Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 17:37
Static task
static1
Behavioral task
behavioral1
Sample
4c44b5daca3b0d8624ef41c157673b36_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4c44b5daca3b0d8624ef41c157673b36_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4c44b5daca3b0d8624ef41c157673b36_JaffaCakes118.html
-
Size
103KB
-
MD5
4c44b5daca3b0d8624ef41c157673b36
-
SHA1
b971ff787b86dde6855e77652ba3c26cd0d6dd82
-
SHA256
2668c437db58631b1b2c411971ca149793d14b4b686d15a149be8af3018219f0
-
SHA512
f59e89054177598ea895188e1db36e8cb4b613e726ba3fa74bf3231756da3179037c5f910c78258b71a2d4b3827c233226f6a55da9603d357c902169f3620277
-
SSDEEP
3072:RoAnOo7X3QpEzhUt/ibwm22PthqUbVB/ytckCKw8kLLH/u5OZlraWn6fdGEJIcLu:+Lm22PthPbVB/ytczKw8kLLH/EOZlras
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB49D271-13AA-11EF-A346-76B743CBA6BC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422042923" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1680 iexplore.exe 1680 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2612 1680 iexplore.exe 28 PID 1680 wrote to memory of 2612 1680 iexplore.exe 28 PID 1680 wrote to memory of 2612 1680 iexplore.exe 28 PID 1680 wrote to memory of 2612 1680 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c44b5daca3b0d8624ef41c157673b36_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5a086a6f733ab94fdf4a4597d502a55cd
SHA17dfee367affeef29274c0a31f788668e6320166b
SHA256e7ced8dfb901cb18a76e9dc00ba6273c47722fd7765950baa6cca20aa478983b
SHA5128ebc2c07a53a3ce62a1bd199713f05342274cf61151288b85f4592b91829b8935b2ecbf1fd6e140ab856e2daa9f9ad2c7485422422e8b19b228acc07c37528a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50912612fae67454b634d2d426900ad34
SHA182d366c4d843af95b4c136194f7c41a7b156efb1
SHA256f213508dec5f3d3e574b894c5aee3a6b98827fb72af753d8e2c27700044b9a11
SHA512a858c17d6590f50ea536ee04272a7e59a3aecc6152e15dbc62e34e01b05fe0bd8153e9ebc7a65d453d36aa9d0fa02aab8fa3a830ef19494ae2b1736680355098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5218a62880965ea38d98996ef8e65a80c
SHA11cb57e726ec7668c7f194ba3880ccba4e89a62f8
SHA256774772df58a77dd1673009bb764c03a90bb7f3c851f9b68854d3c9f248e1f5a0
SHA512afcdaf61a0eee37e97a144aeeee2eecd722b5c60c06ef9b64f84c487646fb72cad0a5b6f92bccc94fe870e6597c383eba54eeca988769aa315143da0d7d2303c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfcc61e7d735ed34dfe207c2453a92f6
SHA1e45d526e8b0c66313399569175f1443e721d1eaa
SHA2562d57d4b2ebcfd47f3fc61bd4af6ee66fcdefe94bc11a3686ceb9f8be3c6abb45
SHA5121194847b643c35e6360022080927d56c19a80cbbc991558bcbcf1046d88bfc560d6cc3a77278fd86df35f230d7fa8e835c63ddd6ad54cd7585fbdd907378471a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f55468db566af036e092a75cdd74b3f8
SHA173fb928c98cab32e7b2375c5af01146bc4068c8f
SHA256cff8ff3df1f6d3a3b0b8aefd13683a8ecbf1fc99f09877c3237ce5e5e13fad48
SHA5123fd8c723ee75cc2365e8b9cd03a8ca4e781ae9b1f3232bd9db5b05fa391ab327809a6d68027c3c287e7d1c560261e20e1d08cf15632376b9a43f8914d4b69a19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556addbfc8f9f0885f23b8a221e1a71fe
SHA1ec9af9c973d0c80e6d1cf07cc32122311abe4e7c
SHA25643d5ed1afe5f24abb832c8dea622c79a74fd42b90daadc0692313e4438212cd6
