Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
44a6f8414797afffdc20057171bb0319_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44a6f8414797afffdc20057171bb0319_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
44a6f8414797afffdc20057171bb0319_JaffaCakes118.html
-
Size
1KB
-
MD5
44a6f8414797afffdc20057171bb0319
-
SHA1
948aed967da2aef774b427a31c633c8fceef9117
-
SHA256
95f87ba1dd049f5bd7e4f655744367b98cc969194bfcd93503eeff8509d8f500
-
SHA512
ef2a3e5d31bd88cd2b6dc281e22db8217ff91ef25d7da880e523c1a9a9fff1dbc2d18a9a3f5a5b4d4507ff5573246881f79a207f478e68bff31632bea0388bdc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427099737" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c075d69fb5d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000078174b00c2b2ff95059c8434e04256f8655eb0188393522ab331e692096e6fcd000000000e800000000200002000000052cfa3c175807d9101d788b081844d20b3bd5f11f95a68719988f1cbb21fb940900000008c850f1984ff3115a0b470fe2a59a71cb8a748294caee2cc29abb3c777747cb94722d8a4c0f6406f46e4562a117b9e64bddd278c466a89e97a9b4176c929917846e9f3ca61c3dd05576e85215a9b11e4ece33c6896e7dd03c7eb8ad152c3a537d9db40057cb2255d45892a03c7e5c07988092260384341211ea10565007f5be121f3dc47a3ac4ccaf98ba9a992c5231e400000007db5d06ab1e631e625bd7f1c84ac2de9bb8d2d9237ddd879aafe5f487adea0dd08ef2ba6e8b90d92947dcdc5c3615cac2ec2dfc815e039878ebc9b31a29bce2e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000dbee7ed9115f8c67df5ea9925ace53c09bf96464966b1fc943b9de0c354abfd7000000000e8000000002000020000000acd4407fe50e72318d57ca19cf47581ca57de8b2fd6aa04a5731d24ac1ef89e32000000093271462ed96b6b09153bcb292de8f75d3aa2452853cfbf2b86f143a6079014a40000000bdd443d9da40410293d7c39967e271bcf642a53636b098de18c0a9019c45ae9bbb43e5e390dd45f73c04780bcdad5e76ba62bc91257f6e3cf1e2d6aa5e02a852 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB598701-41A8-11EF-9AD1-5A77BF4D32F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2672 iexplore.exe 2672 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2732 2672 iexplore.exe 30 PID 2672 wrote to memory of 2732 2672 iexplore.exe 30 PID 2672 wrote to memory of 2732 2672 iexplore.exe 30 PID 2672 wrote to memory of 2732 2672 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44a6f8414797afffdc20057171bb0319_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5751265b76ada23c9c4468c2ff0881ae0
SHA1ae100edb8b48980d700c5cedcdd8288e6a166c20
SHA256590105f64027b5d7f907dfe383a52e991755bb9d6574b106f20a43b688515e19
SHA512cdfbd434aa079afa4238931f120d375b07adf08f436f982147e4f12ee6319e28daa9ff825dc58117029423affc150ecbf2a54c6956603bceb7299904a34c5967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fc23236b3d9e698a023504e9835fe42
SHA14125090b70feef17dd48ad908261d0928a2fb5bd
SHA256bddd73d4f5350964678c9b9e5ec0ad7dc38a7a0ff17e4e0143c4396276ed3895
