Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 02:48
Static task
static1
Behavioral task
behavioral1
Sample
4e19ed0b47f473a6dd1a60221e44d511_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4e19ed0b47f473a6dd1a60221e44d511_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4e19ed0b47f473a6dd1a60221e44d511_JaffaCakes118.html
-
Size
462KB
-
MD5
4e19ed0b47f473a6dd1a60221e44d511
-
SHA1
a27b84295d566a057e6443b0503a680415c2b08b
-
SHA256
e764426bdd396b0fb73db82052d09dde10a6f7383e4b607ec20f2bdd92017b62
-
SHA512
a5d3be1efff4c28ddd80f72fa6006bf7374b2d4fc9030afab1a3802df02f31ee2588e4af6e5b5124fb1c86924a68e971510d75148e1a9f5937ef3eaf799f651d
-
SSDEEP
12288:DUJc5d+X3hCU/h5d+X3jz5d+X315d+X3+:v+n+v+5+e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422075994" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBBE1111-13F7-11EF-AB01-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e928d535066a3140e801e4908135e24657556a6107c300f985d19b95ed8b0d73000000000e80000000020000200000008555feae7f7fe6951b4ff9079ae3f40a4b19f858eebe82a33dd733861696828590000000f4eac475d29dbd34c145aac97d616502442487349d14bc70a048f0f2afaf663e85643427d12dc3e5fc3878d43da9246e0e0003abe6db9e4368e174d6de79253c13b1c551afd2f10286a549f0275f689ded993c737207c3e7ff4212e2da234b51f622c70ba40e20c722c261daa32718e48b58b399e3c5c580699867742c874869cc294c6583cbf82a57af4ac6c728bd37400000005038d5795ee1244513d9192b884fdb1950b771227cd96f8d1a5e525e1bdb87dbcc074234b6c6cbd51a17f7f7b0d62a30396bf332ce36efd8b827e5339b2f772f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a6004e1615ec70b5111268d3fa374acfcafd18cd0354211df97d61678b2d9a6e000000000e8000000002000020000000d9e98c09f945de02ed8c0d11a4e36d5005d133abf3d8b14de66a6f7a0dfabaab20000000c8957cb61872053d42a28669a8c9f3c50ffc4cd61d3241e69432bc431c6e641f40000000fcc18fbf9a51071f15722b1eef5b6de6f867e6fbf8217a28f48ceabfe7a5893ec71e8b18d0174e3a636b5d1c49885f52208e7e3910ce2a0115498af249c324e3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20444dd404a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2904 2056 iexplore.exe 28 PID 2056 wrote to memory of 2904 2056 iexplore.exe 28 PID 2056 wrote to memory of 2904 2056 iexplore.exe 28 PID 2056 wrote to memory of 2904 2056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e19ed0b47f473a6dd1a60221e44d511_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514f76e5df2f8264ea2e108b129ec87bb
SHA198115018ec4d346cf9fc077945db41aa849a9ae9
SHA2567891154a5a5abc660802b6315188b458dc7fac5c75c4ff19aa170dbc7dacbc19
SHA5121eccc2bd463fbfac56fb7436d015c1a602de9034b6e3d3bfe9f72326506c8ca0fc2b0408bdfccc6a0cb08e92219d42bc76b2420fe0fc3117f49b6dabd782fe5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a7b8cc8065a48b240332b242926387
SHA10d5581f055323f4215263179f0f115366fb7cfc8
SHA2560fa6b3b68d5d4dd687fee5f93b97f524d4a5a3a5ad801b1f8f75c850685e86a1
