Overview
overview
3Static
static
36179bf4ebc...18.exe
windows7-x64
36179bf4ebc...18.exe
windows10-2004-x64
3$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3FLVTubePlayer.exe
windows7-x64
FLVTubePlayer.exe
windows10-2004-x64
$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/nswg.dll
windows7-x64
3$PLUGINSDIR/nswg.dll
windows10-2004-x64
3$PLUGINSDI...e.html
windows7-x64
1$PLUGINSDI...e.html
windows10-2004-x64
1$PLUGINSDI...w.html
windows7-x64
1$PLUGINSDI...w.html
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
6179bf4ebccf55c09e2c5cbfcccccacc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6179bf4ebccf55c09e2c5cbfcccccacc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FLVTubePlayerSetup.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FLVTubePlayerSetup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
FLVTubePlayer.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
FLVTubePlayer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Progress.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Progress.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nswg.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nswg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/welcomepage.html
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/welcomepage.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/welcomepage_noadw.html
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/welcomepage_noadw.html
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/welcomepage.html
-
Size
5KB
-
MD5
1004a88bdeea82e7ef4dfc62396b1a00
-
SHA1
0de1e852a8349734d726ab35df540d1a1c177c00
-
SHA256
e3903f421979faf30a9324b35cbb4c2aadd299efa1cfb3e48446f6703207ffae
-
SHA512
71af71c78b74d53b1ab3180519c66ba2982ff2b467bb9bedf5b410a0543df22e39c49fae7e8bcbc12cea547aceda17828ba34bc8717c2bd5da23bc0f7a7eaf82
-
SSDEEP
96:SI32bJiWEMkTSf7qOugnffDbhIDbbE5zDbnwEqqc/zIxG1Dusp8V+N35yN64WVA1:SI0iWEM6Sf75ugffDtIDHEBDzwfF//45
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE2B6CB1-47A8-11EF-B961-D22B03723C32} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c34fb630749cbfdc2c3ddabcf35d44c7374abc7541b753005f4b9d7ef25b00b2000000000e80000000020000200000005ec1fd78a2f903d09415a30ea7bea0b6c902e01d30592aca5683cec46b51fc0c90000000feba5b65b787911cf094d4394e8c29f0d0887e8192d8cf6ed086f18dffbb4d9675a89fcea2d60b6efd61b1aa65867944ab61212ed8486a30abb8afa40417ba6125c57332ea20b0b308a3b3cf42f353030ca91533362a23114151b5c4f11641d15ddb3919e19cf65cd1e40c9a5c3dfe27d2902d61a1f8df78e4b6b5928e896c2044d303e521276982456304903e2e115f4000000007534a0dc5d7017f4a33c9ccd23c654c220ea279b8b8c5869152978105dd0b2d98b7b507e9780fa17ecf84327aee68fffe2291043644fe8bb5e1206fd4ebf734 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427759395" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102fb282b5dbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001017112de0192aa7c593c77af5246ab97b7c89afde6be329076da805def16d9a000000000e8000000002000020000000182b21fa92b5c22b0820e421210715ddbdb244044e4e5ae701f090128d2f85eb200000005187ea37358e9077d75d1cbe1bc687a068038724ab0262d2312e67413ed2508840000000e5ffdfd2a522de5b6e3a779baab20c5fa53a93c9f6ef3642d05ad6b28cb9a1bc31ab036ccf747000b1fadca8de1e61056fed3b6a51d6062990a61bbd8352f1a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1488 iexplore.exe 1488 iexplore.exe 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1588 1488 iexplore.exe 31 PID 1488 wrote to memory of 1588 1488 iexplore.exe 31 PID 1488 wrote to memory of 1588 1488 iexplore.exe 31 PID 1488 wrote to memory of 1588 1488 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\welcomepage.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2ebd21f2808331aac5c835c0b6943c4
