Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-07-2024 06:14
Static task
static1
Behavioral task
behavioral1
Sample
44a4731597552a387d73f657b5cd089e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
44a4731597552a387d73f657b5cd089e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
44a4731597552a387d73f657b5cd089e_JaffaCakes118.html
-
Size
15KB
-
MD5
44a4731597552a387d73f657b5cd089e
-
SHA1
00c04bf8ce4ca23622599c6ea790ba80146a602b
-
SHA256
219e436a8d1977b4ad0923feb4df59b23aa3e9ddb4ff6b57c64b29fd2d701fce
-
SHA512
18867668f5d788d29f0b3daaafb15f344df47257533b4cd5a9189d26204726024604614d476c6a063c2d526083fd7eb238e14292686d8d906dd8aae7366429de
-
SSDEEP
384:J50rDhcTGIGa8V7Y5jNe+ZqJuUx8rJMXan+Q+5:JYDQaJY5Ipgw8N/n+R5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427099523" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000281238e1614d033336b90982d98d7964c39ed635d9913bc69abded59b71e1f82000000000e8000000002000020000000d4f6e993560c1e02709d76d273630b25e8b2aa29c6433d27612c9b676b3f92a0200000002cdeea7f8663eb4c596437093060f9b5dc0e24e0bce266ecf78de9290624eb5240000000757e4a89b96c2bd96fb88c644e78c0cbff060ab8228a56346309c74bc9bcc0f29f7f88db4e9f1214ae0c914557505d34d8623a4a46402bef3472f4f0e9ca619f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0715d0fb5d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B23FE81-41A8-11EF-988C-4E66A3E0FBF8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000727b5d5b71e53c2ac7036aa5fe5bdfb250b98fda82cf75fd727fce073dac7e2e000000000e8000000002000020000000624ac11bb44baa665b1cda1aa7738985fd5e4856d4ccf510624cc14f6d79bf68900000009e2971e59fbc3c2346b2cc4e0ecda1490abbf57d594199f1477e9f81fd225323c770247bd25413f1e03ee920b56597d53908914b271e4c74c9687877ae3d36db5d1b41bd2873b42d63ba674e1b16ecb92564e52c93bacece152c73f68b10237061b063284282a6a2e7c9010e18f10827a8635b59e6823acdd093d9f0c77dba02dfb68cf21cfdad6f616d2657fff0d549400000000efc780da6c99979594e6e1968f3556cd1d6460b8e4c7c5d8a098a5a47e4ffe59bacaca07c057a025531448134b54767bf6c162f720a2e0f49d5e3b51e5c663f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30 PID 1908 wrote to memory of 2688 1908 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44a4731597552a387d73f657b5cd089e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8cf29b41fd73084c81ad667625268c5
SHA1970643ae69e51abde4bb705b69396ae5397b5941
SHA2568a3f270aed36147c64c4e99965f1d26eb32e54868329fb8b3c9e32ed138a5bad
SHA5126d2745bfd60f3865687b4c8f368b2b5c92ae1f6ed7de751ea9ad738a44bb807f0dda34a0825c30096b70a20a3f65733d36446f9c4748996ffa196800b4dc4636
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7969e678a37229f0ecacfc749402a1b
SHA1dad926476bfb4038f72b047b35cb964428c8174a
SHA2566aec5b5bc675f8ec5ea006a18cb688675444c47f8ba421088e01939ca2f68ffb
SHA5125ecec2ca625fd3759d076cc52fec95a2f0febeb31504a0d64ac2e4e4fc99dc75eedd5c73279ff839c9e8341294e60d0302728d5f8d76bb6cc1fa9fdc76b5f418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5face81ef2e052a25dd63855792da54d4
SHA1749a328fa80da5db290871ba45ef0f42239a8eb1
SHA256dffd9564189a9b3b4d127b4cb4530692c6e3a122a39c05d0f316e285864cabb8
SHA51235d3a39f0894dbcdf672e0badc177ea46765fd8304ba8f562696c0e0c4c80d49e08e3262794c652d97cd895e9d71c9eba41133a5a3d90fd81bee64b755568c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e39d2a23643e7f9f6763aac846bbe8
SHA178357b18ef00162d8c1464295247b9edefb21ac3
SHA25673e649a635f4880cdc2ee15a6cc4f5533873dc774f053e6aa8c5dad337ac47fb
SHA512ce17a62f460e404802c05118c8b9749725c613082dc387dd11146a182a292dc9b90a3c4884820b36c7487a6fed132821127c64f32a1ef4aa571e568c2992e4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e75255711e93605a4902a1bdbc182b6
SHA1c628ed60397fa81760f64c5a9b284c13bfccdaa8
SHA256caf36adfd1306691e7299e71660fdb56012f4b283f13cb3a6c50d3148918da59
SHA5126b47aabae9ee4a273953858eec1f62c2c45f3131133b02e2b4de1b902b65e80e5e59414b315dbfbad1e5cd7f7ebd613d1ae4addf3c55ceb9e098e3697960f96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5201b97752468970b3649acd7f58bfb31
SHA126b387ecdc3a6fcb60f403325f88b8040055b5fc
SHA2565e64d4de978cf21fde0c29a6810aededa405c7049fb2002065c03be68019e255
