Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
50ce38b6886ea93ebcaa0aaa884fa882_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
50ce38b6886ea93ebcaa0aaa884fa882_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
50ce38b6886ea93ebcaa0aaa884fa882_JaffaCakes118.html
-
Size
32KB
-
MD5
50ce38b6886ea93ebcaa0aaa884fa882
-
SHA1
d88e5c55208e4169757b4243d5583bde01f90073
-
SHA256
de0807ed2f77568f002ba5a1ff6a96170504035f0c926464d9ab8c90828bf583
-
SHA512
8b5e25fe17f94d017c20ae18a717a6759f92455dcc1130c9cad2c8e2c2bde76bf56b74c805164c0424c8a26335d810759584c80f3da62650925fa49ffdd36360
-
SSDEEP
768:PXt8Wxv4CGkr7APQGAx3GvSVSH1ZO+OORrVJh6Ny:PXtt4CGkkAx3Gvl3OTcrVJh6Ny
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205d73f085a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCB1D641-1478-11EF-8456-F62A48C4CCA6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422131362" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000248bcf55e43d964d8daac569d38acafa00000000020000000000106600000001000020000000d5871e2ab00bc25380b7ce28bf1f599ec7de6f160262fb0b811282084973fdba000000000e800000000200002000000022f7e09e9602c941d62f06a302b039b23b419941d19a2a7eee64cbafe78bd5fd20000000fe44fa97aff974ef9db954b093885a8a5185c12066b6e912da7a6d8e7f87f6ee400000006ab32bd2fb98548210e4d3d34d49529a63d8a865b6b9ffe3a0cef37b125b08d2b780eb6409bbfec999424ef90a441274f026357f634577ce0347071fa1b91f08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000248bcf55e43d964d8daac569d38acafa0000000002000000000010660000000100002000000014cc1dbc7ec435d84beaac39a71984a1fc330fcd7d0829776bfeed8d62dab30d000000000e800000000200002000000016c054f292c130e04a89f220ae5ad348813a3c9a65e305d95e1f21415773008f90000000ae5d04d044a47592fe91ce029ff9d61bfeb14ea7746efbeb86a9a657fdf50d56ad2eb9e917df1046d0ec8829f1c33828f38e1db43bd968dc842a044ad189889d416446e0b5adf2669cad77c595e5c2171ebd77dff72cbbec8d537eaa8c408e1b9c120dd2b4c031904e567ed642399001a396916eb4d01efbb4e388b02628b0af50f233f5948afe6a26753fbb372a86d0400000000a928478c24d9043c927d86e4436d6525137068ad3b87eb074da3e65263466bddca76edb3c68004c5031178633e9ae6b2659a5c7d398371b319e426dc7943149 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 836 iexplore.exe 836 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 836 wrote to memory of 2400 836 iexplore.exe 28 PID 836 wrote to memory of 2400 836 iexplore.exe 28 PID 836 wrote to memory of 2400 836 iexplore.exe 28 PID 836 wrote to memory of 2400 836 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50ce38b6886ea93ebcaa0aaa884fa882_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD59d0a181f64cd40fa1e215c1383fe359a
SHA1fa7ce88341d01815a841731785dbc22e4c6ff5e4
SHA256f44ec53e4c3cfa67175cef54d0ce5c980ae87ddaf3818d0c37080a63a0fabd11
SHA5129882893cbb93a4f360adbf8fcfdcfec2ad8e260b290a15e1225d9b45c7e694087fbe36295d4c77e40092236cf4d96924303d109a4e1a7794798fda81384d5ac4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5331b5aa4f44c2e9367f1085f84f787a1
SHA14e6fddacb2a8a69cc6e4c1c2afee91ea7c9fd31a
SHA25648dd63b2682a9b32b03f3e977bce3ce7991890d924d365f5aefacfda12e7d584
SHA512903ae65904fab1026bd54ff6d50a09a356e9e7fad838c840b6525b2c27f97565bd9b9992a8d6e031a776d593b9355cf3543fb8a8aa2c6ac7f16cee553f41bec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516b8e38be906740987a161098817c777
SHA16ea6921a2b4d47c385ce0b039c6b6770511353f6
SHA2564a0530c01a608669517d12a80e1b6607e8b1d19ef3355f70e1455661ebf5180d
SHA5128887e58ffaf057a764118239875d50cc1af7193518053d25c62ed9d0fc54e683b6dce5b0171221fec878372b883e5f6a7e65aa8fa612f3272c78befa35abdd71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519867922927d2ef5db1d7a59d9d0b62e
SHA19d22d906203e5bcced36ebf08de3968dfae34e2f
