Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
50367bd55647c482bedaa7d07777cb5f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
50367bd55647c482bedaa7d07777cb5f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
50367bd55647c482bedaa7d07777cb5f_JaffaCakes118.html
-
Size
3KB
-
MD5
50367bd55647c482bedaa7d07777cb5f
-
SHA1
1c48a8ccb8cc8e2014d4b4c4831f20dc508a53a1
-
SHA256
debc0d80f53f79540174344f030a8bd706b24799aa84518a7835b01a5001eb59
-
SHA512
7da83d237f99fdaf577f03e5df0ac569c816eca5440be7cd78ea972423163a2766d8c42d0464cb50735e39e02cf95de550ed520b430a4711fe4ad204ce38af7e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000aec2cd445ac3cd7c5b34502d352502eb29432735a8a512f40751ecafea6e7123000000000e8000000002000020000000dad7bb4d18cf2ea558554f0caa957c526ed02226e6fb58b286c19218849d42cd20000000f4cd6369da029a285ae949f6dcb39a8751af2128462e92e59ba9b7d9902b609840000000d6df17bb3d812a1737c6d969eb90cc975495506900ed85e94efdd74f65d103de195bfbedd276fc0a45ae01e26b0daed5cdec143751a7726f5288d079994b9cea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA2F6931-1462-11EF-906B-FA9381F5F0AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422121870" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705fca9e6fa8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000050d52b1262c97f4cb3d2f819d9e00b4af7d4e265e9338a013c66ae08bd51b5db000000000e8000000002000020000000cfc757117129221f06eb0c78fc1129322351f63d0678d18464bd9b1e81300bcf900000005c94321f35952a32602bd57abb2953f602939499317951f7a69ce89add3e8f86d1a4566625d21bf6c682f8f72c05a73cf4cedd9dbf1a46c87c32bee7b15eb305daf0a85b8ca82dfd654693539a7f5a62a33182a6c578df7d5b8bde1e8cd487b2255d04c395b5be2715e0495a7df981312835136ca3b83ec87ae6991008a18b5aa968efced445577f6c9a5ba556da068340000000a41ff06e1bf1c50dbb10c75468285985d083558e833f22a4418029f8bc3367c9d7d11d1b6cbb1818865dc621bac4ddd37e1a9488b7397edb9768821ea1d5dfab iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2128 1708 iexplore.exe 28 PID 1708 wrote to memory of 2128 1708 iexplore.exe 28 PID 1708 wrote to memory of 2128 1708 iexplore.exe 28 PID 1708 wrote to memory of 2128 1708 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50367bd55647c482bedaa7d07777cb5f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5244b0af4a0efb6ddf4975f84792302be
SHA1cc6cc71c3e1ef828df8e3be33020c73f3274bad7
SHA2563168afe2c61b83a8050cb59409599e7f2a63ebf2c32a941e3ccaa3987f72d442
SHA5128fe975bfa743b3b32cb5f64261ab8a5c1b47e86311d5bbeb7c2d765dc62fdf4a8910040ad8717a836242c3e0a7cb10fd393f05e1c682463b9b86451a54f4b02d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545b45b726145f3e44c6edecbb8b868cd
SHA1f81ec135924554c4a7d454e317a6bf3f7b9b3473
SHA256cb51fd6c4763620625c758cfd6dc0794d39270ef62ad194701d1a44c3128fdf6
SHA512ce868bdd846ad316498f39c97d8601c417151095d40a0e27bc15669c482d3520810032444562746e10533c4fa9444df675b7e57caadcb2987f89759d57eeb5e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb1f375e18145cd5400f08e886e761f1
SHA12aa869f8a85d1b73f3d702cdd653a817f4f29201
SHA256e728e446b16a102be0f0b746061ab123e8f4d7c466514bef8f158b48253f2924
SHA51262d23c95fd9379dc32c31ea947885c349a1ece83641d22e9f7bcaa18e2ddab179afff74b4144ae56ba645bf3bc24d5bae2d620e6d129c240737ae3e178f84f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e92738500a82e00c63f1f97bdfc73e35
SHA1a7b36b0758f0cd00c064b806423744d4bfc9fd66
SHA256aa1ce6d25a198116e9523e187fb023706e86ed9a91ce1b2bc033e294216eb687
SHA512f1d73b567f625634c8b7887c0f7d9ca968d7350ee8a823a85a51d2c9c1f488faa1c7d8a1be70fe203c17808262a4ef3b9a6bb1c956dfed87e3974a6709642d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576bdc5ac095bdb0178784995486b4eb2
SHA1b67d4f235b8e171ab0e9bc6f9adefc8c48e2ce5a
SHA256cd3181cca42f17ad4d969274f4269cde4ae9d360cbc76c490e31fd2f07225846
SHA512dbc4cd6c0e70d8d0c363e4427a2624a53a57bbef2dc756739fbdd891167906ffde4e3dd0f41e808293e57d000b911512cfe62178f60002ae95e6becde6089c85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53184d2f58bcf71f08ff4cc601add2e91
SHA1e5f0e851a5824c41991e4e1e3ad605c93e2ae60f
SHA25691612579aa298b09178a48aa948d2cdfb2380ca9dfbf05bb63ea8d470a8bff59
