Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
b50a167c603896c43fb2f0cc77a0dc44_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b50a167c603896c43fb2f0cc77a0dc44_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b50a167c603896c43fb2f0cc77a0dc44_JaffaCakes118.html
-
Size
844B
-
MD5
b50a167c603896c43fb2f0cc77a0dc44
-
SHA1
f3980dbac383ba60b0314ea859e58dae10ba835c
-
SHA256
1b47c5aca01699fc698ba9a6f0bd7f1d55aec8b5b5af4d6bfff30dddbfa8a9f5
-
SHA512
ce4be7045d9efcd5b46dc9540fadca7c9486795e3c6deb149e409ef4aaf2605b5ca58b6b26da62a59d63952c104bb552e294e5b9c89ad2f5d3817720fc53192d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d00000000020000000000106600000001000020000000139d9c68410f98d54cf2611175cb2b7f2c04c96c9a65a518702c84ba5829892e000000000e80000000020000200000007419f932f10d939b60431798db221343753754f8811a5142170c384027ae5aab90000000b9904a9cdd81ae8c92069a2981b65fbfb2667c34d5ed3d447f6ba1c6768fef015204a1dffa4f63aaa84ef68a527882fbfd62a40128433a3fd9896a682a4737040f5896c8ea34ef46c6bb44ba2e14707b55f0c1c91d14564cf2b9f2bd108b179263dd6a2aff3e812c21330e061c179cf8914e2989da7a67da347461507142771420354cd3a43aa4d832400f80c1607d88400000009d34c25c29187a7b03157dbeb5d94335678c899b153dfd9f78a3f554594cafb30560c9bdce4244d701a7e004f87e5d70e1917a9c519e8e381d12743eff77483c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424731398" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d00000000020000000000106600000001000020000000a9f5070a581d6d696f9f70f6138bdf59d577e14efacaef969b7411a4ed15157a000000000e8000000002000020000000fe6ef71d356ada98b93e892601cb8e1356567a1e90b8b9d7a8b5bd492b737dd120000000e681c1391b0da519dc0b9cf81484b1ead4fac4b2a22ce40c56857a90f5e0a54f40000000d8c48b276eb84e77e2127bfe9485fce8dac30a819261157f475afc0f0e261ec31ed0b5894bcd57279cc49a47273af7010676d111c81b7422eb08984ebe281f88 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93440421-2C1E-11EF-8FBA-CEEE273A2359} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c008da672bc0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1884 1984 iexplore.exe 28 PID 1984 wrote to memory of 1884 1984 iexplore.exe 28 PID 1984 wrote to memory of 1884 1984 iexplore.exe 28 PID 1984 wrote to memory of 1884 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b50a167c603896c43fb2f0cc77a0dc44_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbc5ec282ae30cbd36d929f898bcceaa
SHA178ca559ab294825f860bc25029e9fcf39b128e31
SHA256033a94e11a92ecdd85b41279d052c11a207330c9263c600cf07f02da26f4ed58
SHA5124d7654567f17610b7c424f4e84e33c9baba897f55fd13905b8be05b42c52d9d6957a058b7b53174e5409ce55fcd4ba502cf9a410fdedf5d7396ee34a7b3f6acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57160d00e92849d7cf13eb6ae25ef324d
SHA1eb4b0f2f8ed3ca846d4053e7a832cd14706f0811
SHA25692acd52d853ca3c7103960121949db8dbb556ef0bae6781659211ea1de52a4c3
SHA51212e08fc6fe0fc763d81879d3733cab6ccd94bb6e535e9d1f0f86033e6bd352520727fb0903109e5e967b762248dcf8c055125b5cc11cae7627e41c765de820d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583a281e595d6399059b14f8d894ecfc2
SHA17f407ba628fa2d023a445e75065a8cd11f340cd3
SHA256f15a727838d2109330058785fa8ad9c53da7ecf6e8b0c909ed5820ce1b3d3f32
SHA512b6b97401fdb17006270cc6809c3412eb3abe18f05fe036841acb5623ec375d123cc3d2b8e6b9c42a1343819a25e84f35f748890fb7566f6e9dde4b2889c4395d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a84c131d499f676b0d067e39b6ecc89
SHA131ddb31fb40ba01739944f517a94ad0b3c474158
SHA256ca7200677d3ae33e7581c54efbe9e33f0d03877bc06d7423d9f3183fcb18c248
SHA512b75001a7aee101259e1948e983333b58d65170be6ee9787ee748015e90a584e40343182b3ab32e33e0df27cbd5390d736ba0a004115250f7d714c543addfee7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f99e4d4d8bc643018343158da965ad5f
SHA12696009db9e3daa9100f57f8a777f758c13a98f9
SHA2567749029c8e0d71c19c9933423080924397f01e59693f28986aa5dfd1c9eccaf9
SHA512dd443ab292b6019a4b83fd179fe39dc27e20cc0fe55615d738649dcecbc08ee1a163fbcda794c3adfb161f2e4b565df40920eef525e43bfd9c4661ce4a9914f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537727540519f8ed14969094466554f86
SHA19c094d39d43a3be8fb22644e8c944cb8edc15d0e
SHA256e039591b68d24fd624a404839824fbf895408e078bd8ae0dbc86ac2588b2ac5e
