Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 00:54
Static task
static1
Behavioral task
behavioral1
Sample
ac50fbb47687cb8436a0a16927233b4e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac50fbb47687cb8436a0a16927233b4e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ac50fbb47687cb8436a0a16927233b4e_JaffaCakes118.html
-
Size
61KB
-
MD5
ac50fbb47687cb8436a0a16927233b4e
-
SHA1
454f675f7796173b00164d0553b01a4ae88d736a
-
SHA256
8475f70c443cfefcd8f56d4eb7f87cd5c15ecc8af8afb9f7408c08d785687c3c
-
SHA512
d9a3fc2a2d23069bdab8fca7c4130ee515d670bbfa8109e825fda8676cd5e0499804e8643f8d7c8f3a0d5c86926a07a288be8237b7deecc2d9190e5384f9b3cb
-
SSDEEP
768:JixgcMYUcXGeCSXuhsSEY5iIgNoTyZCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ij7:J72RQ35JgqTbec0tbrgamchNnWC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0C74141-2AB1-11EF-8156-CE03E2754020} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424574735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fefba5bebeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008ebf3a9dfea8ec78f6e8816b160c3819d0796d4b363fa8abc83bd6eb9143d028000000000e8000000002000020000000e97c0600acb85ddb15652c16681e655af256029b20ffc00c3e7311cfd1633f78900000002f325789bf37359467c8e59518b60bb0316ff42c9e5bfdc5b4f7cbaaa405849e1127187dc34ca33121ccf14cbd02f7b6d3f76757b6e212413284a8249f8b728fa9b1156c691af070a843e5f3b15ba3c3a7d1d500c560b1a21eee657ed8cf8719c68db36edba03e0ed6db342305729957d32ad6d6dc8bc8ebfad399a3a8ab5e03139ec049189d591e7d582575f238e60d40000000c189cb977160c32f91c4924c40e0ae90e3d32c1c5ddc1626eddf073b953cb2b62199ca7a149c3cd229413064057a2edd432fda24144ab1bbc7b1bb66e38639fc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007231e26bad3cf41771808c33a13dd3c0a45eebacae59ef609195148847c74127000000000e80000000020000200000007782b51e65b398569ef75ff18e26bb274f71fffda86f9f7d586f98629c6f9dbe200000000043b8565763577ea2e3b1472a68eae95d338c5a7ca5f533b494768ee31405b34000000085e5b67c71acf63d3b9b797dcba555675f575abfd5989fbaa88c1ce056839c00170009ed601408f594ef779c1ec5956cc91c6bcf6778d996a9d7e8926a4d9487 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2596 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2596 iexplore.exe 2596 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2052 2596 iexplore.exe 28 PID 2596 wrote to memory of 2052 2596 iexplore.exe 28 PID 2596 wrote to memory of 2052 2596 iexplore.exe 28 PID 2596 wrote to memory of 2052 2596 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac50fbb47687cb8436a0a16927233b4e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53272566c5551c22a9bebe665b6bb77ab
SHA1c7fb784f39d1e3c600a41bb8578f2ddfe5ca8241
SHA2566b3e3412d1b17b45b183d567e1f68a9ff71be66fb3673bc9251ee91e7a33f14a
SHA5127a111dc1ce37b205eee4dfe6a002754eab7a984b272603c1c39dec8e8028a3091e9e44403f60972fd160b0bb3390ab6e972ee472f76d20ece683e5302e664808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ce7092d121efb8ff10a81344264be5d
SHA1cb58e9513a0ad6cb1d20888a5f2315df4c1fdd84
