Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
ecaab49a0e0bb16a2967cf36e670225f_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ecaab49a0e0bb16a2967cf36e670225f_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ecaab49a0e0bb16a2967cf36e670225f_JaffaCakes118.html
-
Size
948B
-
MD5
ecaab49a0e0bb16a2967cf36e670225f
-
SHA1
023847efd78636eb7fc93c128ebfee15f96c3817
-
SHA256
89d4292b89c6053d78bc994748a60b786e51b1b4692c346edcc2996e39d64f74
-
SHA512
a4a8a9533920f40f2c81f51baaf53ff3d6a733f901215ae177c0829af27e59823a170bb2c6c74e691a066f65076a8382d52ffe27bf99c2657d4e82e7c7bd20d6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05f5c95c88bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000181728560a2d0985f215ff6a596705d4a3e89ff4faeb8fcf1c5297fce95442ce000000000e8000000002000020000000f2ea7d8afe804ff072650912154ced7a91246ea26d2d61a1d50201d308e6dd9620000000b26750bfcc60ecd7983e1dd4642e3f75e7983a139244554395fd513a4afc7b294000000039c522a442d30d2b1c8d0921d12487ab02f4e5a1ce9ed8f0f3817e5356cbdc2dd9db6a34966046a375a57450e2185bb424e00beb37713011b5acded46009d84a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418971493" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004ce86b200397260d4d667ba496e4d70f5a0a3ecd2290163545cf2a912a54503b000000000e8000000002000020000000eb269ea7ea58a112d7caefe72f7c8e5d1e8503d39b3ceded6d589823d7eae22b900000002c69a5cebe6e23dee2badc9e750e753473e6b2e987cceece34a9c1ed41bf48ae399d140356e4ed14d307b2acc3297d5290b79224e836f5f23e23b1e968fd19f88f2b8d5cf1c6597b9efef4c04694474ff05e2acdc516db05666c57e8446e09e5af06ec046c530c760d4505023fa405da5c7a95c510359b121eff0fec8de1a4edae1c92c54c0966b15106c70bdbfe904f40000000867046df3853c3ebe634937cd18aa9b5311fb84d40083881a1250b265682944dbe30ee729e1903ffb3e11aa7f07569568bb9e1b26659003624c031cc4bac11da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0E6C3F1-F7BB-11EE-80DF-F60046394256} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2896 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2896 iexplore.exe 2896 iexplore.exe 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2896 wrote to memory of 1564 2896 iexplore.exe 28 PID 2896 wrote to memory of 1564 2896 iexplore.exe 28 PID 2896 wrote to memory of 1564 2896 iexplore.exe 28 PID 2896 wrote to memory of 1564 2896 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ecaab49a0e0bb16a2967cf36e670225f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b787400a73a64f1fc7d1ec0257a09bf7
SHA12943b5f85da351c91167e52727b208b0b8766f64
SHA25668a39a80335dbe07df4d51f1f553cdb2ca63542bbe9e93c2e53dabba18164e24
SHA512005285b7e5e1f87c7b08393158d37f165b4bc8116265e25a3f8e872cf8f509ddbdfefd2a2a7700197757f4389edf048e7877b8236d3bd5fb3013fbf808ba5001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b08b11b80ed6f0f69cae808998b9278
SHA10c2844fbf0d6081ee424f4761c20365f59c0d4e7
SHA256ca789376aebf96d14f8051d4e14ab8989a093eda9f2bd4b07b292fb7b119bc6a