SHA512698e78a7e060d952ff166e46335d1830ef3dfd85ffa2df4b60e307a4d88c0d8d9f3b3068f9f215f7e0c2201f3e1ccac97512082a2868f440fb8e0e4f7aa309e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b60e1644c486658d379421abf79acb7e
SHA1a6110f8bb272ceb405085fb30f0625418a2f5290
SHA2564609bfa46a342d4b766e6dea55ba2070c843eadcf4a548d458f74068d846e947
SHA5123a6c365bcb927d60b0a1372552ba666ec18e8074313d960bc9cbccc96117b7ed83f91e78fb92aed266917403ab549e04d7080f0ff5921aec3cb786783e3ed910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53abac9e891373ece72391a363ea1d541
SHA1db7110b2c29f50099049be768d557a4b4dedd883
SHA256fd4c64c6463708315fadaf96a06ac9047d50b77013821c1d5e79c5143889c692
SHA512250a859d01382644d4afa017bacd110da8445220829b68d45d8c8c8aaab58cbe173ed04759f289773f93a4cfafa7807e563ed2b13ee7996f02a14964ac824835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04d1531a4cf668024f9a77329a10ce9
SHA136b6df6d95039f4bbe8d41ca89131a2033e90703
SHA25680fd6e4856739b784a84a7b88fdb7c268d07cbd7b393ddeb64fe1ec37eb9d7f8
SHA5128dcf20a882cef9e301eecd3666c23e58a1d46abe09e606660f35ef4314ed5ff799c9644e3ef8e33b99528cf2b4fbaefa90b2ee3b45610b6c7083ca943d780fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d11c2a35b866617dd79a3b3ab5d15481
SHA1c49528d91f065d9fe85c9f4b78adb497bfce2550
SHA2569c5504559cd4cc22dfdc2fea9cd76488975ee12b85e11fa801e97ce2600f63ab
SHA5128ce1a49bfa498250ad69468852fbaa0e377e37502694d02077a0b57cb5389809891266ade847b081e0f35c0ca43a7bf301f909b693bea7cb981f2835f940e49c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545056f13c73269e77a680fe00f524393
SHA1f9a62954a1ae27f67677acf24abab69360e5bc65
SHA2561bc93f2b375198c81db95d5169f734a8a61a1c6d5d802dae46853b5eafc9adaf
SHA51263dee21a954615268eae418b1a8df48a846cd848c90f062fb796c5b011371f380ec3a0e8fd2908903dde66717a8c0b2e4c39f6ac956e36133adda7ab4e50c578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ae13bea74668f57a4222c5380687efb
SHA1fae5b9bf9acf5dab3661230db38d13fc4cd1dcaf
SHA25692184adcdece9630108ff1107796fb562a3ac51b01674c168f119ae8cc9c1cdc
SHA5122ef58f6f03866f7f1f3651e5ea5dea7c595af92598849cd0977a9abdcbf4e4e49a5c8df0ce0ce573ff4ae21d07423c94d1c1f9de5247a50669150e8ffce9ad6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d7f0e8553b2b2d6344cdee0ed76797
SHA19dfda0a9863f2a7a02159ea5fc43533c30aa45e0
SHA25635e8eea5bf50c122a604d754de490412211d455593d43881805cd2dcf2a6a1a3
SHA51213c6f13ff881625e335794f2be5458c9d88148a01b392b67b558fd268a07c221e9dafa481740250e55797b1414662e9f23847b50273ed2c0eadb29bf72fd20c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eb5f4dcc578d1b093561289f646689b
SHA189a1f00e1535810a86a419f7105978b2cc9447d0
SHA256c0165eaa6cf1a6a6f4500d5d3aeb835f7e361cb259911fa80ed5ca94e27fff57
SHA512c6369e4382189db5c8cbd682db8a7ddfcd5c21529e49a2e4c3940fd55158854dbfd99431d327ed2dd7240dec8f295195dc26b967d0e454e33499312ae38148c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df5a7f72b205d0671658cfe360b36ea
SHA19026d58fd6b0c10c78427495f3f61005ab71ec5f
SHA256aa53761a902cd3ba6f8bf86f1a37eaeeb3f6ad982dc935a8cf9ba17d23a291c1