SHA256740758ff4689842db3bd56d1a090ad80fb90921c9bf5e888738c8c3458050859
SHA512d9ab6613c4d11e05c2159a50576d9fa26973f0dd04438920c7bc36d3f9ca7d9a5494e6d41e9eee06ce32344a5c128d7083a5da70e7bea3d97ebdcf710c8eeefe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b806f4960bc40fb7a2c743c4f80588fd
SHA1b52558d32418a4a7593adcda86a7da3e76283f9d
SHA25630595cb5afa3c046f32f428cac95d75ac584149d0416ac4297226b74ce374264
SHA512cf80b18828b7513e9918bc694d6d5e763aab5290e4d6536499564cd297ca49af4de26c59ab78996a4be63b16a1c974f3ae09fdddb4f401bad9b79061b58db765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56359bfa016c806c3ff43bf376eb46ee7
SHA17d2d0d37a27989547a36d73d0e7a2da1eea0c234
SHA256937f1557a2d44028a9d8f0fa3e530c9d9f03868821d9e03de4a9286ffbcd11d6
SHA51283294ac2834c3f38e42d833b84aeae283acd3002d8e25e5054cf21a3e2ec1ffd55f2f41c72a42d883f6505de8693dac0d27eaca48494e82ceb71cf7e4ad69dcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e26fca60b407aa10a18ccfe7c457f541
SHA10ad4804ea428b9cf6cdf3da8e65f332682170944
SHA256bb8491154364f168aa12a77f22997bafe7f91b836aa54cbe68819985a4c32ff8
SHA5124c13053588d3f8e1acf43f74160e0d479db9c78b500c110d46a7e822e33261cd8987019fe67c350fe2f8f93f0ff8017a2e2a34942d68b721be3584099d8ef8df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5094469b910a84f7e6b92cd29891bcfe3
SHA137d6e29bbec7971d47dd2d5d4a5395d7c55ad62e
SHA2563f4be035936d0a9d301eaab705d4b11740381e067e887deeb76440ca6e4938c1
SHA51244f330a742fefe7b5db3c14893e004295ff7d4137554e4d99d92ae12e7fbe099a21d2fe723598f5c977d67ee8f3eb1737857d0d9f5c8744c915270e4b3178dd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544ada01428ffada9bb3511c10be2abf3
SHA17e76d734acfd08148a64c500aacfdaa649b01360
SHA25693744a2cf2df005591e0fd89c5d797665904494f4e01298c40bec604acc6fb62
SHA512d994570e7d60674f130fa8fee5e3373e731c9024d4db63d184050cebf0c05dbf366d0973a13230e4447f7829d65468c1211235cc5ab0a5c1a5ee69d7786d0379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566b052898074b491d5136ad8428ce366
SHA148cd7f3570d8c1fd5194fae9eb659671e3eb2ae8
SHA256eb4a518ff3ec4c83b794ef0105a1d93481d65fbd46b4233c8ca975baa02dd9b3
SHA512e88ccc218588c959f99136f47e9881ab0ed558640f32da4377a938126a3fba3cd2b34d27af307dae9ae0be2ccecc43ad8eb8bfefddd534e9dd18a10c86973c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed2538b79ff411e19573ef334dd813bb
SHA17aabd5015808018f20f0f41f9c1a667279b87f23
SHA25677fa4d1a6d2be4d995281f968088fd2a325ea41242c7d51d37b9f49c1f0ca68e
SHA512ff782e84ca48f552011dea82f8a26ca68cea9140cec26a92078b333efcf7733abdae94d6730cdeb51a7d986f67f91b59435b024b9bfebd9c3ef5c281ca3d100f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bae2e2b8d85e68da5d100dea09941c9c
SHA1dd8b486abec3281b224b210c2e902507bf8a308e
SHA256c854d1df23c8912aa0833fa54a34af8382cfe67993c9f514242c7dcab764aae5
SHA512a0fbef57a1484ebbfe377c69fc22fa7837a0d0a585f076871dd5ce889e2365dc583879e94f2a2853562261a676034d1d5a64fd603af0bab336c76416566a1895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d8b129b42a10426112911c9ad55cb523
SHA18a9eeb03bd9a0a03d93a39f3651df24e3d125acb
SHA2562c6fa9c94825d19717079c7c7f7db61e93e6cde95742257b29108f8314d96db6
SHA512d38521cbc472e30f7f3be9447ec578a4b711970f78428fc36b7a1d8c75f0e0c787f77d3a32ef9691113e173316d8c92e70cd1c54a332bd107a4dfc0628af0b98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SPHFG3W\master[1].htm
Filesize371B
MD5d24687d8f25a80e26a08e0cd3e672b3b
SHA1d41781570f5abdde2661f062e082e9f7d696b046
SHA256041fce169f124eaac6057fe0f04b1107fd5de330a6c1c7199cec724dc159bee1
SHA512f324228643080ef73c17f653fb28201655401bf6014f308ad27b3e841e9b610da2c0cd124c14d5d735978f550449f371a14cda15778c2f9b39d6d97ac8c69491
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a