Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
5e0d185ef99d8126e46339a5ae3bf9ed_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5e0d185ef99d8126e46339a5ae3bf9ed_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5e0d185ef99d8126e46339a5ae3bf9ed_JaffaCakes118.html
-
Size
22KB
-
MD5
5e0d185ef99d8126e46339a5ae3bf9ed
-
SHA1
7e3394690118fe905e7fb62489b1425ace94ed16
-
SHA256
918b7f14a942ceadee6bf6b888a451edf56003d1635b30a506afc3e5105c934e
-
SHA512
68ae4c63dfaeb774ca67f70ff7c43fedf7860fd625794cea45db8f13a0322a74debebbd7ff330adc995c4242865e5628e2f9cb1b69015e9a622d05cce61e39f6
-
SSDEEP
192:uwvfb5nG+nQjxn5Q/1nQie4NnwnQOkEntnPnQTbnBnQ6v06J4RnQNjMBYqnYnQ7w:QQ/Dv06kiH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422354788" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000058acaeb3bb21a27fcaa0d30f78a8042b07088b13ac9939d69bc62a6f024775b3000000000e8000000002000020000000c2886def87e87cd6474bc958ff704a928057df2c8e2299045cc0daa316f76c419000000020f246526abd9e5b5af01e4d4d66beb0e457aada5d32fe78cb47c0470cbc83c64e9fde82fa5dc7a46ae92c5b5d3cc01f36b834541201833abf511525058603250b6bedd9d4ccbba7d07ca7c2f8c2a128f4d2b480db9ca3a323998bbca019dbadd9e0ed61ad427f88175a8a30a310909ddd5c6175bcaed0b368b6ce0112447a7b72ad17530a009854233148218f4b2f3e40000000e22647210dfbf7a8bb03ebe49aaddb425fe32ae241f26252e034821f84f2d5cb94a724dd53e7a3813137d3309a170fdee5b475eca95a1e4217b6ab5163fe015b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004042ff21d6a10a92a205972d3eb5385a5bfa99d25d9dc9ca5ffaf326e2e20126000000000e800000000200002000000097afc30c31111c54a61bda12561b9517abb6515fd72f99623b0a9f50b8f4ac9e20000000a53dcff11a68e118de31494bc9575ea536a78b31a016c50ce816977f837259f8400000001b1bf2de61d2773ec08b5e054c9a0f970328d19e390057426a7150abb74e41ac362ae3f4978ecedcac56d7b5901669447c4797e6472eea3ae14170dc32c7c0c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19EE7181-1681-11EF-BA3C-D684AC6A5058} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0018dee8daada01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1276 iexplore.exe 1276 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2816 1276 iexplore.exe 28 PID 1276 wrote to memory of 2816 1276 iexplore.exe 28 PID 1276 wrote to memory of 2816 1276 iexplore.exe 28 PID 1276 wrote to memory of 2816 1276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e0d185ef99d8126e46339a5ae3bf9ed_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e62125ca43ca8020e00c4f28ab2049e6
SHA1b15bca167cfde7d49b76d44daa975d0cb6477444
SHA2561094b1ad859da0790cd42e53f15150272f7c1658362b2fb36cd743b1203921cb
SHA512a6b20e4b1ef78dd4b3e28bce5fb00bc3969c74270413a5f57059ab3d812e4099aeb729a85d8047b325ec60dbd38163a1694bb57c956665b7f90371c067cbb829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ad1944620bc4f651c0de881b1a08848
SHA1e6793d2cdf207d2f348dbd957e3211917dcfbcc3
SHA25689742af94c31fed72c45ef6c289cc4d4879a1c2ba93945a12485e75195d43dbb
SHA5125b26cb0f00c8bc358d2dea49516cef5248a26449a03d244f30c5b21a9888c34d2acdd800c18c1863d15d5bf65f63be7ee9f52f729b1e9f1c2ad20d5dfa32126b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d0f39cf40abf85c6d7728626bf87802
SHA15c4e0393e18537863fdd7f8030c17ab1691472e5
SHA2569d00fe135e8e509be215a56a83fc8666892f3b77fe78dd7c66e12ef275b9e254
SHA5125b246f666c23570a9c11a192e21ccfb2d460ba406be91a49c3e1298c1780b19f126c03da4c60db2f8e654c51d7f6b38368433ff42d7db15cebde81b4112636cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ab8de8abfb4ef85b4dffef3f0a78e78
SHA134eee1a5adf803d585d99ba44fcce5aa2cd01b58
SHA256d5eff2331527ce033a13d84eaa774c6e0234171922ec8774a0dec57ad48925d2
SHA51218588f85f86e1ffb77f53eea347cd235cf0894c5c1a9075162babe8fc92a1254d39fdff632cf93e05be7567acc5d0a6d7609bb95cbbabe298754d942f5db2f61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a582f2b6812079d9cd22d4c7728fadcb
SHA113da67c9db265f6cd1fbbc19f65b4bd3f5b96039
SHA2562c4965f61f3e1950f0e838c3031c6919fdd0013c024c803adf6b57a758fbe5b3
SHA5126f041945b4945301d7e83c1ff9c68357f8996ee22c7ad1abf45861f27de407e896a8d5be41a4529e0d619656770841a7659490d9f603c94307563f4180899693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54106a9ad993ebaeda0f6f07f1c7eb6ca