SHA51245ef64cc4a20dedc3a2a3dcd995c00cb257aff1338104150895f451dbe1f35aa9dd7f086d5146cd3f87b06413e53ab814499e9b1610a1ccc1a4ae9351225ad2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58104c640082cb3d5af61e69c16b4cbc1
SHA1ac115944de41868f3a44cb31f29c315634e84770
SHA25698001db892c20f1b1f07ee9946c1a6561903ebd16b7264cf294a831c971e1269
SHA51226e8449ba3459e9f19cb05b6f373d698189f3dcd63c063e99cb3ac3a55fd79d5bd0238fec24fe4a289c19649892db04c3b5a0e16c7b34495db3d85b8adb81dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568864a428cad91613ba8c96231c21afa
SHA1726b6a197362d832b3c7d2dc97ced9b11ea84d6e
SHA256f81a5b4f1d12ac34688ea5c13b5d0bf28be357b3b6f3c5b25b6c68e2b8b2f956
SHA5121c084e0ed96fc87cc4d2d74c1eb19c57d27eab7e077889b9f35e923fa7fa6a44e16b49396d754a82a9b759d8bb4a380b65c2be53391d8d30ac72af4aa5bf5de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcb63b34c766f2b16af0de9b893737aa
SHA1e5b2a4c6e8f8daba2e6129dd7e7bcdff16ff6370
SHA25643bd968ccfc99259e74d005b60991765b94b8999ca82148d65b7b382f18ef629
SHA51240db25f88c6849a65ed80ad95dc5021991e27a8868a77c3a42b4625eb2733de0304be75992f8fde3ec75011f918088cde35dd24f7fbf726cf6e9188a71030a97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596e98fd14cc8b91edb71f620f236d91f
SHA106ae3a55dc63976553ba1afbd599a50403c2a418
SHA25645f26241e36d56635d6dd905b8763b30fa320e95b48929bc060ab05ea0fea299
SHA5121853897e8e7b019a7c69bf2d91b4049e1151186a293c40495c77ec1b0bf0f9bc8d9e3fecac74149df3bb5106dff8499e37d403f1754d0b86136977a59fd8d6bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd24bad60eb8578a1a5e6515167929e3
SHA1c49d212cc3082506d1e32356c87c4ab25c84dc8b
SHA256833386901fddc443ef6870061510af4da8378040a7c72a00d55b912c486f6751
SHA5126452629e81198c1c7f316f06103c8ec27411a649921709ca5b4e9e7294dab18b9bcc9ff819edefea855f4f0b7e8483d626a32c0535dfb6eab9bfbcf458f680b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512fb2a212b4d56022d64d30db4e3c884
SHA112b8d3b9ae2d34bc445e1cef61325f975b467699
SHA25697eeb73dac43857e96a4ce7945d916e6c2f0c2b8620c94e967e434f9a0a415db
SHA512a94a7b96974ffbfdaa01680c5220604cf311ad952dfffce2565f52d9c9e0b1245f99d6f570b821806aa1dc6b38c1bb4381672af708c93cc5a6778db9d7703559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ce5c80df0e3b823809c261e6bbb178f
SHA10911562c2052280b45e8eaf783bea6a30d6e71d2
SHA256cc99933c9ac2793856238395f8bd4d262d9dc63254a30f5ff6ecdbd03bd3e7f0
SHA51298519ed58f9a776c1c2fb611aa75de52aa51afbed17b297507dc72a41e2d9a94ca42cf08ba6b7870ff9a2b54139b105bf7620ca827393ee99d4a2768c3cc07ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db31f83efcdf5af918d20581b61e13d5
SHA1df9793422fb5ebddda2a674858560d47c234c76f
SHA25673a1e7820358b5881d53bf4cf1cf28e5638e36bd4b1314116fbfe0a396deb1c0
SHA512dfa44b41e70cfa37aadca652b53bb226a6020e60bab9adb57d9a911b0b53c9f781a13c5fb4a885b4f641c5405c9799d3764b5fd220b166c563bc106b18f7db9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b1b95c6759ee2b2edd274da8877991d
SHA1a85421b91f4c5a76550fe407e6a2fbdd28bd1910
SHA2565e038c0533126b39bd5a26b28065df118f1a9ed49c6493c409fbcd5337115cd7
SHA5128f09937389df0a421b1e9e9ee3b74a126a5a327307106ade376ae35d1f151e8bbf2949219d8008801de8116b3f9353559aa2adc0634dcdfdd408feaa4e7d8a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560045f9dba215887b3b3f47c5be0a550
SHA1cb501ab35c9e6460df225c3f5339e2e9868d376d
SHA2568b747f3e50a01af1139d44242df09b3ea809db76e5f22d6471e45baf9f5d724e
SHA512c5b54bb552102fa47d3b06ebc239806a9fd7b6d78a4c3502fc0e32d88ca2cab46fdfb0a740d08e1c645bf4b882888fdc58b6c9e11396944f92607cc30b2e3f3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddf0b4867fd353e13fd30b7cf40d45ee
SHA11faa91ac2ba3d1ad7b74aed116f3f46a81a3eff0
SHA256f1db3ff676b1f49ede4c83c2a660f22961c524c527707ebdf1f5ae1a4df4ee07
SHA512afcaac83e6bfab958859ba2320c39fb9bfecc57aecc8d79d496a02dc890ad778d32218c6580cfec285dbbb7c17b6f605e7977a619abed9cd7a06ba74dd689d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534260a5133bd815374af079c1bb2372d
SHA117895c38dd76cb4e0f2d57d5b3b4625ccab67de0
SHA256aeab6866048c2a826054d0db94d70aede3fd98ab4dbecd4b1e5b4a96422a95b4
SHA5126cff43c1d0d2fdbd37bd2d2f4c8fa0f3069d807faae2aa1c8ece372aa8d418d0d24cd3c0923ce1ee7e2522fb45d39284b749ce732589568ac65c6c3fdfdca154
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b