Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 04:35
Static task
static1
Behavioral task
behavioral1
Sample
0faea1e8e6007adcda33b12cfbbe3dd9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0faea1e8e6007adcda33b12cfbbe3dd9_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0faea1e8e6007adcda33b12cfbbe3dd9_JaffaCakes118.html
-
Size
145KB
-
MD5
0faea1e8e6007adcda33b12cfbbe3dd9
-
SHA1
bf331be8fafe55b28de50c8c7f635d45b7a00bfe
-
SHA256
73ad4211a4623d69a19c7932f60fcfe522cc9399470279c35215c6d87161ff90
-
SHA512
55860ff3aaef52871211a1012f6b548f6596ec4225d12d757b591b258c722aaec289e386bfb55db1bf5a93d55aff4a8c2504f8f49143e520cca4bb883f75eafb
-
SSDEEP
3072:GwuJGvWDUO3e+/HkBxRAT3qZ7Wqq8bdh+fcdAdpFpqrBSQlks0k1yocHcxYdDyuE:PWqq8bdh+fcdAdpFpqrBzlks0k1yoc8T
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A328A391-0906-11EF-873B-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420872826" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2340 3048 iexplore.exe 28 PID 3048 wrote to memory of 2340 3048 iexplore.exe 28 PID 3048 wrote to memory of 2340 3048 iexplore.exe 28 PID 3048 wrote to memory of 2340 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0faea1e8e6007adcda33b12cfbbe3dd9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5fb03526b897d572b399f3cba89305c9d
SHA18af3cc1409538d35897494cebe129fbd25de3bdb
SHA256129164308e702fdc66b08a3e37443c3538cb38d3f8a9ec9f2fc242809eb2f745
SHA512a91a001a7d0ef541fb2ee9e95a441a651a5555a9b2575872aaa5fe376fb80c60fbc67183a34d24291d1b255d6a216455e93c05b1533a2c235bea40d947e96c09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5C77EC0FCAF0A83EAAF0F4351F61FA27
Filesize472B
MD576795a156a035cbf5ac94eff31227104
SHA1eb999c15eab99be7012a6c12c47efa0f9b3a26b5
SHA256628ae9863e217cb826a79614df45a532704c3c708bddf7c7d8e3c2b05f4f8606
SHA512fb36f0ac240aa763f5ec1f89b1a4d695732d2d215eb81df2206fb4d6d5793c6c047bd5eb3f6c7d30b230734f6a8a83ab11d57efca73888511030700890822b3f
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
503B
MD5865507ccbe3dc72b486c0d876329ca2f
SHA17144d4a4555d59c5ab2a1ead3de8d17805295aed
SHA2565904902a502ca24c4a2ef7cd11a58a4ba742b5a59f8ab3d55f0662dcff56770d
SHA512b50584e5413e52bedd29fe74342d6676a46bfdb6212620f4eb337859c1a9d1478937f95b81c32947e50dbc08fd5b4178432087065e5361fea83057e0ee8fff83
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5abef251dbd0c498c244135cf18e2d42e
SHA1a6112664fa15280fdc4d169aa125575313844e13
SHA256c51a66ed6496a8ecdcea5557e87f8577518aeb5db5174928fe85f2212800c99c
SHA512f6bf1a60860c56dfd74f9fd32db719c9e3bdeec0bdf977243b665c5d8b3a5dbfa0981ae8ca388c13a2b7faaf91dd2c3e4d550aa128072434568aaf115db63666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5C77EC0FCAF0A83EAAF0F4351F61FA27
Filesize402B
MD5be1d2fa7ae96be047f46e7d02c449136
SHA18780d65f069cf807201bdbb471c32e62ecd94688
SHA2560c670af59e8949f39525e1ce47ea6e5857190f390556b46424f3db24a03e7d3b
SHA512c7b0aa7e943d6c35fefec2c47b44178ce32600327453db5ca86aa2331db9229f38007cdb941cdff5eded79d2be20e4d210f773c207772525cbe7357bbd3983d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD55a57e66b6a9335b8e316ac8da45ac5b9
SHA195e8e14393fdfa6bb04afd8ee9d921582efa0ffb
SHA2566fc21b221fece4cd61e3772c081c8a35a314240c54409abf38abbaff38f6d8f3
SHA512b0e8c362e3c60afdeda7d8a8304485eb081f8879873f885920ae61d3f1f97a6598bdc5e36d7e04e3eff60c5cfd1cfa671a36ec23f5ca02a9024ba710a88a5612
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c77ad22c14fe788d9b53cbdac10a913
SHA10b8b5be6f8d330958afde60fac0d1d2c9991828d
SHA256517967c6035c67f651f7ef30e4f47f2b74fc0b3ba314e4df647054c9471501e7
SHA512f44b96a1e51b9b63999635b43cf030fcbf1ee7a91c2be1ffee71b5e63b0b65fe1b7c891e2e0d242e036dea157bcabc17be5643b10ab1c750b6612f554b024e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af2094a0f1c6777e3549473d1bbccd7