SHA2562c6ade149da1b25ce9fb7c9424f7d6b9a4a5bb487ace1f288d9514cf68a2cd71
SHA512bfbec68e44500c8901c6259b49182616986019662593f1dd72b3fbbcc3291503d59be8728f6d7754aa8f80cfe0ef27d08c21da50a426d5499c600953b484673e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3fe3d15f93f01f0baebe8cbb4ee1095
SHA19838f8965cff9cd008bd721bbde8174e26bd515f
SHA2567716e7e420af9d46186a9740d11f6efd6df1b9bba0be540a5d59b46ce15af4db
SHA5127b243a8b01b2b584048ea03686afd8591fd3cf8a99083071939cb1a671defd4d1c698b14b6173f8aa1b54b4d85dc54cb07b72725eb174557a6c3256bb5b4c603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1ee597ea977a85cbe80d0afabd50c2
SHA1aa9d642ed0a3ed2bcdfce6d5b275ddeede8ef027
SHA256fa36cc852dfe4a1bcc22603b7e79a9849fc8787c433d3dbc8cd414adfae00d55
SHA51210a17bca23d0cb2aacd826bbc42a0c11872aa84557f443523a8908dca9072c20dd4d8ee2dc9194856babc21770ea46fc47f6660e45333e18137bae57c8d4d6ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a5e8f6d2c5166ed8009f8974e7355a6
SHA1b955f90b8d06467397b2f690dcd2473ceb7354a0
SHA2569a9b39290b3e1720cb01b22c314fea942e51007f2834a693a7dab50db5761bc2
SHA5122b930d0d37c938c58ba7619940fda92a974db6398fbc53d8d646cdf225729038f9172ac8043648703b4353f2e94898858b3b967a218824d870923006fba1087b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d69c37f4d45b3b47d26ac8a4b73e6e0d
SHA1acb62a72e6fcc54a993cd3802a9b3ab5d102b054
SHA25632aac37a229756a2f88aed6fc63e6055b94a258ddd7ffae54205603f6076597d
SHA512633fc327b6295b918ccbf670451c0e8dc7afac35dcbf4fbcee515aaac10ce3963a109c46721e71aa78d0fbd5722fc8cb6cf3f79cfa6244508794b5533ea6468a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5279bdd6a3e8b0ed8c367cb71dc9fc6a8
SHA1a27cb1888132cd3c50a661e7c4826c40c4d2a8ca
SHA256231d3ed2e38513364426ec317c61ea67e90a5d4c642192bae7e00b70a87eb1ca
SHA512a5bf4c54c3c577c043f596855d23a6924f0eae56ed7cad69eb0922404207298e9683adc5deac9fe78ab8ed3200ebf3b3cafaada4a2dc0492d70a937b24923ce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2e55eac97e2e80ff6cebdb7ea08af90
SHA1f14335c10d23a64adec6ba65a20e1430ccc4226e
SHA2560943941e980a281fdff1e05d558f84ca401eefaf9e627b24ea258094d02b8b21
SHA5128080f6e81c6bca8d6e62524fa38ad00c4533933c6acb16b9facf2012f9741cc9e41b2c225a1cb889bbf2b65250a238234b2f3420a18975448027b40406799425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b81a23fc03180ca9fa94b94e0d9ade1
SHA1b4864768a7f9283c6a1c4b250a15ad6a97699cc6
SHA256c376310851532b168febc0af57cc60a2f792c0c8706b44d9b23afff347d09e6a
SHA512c0cc448028e307acbf1c3cb31cb152be6a443235c9c7329029694234fc5d55cc7bff1b80f73655c994fca3140b411a041f7443d0a5d1b68517e34e4db9abd8ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd87275ded596c90577e404f4ef9456b
SHA1ee8a0f50eab1d477efd7bac20e136c4a154d8ab8
SHA25609bda44d1c1cced0274d182709041c59179ed935827fc5f32d25c0b6ad81ffc7
SHA5123b7ea1819834760ab0dc273a4d17a4dc518cb73472fe505552d40cf80bb889f8f396df54633c097907f777f8b93d645c50462064fe986f0045eebd21230af6b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d56ac2227929d6009a6a33a07795d1ea