SHA512c54514fcf9c62e063c89967321ac950ee400954fe7cb6def9d0c8b39ee9499c9db67e85ec4ba1982c5aaa8e3ee368f9066ec7bcb3b8a7ca5ca3f0df39959baed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed15a5c8ed1b83d12924c5a3848e5959
SHA1eef4448a99172a3d0d98353159cefe49e98caef7
SHA2566685e887d2b25a1cbd15d5117eb29fb59b05b2d213114a5938f9db81aa0f5859
SHA512bcab0e3a5372a4fa77d83e96f248d41ebc767837db4103bf791e7bfd5b27d404727badaa6ea37911b40090053c71bef7336dcface1b27e16b75a300f33d93df8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c62061044d9fa80666025eb2c87943
SHA1896fd17a1f09baa62d5f0d02cb7b2e7f3ecf994c
SHA2568e810238417a2c410b522c4bad955d715f948c05e36f1abb0a1d03ab1d1dca31
SHA5120f9f1e1ea83590aa74a820218def7e1891218a4c2141f302583bb1cd99cdb8554b9114f2ab34109707ad12cb65c1d31e1c455e586602f38caa06c79bdf9ee551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad89846f62d2194c567557dfaf361fd5
SHA1ad0250e5770cb0c2f2fdeeea491c879baeb99365
SHA256fca1643ea19e9ac2e61519ba179a845a53a8b14d05155ff06c26653c32e1cc03
SHA5126e40695b801ec3cf31b105b136634c8ee7d61c123bb60dd5b4b39b86c87b259ab70cc0e75f42bb43a77a2b1a6decf679b479fe3aaf12cc6e8f567e9ffe4cd005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ade9557f382c53875a9938d78f1d545
SHA157d6cd4d19f5eea025942c10abe233d468853133
SHA256161f2b91c107093520f74f6d2dceb9f514964ed8960ad27ccb3f7e6406741a93
SHA51289076766b630e52717deb4e30288a91a089a09d327fe26b338545a5be5a7bd160e89dc47a2344ed977c1c007bc0e1ac0058fb29e1bc600c303ef3108fc1a4f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5452d62e3e6c4df971abb2a02bfd8c68a
SHA1bee57abeaa774fa7c41d8e2b4c16c1b19d457433
SHA2561ffeb83bda231fe2327d0d81756617efe2ebbeddaaae91681f9d3e33043ea376
SHA5129fa43ab52c5704cbecf2922f324f91a0f224a5618a0fef995f8a0a92e528547f4da6244c526c337c5d74c6fc5d66f68e054420ca2746217bfe6ca4cf629fad51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ef970ed1355ba081fe236fdcadc721e
SHA1c7e1ccdc2ed0699ace3ab95902de1f79b2e6ba1d
SHA256352dec7300ea2910fd0c8d19c54806fa9e1d588b5b87d1050c176b261abb998e
SHA51218f6b6caa57b60eef6a746535c033236e6941685b7cb54e321cd8f6c1303ede6136f1c2d617d1f6ed6585ccd3ba1d622b655423014fa49b79bafddd9421b3f2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5636761489249cd15220e4efc85945be8
SHA1b9a7d57930c465a669f31b257c807a4895536996
SHA256aeee12cfa8bd9f4ba4718fac7a1f363bf98fb84c960d132108a3db9a746498f0
SHA5124e0e9b1cdf0accf3ea033cebea6f85006fd0105f3f915326027cd23c09b13a08f2b94c1f80e5e5639be177d1bbffd61ac440b31bda50a0db0a0ca23b980be32a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556a9ac218f367558c7b2b6881b4aa482
SHA1f75bb8aed541232d3d29a7037240ad875c643553
SHA256ed42350c9a2af753005d1e91db04b9dbb577b515f120a2017a6b1d7b52c0e74d
SHA512cf0c97b6969abe96eb4c449e7a0aee1932a35f206a742700a8f9915c7f59b5bfaf65e4070599f335603b49b983bc68240ffd50d71287f523a6b1d25fda32142a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f7ecf438aa5630710e0bd6170f60242
SHA1741600dec7a8d9592ac5eeca3863f3063169847a
SHA2569487b44a654ba81699d81edcad30cb4244d16aa0dfaf8f91db4273ba32a98dc7