SHA512441d6e695c8d2691826d2291eee9ddeadb3b9d2d714ed7a4ff2d6ac7140af3c3aaedf9b8ae66bd6d23b422894703be5f16f35f4ddb2c9835c275eae0315b6f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513b4f921b5eec765fcc3a87455b60d23
SHA11fb9d41dab4d62ca17eadefc1c422b4c4cbdb2f7
SHA256c182a10621ef35e1196da41607e4d8b5702dad30bbac7342960377fa2580eecb
SHA5125f41c5a310dd8baf7b03c74d1b48d5f5121942620b43a50080938c6a3ffb610dd99fa06793178aee72d019c30cf1c1916324e55cc285d0c10d3cb42c09abb35b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5893c5ad42ae4f731932fe208579596fe
SHA1520ff47f3cb7640b59bdcf55d60ca330381856bd
SHA2565db45a79c24df3abd93abb41068d51422d08d345a964aca93f9008e74e612c35
SHA5121c4484788b352ebf0cfbbac8efdd4840743627243d92b125b15d9849ad1f96f1554eae10a5efbed643d36b33b71e96793bbd83ebead836cf1f14e6e97ae9d536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47cc29abe905e7095d87450ad50b7fd
SHA1e5daa6277a4b7be0ce1cc6759ed34a07710a80dc
SHA256a79af4cd941e4a8013841c3760b66e4cb6f5ef113a07bcc5b5081e692f769f71
SHA51230b019f62c67d0ca80ce698bdf8063d27fda704613ea9bcfa4a470197ac58e1f341a831f257972963630dd77e36f642154dbd3de1d133f6a89c989c3e9a4526e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b395e436060445a034d615180effa08f
SHA117d0fd688649df5ce9bd9341a74d341db6f7f954
SHA256fc68d2c870eee4757830eb16df51b107fd5aa98a370a96cdd5892a5227d64c41
SHA512d076309d65f5c1c10c5324c14ef848f3a87a5dfc2010c0267b038a64f9d114c4319830d55fd3d79548210ca0c13fa555978cb4dc726bba4d7fef807977050511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ede95415c85c7b18db806737d676ffae
SHA13fe620be72cf5cd2e5b4d8849d84328b42cc7f77
SHA2565579bfdafb78ca0fdb777f74341158921f7a0167ac9ad9fa516d0f554277c822
SHA51292626f703b0ec3f212ee84b8415333e14087f820acf15e6b537f9e66a1891467976b4447f6287557bb5b188eafd14bbb37c0fd66adf59388815cfb0141885f53
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\ads[1].js
Filesize1KB
MD55bf11a14a06c7782e54ff17d882f94d6
SHA16bb7a5b5ceae064acebd6fdcaed0787a03c458d8
SHA256273c95ab65884bfb12154bf674975fa538719d095fcf78c27504e52cb391c68f
SHA5121bb92b93fc5a5b95a32404c4d811f2e6a944ea48143301da804ca3fbf39722065d44910707c68d71878ba90472ef993de2bcca7705418a60089d70d8a51e4b08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\nativeads[1].js
Filesize45KB
MD5193604fdae71b60626c192c7d335c6c3
SHA1cd03860034a1b8fc35264aaed35cadcf01810c8f
SHA256274b787108ec5aa794f174f9680bee099e4f11c90c3910c0f44460a8f28ad2df
SHA512960ad84042e16e65417809cdc05ae5d679d92aaf96cae5d930c31082a11c0136caef402c05dbb30e8ccc45e34072435c76418da8fdc18f1194279120d4fff491
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\pn[1].js
Filesize17KB
MD5721705b6feee6cb24fa055826107e111
SHA1660e525a93a5feecd899736db836e33353c2f9de
SHA256b5c0a71e77e127da8090462b75b686d7911e43521efc6b1e1143b34b702ef2dd
SHA51294ac108a929cc835e5152baf82c2da3b3ea00b2aff137d7978e2a7db0bae33d81c1dd6c3a0c1e08b6f7d4df113cc4f3a83896d0c7812bea44d76b46584b10f22
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\popunder1000[1].js
Filesize97KB
MD552d9d792316aab38c1001996be3816b0
SHA16f4699614ed3c19f77375a9399d10606cf69a8f1
SHA25660a3e7bf348e0710ccad6193e3a6a000892930da251a5b7f98606129acdfe0af
SHA512c582e42584551e0664ddaf683b4822be5a5b60161f7f8f8c348f5d7f5a28178575128eb71c75a111083b6ab4b25219cea516893d13bbe2216d6f4755e55646e1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\video-slider[1].js
