Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
50420cb97d77df4352839f965520f018_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
50420cb97d77df4352839f965520f018_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
50420cb97d77df4352839f965520f018_JaffaCakes118.html
-
Size
2KB
-
MD5
50420cb97d77df4352839f965520f018
-
SHA1
64fa1a089891ee193e9baf20720327786e01d065
-
SHA256
b59ea65cfa73e809caf8f7dd0bcaab9832aa4414fae1262a4e3ce8e512610cff
-
SHA512
cff4fe9b27e4844db6ed13430b178587b76f391166dcd59e891a73a2209c44391ac7b24852cfa6588072b30a55e2d3467a86d99031b8c6cf5242b967079683e0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a64ec749d37f5746b690bfa262e6490200000000020000000000106600000001000020000000e95fe78f7e8862a6294018ec282ac89d393c269c4583f31416b6d0df7359c7c3000000000e800000000200002000000021c81e8862cc8d9ea2108bd2008b4efacfe48c0c03c44f27174be84ade38afdd9000000021198db2ebbaa483971b12fbbde0910cb2e05b05ac07af32d468cd350a2aa2f3c48a3aa9c7d381eccc33e77c9bf26264779eb734746a82ad856c1d0ab8c81623d15e2063e8923b5a9c812c943db5c22bdd3f2da799d7e1c41c6f6f710d75068e0cb59bc2faf5e2412cab71a5270b8a85808238d646a5735d2a61713abea55826594f19eb18ee0c642880a3a35631733340000000e34a12b1aa7a1a21e481fb1e765ab5b1ca262d09a03f249f30c515c1b578a54fb288231585ef3a64fdcbd068047932af8de95b8050df11d1f5da358a50cfb50d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a64ec749d37f5746b690bfa262e64902000000000200000000001066000000010000200000006b40e27264b66a98fbfa2f06f7364cdf6d4a7b68adcfa568907f57db0a3ca9df000000000e80000000020000200000003e24ee8967d9851aaac5c31a3c9d1028dc4b860cb6c5757c0ce9756893d6d8042000000082f5c8c92e49d9741322ac4632f47fe155fbb235e0a82e2da39da8863948df4340000000f34a62258fce6a1d97697e34cbeaa201f68fc1ffebf4fe7eace8a9fdb6348a01a1ea59b8ad1a50ba9dc82984577acdaa6dc7d7e9b634800618346b08e950a1a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6316A51-1464-11EF-B411-768C8F534424} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422122773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0042d5ba71a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 768 IEXPLORE.EXE 768 IEXPLORE.EXE 768 IEXPLORE.EXE 768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 768 3000 iexplore.exe 28 PID 3000 wrote to memory of 768 3000 iexplore.exe 28 PID 3000 wrote to memory of 768 3000 iexplore.exe 28 PID 3000 wrote to memory of 768 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50420cb97d77df4352839f965520f018_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e2c3fe062c3cac730eac83bd604e67c
SHA122ca7abb96043522fdbf93c6f9b64cb0827b0ed2
SHA256741d2326dd4b9dcee6bda243852d9ed98ab84b94f060e75a7f5bcbb44954c43a
SHA5123f3c9f8b5320d819dc3655ce82fbc421507115aa64981c540828e2b234bf6eeb9766089ab5ca36af54b1c0eed333de11e1879031a547ebdd17c22f56e4020f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2b1cda569b3afc6f1861ce519899164
SHA14e80e31b9f8c57af94a5a57eb04135e86c559fc1
SHA256e7d8aed37fb4b5e46e8a33dd20643a105d32b3f47ff3a724e03eea90ae7637fe
