Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
50a91f61d1d40bc749390cd0653164d2_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
50a91f61d1d40bc749390cd0653164d2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
50a91f61d1d40bc749390cd0653164d2_JaffaCakes118.html
-
Size
8KB
-
MD5
50a91f61d1d40bc749390cd0653164d2
-
SHA1
c494c15926118531cd604ec912b79345aa1c9df5
-
SHA256
60fcf95720e13ceff4bf1f1cc3c87805e0ead11cb736768674a4914272896f31
-
SHA512
93829eb4068c45a83270c4eed7677b9c88b4b4c5460ce27b4fb873d4d36002b0b5911a42fa669be294e94d52379f09c792333a34bfa0e69318d3c8de1d8cc236
-
SSDEEP
192:Rd2xHMds7qgiOSIErPmcDNDFdNEFCBCnf:wGs9LErP94nf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422129092" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90109d7180a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C9C72E1-1473-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000062bfbce4e54ec31b849f84f6e04a48f091bdf878bef179709ce46eb5ed405147000000000e80000000020000200000005a81770320f4c58f8d58bf1ce9d2de9bd0b752b76df65f7c29c1dc883f0a229f90000000dfbbd0c21b51033f7c5d529d4116cb12bbe663c3cdcc31e3787e75e50aefcb25e63454a4521487c4e07b5e4c7a679ac96cdd4a7c39cad07634cbe09b155e61eaa59946bf4e35ea41fee03374b3a70107953ce9fa808d4261c7995f3d71e81ae9246a58ef2c3bb0e053cb762f63842028237196f82dd29b4c894c886cdbcd80987eb9a9fd51a12e3940ed33944ddf3d8540000000b93442cdfca14f8fb103a70f130c775f0fd47682fdc7854e22f9d4ede9724c4bacaa69562c47f980c9d4836b416d0b9093874195b2d24fa41aef09c717b752f4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a253a4e5cc96e1281dc3b8192b1553d38db75d3e5f8f40eb750907db378ff6dc000000000e8000000002000020000000445993e4c986cc9fe44c2ddef6bcf5b6177390464aa587de8a3e8933b1ad7eae20000000e8ce9cd01179216f92259c2eb069b6be05d9d39207df43095a14ffc9b4396ba6400000006fc7ff9739a051cd6ef62146f66e2c3651d1102c5200bf15266912cbebe295a29ebb96443d48c186806f848f762ab5cd1ec9715178845cc4868bdd41bee650a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2428 iexplore.exe 2428 iexplore.exe 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 1648 2428 iexplore.exe 28 PID 2428 wrote to memory of 1648 2428 iexplore.exe 28 PID 2428 wrote to memory of 1648 2428 iexplore.exe 28 PID 2428 wrote to memory of 1648 2428 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50a91f61d1d40bc749390cd0653164d2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca14732123b4c219f11d821b42f8a404
SHA19012637aeeaa08d015da245d6875a5b900f456cd
SHA2567d610c033d4e9b3ab4138606cd9aad46b483a5a76af6171b496b4954d691a18d
SHA51256898bd96f01e7ca5bfaa177da625a0a623df3629e0235d1bd6a791b28f2a7eef40620823695d27b4c2f585105ecf5678039983bf97819f8cee3a43fd858b7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe12f25b7d296f7727ebc71bf7a83bad
SHA1f5dbd6a758ab582c63f99ddcd2c433b8a1c5af6d
SHA25634682482e614e1717277154b8e5946268b0831caf9db191d6584b109c530814d
