Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html
-
Size
121KB
-
MD5
5bdb50737d186a81d2a7e38fe0d28460
-
SHA1
db7c83c58a621678c8c729a7a745e0b03ceaa4ad
-
SHA256
572d945f42a3ad3e9c269e769faf46146e058636a7c501ac8235c327d6f246e8
-
SHA512
67b4e3a54b9689f905c27f99c950d674fb3d5fb93024bd2644936fbdb2054530d937d0e4fb31be1e6a1c68d817ad392b4ba7fdcb91cc72e4bce83d521961182d
-
SSDEEP
1536:Sey1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SLyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105fbdd73daada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000afaaec2b9efa3f8dff6a9a594cf97595917966cc712fa2ab2c8a2bfabe95dc22000000000e80000000020000200000004c3785e3630cb67b2014554507ec433ef596b963f8cc421a5adc8f443fa7e4c020000000af6d78e856556bec34f5d353229755ec91c6c3fb8ec5aefbce3b2afd19279872400000008abcb63c8c7b75256879d84adfd38d072cb261814db1c49a619f432865b8758758f708d733b46dbcbcee94d5495a45aeb6590a8c51ab8854bca85d2821a33410 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03209411-1631-11EF-805B-F637117826CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422320390" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000de8e79a3942b00506e85f5e427f5077c63ddf464484e054b8e20cffd5933ffb4000000000e80000000020000200000007692c6411192b479eaa7fd8eec54f19c6baed65d1755edd528d7af9d9860cbfb9000000029b81c68e83664dc2032b52ebfc2e866d4305bc1cabf6379de2c9bfe87144365ae355ea838b7943c14f778317edfd4680c4a0f5bb52b2888be4de33ab35d0e91d80c1313d155357338dfa23d1da0f6b5d2166329e0784a8a03d5be135f6346fee284fbbb4c68ec9c1d38dfad8fc79d73deffdf6a40f25f2086e09b647f8418e4b476fe8f7bfd4428726caa57b1a6a62940000000092744e4edb1238c2d738aac30cc09c2c32c8ee566f304db24e7f0af1303b024d240825aa628cd2a21d14fe627e1c4b499bc633678ca7c432473fc6c5375365d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28 PID 2436 wrote to memory of 2348 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaca48e5c9e7dac721ca0815958a93ea
SHA115c4f339302dbbd7345016e81b314ef98dabc39a
SHA256be7de80291847cd546ae9cc15cfc2a33e169a38c4246d3de759231bbe46309cb
SHA51244e7348f172f5f7b6486e81559d9d5acd8f83ecfd6ed6fc1bf6aae70511f33035f2d748e9cae5318e102229730ca4927eb2a242fe226c4f00a11bef71b9d8ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adff880f028dd690dcc34d6be88a6eb7
SHA11933cf529bd5e20ce8d3fe4e1c135c4b9b5e2f4e
SHA256a360bce1e7e8fba15fce42cd1f717fae6d2b2e61c67718fc7b80911f79838e4f
SHA51230a2909a5c29ef6518b1599c6bec60db36494705d20d4d3d6d61c38e6338dcf1576c0d05f5c8fcd0933fdf07a1a790f373796d9758269deafd8d299b1e7e87fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecc4c07fd1ecfbf459ed7a3c23708633
SHA137fe8dc3f2bbf6a0ed9b4abbf310ae37dc3f1da9
SHA2569f3526f54ffd0bd230d97082095e47de7dc2eef1a08d855c23ca6f118435487d
SHA5129916991ba27bfa6850390ada09affb732f17587bc57b57e8bebcceaf1cb1cb80755dfa2020bfa39f8f1d2d352474dee5d328ddc405b28d8a16c982a88bee5526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5188e281c6960a5263f2054a8bac9756d
SHA130664a42e8436d515a0fc76bd2ef91f459fd880a
SHA256c9062db5c87aec29a8f71d3a0df66fc793665ab05ef3a62daac2a51e77358bcf
SHA5122bdb0b0cd0cc91a27d3c310e88f61730b41d6ce395731707d3e9c9712736145cb2ef7e988fe927a8b4f93b1727ae070ce373148f477f20db48ed20cb8e23ed9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503d475a15f6b0c95c27a0f54f4846c2f
SHA1d48a8033b415816edb25d2f3bd7644ba57397b04
SHA25638c10524b3891ee30e4eaf70e02c56328e8a3a16b67e182b6f6926e74eb3cd66