SHA512d2eaf90b7607e673c722782cd46540637aa5af6ebbddb5bcf1e8ebad35d60752a0c63da3b90797153ffc0763e426fa7cf5114bba94ef2d76d20f827e24835ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de7c1519cd5cff04271aea11ba38c2c3
SHA1be0c9f2f5106b7840f52196e742420826f13d4ee
SHA2568df95e3e81883efeb7558344aba797fc79c4a249a4fe8375211d754c0df6f2b0
SHA51239f89a34b91e486a4c7f0597d9504ebbcb18496b9030f00bca66ac6e978bf4152ce78f24f1bca093057eba166e42c7a309bd98d281f76009ab59dbfe8a711a52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5bac413e840895023197b0a6d1dbad8
SHA183d4225c45f7ef0087b8aee27c24bd1fd5097ec7
SHA2569e26cd4bf1740c676feb1c50abe62b4354a977e3251eabb59fc6412cb54afead
SHA5127af5da88c39f5fd650814f4c9e14bf2d97c691204fa5a017265fc108c89dc17122f6466f19b6420d6221c4cb0f1c640073e956dcc4e2e88513f2f86a6f5ef255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8851631c795a4792c1cfca5313e9dd9
SHA15f93446e38282f72443a67429079d9d2ec2b065a
SHA2561bfdd7f7cd888fbc1bbcbed70db78569484dbdde4b23cfc08fa67d6ed641bc5f
SHA512126c0fd7c451fd1ea33b80fb1f6cdec4a2b169f6da87d5266d8897cf6f5710ec91035ea0b047274bd7e5c31e73cf1e632d02e57ff3344d72296f0ee9e41ab38a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519bef1f81838b5b4b305df1d5b8ba080
SHA1f294e52b6c18d1b4902810d0803b109df1092a6c
SHA256fefb7d4518a0448fcb695493903feb9996fb6ed5e854ac6061ee75691c48d2e7
SHA512a61b35e1f21f37f08bd854f824a27d7493b13a760bd2347258923192946196ac342b1667e47bdbb86669e19c0defba55b95e8fcfeb2b0f64e68f2bc4ef423564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1c6de6844b54ff0032139cda1226732
SHA1be51de7b2ec1c5740117c325f54d92db9089d5e5
SHA256214248f807792bff322a76e7844d635d129509eba56fe5c192f23f3997152e7f
SHA512245994b1e2989efeabe2d049961ad6456a68dfc59a5945883289b427973ce54c59f572317b749b31cd3be2b321effd0d660a025a5d04f7cb9b5a3f57e7718cef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f994a5f276ae8004f943264e8d99671c
SHA1c626bbc5720286aa9025f48236992dbae41527ea
SHA256f7dc9ec4705ca62fa5f1671d341a7f3dcfd068773d09121c9ae3323823fce102
SHA512705fc057a134840294732d9deb3652cbc4fc459748574abddc3cb6e58f58c62ed7b75b90efd6f407a8c3a321d32e14586aeeaecf175023ec25696692aba22152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55af985436c103a059a5ecd31093c64ca
SHA12781fa20e0cc34b4b093b027f07d4b4c8e948e1d
SHA2568a004322af78c66ab7677f28dac5f2de14032f2001c60c1571bcfca183da26b0
SHA51229b5a3648015a9d1c1f61db570c403596e35dda74835a0054fa1821354b248c548836751908f4ed1fc1768547d7d1c45363bfa06cb388bd8654ab82229b26c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52909bab887882ec3d74b83d8907c9826
SHA1734c7f6372da565fb233c079cd088f100f8e4733
SHA2563e11fd338871e2e24d1a9b64b0050de82a9784202dbbe35a51951e9837c88396
SHA512917431f2fb0b5dcf53b1da100f403c358d2edb7adc392ea7855ba65eb6e3b678ecd27bf317c4d1a725d377b02753baa99bb6648b674b72bf0cc81f48e122d8ec
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a