SHA1f68f09d0d164b85757c6c46e7a4e9d2543b71573
SHA2563c6d72e2130deb05b24012e779f854a590d967003429f9b3618477160c795284
SHA5127ec2c7cb816872f22ec8647ae02b6671cc16fececbc1d9fdb4ef3b312b9bf40685eb8f6a64c3acd3806c86e4ef258217a61e7d8d0cf017008b50e8d730f22996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580fb325438c717c49d27a3f9476ce3aa
SHA1c4ea86028c5cdcbb1dde694498355c15fb3ceba4
SHA2564d41001dc65c05ed8c991f44e509bf6df41174b1b430bfa2cb47cb1782da7705
SHA512aa2307364b4493723a90d2c47d708445f8d909550d62e8f06d7af4ebc48fcab73eb8e5785b19865c1c26268eec41bb82455f1a0575d310987ccbce090d4f42d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544bd583a3fb14c7baad41cac99540f82
SHA16c99ab612f06ad841ecfe7cf197bc54e8bd0dd92
SHA256957c9b9b17aa0adc4c6ad3c2c8cd77f749190e7666c28bb04bab9347cbd1985e
SHA512a8ec98a3845e8c1413177b7327b39168ad70cd79acb70f1172f0e4bfa68e9aec54eb6a744720dc5ba0625506de0fc02e846eb745b4c8006444cc2c87521d1f22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527af55fa497f57b9bb4a1d9844219a13
SHA1af6a2c130150445b2021b88f915ea9f05dd08f55
SHA256db91f52dbc17bdf2238c125e2886ce92fc1bb2cfa815a5b5aa02efd7b9be7ff1
SHA512467ec2d71fa9f36a7b37075c016dd3781412d583389374ae3a5722a49a00864c3a52c8cea5d75a2ff11f3248194b80abd0f4c01b19fd88ce4ab7fcb29ade4b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1574c1b6cd9796cb2a9dc9b9f056024
SHA1195d391770b2c73e21873e2542a9b084a3a7e9a0
SHA256efa778acb1fd5fbd4f57a48759b094f0675a092c2b6157cc6428922cd87dbe2e
SHA5120bd6952f67528bb35c937d1b55c2d8382759ea83916661cfe8def3d1c6a0501990c65c58a1abeb95bcae8b1e26d3593855673f6dcbac8cb8a4ca9f3639e1877b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563cec75ac2faa693b725a973ecc25fed
SHA1b4b101445166811ea042cd6e3611a89f4de49d84
SHA25659d2c346c04db11aa99234992480bdc5ccd6436756e563a6a169d2da50417ff7
SHA512c428173695df25c66c39e6cd1add5a9f2ab206a423a159f77b09bc32dca22199acac7c20abbf8e86182f76566c0c2699c0929d83234e179774f3aa6d8d0caabe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d471e798b90049d8f9440aa80bdfc46
SHA10ae6b4abfc63eaac1482951a521a47077aec3813
SHA256d134111bece385333d6503e6c694b22960988cb95f269f2f6bbbdfbba1feab6a
SHA5128e965b366cc96bfbf2932ff5b3b9ce97caefaec0ef0dc5586a88da0b21f21f829cb6e7f52fd660c8d3bf68330394d8288c17c429fa7ed7b49efcc135d9916f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590306116afcb6ccc3b9352a70b49c57a
SHA172ff3453c3ae2bff198d24460c840e144bb5d2c8
SHA2569a60e121710b08432f3587431ad3adacc09d8a184efc469651bd29e02efdad6c
SHA5126bc9535f3c9a570f1359f42806f2b839f56317bb9760e5a44b6b45d035b8f1e00c341ae6ece3d7980dba467a44f856a37083bd6acab8cf8cde06b8c8eb34bcab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549bedb1a33326b5ee6f70a4f90f2da11
SHA12199d42102ad3499bb322deb501ce474a1d0ee05
SHA2564ce8e4ca8cc334c21951cd49a6c8b933841eefb32fc48a9d1a53ab2a12d1c496
SHA512f073debbed0f5d8b0cd60a7291e45dcbb8e51c4824adfabf123a5729a34a566a408dd010f39b8e0d31b7d82af9c1aac73f26a9399d6039f6bd00454eb247abda
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b