SHA5120fe4dd7e0d5be5fe15c5521c4fd55b7e1262563adc92c3484cc6b0cd2210a3eb7c63a7640a6a72585fc8e688d7aaf207fe9fdd6fecd7d10652d9c488ed94ae11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0abe3fcb8643260440419c4e05078f7
SHA1a941a8217b6a022b41e5694bcc45a05bd3b5a2a2
SHA2561fb3a416c767608d9e92211ccdc15ecb499b12600d890bf980709ffccab39d9a
SHA5126efb1e343ac6213ab343c49ff86c5c21ce69c59807287033da103883487181b5e7fb9ff94eef0b410383858fd50ebb393daeab7c6e265803332043703223c855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ee887f60f6a5b76c9b43cb0db971dbd
SHA157f24048556988c6489ca480799b3412d2f01196
SHA2561d149b85d85e3786aae5d8c78857281ad103485ef111ccb95ea5475ef9e57021
SHA5121865de20591473cb89dbd033339c5c30f201c8d6ccf2aa9918e66cfd9849f99c0a34a69d4e27cc49f14fbe6a47ff69559c3e3217b113daac499986c31352bf16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcba2c12e581174aa21fbb431f0b54ae
SHA10f37ffc7ff173b296a3d87455b271dbd110981f7
SHA256642f330175a327c9b5817da50ba404f017074ff477acb3afd9253c0c68287ebc
SHA5122e7fff8231367a4298e091c23237a4cef00605b31756ecbf26b5870128ddcdc6bd609ee13503324e50ec0bb373e926002753ad530d0a041b38f6a191a6d346ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5184dad51d4c816e9253f8a3f400c6658
SHA17b4d463a5a6342bd4362811a75c171f8d6c1b5c7
SHA256b11d3b101028aff8a5b4d95567985f467caf6fc94e79bd99c7c41b256201862e
SHA51211ba427a6e6f1839fa906a6624f66b727bf657577428c788da5833b5ce19dcda110cfd7bac98e1b2d3200efdc028c88bb5789349de676b165db376e1db9ca3ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503561ab0f20d2b7790efb13cf9f2ad02
SHA1d2b4e39273b9bb3175f41f1d053eefa9ad7c7064
SHA256377b9624473738308be9e319c056a579f38b3f2fa725a43026184f5bf80d647c
SHA512586c9828c6bcd23cf1115dbe19eb4a4fbb9e2f3948eeea97b8d8934b71d7b62ae93d8b5db8309b95f75bfe0f3c1225a3f4becb654e18c02c857923578b7963ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfdb4d11483e9175949d5912bae5eeba
SHA12c7d58efcdf7f4bf692447164ce398d5b30b8a0c
SHA256814559edee92f0d1b63f5b661e03bc7c05111491dbdf4760328e4f56628a4419
SHA5125a14c43bb862ed8250fc6d6467bcb8c31ac10da8aceffa070aba003b5ff6ce7543fc28bc50e1ae55b6da0fb6de2251f9188c470a370b91f4970af27be5692179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56900efe8015d550917ef79cde352336d
SHA152c70b73f74982c93c83901f43e3e89778854e21
SHA256d0ae6568a92d51170c383b9f29f6ecf6fdf2bdab980c8c0637811ab2f36fce80
SHA512f3d640eeddf60f36e2e9bb647204d47bc0f42564f7f3b25af26d9974b220e287b72c972518baf4e493bdd50215c48edeb214f3068c4d815e74e87933e26ab35b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5069426d0a6512ed7a36d4c62beb52560
SHA1ca6c7ec3dcd5861d0a4264b8b8b5b0db7d0b0ca5
SHA2567b1d5de1ee851b77fdff77c25a08014744c6000e461ef5a702b454af1302e687
SHA512e31375d29e8d082498a4c203a6091fd28cf49534a69dc7baf426952e285f868f9f392e4fc614df798644793f2dba34a10ecda1d5bc7ef64fd13d821be4e5653c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b674273264a665d153212fb3c82549ef
SHA1c193df59b251abf75788f70c3943a136464b63cd
