Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
5f55292e72a16c02b2d2e5d41066f513_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5f55292e72a16c02b2d2e5d41066f513_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5f55292e72a16c02b2d2e5d41066f513_JaffaCakes118.html
-
Size
19KB
-
MD5
5f55292e72a16c02b2d2e5d41066f513
-
SHA1
26eff29079896d57439a7df7f9efeed753f95d50
-
SHA256
df0aeb51c4d92b57878e8a16782e768d4c19e1be900cf7123c2aa409fcadb1a4
-
SHA512
ff2ebd6ffceb60b7c323bb0f09f669e8a6d06cd7f977cdf261a16cb8a129ac9e863050c70aa03da6f94ec31123c7b968d85d21397a46cce25e625419c72489cf
-
SSDEEP
192:uwbpb5nW5g3nQjxn5Q/MnQiefNncnQOkEntQ6nQTbnpnQmSgHMB/qnYnQ5ONnlnk:8Q/zqxLI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422373821" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002250b8461705ccd6ed6906937c77f7896917a5f00fe8375071c290708134fa80000000000e8000000002000020000000ef3900e0aabc30f5a253d4ce352499efc24caa7cef9a361527a174fda12ea015200000002c443d07b2da6416c9831d65d3f4955510d678344edfb07436b0b3ff73d5d4d040000000f98ecc306cc596d3ba7e951d58260a2aa1fb0b7012f68af1fbf1900431322838074c6de22985ffe75ecf4ec92bafd62c4d5e8938fd8b0050179e36f46dbca729 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008dbccf684f3459949340c091098c1f3b2b49d910be97cabedb9cd4d505443dfc000000000e80000000020000200000005acbfaaec0778b612e3403d29af63c808bc343b8d1d3f262f238fb8289bf9f3090000000a8a9c1bfc4642528e6830a2a09ff78056d657954ed5263217254bfdc60cde0972ad158b72d8b16409cb46ca333c850585641f3d747aeeb2f4fb9b3a07385d0fba56bffaaec03e3e4090bf609450d3a149cb66cdaff47af2fb6781414e9ec86c800fbcc6b464040d94b73abb6a8ee288b6eeea38917efd0095f6704d651d3ea005653020516b982ed23ec269e276f2899400000008f999551091515472d07ca494a90a66e99810d721ebf6b9340de6c8a296dc102fdc75100586240a7828f71608f385680bdf5fc886accc78be3d012616d8afac9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A744221-16AD-11EF-9CF3-F62AD7DF13FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d5143fbaaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1484 2036 iexplore.exe 28 PID 2036 wrote to memory of 1484 2036 iexplore.exe 28 PID 2036 wrote to memory of 1484 2036 iexplore.exe 28 PID 2036 wrote to memory of 1484 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f55292e72a16c02b2d2e5d41066f513_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de7faaad636bc9732ab62ebd3e7cae6d
SHA12ed0e7b4694718db5b4047dc2d76d047616e4177
SHA25646948f57f76f4e1a46efd162b4dd1e6bf4599dd6ecaaef98e3c751d27ef343d2
SHA5121bfc2763e77bedd71b43ce9a45414e7c7ad067b31a2e5b3247bbc3ff3d23c6e3a075c4e259c4c536006fbf667f5bc1602a25ccbf10eb50c2b7d3979ce89465b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534ccc6a4a901c1d2f6131a4b8ee1b911
SHA178acb79063d5804f0226b600107ef8ec4dc8c5eb
SHA2567f7bacdeb86f348a9f3870b2e518ea04d9324dc0150837e0bd9d5675ac13e4fd
SHA512828a5264dbd409faf456db5d6c108b90499d78b0276908090aa14b404cfc1ade0c491fc0cc56302ef81571c898f63cce096eafda2b824e698abaae734900ed9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524f2d17eddf7f7787fae51988a7950a7
SHA1cad864035efc8ec4a59b52183911bdc3d5450356
SHA256cbbbf35a1cf2deb41a1f14c18728b2b905cab8df587e5a7256bf297b052ae10f
SHA51206873391bdf7be53ea7dfee2eccea426a97f28fcc650698baf965a27cfa08142b3cb4b736eac3e4351ed1b54ba531e33e881b87a3437e41f6151251ee36dc3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5902142d21651be1d848632bb49dcff70
SHA1c13d8a97134d90246867f87f1d062a18010618ad
SHA256934ec3b0f5f85e94c3862d9b4a4708b720f872686a2078e8b8eed7712bf6b411
SHA512525714c51550b47cefc595df366f9d5b8c24e68a9da8ff0216765bd74925471520e3ecf49bb49c8ba937e2635114d7238ac656589895675bada86e756570ebee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a21bbbdc393d65ff4a7aed6ecc11e7c
SHA138b6009b01b24da0a43974372e5bf3d82e0fecfe
SHA256c313c30e908e8c91ec624c3b4efe8607f506fa00b32e3ec36a1c0ef134f98811
SHA512cc124069843d9c0ad4fa8a15e5b40f413f3181f602d2100bf9282d4065a07a3b6846c351c6e355aabee89660c7a6f6024f1c54002b8dbc4b6bdb6abbc48d508d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5772246537f2955d71de428bbff6ce2f5
