Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
0ba6d62cf6be7a96cbaa88dfb1177fd6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ba6d62cf6be7a96cbaa88dfb1177fd6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0ba6d62cf6be7a96cbaa88dfb1177fd6_JaffaCakes118.html
-
Size
19KB
-
MD5
0ba6d62cf6be7a96cbaa88dfb1177fd6
-
SHA1
dad568e09b323f8f0ddb7b1fc1e80d2774278aff
-
SHA256
2c13e2e8428e6db30086884477eb3a974ca364d8b51ae2357ce52ee8c797ed79
-
SHA512
517c89dd8d901b83807256c09b6e593ee8a613b7d064ad9ff054316c2fea9c04b1da0641d0d49d31c53a2720a0f5542b3b3b341435e1d59ca7c68c66f31610f1
-
SSDEEP
384:ziivKhgESIVBD8csQ3RptlwG3emLxXucfIk9xhexazVc9YB:zi9SIgcv3X4PmQOIk9ex8qYB
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E73EF681-07AB-11EF-989B-729E5AF85804} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b15cbcb89bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420723907" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004785b94a6088cc64b4b92fdc4e75299cbc8d76c16159023dfa6c70cbbe2a71eb000000000e8000000002000020000000c9dce81fccff805f75c4519b10dfea1b28803b98731fb298bf75b77d3d9acf5e9000000018bb601ef5f69b43f308ba299714fc5e7fad512ade02336183fd1a4b55f750ca7cabb324006ef6db19bcf9abf20e70d573ecf22cf963f9b678435303f1abedd664a3406c1ad9462a4918aeabf7544c240255bb6893b5b11c25141eb9694d3472f1b91e1f09123866e74dff283a838e9cffeb7a0672a6c1b539297c4fb9873b73f3ee1f2d920e82970b0f7b353753a82d4000000089e25a7f6691f91685812f93c1ffabfd8e749b6aa86329a88654e79e848cfe299fb5e8646b4fe40f9ff067527f80be5d6b5d186ba0fb1b91aa05c6db8e71dde2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000097bec7ede4dc2c7010245f6b9338a4fa6817afea939b004f278a7678b73fc80b000000000e8000000002000020000000d4333f17a65f3608736e19eac638a4dc2c8a2a4cdfbda7a46c174f7b2b885cd72000000042e084f7e126c632a6befd8226a6905d2cf714307c84a4c359c26b67747f0e4a400000003858c93772eb3d440cff87fb33ab76b8429aa8e7ad6214330020bdf8f447263920372bbd1f48080d63e0ea0b8f8203ede36680e32502e52dd043b005fdf64d19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2700 1708 iexplore.exe 28 PID 1708 wrote to memory of 2700 1708 iexplore.exe 28 PID 1708 wrote to memory of 2700 1708 iexplore.exe 28 PID 1708 wrote to memory of 2700 1708 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ba6d62cf6be7a96cbaa88dfb1177fd6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5a8bcf43ba14e0dbe5b49c75869d4d9
SHA1be47f784598bfc9df311802ed115256fea45f0cc
SHA256d54916f2069275aa03c4393cf15a3b874531df293f8a7ad765e422ce29cf339a
SHA5122bf6ced221a01497c316f81d6f2ac3421145f9cef01eb97f7353edb773ecbafd7d52f994fd5f2beb9f410bcf3ea8cdea954554b076343a9b7037e38ab70687eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c698deb65c897a22fe0568b96cacd16
SHA1fa3a2e25a3b064dad557067c61741872c8025012
SHA256c545dfc1af29b8f94cfe85a733ef99384b1bb2ceeaced0dd0e12e0477143f4e3
SHA5127bd6d928d83e459958410f72bec02309f0fb94b315c4a1df0a890f1f459fdad598a2439f24999a12c9e48ec0f97761048683383056e81145c7f89e68a27451c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d73d9646d9a61f7cf8ff500f49d7737
SHA16221c9da30cee604360df6c4feb68ed07c5ce3ab
SHA25601c33a5f81ba59bc127a0bb6f7fdf15d39b9f39bb2ab46138a0d0a103e52bde7
SHA5124badc62121b3fa60f640c725948a8b3466d2be5473535ea826febd71ec56716263106417f184b923b556ecc31808517bdb8a4cd06413c9e2a47c48f5a31ce8a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c73989518c64bf736b234f8b50b96d1b
SHA14fab831ea16d566ba4cd3e5465e64d7481685c6f
SHA256ecfbd216b1ab0af52a1ad0a8e86e091068bc168489f5f69bfb849f373ce3a9a5
SHA51243fa7c925a385bd7f5d1aa8b86e122be5ddd12164a802af54c2b5c3ba2940b6696fe747d6af790dd657492c3c89732ab5ace0b4f132249763e48f50c7e23f910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5296fd866e6a3c26f7374d651a3a5fbcc
SHA159df68192b67ea7ff94bcd5efe7eecc7aa65c934
SHA2569aa15a888eeeec7565ec8949cd94a7b17251f60ee7bcc24fab1648bb80abe9dc
SHA512860592092bd79b33ff88c78b55cd0edd77f15c36c5c14c90f27e0c0157a8f0f9d49c53bf48eaa1ff690ed6b52c5671f0e1dc3200311f38faf87c9387bc7fbbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577947b3a6c8f1855d7731203ab64fcd3