SHA1e936e734fddb2a1434f8fd3023ae59a393d81108
SHA256899b8b76de075d60a20e3863684af4fdc6c178964ba259cf9eec3138c2ff35e5
SHA5122e832c359c1a06dbca885abfa135d03bbdd7054fd818914ce3da3ad83ca7d46a99b3b621e707472ef97b4d285f0b1beb5ed09fbe6bfe7eb68df85e70f4fa5359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55432177d0d80e95824572abcf4795c85
SHA1317f38b8dd19f8c941f58210ae8f0496a5f7f967
SHA2566a3cbd35c70eb02362db8e186246acfbfd0ebb8dbd0ae40d0f413a57ba9956a6
SHA512d07fd3db45d3415d87a86f8f742770e6beaea743ca5ee96979d59dcf5accb361a07d730cb87c30b3f15c1304335a882d96cb40297cb10c1036d447a3eb4952c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848b830acf57da9fa97e48abbc6679fb
SHA15f761092c4c48fc5ec0ef0a3fa70548d9ad0f6d2
SHA256c2d6f3b8f37f1e251c31056a8d059b8970e0ac0f9dd8ec872bc7a7b0873b0ba5
SHA5126ec422c5e561dfbfa14e3fe2ab5cdef35abe350678d6b6fd768e5dea4bc42263324d6d9dbada0ff6475f5c9dbf915bd625f73a262b330c5ed75cf81f45a8abba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e54db80edf77383d024ee2b5ee770635
SHA1c95e1f05e289767f0916ab85b1616438b9c5e235
SHA256aae13c653a18cb5b5136bb91ec8388a610aef0733b80c510161589367aad948f
SHA512a5ba39f35b86af3e929e7c926902018662331ba33bfb788bc514994447e6ef7e8fe785a922fe11a40c0435f5e9d91525e89797cc4d75ba5f3ad3aab911a9cc27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568308c2d8c40d32638dfa222e8c271da
SHA16a2343eb1b6f495a654a6ffc65f3c7c8976bc3eb
SHA256b10d93dba5d9ca20a088c449d850d7c044719801b91c1007a936d731c8fb3c0b
SHA5122509ab36a44fa0349e769478089eb7e86ae4161089e2317d4e123a9e0afe8c5caabdd206e401fab38dfaa2545bf8996cbabd59faa2aadab043059540196b731c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c92a3f6578ecc8420f5643d8f7d85b3d
SHA16fe7df59d2ca5e1d3e5dcb765c16c524ad124aa8
SHA256878916e8422481ca1dd41290aa6a4dfd00a272349b76ba3929fd09be25c5cf45
SHA512858e2968c133a8d95cddbb20fe7749d2cb734effeb4b131b112839c411f6f68a29f86e56940fb3bb400134f685e1385135db26e4e16ec0cec2a4a324d2b6c009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aa95e560e79c57ed30b279603a29990
SHA1d4ddda9996e6ffb674e17476dce81c274a994727
SHA256459c288eed3b4f2d43988321eb445044ad96fed41fdce4e887bee1c6d856e61e
SHA512fd59a869beef9db73779bd7b9abfc907cb07bfda23f48705cd2aa6ac2c21273a88a1d5198cca899b0c01748c71145957f5c0726f0fff910980cc7a329aa0f6cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57267108145e714da6d3bbbb067b0b6e0
SHA1d69e7df62ef8535e75b936a223e275faaa699722
SHA25642b8ab3b5e54176b76cfbf28d556f76c64cdb448f90f36c586d70cbf973bd77e
SHA5123ea0a6aa94355791a077883bf924aab7db48c3f2645b70a4dac568c355a678dd189e71ceee96819d95ad6fc269da3f61b676cf8a6c491341f4555a82a9caac9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522a8ad8c2d44be77591b44b96e5b5a63
SHA1eb13781dadb399f7e69a28ed824bf97a321ae3f4
SHA256a604563d8282572dfa975eb5437fd588aa9f1aec9e0020d65d48c63e77156b64
SHA51278401de4d3a83c6fe443b9a01f7daf245657e02bef25c2e2a270d97ecdbf9909e1f97e4f6e69cdd16dd58e8cd104fb8e1b71dc57da39d767972d292b570e95ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD54591c1164067dfd0caefc5b20bf8795f
SHA1fecc69717a31b0c5aee69f34f507f8947737b15b
SHA25601d3d99e1e1cd0bac7979def58abeb670a2d73a62a180b87afe3b81510c893ee
SHA512e84fd5b0b083a45a1a577d590df2d5ec2bbdedbc2b1c2027aa07a6ccfa052179d278bacec8d6d4fe7d0d461e1d0fa0df1a49c1623bae2a6dcb488cd47c60d3f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ae72ecb802e8ac5ec427f1c061abcb61
SHA1ef230d79c4e15287b0d7390ee570f31bc99ca6c1
SHA256585af370c7eb20dad743358289df80bd592b4e69ef36d614f879e9f6dbf13887
SHA512a74be4ce3e176427887be0c6575664cef07496ec736664f70cb2dfebfa650175781d18777a5407f87eca23f2c96a45c260c5a6ebbb6b9297de9f68396a93c7ba
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a