SHA512e38ad08c041b11c54d27dbc9a1a498ae1f5ab0186a0c64aa4f538f082c38ea8190e96df52c57d28ce7b94b5a70209fc79da95093fc543352678673827ede1bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c878d1620fc1b92842a668e5e734ba05
SHA1667f7532648694692e55f73d72166f39594d8924
SHA2568fa765fcf887fbe2303501cb5755d45a8f889721daa296a6349c4df490ee4965
SHA51204cbf859f1290d82ca1442b285deb3e9fd634dc466bf8ce66ea7d9ee9a9f5fb90e3809d1238164fc61c3ac3b1330b6b9d31de5ca7e82fb4351408ff0322b95ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcfdc59052008835d8579056ff5cb7b0
SHA13bbd3923d83362104bfe87b2a70c1f14c99140c0
SHA256ae3fb46b20867a1c30bdb9ba69a53759b7e1c48363b6a8526bd1a309bc4bd637
SHA512628fbb4341fc38afda6f41ae0a69d377c50ec8c1bd8afb315769c63e04027f1938c323d8b6c1587437b02463f2839733114eaf54eacef81957f7618776078289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0f7db41fd2e192c96819fb9b2a8d22b
SHA14c94dcea2884fb75cd5a0ec228fc2c5219730487
SHA25617ac499739228cbe945d52762358d81f835ec96fbe5046b5b82c10703d0d7a40
SHA5128fc51f9a41789886a04feab3d71b6be01f5b07b4102e1c9b86c1f99c6182755d2bd2968e5e478589c36e74cef9bc3cdd5ca8e7be03dec80948ba78982ddd4ab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5de2df28dd88cca12cb50adae0bdca1
SHA1f11846f92492f1846f4cec8a9a7bc54fa50ddc55
SHA256652efa0fa32aadc67aae1f790e836a6a8bd54d89ab798cbc3edd3aebaba0c1eb
SHA512953de6b4118d5cc67f9645c27f8dfeb07515b4c96b4a79f85a1f4ea1995a9e666259b5ced0b00d66b32d3c6dd9af1f729afe3716c5908f37ea1de87f188a2796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585b19b370618659131d9e1e95b39acab
SHA166ef09804df9d7ef15cbb5883e4baf1d3f30f7e3
SHA2567f191f576d1e008df8a232bde5a1919db6440c3c52a4b12d81fdcb93211ea1ec
SHA5128a567f78ede3afadbf36070e9ec104f34bd9eb571bb8296dec1329191b9dfed8449090f267185d5e8182933fef09e42f4dda192cc56592f1dfb9133ea7295a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f487f906c418825d42c55944f9af7a75
SHA174424f92689b09dff355657bf0f1ce08dbde547c
SHA256123d5dbcbed04b37966c6f2e79108ae8d3bf782c97a958d724072c0e0c38ccb6
SHA51210cb5e491fbcdf523963fbe94c60407dcad3e088a2c0d478d2562e30198b7be65bf0ddf72c2a35f179dc7b27a2deb758b81d0cd785b4e26b540d0bed0177f036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50891be8658f9b8a5a4d808a2b99e939b
SHA14d0934a8aba84d7c17b537cf4a4859259ea892b7
SHA256d31159c3b75a33589ea722bae8fa464c90a91899b842645cfd1d0a4862c28dd8
SHA512c2a5a272ccc19c9f9cbcc2b7255bf996716c8a16d8dad3cb8d38f8fa64107a2eab4510ec3d3a5465190d062e9484da83a3462309ef080347623ad86ed50c21b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a8f912f2681aaead2000bcf8c4f352c
SHA1a6149b07c2f771199e984250476f948e276ad863
SHA2561067003dacf338f2a088e761849fef4ffeb3f8f05ea0d6a0c74e6e26d37eace5
SHA51296d958c79ef81bb618ae29877ae3323491a88fde54fa80e90e6acb7d435cbead3ad07f7262e5a28b120399788516b7ca99604d23431caad72332968b456dfd7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568e8c935611d56db3ddbd8b0ddb8c301
SHA1280124f63353f1540d338ebd105c159e342cb641