SHA185e14c045879b9e3da8876c91cfa5cad2418109f
SHA256ad714a9cbf08497b89d7c57b7fefd72dd26cfe4523b6505bd30c99506df10b52
SHA51287657ebdf5c13f4397ccbaaa9fbf164c64002ab95e24de8d7ee84f78f246934105c05930b65ba5cc034af2e67d4ed6ea6f06da41af5595221cf412fff1b14665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556545a4d870fc283cc1b1038d8ecb480
SHA16535f93f4593d3db115a99a441c4e743ecd5d586
SHA2565955d6c3cbaab1cbc071135ef0ab67d12b18277b7a9c1c7adc7a7473295c3e05
SHA51289c2d0031b73356109dcd68563a7db619306e117f1df93adb00e8ce2e65d3acc49de0f8f2f8157fba19f1e455b4dbd740d3266c91d92082a2060b0180976186e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5265db946ddc63a1f447bb5a83ab500
SHA16aa422f924dd3a9f28fe7822cd70760b82ba8ca8
SHA25659a0454b2cf9a952eb55f443f7c2d469e8b8bf195ac3de9de21f8f13b509f665
SHA51215f4ecf8b4fb1f7eff3c524b2b5e31c243ae4cfa6231d1523e93d3da648a167c33119ea8f9ef3d19eae3a733fe2956a5fabd85864804c1544740175dc4b9fd5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f542b317fc6ebdd0b094c6bdf9a74f45
SHA1a4942b70cdf0b8663cdc072470943cdcc7e20daa
SHA256f8fe8e972eec18eeedf4285581f1fd65d89d6fbda60a83986c94d67385d03a36
SHA51228be004944e7f45554a5a9aa11c8a01fb91179e59b2c6dafa7eeb98f92857801b77f5b38bb947e7208945c0ed08a229896359b1438e1556bff40a0e959db9c4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583a3d6400f992a208fdd48aae744fdea
SHA10baeaa50605bdd7b6febf72df350c66e839488ac
SHA256cd2cf41efc6866c1fdd86d3453ae3a4ed90a4a6785949de9c8690797238d240e
SHA5123663baf051e3e3dbb25f9e6463e1c4fb59bc5b9323764bccd214963a97f2e7c7da5a3de6890c8b3b099fcb22b542adbe0f93cf67bc70d2c1801cf167917eefa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5285300f4e74e17cb3b3ac4f4e5837d
SHA1c9df2500ad5d8794e21a1d3330669c90234457d6
SHA25614e522d71165cfb4498d23e6b005c3dd6bbc4ca5983d3afe2886a8435a1b4541
SHA512538ecbbcd8cf377677cebd1c9c9a46f6ff2c2328dafc2f82257b17cb4ea6461623bb11208bbc9925db01c7b493ceb41d71d7769a50b4f8df308965f2882088d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cc53a7b30547056c4ac5e3d101ecbf9
SHA11b5cbbcce3fe10bb2fbe83a1b10c1ee2dcfec70d
SHA25672838dddd4dc411cb99b5307d95536e6b0696e5796d1a3dd324b36548f49a43c
SHA512cb26dbed559af6b7ee0aa05d9b0554a8be435387f448d2c2ac72c12eaba0fa1802ca724cd5115313ace0d5bf977fa23c515a03845ced5a648da6b70552c7c601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0613a9f103979844b3d1c6f3e9791e9
SHA121bda9410de56af4142586ecb648b4a5a8e1c1ad
SHA25635a46b39dba8b578343216c67f1f4a4043c127463cfae164b28c3e7668cb85a9
SHA512fe1bf9e2a65a1a0a494409965e5f095b81952a4f61f38a7c95eebd180789b6465ecb127b978d35d884f473c05fc480b86c74b3d29f7cbc44b18c6907055f0337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da7fe07dc6a704df434888864f98caba
SHA1f93efa446c773a3f39c77ca7f9e58c5815573daa
SHA256c1e0e171b80bd3fc29712db921ac086a398e6bdc51e70c73da6334eabe41c126
SHA5123ee6edebf2cdd61596fa1347b1c186ce3cf039aae7f91200c421384749e89a3891fb764f32decfe951ea9fe5259834fa39d8bf6a38ec2f8012ed98011d15b250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5264387b7dc27ce066cec641112478b13
SHA13ec55387f065371232bc2f5cdecb6447c4e2fea2
SHA2565c50f1b4ae894683e336d86388bbc5fa2dbb9a72711583d689056f132d2f88b5
SHA512a0bdb6ae8b42021e967dcf03f7c59edb23979b4939c31795831d922aa766d3e1b9a95891e23c6199d9fd69fd56a2a6d3ac48951e749ba2ce23f2cb02616a7ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba5a053ab3324ac7e29b23a8cee98f57
SHA182d8dde379a89373b4c71182b638c1f9ea5d4cb1
SHA256815351fabe45b7282ef0f73eb972dd5871b403c2ba6428943c347adab1e6cd99
SHA5129607f83f9611caaada9431d15d63a1c4f67f1136680c2f094b119039b3ca7e0885682090a4769ede4c6a4ff33e5bfcc51cae967e70adc6f7fde4f653c345aa65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634530f23221d009b0eae606e73ffb61
SHA1b8b2e6b182a312748b3ffded309732c74e9f855a
SHA2561ad8ac858a17eb4ddb588d82605bdc07af3a801bd6873e5f6f4cee4593340fc6
SHA5123feb2c7fa387d7b1ce1573779f83e83bc60cc2b300ecfbd296d041a50dbdecf4bdb6d6e6ce3a0e7684b5ff1b5111e507f82fc6cb5403b8a01809505591a8c6be
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a