SHA184d34ae87612cdd00756c3c01d971e217baffe7d
SHA256b7ff5d899f322442bcb4700177a2feb150d23559b4580ac431c82e911ed0b15a
SHA512165e8fc6d1c8a3c64974a584130436d12920ffef57144975cf8c3eef09866097af2f44f3e4564e70d2ff49faf408ac7eb6c4234efa6cdbfac565a96420da28b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565ed66066739e37480e1cfac62c21ee1
SHA102f9c99ce0b1ecff8910e70782a18559c1f4395e
SHA256db719431746a15ae5a18ba4c480f73b654ca214d7eeef06cdc3700e0f95cc851
SHA51219aeb7b56b75eb9da75f96a03ddd76736d8e277437a46f7b0bbffc1beed5ec814b27cd235686495c5f8cabcb5320cd6cf526ce511b5cca1816a1227105ed59fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2b846e7713de46a4f6093701be11cad
SHA1daa8aa2fdfac0113b4491e4cc969133adab4a5a9
SHA2563363088e6d3f6623b0da3586e0bb7890e36476e0ecf8a6e700b7f2ca91981d61
SHA51245f6c898817700f5f9d81f4a9874a4005f3cc876e8498e745aa28f4611a47142ae5de828da0db5e86581559ac597e5395bf6ade166f9b234f07ece5ddadfeb90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baae98d11fab216bd35957f10aa21bd9
SHA1ed29362d88dcd8231b652ff70b3f17bad31869e4
SHA256ba93bf299ea2a8f5c232be40bc665c1bbf13448e2bc1ec7071e2a966f1a8ea5a
SHA5121cdd44d2f93f7ce8937da4900c64b0a3349d64c94e5f2bcb43a20e09bed52930cb48891a4581309620a613c1af0e3cf9daefe9e1878fd251ec00f20e5184192f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d0fffe832afeb9ea3671258de012aea
SHA1bf564b4acec223cc124160c175eb55dd4f56761f
SHA25678af07a0b6443243c0e5b1946556d50ffba11a4b2babceb3fec075f4b052bac1
SHA512e6171f51d8925a29f88ffe937696b8c49863e0bb03e95080bcfc088e45479efe6e0fbc552274a70b5514d7b8983b3dc7824f0ce7358af0ddffc251dce23a13f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5115f12f6d63361c7f4b377bd1dcc2cae
SHA10150148680162dd15274daa1c9ee90f026dc6f75
SHA256702913f6205d2738cfd7404e6064a625d25e457e303c0952c0e867d2e4a19f93
SHA5126c4c1114869bfc69ed5e371c3b64861ecf16bfa671b3b9d530cb27bfa90022240de08363de868922af32352655f4ca40ea4ab308b09586888a6fe0d9f696dbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583050d047c673b22eccfdbd1c303988d
SHA11e61843221bb76f31c13598c9d7d55fe92e0ad67
SHA25648490421efce3896b3eff86497a7d389796469c4a7bd746d475b584cf311d166
SHA51216db5f2b7f2bbebfd9ab97f169e0b01fb7a4a7c3b0d5b89f57dedb152990f51db9c9f83619205e8cacc41b10d416616a056e36a3daf318f21c807c93cc2394a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e694d08df76dab0ab729e4ad93f6e1f9
SHA15c62b64c461ccbc6c6909646fe360f39fbfdbf36
SHA256af4617fcb0185be842d45e4f997c7375597324d521eef6a4a56fe68fbac93fde
SHA5125c2f9a3f0a8ec7bad86a05b0495cd8a6252d8561ae3404b66c857dacd143086a3aebd4dfebae08e38e2c51aa908f1da58c2ff442cdbe18a01ad733b62436c4df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ed97828f0496bf3dbd1400ba8c7d22c
SHA1d7e5f7858119f206eae0a668a9c5b4895ed03524
SHA256267c97f7ec0ca70a1fcb4198e8c5d20b0390760f1ba19a211fbb9e577ddf1d6a
SHA512ff6552ed7a7b64f029b6094db2c9336f2d8297de4264dc33808f8adddc5e1629fee6195925f94d0e4f55bba24784ca4523718532f1f209f1f1ccb7ef33eb34de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd89512c4ea8a33212f96f6c75a067a5
SHA199b1d59343312f3ecaae5a0cd858e83f5c29f8b0
SHA256ddb41e6b077cfe33e39d3f0a26f814576d261cbcf365eb27b26436ddc1eafba4
SHA512330a1bbf1420f7ac4be0b2b802ef0924a8be44204ab3ad71e2103a23279901e572eb2178384029df77b1edda521ecab5f312696797bddb3d04806603c7116de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56db999f0fe2ec0cdc8db31c5101488a7
SHA1324cdb8b88e5227ca6515f668dd883ea2400d8c0
SHA256e512660d2f9ff42095cce209dc4c86bdcc3213b89e37d1a79034ba4f1a7bb726
SHA51275fc5acbf1fad577f58630201b467a10f6dde57d70585629b8d359507311a0eb502506705af4f31e5e87144fe66cd9a22d4230f0dee396ae77068f2f8f37e899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc44c7356e7a39f313ebe75555ccb47f
SHA1d0ed0a4e1f23ea6352aeed5eddc11d3a65cf6f15
SHA25613ec31c2e9dd4b6f59e61fecefeb4caa31335a276417594c71f7f4d80f0e57d2
SHA5129b0380a75a4e65c132336232b0d49111437305a9a8ab2d52a661c15a51d23770b13afb88bb140a1c65295e942aab07971dbeb4b80e7eec487a492bea609889cf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a