SHA512117ab9dd4c2c62950eb4b30e64d643a2eab0c139ba44a422ee361ab1132d4996630d8ef7e47fd78205ce79ce6f8aadc8ebe74b931ed8dba1505aac74aad35edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54404bb3a185bcbacd792f14ab144462e
SHA175053d410b4050988ccd24b076b099554ef90914
SHA256446beb7453e0ebd84fd4062cc0f4c2df5a6a0e9c19d403de9f5195082857db4b
SHA51258002f4ae4b8ab4792be1a17248157f5f946ed718daa4f61e13de42f2de19ab03975711fed17e5c69af94bb81d7a6b7ba886cb3f5919ac38bc6ebdc7ccad395c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea76a8b88251f4acbbce2b3ee48fe6b
SHA17708a646d0350d66d139c8790b34e459c4d5233c
SHA2567ae37b3eab8ca02b54ccd5176a0fbc4a83cd87420594c953ab2d0d572ac08935
SHA5121db7e235e98250b53a419bd023d8c9f48debb8ff7e3042d68f7483a669be5b8e2f7814c5052aa46c4a7fa6d9017f625377923c2f31d088d3a32a4f694cf1a2ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac70ffa572efdb5414c38ee98154b69
SHA18895971beb757c1e1315bf86872641372ef66e72
SHA256242378fd6df72ff73564956119be63fe8fde52a3f7dba57ed65245624d71fa39
SHA512354a0b18272a0d8f44411eb622bb062fb6a1510850cc9a77a419b6f6d840ade52afac4679a56a254e5dbf9cfe6f1e7ab98f4e0709c6ab53efc4b63301e90f2a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553af34bd041861544bba9da0b1606e0f
SHA123da960323ccef3a2415b518b5095dd3b6bf3a40
SHA25612ed0149f3e008c122ea4c57e5af6e940cc78517e4e15ccf3a1975657c93d481
SHA512f119e417f654e192cb463ae2f70ebfaa800b15827dc13212d55098868d825f2f024746da952b3e80cde32fb307c71b720fa57ab62c537245373727366180338c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e5ea285b5e5760d1b3f1257eef74cac
SHA1b573b53115d99d8b0ddbfd4ba0923b0494b9be6b
SHA256ce08809b7e41bc9eed5f8d12458aeadd2ac25cab5b841c58d68afb6dd0159507
SHA512940472a03571c1b092fc14abe97a5a333116fa5a00522a5566868bed804f4fd4633b1ae6b13a63c4ca26e809d54ac9bfd7d44eb095384a907ef33b4cb0b70438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efe0dfb62e9ef6626dad978a4c229794
SHA1dcff26f406d321bd40746d15f750dc48eac93968
SHA256c5dbb6fd7540aaf23e912eaef052de42d23bf6111fb34ef72de8f429d31e2769
SHA51238feb61f189836901962a46cd4b582adc9c410bc25213114d868434fc47a35fe80385976a28ec2f6d83009fc7731c8c69cb099599fbbd6b01bb256df0fdb0366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564bd9376d674698829ed9414eb58d39b
SHA13f953ec60234c65ee977b91e10ee147341b5466e
SHA256c93881dd9e3fcd4d38ba970cce440b7ebe76d683ff1924db0f6520d57a3857ad
SHA512cd0d00ba484d4dc0086fff5dfb87c238be4c77dbcb5da5b25fa37d6e1f0ee719f6ef3c944cf30233c30095552989ebbce743de17e6d009492fba166f5d95b0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565831ccf3d446399d5661ebb9569ed55
SHA19784b69ac60959f9ac201338febc9e810dfd30f0
SHA25617d464182c24b92e40fc7e2564f12e34fa9e4fca1faefa32a80de18a448b9b7f
SHA5127b3bcde1b98932ebdb3eda4c2aeadd7bd4b95613c284112118d7249d003845148df2fc2381ef423067a489c45a5121cc247f9f86be0b84952bad6d0a8867ac96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d304fe94a386f51ba7e5cb9da65add2
SHA199a64b8a538c34eecff53bd7d157ddec27e249e0
SHA256ef9c78760b8291492131e634c39d1b7ada74d292ba25f9237e2af503a062c364
SHA5126f8b6b391ec100f047167456e1ca1a4d8aa3e8a1fcd2cfb30a68d89cd35228b14c30e4eb30da35275441e565e258816d4070230f95a22f60a20ccbd4a10ff895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575d5d7c329039330f0322cfcbdf7ded2
SHA143ea2de610083d4a7a0f40198f53e2ca94a18a22
SHA256160a42cba351d958315400a7eef08fc9568178bdb6eeb5f8451f04222fb02f08
SHA512df20228ddaecb323a4493b3a7a0c5c6ddcfa0ab13a743aabd14bd897bbeb61cfce503338f0e3f2a7d695f36bd771b1911fd5093997fb7b33d46cf77b21cf32ba
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a