SHA256de34bd7a243f2811d0a6a168bb1477e645f6c521a97d9f546b464a243e459706
SHA512c60476210cb88c091f40400438d9753f3c4bb3a44e1c4542437aceb6c6311b3df9bf31583cdd02f0f83bba53c651b9d288fb976617b9ee532f33336bd7507389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d92b09a95e3e1d6778ca2f841e86459
SHA1760a83c5cc1d92ac8f98ac2efd478bc4fb63074a
SHA256e8b3a341df380fa3ba0b501a8c6c5ca43d2bd2d166b880b688bbf079efacbcf8
SHA5129b9a00fa0b9520faa053e775d08fb289463a8aab5e67866da84a66dc585647cd82d4244aeafb70d311fbe8c66447dd426f8fff54f370e39c08dd63f9604498ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b0e3cdd9c026e51b0e2f616b0785991
SHA1b9704a3680f466b08a99c0cfc983e75c0c64dfb4
SHA2566dcf2a08b21bd8b5b3e6ba8349ea200cd10975fe5737ad591f05258bb41f84e5
SHA512687c471be9ff4d8ebe37c9d7e353640dad0d5a1971d562bfa187df14a6636b74a5bcb4cf2833c92ae5e1ae3f945295c0f6ea69322418d5be84fd6f57ea5fe100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddb48296e4d6ce36accabcbc86a9caf9
SHA1abab348bf2d52a7064835fc7f4aeff460c456272
SHA25609ff19c69aa1fd553338fc178f4daaf311886ed90c5087f5582156183e1c54a4
SHA5128c7eba2c148cfe31600f51e2a2462441b67b8467397f5a4c6027830f88a33b49ea613da2357cf5b7846e5d306339fb024db27098b1d9b7e5f9c1dbf65322576d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cc91ddd43aa2f21a8fa8814ec89b013
SHA167c0f530408e25659549f6024e09e9f82cbcc583
SHA2560c9c337ac2cc3c77142d0f23300476d800cc2c5018dbc3434d3964e66ade049c
SHA5120845ec370f309a3df4491a5159b2e6dffb3cec94c80d96a4907a983ee540241413010eed2c2fbb5528b1eeb320556c294359c6db8f46a89f30fb00a2a9e91775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504c10348486e3010a99ee23fc7432320
SHA1126177d4ece48a617c538f94225ead1915834aa7
SHA25633a288fed888f3802458cbd8f5139f5b4075b2011be4948fcb77f8e33c57e0b2
SHA512312274341f295c27be5416f163f8072b59874422e59bd9c27f6e48387c1cc55c02166bc660ee11e5a4ea3a9d45774e5af1913227ac9928fa50b6fecee1ed1885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9ba7fd4b5772607e6c80ed58f93a4ed
SHA18341ff9af79728b994755b57cab2ac19f86b0faf
SHA25688a10ead65e45d403e7a8eb2c87c5006af94d2ba499dd33c42b2d99457d46d58
SHA5123e5214877661cd6c22a4db7cc914403f7fd3ed41a27f96b4b545b63a2ec5ffe5f082bc9bdc94f13fd791ed14eb666d57ad5c5bdb341c48565a932ae3197eea16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f2153ee0e559ad0161a43502295d66
SHA183437b6402a51f4766de851f18f98c73d593a2bd
SHA2569d0f1f744fafb973484ffbd56b2fa93c2d578c9383c934a9b96ebad64d5a1da0
SHA512a9d5850d74ee537e13f85328c398f816cb91ef960df2e18676f2e78d89ff11b208317c65cf8a2ca8ba4c442640bb1f62daefb621ba3f0d95bd778198e78c2b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a0e6a32d43e936ab1c9ca393660d35b
SHA1275652759ba34664ba61f7d36e22bd9df511801f
SHA256b1c618003f6303981b209ddd9164d00e8f39d3a28cc67603eb9f5a2a62b23bdc
SHA512698a45407aba39ff378379df4f3d9f5768ea51ce8a422fdefbd4a86a6c9e584f13c55c29295b0b6e89014e2e97e77944d188908ea00e7c17f62dd32cb4ae6aea
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a