHA1e44b2ee56a30262b0f25d645ff399c52c86f309f
SHA2563d0d5e1879322ffc9d9e73ce60947783ab66c98d94a22e0e92f4c89c2f4024c8
SHA5125df3536550eb10e4523b4f7145e8a28d71517255aa4f0f216c71188de505cde3f5fef7473ac8ab1dc614c87d77d31239bc8bd1bb58ac966877fa4f80c8057a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fce3bf3aa051668adce0f63318c4831
SHA179c46a0ba487891fcd3074a2cadb72fc1624be77
SHA2569d7688d3ddc5c702c7875b406adca1d0218c91835d4c9c8454b150957064f878
SHA5122cad9d519d136796c386c715d9dfc2647371082c2a0635563cef30e75794b8d3eff6711126ee2e501145f7cc2fe2273a7ad43c03e012d35c07d2a980751f858b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957bac722c05128d0abd278473c4d043
SHA13f3463afbb0b5322b448fd9795784fe689643452
SHA256124f69d29080530a375b648b09457515a9595a254739e674015111739894985d
SHA5122f536273bd4cfb76c3b583fb78f6886f7b24aa25985b60b64ebdcb267e4675678920ab9e36db61a644eb27116e1364e1a2e98db672530a0bac163af26cfdf9a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549a047cadc20d918e344797f478c81c5
SHA1b12e4781ffdfbddbe1b158109982b439075f1c7d
SHA2566dbc0497e80270c93793396721878d14d42fa9cbb62f65c07d5121e2fd6fcabe
SHA512744ae898861dbb8746c3474cdf452556e7c7fe78f67518ffdf670fbdda2a836f6812c96cab4eaf479ec043eb673c4104f074dfc33c93a17baee461a843cd43c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548a11ba06bf241f628f0cc77011b94ce
SHA1d57f9170e61db9360f8a1d0e32c8d7692fb33eb4
SHA25611d86e5edbf4edd012b05546a4ecf53cbb65d8f89ff64f3aae6c7efe974e7e9d
SHA51275ca3cdadc1263c364406b4c632b57a4d2c5ee5785e301b9cd2fd644f4150adc7c639fed0b6a03987d90d786256722549e4be27409d354be51596fb1ba461edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5033557ca67ae5a333e84d45a7b10be4a
SHA11270c5f1a9ff92f84a390d6074b8cadfd9db1820
SHA256eb31c36801c38a708a492dea3bfe5f3765c5ebf921ffbec1a90f904da5112154
SHA512fc9601c42662a15120a3e4c59272907e8f292e995aed0e00a94b6468c8f94a6a18ab221de143d513c01f640710271ca37b2cce270625384a75b806967ef8dce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a5a725e06457a756f2e2415e6dae451
SHA15fff82658a8c0efe94f2bfb691ab4bc212dca22a
SHA2562273d36df5bdcce546d172ec4917923cb7dfe1dd1fe859d89c08154f025277bc
SHA5120f993a27e6cf039f8e5a74ea290dd7dec48537fccb5a30ab2247f06930bd6dce58d068341fe50c39f2bbcb374e9700dc98be9464599f86c3af058301bc59af78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5662e9f1734c44032b86536e6d4cd7d47
SHA18ebfaf16da203227711fe260b7d1a9df7213a629
SHA25653cfea128a521e61658e93206463c1434769b63ed632401ca4ec5503aece47d0
SHA512dee6df6bf348883e1054b8dabcca2c00efcb8ae38a81c47099afa2228cd42866fc82da20cfec91ae3c5912340cf7a4fe33f19aabfa7512990207a3156e3d9f39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f771a4c5ac66390326e58cc8b7c8f7d
SHA1756324c41896a0ee07f7e2454e750d51006fc93f
SHA256c3977f276c1998e57e4f6be7c87a9757416a5851143aa0ca0c5c142665c97bce
SHA512bb09c44b4678b3e398a609ff399989b81bc608c6e6b98a72fd2253bd67ae89ec36a4dd92a8ab42a849a1a3d719455471ff0e2ef8f01342f824ac63014c587ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586125019395d276ed504f82f31df9d5b
SHA1936490c4a33dd1bae8b3a74137c752a6dc0aacd3
SHA256319f64eb99612902b12f827257ac46fda40a13c154416250a4823a2e36c90aaf
SHA512a95f4dce1619545f17da470e66432a5456b7eafe357380148aaf4980b2ba34854a9f5e2654b2b644ffb778596fa07925c45ad9dedffb086b9d6eaddfa2009eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db3f3d2f98309132dc37a23c1bbe1abf
SHA187ffefdc3e9c80658d41cd0095424e1c92f90837
SHA256f589023ed8d79ff741680a1c2d4eb62fd2be3521dd4f8b2ab4c8d7f72a16285d
SHA5125fd0b7de6f49b88e11b1b39363a1b3a255f35de3755cd8a9b609e7e6c78c02b777924daa72f7b635cf08dc79b63d27d5079e657ca7141f686ea14fa4fc6b994f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a