SHA5129f5a8f49a29b6fce42801c0f3b3c89126194967ed9307f724b1e1a4269b7f10cdab7b94719fc5c52592756cc014467e4b4d21967d777576e513dccc08cae026d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55931eb3d8f61719aa3cafc0d581de3d6
SHA1f93103f50e459c08887d24a8be7e36299472ea59
SHA256da60d904bb5916646b96583d35fd8311baea5d2f7a9a94f70a29c13393b9c8f9
SHA51296746a0489e91ed170b9306db95ae8226b016ed41d44dac1e2d7def54c7b1d524d9b837bb7b2327a06df64e93fc8877c78a6f2437968b15576d98329611ec480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50beba72d347780cea4612b6607563166
SHA11d0490e8c033217fd8cc88d0db6272e2ef0359f1
SHA256c276b82c5dec2cbd9b27306b5c07c5a5cd5b8482f02a42a6b74f0e1041d8fec7
SHA512b054207d9c4e5edc2a47cf98062fe872923bfb8f0410b354ea18813a1d5b8744b919edad5a4e381fd2ddb6a5d396fc97e9919446bbea162f0ba87b2715865e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5b32c70570642371a562e040cdca28e
SHA102b2d9aff5be867bddd3ab9d4cf854b9ad2233e2
SHA25666f7106475233293ac41c6fde2813ce338b2f514eb622a36d4767fbddf0f522a
SHA5120b02dbcc1ae3615cd65ede4fc115426f38b4af576fd300d7642a233d0a22a9e0b75dea173eba9272b6ed747ca070cdfd361253b5f1021971aaa69d0dbf811c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80e76f63eb725c1bc1aced7553a3e83
SHA100a1bc57edc89b91b9a288f67f791cb0f30a683e
SHA256e20f3875dc190427232296ee1190aaa924128cd70d20f255fbeda582e9f5d97d
SHA512ed4fad72200485df283aec9fc9dca183d383f088adeeb1d283a4ddd7f2d70f5fe3747a14960407d72d07fe10135a8e92afce0fb26b75da566f223366a6009755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c054bbc5a47e35c2569e3b94f76e35b
SHA17a9b1a9488987f5554fb841d9f16e94dee205948
SHA256ab06ad824d470fcacd8471d124b784af425a4fba53aa21c7b9fe2f817a2bbe26
SHA51207b722d78e6e9e868713ee71b986a5c19eaafe0fab7bd2b0432efdfae216618e4c001e45aa0d4667b10c25d6fdb6fdb2d109df0b32cb4ba104c102452e477aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa42ef45d24e2e153c46e8ede71bcc7d
SHA1cca4e6f696c454496aad9b678cf645a410661682
SHA256fbe10f84a299dfa8f70752f1d3e3db67722478496a0e4acbf5b9e37539580933
SHA512697282380025b95da10da24496b8ead6ffcf24d083d6d8317d2c04f626698697572818dcb54db3e62a819c5a849e3317eea614118f72286134f272369b86e2ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eae9d1a3fe715275fa636d7033ada86
SHA1722b6a174a56b3e31304f7ed4f0effcd3be5a2d6
SHA2562e4d61f97a97a04420334425308b5817009296e6f787ecc710d37e583b10a0d0
SHA512bf7ab212519f9f41867147f99b77762c1d01b1451c1a122f22c83e0024e5c21239036956d9468c45cd2f1c957f11da7e18df73152f9faca5540e5c9b2058d501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0723b8a9346008792d00c37e6409e60
SHA1f2be1fe24679f38bc62dafa2927ca608dfd5fff1
SHA256e74ca39cb1b82afacbcfab9ed0b9b6ff89f97f9a558e767dbf52b8e38da0e908
SHA512cbb15acf9450e61e97d4cbf47cb7010a36edaa124bb4c4c85a5799cc2943659c9924034fddcb0f1d937c28f45bb7516035585fcef333028af3efe782249f5d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b65afa9e1a5f856dd367d6e0b4860843
SHA1cd4acc028c622b4993624eca0645b8aa04975676