Filesize44KB
MD53908e75540e9f4c892d7989208ba58f4
SHA10d7c52035e57fc2977ec47ae034a2e0f7bd54d3c
SHA256f5ee80433d8589a8ee23154603be2587cf949b98421e01b7f9b9a778153c03e8
SHA512a4f6fb5be76176bc53fa8c4febd2d7e416cadfa912ee5aa96be1136b4cc889858ef9fe41e6249e792dcc568c0b58fc4ee6a80349e40638b4c02847c68252e620
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\addthis_widget[1].js
Filesize56B
MD5de3701eecb9340ae075e05b04bb05a6b
SHA11262474193bc31e859367df01c4b2b26214a375c
SHA256f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
SHA5124cce11abf10df2640900c923b0cac9ae1b80890f52701d5b57ab937c4752e91aea392ed9439ee24357a6f88ac6f0f79b160a9c080f5670220c29c81b5148c69e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\count[1].js
Filesize1KB
MD564932a1e2564351aa7642475acdf3fbf
SHA1c3dd2b7d1d4604e3559c2732fd90d71059dd77d8
SHA2563487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
SHA512ffe08187ef578d7afd64adb9f50d189a894819bbedbc116a6a5d3c18bdfba1a44ff5ce5a86fc365500e2ec03d4757edf03cdafb92fbe9ab7e5a3191829bc74a3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\jp[1].js
Filesize92KB
MD5cc93824aec5acc4cbf51cda6810cf126
SHA104e30cb3eaf76ce591a943da03a227365d56e637
SHA256ddad18891952b2da4d745a3b22b711e253b9ccfb45bc8343a10d4006984bf0aa
SHA5120ca127c5a6724c6298ed43d0cbd2934b92154787c3fe8cedb487338c14fc1a92eac47001cf13ffe8c8a7cabbdb3e72cfbbc5c83a85c967b0b1387c751f5ca8a5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OV51DDG5\ads[1].js
Filesize435B
MD5f272c4fafcd07f74a095fd6be5f72034
SHA16f74be4b31ee91d8d98b52d96606c99c3414a025
SHA256905f4b4159e676360f04de47a5804e2f9aaf7ac07d74c3418dff899cdbd527d7
SHA512a3822323a315d1673a5a77354911b3ba954a221c7332779cd59db4e1aeb1bb29a55ce0949135fe97bc84920bfdc6c8c505d1413a227ea7d0775ffa898a453058
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OV51DDG5\ads[2].js
Filesize435B
MD52eed6885ef06e829f6040fcb67b32721
SHA189d08a8871281318d5270cb5d37a0494471048e0
SHA2563cdbe828696adf1b3bc0c3ec49862f6549bf930c64ca1e19520a0357494d2200
SHA5125d1c4253a6d62ab913e33dfe4235070beb12870b017ed4f409348c9a3156385a6841f15e498a4ec0ac6f84575360af07cca22a3bbedc9887cce13df4f247adf5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\ads[1].js
Filesize435B
MD5cd842b7756caba4cb646aa410c73edff
SHA1f172e6e540b703acc63cb4c22ddf6ec2420ec24c
SHA2568f6fdba1ea6c887918c4c12993fcba17d9e20855bfd9554e7a3f0339110a0220
SHA51251c432f62a19f3e0c1b5bfb1f5527171ee6b2b96b130e1b07b4b525399976ace70afbe0b0702d40bd45efcc4cff03d0d7179f6090772a222960bcf529d82be92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\ads[2].js
Filesize435B
MD5ceb5e37b2fb16f5ebffcad2714e7cbeb
SHA1c80094a8fb0fe6f6959a6be6c0ab2781738e483e
SHA2563eeb6ed5a32941ef31d229c71c4618a5f7bc280c5c1b0be00a761c6cbd00a340
SHA5121656d72317fd4e2339bac697ea4d7791524e1055c48a78bcf679aa5f65d71acd4f4fb63faf262244bad4e925057b19d5c6144dd96145c44fabe23311785a171f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\css[1].css
Filesize978B
MD5fc700624b06ac36ce84777f7de3c59a4
SHA1a2a674ae11716bfc4fdc98c0a8106bf970b08565
SHA25616adc6ab035bf71b78ecb4f52fc944f6a8383924e3bc1e6ce5f9648f372f1e5b
SHA512e07a1f4ee6d8b65a154324648c619f804bcb4eb81ea1a1ea3f59808bec1e37e546a0d95511a5d8330695e65006a3cf22aa85c27116c7d55688bfd4801a9b4522
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a