SHA5126b93f690eb92094ba38ada4a0ac15c25ef5422a31257571b7bb332d656d1fee6c47bf3d5d5319b3b2e1acd88904a8911dfdcdc17e0381da0a42b04e3f1489ad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b809af4bf25979a515ff4308f2fb22dd
SHA1db96bd03cec1735ee59c44bd6c3f03491a345932
SHA2563d8d4a7359ba3ca204c6a647515d8963ea560df9df526bba2952303aba2c2cc7
SHA51299040036f9351ee65734766dfb2b8337d26e0b348c7f45976ea8fed552d5c53572b9a33bbabe4d2e7e151dc16ec936036f339625628c9d44ac2f410f01553387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bd6e83b6718769c394e87396f2906a9
SHA190b3dc0f9ef49e37b4d7025c9c492b4538f73e15
SHA256c4b654209e0b59ba068c4c79e7642099c147558b3b5d585919a7950497a40423
SHA5120400019f14a9b6454a92ff5a5ffa5ee9feaad1c80e89c2c63c809dc0845e941684f25d6d52ba162c0aa08577cb48d3deab8ba911ab6c7138815f5919b51b3d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51718c8d5c494d9bba83bbfa0390f4112
SHA1de1d9232149a6a7c0e49e8599ed62bb04e1d6c9b
SHA2566b959018e8198ff88d033798dee8e84a4772d7a05a5f32a2edf9e63affe6fa75
SHA512dad71c9e11319796780c8019367d9016cf898b447f5af1699f83c22c6960548c4bac636a5655ec68e0e1d3200d739b887fad51c55fb2fc0031b886c2965b5e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b07b643d5cab10823fe049493dad13c7
SHA10f8fcfb5bb630dc0b591ab17d287144c2a87d310
SHA256046b8b888dd5767f3ddf7ef1b6c13a54e9d6234ca6e31b2e672d0a4d8e2aa558
SHA51282c5054414ee93080b248db4d19bb1971e2f547bbf9c50ecc46502d582bbe6f9adce043d4c81cc56a490c8459a9e5b20661865c57156b1ae0aefa89e2aaa42b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531db88dadd7ca72f59bf1e3c5aab619a
SHA14494ffdd9d7c2b383ad57359883c8033f60e9943
SHA256ad4d4563a36d047d34e357ba5245ce215e5bdb912f076b8211f0d2bd8352393f
SHA51248e5b6b5cc9302cfd455dddd74f9d84a3f61333afd27e2e314f3b0feec33db1bcf2494683f18459472049f05112e40ec80da126551b0e98721188064fc93c5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d1f55b88b9dea2e700207d946bb3137
SHA1d8afd07225d2d994f57b19b31be6617119fb4806
SHA256793094c3e3c23d0fce238290a87e217a1bd5bbdad8448e074f0646e51f0c3b1f
SHA512a6f1f74a240459638fdb9127a21163b6d0bbae3532c6c73e4ccdbd115e5a36696d12698414ef0bd24b60f741094d432f392187d45672706606556f87d07a156d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdba4641905ab83d16325964bc7e7396
SHA1b7a525e489c51cb2514b6cb2d8e497f0f5b87d8b
SHA256700daf1a0e25ac26247002d2f91ee100381f022e807d661de68a412c8e3701e8
SHA5120874ece4dab1c4f2c2766906e86aa6e861995b69e05752eb25272393e21ba05262fac8d90d97acba96ac141587701d6caae29201b1c4c0dd9f9f93f30bf6fdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5735dbd8954801c1cc587e60985c444
SHA199867653cf9fefa77aab4b59566538549d129acc
SHA256fbea29d77bdb9bfefe7b2ad2cf16ae6f28bfa0f3c736b21c34be85cea17a49eb
SHA5129e7315483e509b8782bea7c17218c7cae55933ac1900ecdd962b1e9239f1523d7c95daa8ea876999b6bbb16a04649343232b3ed4322299318445394f920529dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7df188ba7f8251b58b517ea12ce6a32
SHA1d7a4c0070a24a6a34cd0113416aa0cfff84abab5
SHA2562f05f35eb6e69a3785aadc282063ccab2cf0ccfd148297a3fc61dc76f32b0b1e
SHA5126cd330b3d5c386f5f360ea685cf5e700c34e8c44715dbf265d1552cf0aebd205ec0c5151ff4bf2dc5f40b8e44f3301f6e588fad7cdc1701e8dbd209019779211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e1f31d62a12f96c280927c4ed5a69e3
SHA1d86055656df4dac6705689c4c0436c6bf702ca24
SHA256b0a74b959e464e0262cb6aef32cb25c320c5b31632ba13bd7d84113fb660f366
SHA512e44d6d2ccd300d16c9978680cf9ee2363b8925c9e044623150b218807e50adc2e5f3e55246cf621ebfaa2bbc20be6c7328dd03be0a31f093372894bb0abbb182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8870444e9e016b5f3dc9bf0ce29095d
SHA102bcf22385a13177daa639423b8eaf757f940e97
SHA2562d0c4480ff3fecefb99654482fa82fc1bb25fbe9482632ad440a00ebda8b4e16
SHA512e2731ee740e34488d572e82ec1baa918c3f7c7e8c19ae8e7406388528b4d3185d4ab37f0d4dc28540946e52e845d6acb80b3d9903c581370a8dfd75b33771805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59199d4395d20f6c773b414154ecf9feb
SHA16a2235d7f1219ae7beea819175c3e5ab919250bc
SHA256a9d6617476eb4c1befdcc2b0195d8eb5ea702fed007752e260718453f678388b
SHA5128e88f809a48668f94ece1a7f2a26f83535474376568c6c2498e91ea250485c22441200a336ee1ce5ad064bdb15a0773ff26d0d5f6bccc16a2ed231f40b6e5678
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b