SHA256f87d61a4791634ae45fc4b08f8f67db02d1638cbb9a808e3aec60bfc6e138e42
SHA512a56c0e1d14784bbed019094d131d0c541016a0655754c2a9b08a72944b35763da4e6f84484d64dafbc9f1186b8b39505bdf2b6938aea5acee470ac32b8f8e411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5404d39e6f2c130833710539b5ece62db
SHA1f9e2977a32779a9408456e4a92498751647a2cae
SHA256917bac6e7d7e0ae3e63a8636ea648e9d3f99543afdaed981bb894636456bd0de
SHA5126c2cbb112c419d674e9bdafe434b1050e407b60082f6b15acb4779413295378358364646f0e15cca8f81c7b16fb2b1edb7b5843d46d9c88241df0e1b12073114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c9e58e852cabf83e9820cfddbf45136
SHA1f6b6198a99a83a8070db169b6e0ff0d10d5af52c
SHA256714743844e133158e67558a05acdc854bc56c230e2bb869ea1a69123edf6d0e1
SHA512dc05a61221856bfe518cf80002c13832b0d00498ccf4d16318cebaa042f105db701125a9b8ec991e081df432a8423a93dfc3f3c19cd209dc552fb6dc1baffd0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce7b3d63d42006e1b8bd28ba2d9761dc
SHA1de33efe5e9d60a52413f51585438a085112cb690
SHA2568762db0399ae4f551a28823e239425fa5101434bece714879ecfa21919924f30
SHA5122534172e218c9235e9adddaf4e25270bb1555f241613ddb58460782ae224db87b4309cbe3c29dcc996ef033ee13ebc2e85327b9605afe8615e9058ef420a931c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5850c5d0cd6858a309c34c21f9cd5a4f6
SHA1d3c62677c777d669f892a0d7b57b62d00d6f2bf6
SHA256786ff2102104325799681a0da59e846ebe2f85a0e71745ad253eb7a503797743
SHA51231de775555e9f02ffdeacdf2203d5730ab67c27788725a10b74ebecdaf3ab3169da68e85703256b26c2a43b9ef9983286afe1c14febfcb7aa41d9a55cf86a2ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c16480ed7a74bc6e0210fee5788ba55
SHA1997782cdc8f140360f565fa26b24f391646fcd3b
SHA256a6ac06b226381cde6d31e17485575ecacea4089e43859db5d555e2fb749bcdfa
SHA51237fc904b1967926f2a9683eeee0a3a8bfa45710e6f0e0c7bdf1bb2226b3119dda098d5adfcb8ffcf739ae73d7d18e7138d842b289e6c0323bf98a16874a8171b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da6faa9f944b59e34f858b5b09debccc
SHA19d7f3471643e3eb33e1decf76513ba28f815afe9
SHA256880237272243c7a1fe72a608899a19ba9b3af35bcf31b2e9c0cdf9e26804bae5
SHA51227ff1eefdd3bf175fd95ab970ea560452b7413f0c19ab0a207dc865cf4890e42427f8010a211c4bb93404ad485d073ea4ac83e2697f32b452644b3e784e584bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c18e58af0c917194a78e75e7ff4d00a7
SHA167a19a101a04f1cef3a4dfa35725386dd21f62bc
SHA25686baa62969ab860fd756ff840512094d04a78282457150ef5376335446e957f8
SHA512f4aa1b132bc20cffe70ab7f03adc7a9695576d5ca91f28a68d2a193056d9e807df2ab788ee377b1f6c20998fbcb2b452df9ac2ebcd7f7cfe3fa359aed67a177e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d6fb7b0eaadee5ab09af8c218baf2a
SHA148d09cff20728129e92281f84d83a678a3758777
SHA2564f17e2dacc8c95898c56da82dbd4e552d9d99ecbc62c585f55add19c91be6879
SHA51289e92b17c238db58c92df8f105511b7cbbe8f9b9ee1375ecbc540fa2c543bf93e5da713f8e6c504f34f2b8d2398852d2b11273467ed0fcfcf5965de6be887181
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a