SHA1139a491b0dfb0dd59b201a26efeba3e81c7194c3
SHA256403ace2bc8822ea1e35deee27389f04c62e7d3c7539da99e620a3261dd90d03f
SHA5129210cdc0701c18f10b353a20f59398d6861db51bec355cbc4dc8ed595d4701edab87d7a8f7bde98a3bc4db92bd7a81a8aa18ad071bf369b987e7c03a8a2bc630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bf31f8a64e462718c36544548322559
SHA1e45ffc1b594da4ba97446f99f7d612cc01ba7a5f
SHA256ea5fb39f5cbf8a99a08ee5172a95100d0e0b7205ec9fb5e21611dce25ce3aa55
SHA512a940db176443c77d336cea915fdfa8bd0f923d47b1ff6f796461b72b1ac11e4af40ae5087d4e499a690b732374123cb0ce77aa83bf78a438317d4f263d6e2878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b31f125d4cf6d70d6896548c9250b785
SHA15edb3ad5a836b554eec1c9b6641a36450261ca2e
SHA256db1af1a4d2bf0444e7adaf0832cba535c9b9fa27fe69b9fbd8cbff6f9bc73f29
SHA51252455f122431880e016d659440f21aad1a1c469d0dbccf881a73e6c877c3ba5569d51be747ff1bed0735939d7e1d88d09897de84ec37fa4182ed2addcd503428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531c52d524faea78847fe973b8fd75c3d
SHA10ecd35ab4d9c3a482a284e932c2ab7cace877968
SHA2562cfdf2db0df6bad47e7302dc9da71bffceb62a80d7bc9904e1147ab6ce883730
SHA5128c2c1d365aeeb28e9bd7b93283cceeeadc26e2e54e2acc88e70a07dde625da171a15e266ff323d78e3efca7c9db7c8403c0bc7d1b775671a312f75a822bee6fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b4efdf309ef5f85adb97f4a220d023e
SHA1996fe8c51c8ec7a054071a41d5d4e4aad5ea7d8a
SHA256aa104cf7836f65d13eb7227c8dd4e0bbf5db7a7d6940766d01ef3f3b7c6f49ec
SHA5122ce86d78324d8562d8c9b8cd17cf388f42de69c456b7c8a307f65759432000c087e0d8799235eb745806394b4a977cbb537f1dd118f3a408ef1167b90aef0720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5631ef47d7e1e4eee7070baea75c118e7
SHA1b18f6e1bfb1825b53ee1827c75d3f78bca33e9a7
SHA256f971db744edcbc9d1fb39d1169e8106c083c281cc7cbdfd9c9bfa2f3983a1db9
SHA512653dcc466af8e51151998d4873cb092c9d7e3224e1ce13c117105232cfdb182a7b6980529875658a73d5ad335ef747c61f47ceae99ee38c026f03b14153aae19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee393603882dc09cb2cee11b359066ef
SHA12d076ab15e4b566f073f6b61701b0a8df73b9ff0
SHA256a788bdc75a4b2c513d8cf3efe78f1dae632c81215a73d9082ef07e140e4621ed
SHA5126df14ba4259fc2f3e19b00e2da0146a092cad2bca423677d10a0211f833c267e980aec3ff594569d743f94723df4eb1807f63ef68fa23601d6c3926e561bf5ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c750c273c8ba88141f2f222eb313fe18
SHA158273223802d677b30594733a8f786bc790c3d31
SHA256630456c25ce7a6bf0768d1a50cc656c7e2ed78b7c875ba7f6d6eb524ca800e88
SHA5129ac40f83b4e24346b17554d10cdbf912a0807b0fbb196b9182153b0ac4853c9935c9219b6fbee55e7e23cb6a01833ae2a6c6880188cae55288114681cbf15fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53532ea73cc077fd06783d61276a5def5
SHA1b59725ac28bc0b1be544ee6e5170fbbf05a8d769
SHA25676c3b1a2cb5b65cd6303f2d6bc2c4f0f566e4b1e79d19df831c06232509a6307
SHA5124622e853d023993005557975892b773136c705650b938ee16d7c93fe474e11f55b7d5a7355521b67d230487d42555d3ffe44ff6ce918c0087027136028216f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e494e536de0c6ee78907db5859feed6
SHA1789f673e036b6f68ed56a5566cdba8063d43e4e9
SHA256cd8e27c03c726bfad3a59ac631fcd2f515600b9341603ab54f65819b441a5437
SHA5124576ad0775ec1266d1cfae75ec0d2827b14d2c67e64a26664fa270288b49f48bdc7cb39ac0cbd1ea6fd7ff3bb1279bfa69708df0483baf0e1be891c61156b553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33e9de89d75e5071cc3970f2b015dd0
SHA1a78f16dc600eed13c03692331e5a192b1c2ca796
SHA2563a7874de39304ddc0e82c71b29dddab034852d9a3c11ef33b4e35ea9a3e3971b
SHA512b5ec15d1beb4214f7a2efb271951e41ab0fac3ab6d3653cdfcaeff6984704083a25a68009cb1466e9ac0cc940941858fdfb0771dec39b323535ddfc291853d54
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b