SHA5128cbdf5a4453d838d89cec00bb1a377542b362cb11eb3ec4947de9cc2d6eeecc34af8f8a4546b1a6c7e23dfd94b51fe0ad03039060df7def4a3fa859e4084a362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54637bfd3e672882f6c68b2c333c4b5b7
SHA1404f08c3d9a9ef87821f58a0b0cc7cd4fff08fef
SHA25654f962be8e8915309838317c5ddba1eaa0a66af6af120479a0c8c3d42ea29afa
SHA5121c5bf6249d07634508df742014ef7943a52ef4f0a70d6dc5f59b5ecfc74acccf78c7991ccfb718027cd5a1b005d56f47e391debbffde5e5ea4c78a15307905af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b39162e8f9abf4612fb7110d8f50a19
SHA1e646ca9882efc32456c318fd16aba33bb92c664f
SHA256a0fb739cb843e217b5a8479c6945538fd71d16b02b179d5f05f46e63c36d61f0
SHA512a363e9b7b95909f20d9d747db7db1c76ba5edc31ed31ed06f4b8408685f466ec4d873baf960642d4c9e5acfbe0bdf2b220a4e8f2792d18d7db43b84345d8234c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512fb18f31d339371e1e0366e28f4237b
SHA127add0bbde0690c093394797f7ac3ccbc50a30e5
SHA2562fc01639c30896634c3e654562bc436d6f25c3fa747584b06fcc2a9a541063b3
SHA5121425d85f0abdebd1d97664f4c5ab2f2fcf5c3b282fa1066913fed7300c101c83ae884b6ab45c0216e2b50acd7adf6f968c307d7f93f989c8a8e20498959618d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f6c519c80f8e7b3ca3cdfc3a5f5046
SHA1b64dd82811ce9c9f1e358ac7c6aff0b6981a3be6
SHA25655d8e2bb95e18bcbbf77da84c680ac56bbe42cd50c58bc5507f10cd0205d77de
SHA5124787d467dd99854f5db39740360a3e8a5dc36a868e56f4e55fa1234c6097c749e87c947097f10e8a3d0ccda2bb810e21c8516e71998ee5bfe797c9cd68cf8d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5404e6ac81b3e50815b6ab87057f2d07c
SHA1d8f3b02c7f70d38271b055189b7defc8fcb7cb9d
SHA256e483ecb16ad224b0a6ce86f4fbf2ba9b9396ce3c6cfb005258c15b9818a01600
SHA512464cacc27f10c9d1b75e80a1ca5b215234339f66aea8ee6e83275499e68ae4eb9915b2f23d4291b494ea0ea47d0b006563a93bccb04d7e68d5ee4ca317882c7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed0619e8cd4b7dda4a7e1f09bb6feec
SHA1d88b32ff2e7c7d046d16ae75c90ed73c90d7072a
SHA256be73bd9555aecf5b0ab899805bbb8ee4980333f9fd5dfc04761fd7d540d2b1bf
SHA512b7aaa6ea1ff7b55b0e153f8a5dba11aae58a3fd57f58defd064311255b8e2796481404daaa4a366b7ed73f07306bbae369b7a5c341a1a42dc656e61b3b6d8de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af67dcbc02647d754045819da1320c2
SHA16e68c21e22fabe5fba3118ea8290e7a24b7e6f8a
SHA256f5305580a6f80d8cb02dd339167d851cf5bc2f1ff12f59dd062f4537ae2b282a
SHA51275c868bd2e4062a9e6813c9a767a22761b0ac93d9454406b6e4e36c300983573d82c06922134afa4b22932593e02ab73c0b0ea1f1b4daa6b96eb302891e62e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f29887f7baa0a2f49f384f121c9375b1
SHA1358c6270b8eed9ed071debca48a76e4e7c97cdee
SHA25618862dae70c194fd9258a01e1013cb91c49e4dca8f63fe1a661d81506be13f9a
SHA512ddb45223343e9da37e85f3c1ae5e44b2a80c400f2ad462a28bdb27f36cb660e0e46637925dcbed7e816716233ae72a19f536baf5280fb3c3d0393659f7e3033b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a275ddc00d4de500b0023f873826f29
SHA177e4f8b7d4e5da37d215a35f8ca6583e3e0a07a4
SHA256ca13e9f0de921fd5e34f3b85817940289e5fc1f2ce4c5d5aefbfa026d633bf7a
SHA512cd5b8552bd8ec67e983051ca021c2f3bf8cbdd67a515e740c76c6aecf3f8f5bc044993e6807f9310c9ea9d53cb65e8677197eede6f29f5294cd8ec9718cf7ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eae9fc418a7ce8110da34541e551e41
SHA1a5031486cea270e5ec14f89ce8d21d2c6c6acc92
SHA2561c1cba463cc7dd011bde9d79c049b81515e001649695df20126e4b0a72991646
SHA512270fbbdde1eaa7fabe87950120a1650b4139b3b751ff7c696add5989b1e7b505d0f3f4a3c93d80b3f97db278f65282e001185133eb46dffd84141fd4427dc416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4aa7160b7407e20cbc87e48845aa8bd
SHA1c477ddba5275178547b42028df2145df78435522
SHA25614ad1f4fab334ccfcbdd44363cb577bd7ab4d870c05ec2669fb3d2dfaf9cf9c7
SHA5125670ce6ef4b9a47e6776d41f1fef3328f0bc36e66032c3c9d8ddf947f9a2700e42336c677f10c181f285cf31b7800615a9d652fe1ba2f3dbdedbaf406f977516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509a0f3e2167cee02f1c152afdc4bdf6a
SHA1de4e72927ba9a1fd25a7eca301c919360e844e5e
SHA256d815e1c68e7633c98f32ac632117d3185def7e5b79efed1c509fde27daae3ba8
SHA512708e8f364c54edac1b447744fea972153e1caba8f1155d2ccc8e1a4e96c85951bc1d1b81883a3787889797c832f06d5bff7758a47ab1263d600d7b5bf5b1d58a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a