SHA51243781f77583fece1147d7c748cd9be8e0d2b109f230b6a4a2ae5dbe5aa5837217562fc91a5b6b0998ec0f52fd99c8c193f6a184049475a5df6d65a9225b96d7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575641753e3cc6a84c404c24d4979eb0f
SHA12ef96142b4b22e3b2385e183e114483518ee68a1
SHA2564d51d7118e9dd83eb46cd865456bbe8ffd37a608daccb13b66a5a3ad1a9ef0f3
SHA512c907c72a68cde99854eb2715aaa76a216b55465ccd766a695f83a7f59077097433dbb4783ec9cc988296dd740dbb0e52b836278c09842506e0c198751096ec84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c42cc4d6e2e887951308f9528793a42
SHA1d3815469ca5b2dee6e7272b330dc8a651242d505
SHA256a6b52d485e0bd0a39c5ea41d035245d149e9e34ba7857a264ddab356201b7fe2
SHA512161c58725f5a116dcf9328587ffbb22d342de6be25883ebc75c9eef9bd4975cffe2f7a236e32ca46abbbda2b16db7c9223f284ef08d11fa9eee6f278ee0e1ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e8c1048205a0c7d5408e5d733daebda
SHA1824de9160048e9c2633a327982b72ac7f4ff2751
SHA256f22d084711eb0d063f8e686f8384fc893aec4173a7e1a38999a27bf1d3441d64
SHA512c3e844db0214781d25b412da17594393a76df545bec9b9ea06b96a04a5efdafe0f63563beaacfc6ff44a6300bf90105f570c9663c5535abd4e8f9cf20f346387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a104f74a057366eafa849d5f1552a13b
SHA1fb0dff1e5a3ec4c7d7f01568805db5f0cee59b85
SHA2564d0b83ca162e6a21e2b3c262e069eed11f4b5526428f9f75eb2d5988225067fd
SHA51281134984897e604fc1bece65550c2c5faae242c27690f7097d1d81fcb43e8ec24e199d8b15a0b5703bb7d735effddd557ded4dc73f36d310c99d1e74e000b65e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e94bdc75409fb34f4ff8794ee670acf
SHA17a8f003c415606ef6f1341184c33993aa50f99dc
SHA2569dc51a0bf9efefdf024b547004f911840925f9be3ed6cad94e903d692efda1dd
SHA512dc05e869910dd3bc1dcffd9c2b0e7a4eaffcc0e312507ce8c9c59c5ffd0b04ac6b6cd3b4493a376425d13f87bfbc575e831a9c7f71dbb0952854d9f9919d76a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea02ada513a0300d23b7f314651faf60
SHA1ebc6c5e165dc189c7382423f61e73b89f7ffeac0
SHA256fc9e2dbb5d9371631e4f1afe1d4a1e5e11c464e9185e4fc0bd53a5869e2f0532
SHA51278e8a9ae8c3b1607399a4d9d5cd2f2b04a3c583a505ad02762dbf8aee14b862f210aa51e2673e00c5fc64c5c3385495f35f01261efd6a7997102aa7ade3c17cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d4ef4a56c1ad380e4884ca5edad377b
SHA1e635121ef13e14868f1479204f9aee18a83865b0
SHA2562bc149b931a1f41b4de0baec4498ba097b4564413f984918b87b3db02c402523
SHA5120c11d5568fc553b73924a3d17bb1d0a00eae9114959ae33fcff65a544dd8ecf42e7beace4088e2e66282890d80eabf757a33aec6b2478d68448a2527988cfeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51668e83860db63f6055fe14b15891257
SHA19967e71ba4537873448843cf7849a2f4e162a1fe
SHA25689d99262995a2b054c5c9f5610054c880d0b0b8189c8b3f0b47fbe98436354fa
SHA5123ea31a7a84ec5c80bf46f5ca53e3cdd14eb6ef0ec1d2dabfddf4cfc20ba48a06783af35880f43b2fd2289581af479e482069fda2741b1563891a8da825c77b5e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b