SHA2567ee8a78c27bdc79529cc42a892072d194b9d495dc560e95ab62f1cc97c15f163
SHA5122ddcaa693564a68ffd2763ea906502c157cd9d1cddd40618be1e1f27f91bfa6e188cfc91c034cebc76bbda6dad258a12646420827b8c515c75f5f9b7245edf10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3af623eeedf3c134050ea3dac9e2655
SHA1c4e2c337eeff174767caf233d98d85bda1f9baed
SHA2566e47dc9b216039714f1e78785d073631241308cd8ad41de8e938c7524069be17
SHA5126b14cbe6e8f66cc4262e5a4a8b96aadf5877dfe2817d170c167495edc0d9dd3b4d357d69fcbf061f43e983970c69d58cbc0f2c9fff3fd387da312e496e02bfeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d58a0a74cdf8e3fdea65ad0e56cff9c
SHA1cddebef14e2c95710b1d2582ae60fd05402c748f
SHA256d46c207c2144d4def29a68215cd809c791d945e241d8bab87749fcc588f30d16
SHA5123e9fd2ab287dfcf9fe91d88875b3a6a058790eebc8c56aec21f980a80fa8918a93e1174cdd05466b713f19729d0b1e36adf12bcbd05ab24437fb8e215e6e47a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593139ef782b11a25acf6e90fd9c54415
SHA12fdbd3404aff22ee9b22fdc4ba75ce29e9197ee2
SHA256230e0635f7f464f3b35c3ba716dc2987267bdbee9755d018f7d96c97d0d20939
SHA51288c6890ea67cd34d51aa803c8164d3d38cffc87c14d700213efa07a6d47d92f46f3432d8e0ee58d5702f4be5bde66fc09d257c03545b65e41c6d0af9458b9bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1dbf66df5e76b4e98f0da06f33a16e8
SHA1d3b003620f3d34160da0678debc93e58846325d3
SHA2569de0f71d1b4b07e03081d013eea3ddf6860875d15b3e8d6dccf6c73e853031ac
SHA512da013b5471e9a1e752991f9da73a59dfa500d450ca819b18af30a1ae0e79373c8f235095f3e4b2ec96edbe3b1c029917132673d9b1dc12b7bfc595961becbc07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b1811e6770350e132e9663e5935f83a
SHA101218833691b576c8a9ed85e4b8aa8d5a3a432d2
SHA256a4052c2f38ff43d02d961e4f991d54293d03dffd1a3ed884ca046707e39fc27c
SHA512ef39b652a2dbeb812359a84d32ef55a016e67b6577b18c903ccaca7b94ad3b143cdba6cb8faa3426aa5b91827a7cc3c199e7d08781bb8286f72908f247fb0123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de4da2bcda2255e6ad4ab05d7ffcd6e2
SHA1fff3aa977e180d21d6a8ca315f6ecf2ddfd7e811
SHA2564131f4ecfe229c3c87174e1816ff3d7a1ff19947ea368f4a82e9120e9c1b6883
SHA5123e1f07a21a7be47f6fe4e67dd063a08c450cde61ac3e6738e908109dfd7e40227071447d9cdf69e2bea52987c8f91677f16c4fee15d65b2716545ca97caca665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f348a5ebd7e8fa2b3c433ed8587652fb
SHA183a3352bf90e79435ce706eb0200d95c24b88bd6
SHA2562399e55418962f3fc1908d52846e2422baaa530b454110f6b429cd0162f54544
SHA512b681be7f2d83c3ecbc28580582bf3d4823c5d0835e50e10cc3deb8771160febce99b992ee108a413da6f48c6f5f5c236b0247924fae5bf03e894aff175d21f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5645ae29d24082233cf7d8fa92ae930c7
SHA18565f84f652486fe896760983caea9a43700eab4
SHA256e4d3aa6cddee841930fc7183fbe3d7e2a8918eecff85f10993e64c8baeb6dbe9
SHA512b0466060b970be8965e40554e8fdb9605e291b4cb8a199efbe1cdca679cd33cab5cef99d214637267148b5d451ae60b0055072f1784854e7328318b6aba97d00
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a