SHA16db763f8839b513536954598aaf8f366885047df
SHA256550d5d67e8929b3217b8f3908623c654e2ea693c4d560b916a0382d115a29831
SHA512fa42987317d9c4195dedcac63880d754a5791bed6b2afb9346b979bff0a0224ca8f0f2f9d16f0399dcc6763420f73fc8298bf52420687c452798ab11b148875d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a090fd349d75c278fab379ba641e15bf
SHA1a9f9e871631bf1561dc5e1e68950317dbe751dfc
SHA256710a8b8b577b0ed50dca7ea0a155916ed8536ae445a23945e1188b1e41d73e5b
SHA5127bf49d6cc980f23411b9f10f94a3635d37ab562c13de358f553715d6255b28a6a4f79066d0862a797d8ce527dceddfee78fa8ea13b7f6bcca1000c308bf39fbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac54845f0e03c93177fc6a9a5ba1e9e
SHA129b8d3d64ea08ecb537831181ad9ea757139efd3
SHA2563776e570ca72924805a7a6bb471a8e7ae04e985d842e191743bd33d63f7299b5
SHA512be5fc9a00731bb06a7b2e3eeed6f94ab4382bd6568549d2c1c52b06f40a48a56d6c9d5f15a1bb63875fe0899787af7b0a8d712c0ce682b02305278398fa6715b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e4958ce21487a4d4b31df54c87394db
SHA1b495d9106c1e35797489df2afb3e4474127d50d0
SHA2568186df0da77276bcd17e5a1d0125384867ba12cb818fef60cfd266077a1d63d6
SHA512f17ad00ab2fa9d5372a58c749f3ca89a1295c1c336b4a02a8ac0f8f871c22dfa7d2bbe974ce8497c1d6dba22b8fca433299bf67d5102b52d0f43c9e4e3d0e1ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a282eaf7b8d0c8129d9a6ecb09e87e09
SHA107eaf3126b20a89a4541994fa1ff4e31a144f8c7
SHA256dac6185689098b4722190f28cbef2851faa3b4d97832197dcbd8f2deaa9ea022
SHA5127b09839050b2c495f92e12f9b5c156d7ecd480042ab896ac9828b06a41d8c96016005001374abeceb21dea387c01050a4cdb5e7b29a92081a14b2b9a5a83fbc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dc650047ca9ff8722b8816dcfcca640
SHA159ead1a358539833d5c7ab6fdf7e997b98403cf0
SHA2566ed1f2f1279a052119aa5ea41239d800fb2a4e3d79e491f84218445eb47052bc
SHA5129e4b019e53d50f5d6d0045f8fad031a96ab75a7f38c3569ff27468219be78fe0f5263e38db27dec7c45e78bb84f0ea3ece3fea256775167683bb8494b8751c4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5666bef4d6f544152728e4c90a35ea909
SHA14c22831d967d0bbfb7e0ef7068710f69c4cb1aa5
SHA256d3d40b0d8fde9e8ee04818cace6dc0aa926d8ee7f231cc672f7a09282b771336
SHA5124c760cc8c2918df8a99f84beca12a132af27e35ba5acec7fe9ed47ed558e4ff97fb0ea9364cc2080e93b3a67ef9e675df0619ea5bbbe2ecb11bd78f5666f69aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563a06d635da9ae5758e11ba863848b49
SHA1cd982b24894f88bcdc322b14a08397985ac20794
SHA25629e989edd03c1f2f2d503f4cb8b3f72dd32278ad2b232154feff35e22dcea162
SHA51283babe42714fb892ad3b86663f5aeea629948e9e2a7269f1f9fcce95169586f5e81cd1b09bfda34baf7e56d31f26fc3457e64f34c939212c1cc62938c4afab79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5613908c86ddd36c6c7590d9ecdab50
SHA10358a41f5c88e7c62e5b41f719b37bd92c9e6841
SHA25686feaa86bf5457fb48e6836a07985002aed2f2638358b16e665070a6ec5f8f71
SHA5126368fe128f3138a9c34d13d4ba480e5c40a16a9f44b900f87c8e2951cc6c06bc9e7ca59ddeecfaf4ffb0613dfeceeeacf99c0095e366935ae370911e0303aa40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5063f7f05e27a18b747fef091d68c4c48
SHA1fc5723ba7724de7a0a114924e2b75be15d6ab8a3
SHA256c1f52052d28f7c78d636792f2b150453ba4ef792a500f947e1244f066feceef2
SHA512c784a11eaed5108c8d1d29ddc941416508d3708882c2654809d8d9872a45e6b7f73d4ec44421fcfa1d3a0669cebc8aaeb7b892a4b65527be1e97c268fcfbdc46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6ccb04041f30f96a3e787285a75999b
SHA12880ccd717afb2057433a62e951ec0aba8ff3e8f
SHA2567bcae0ca8b620b41d5c606139a5bab66ac5990833595e802017346846795391b
SHA512ab8b24b4c90b9589da650d76f9365492d7ddacf1b5d0da5e50c5cc8c47e648ab0fdeef760c16e0c8927be2a8d5bdeb85aed2600b87d5a4b5e81b77b3885a56c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528ff3b796df26f4134f4ba497ad96907
SHA13111ae202df7fdf1955bd71b216b0d466e36ba2a
SHA2569e2f69327a38ce231611f04895169e7f62c88f45f0bacb1b39487a2c38d8bdae
SHA512079b10c0f30ba3755c80c26bc5e43a584e53e766d1845666cf0a4a759cbd83e4f30735edb5f7c42230d4233032efe6a05d72e4640c6b6822d97bcb81ea5ab798
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a