Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 20:13
Static task
static1
Behavioral task
behavioral1
Sample
2688cf688b21d4e9eaa2da266b436f2d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2688cf688b21d4e9eaa2da266b436f2d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2688cf688b21d4e9eaa2da266b436f2d_JaffaCakes118.html
-
Size
4KB
-
MD5
2688cf688b21d4e9eaa2da266b436f2d
-
SHA1
2b5f46ff128e60abb863ba0bfd5f5226cb77a5e2
-
SHA256
5dc43835825cbb4d004e743d6dd02bd8418d0600283c8951da32c840304bdc0f
-
SHA512
8bda56501da3f4b4073792d0ea300b028982617cca2724105ee0ad02d363238960bdddc997e945010ce17cb3de392d25348e95300734662076c8922a2956686c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8opejv4zK:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421361060" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501dbb3984a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{654235D1-0D77-11EF-8ECF-42D431E39B11} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008eaff0cf3a4623fafdf5a0fbe7a6f540aacd69081ddddc02f0d08251418b3b59000000000e80000000020000200000009f2fcf4fae5cc529607ce69500bf108edfdbf402c1d12bbb11730a34779f5c36200000003eacc867385d421f618a865c229dae26451dfc6b195e68e926d55286904241f240000000dec2a183b803e8f2b0b625d833869f56531a423709e316e54b86fb1f86d3307ad196a00dd863cd96126d44b96783622092325ff6900fb980989f87df6a4d8e94 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000006f845d6489080759204c46a64b649b68d8cb94cf0f6c079b126f353828bfb0e4000000000e800000000200002000000070940c61c57ce0127ce0e258c398fc2033bde18f09e7a68feaee3ba34224a7f090000000fcb4902557c6f8df9702ab2d33715284be2d0d7fe8d1df0fa0ec11db15fe7f8579a41a76fe9a89633767d4900f2641d43350a341ddf8536045b93e73b9fc3d033cde20f51790515d5f549dee190050ec8b89b9a2e7462e4b2271b67a138e1fbdea5306c5b9917210fab7bd9a9402aaca02cc665923f59e395f11f883b14357ff306fd920e49ce710d889b93423a0829f40000000aecd8d32e88a37de9e87262386dfb6ce400bb32e79394e33f2763bed9b7b3ccb79a7648bf37922c37d6e9b117825895230be246008272db44e57d4d76b65fe8c iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2936 1664 iexplore.exe 28 PID 1664 wrote to memory of 2936 1664 iexplore.exe 28 PID 1664 wrote to memory of 2936 1664 iexplore.exe 28 PID 1664 wrote to memory of 2936 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2688cf688b21d4e9eaa2da266b436f2d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529a691278f70ba38a477a21d1374540b
SHA133c8ac68b329e18ae4d5984b8b9b3d5d0fa67cb3
SHA25662e191fae5dd0fa2b08aa3aa9eb59cf3b47a06b804ced374c61488167d794472
SHA512403c28ac1edca512bce2f6ce292c6b9087603ed7291296cb062c2d6098d4fe3a6784a93f326589a03a41b7fd8700403049c21219a97f79a9c4aa93c475af2246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b961152627c7271a53319d990e16815
SHA10dd10bd9a7b510f0fe5462bdc6a13eed6d8703ed
SHA25612fc29982f7d6f4eadf35d5aeccc9fad23c38adbedadcb8be1fe9abe416d2e3b
SHA5123a0098fd22fff043dca7b2161ea9781c594b75480d985207807b8fcfc064f94c85c8dcf93589ebcbe11d56256c6f355630be871812acf848760383e7764868e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce3d653066e299d311fa55af06ab7523
SHA13cbe18e63ea623ac80087cb39a109bed81c578b3
SHA256dee81148d8b465858f459b8bb036cbe186cf2acf3ff16763f1a1d980dd510deb
SHA512e86ea8bde12ce6d4da23541e8957ecd497385ca95c0605bfbc653421b0491de5573262a35e99ac2968e38d3d099297c9e8ace80d0600c3ec8ccb31e05d65867a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5319682e1ff769bc397545aabc49f61c5
SHA12d2f1ae54d83b8bed617cf2ef56d909962943f31
SHA256310266eb70146e67606005af7f7c81c56e96a46b07c41f73c5d5608a9a068c5c
SHA5123d475ad51efbfdf6233941b2db58eaae9bfe593641c9d945ee9a590a46191dbacc928fbba819ecc05acfc7aca795207995c491cbd230bd394a4bd44adbe17ea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5613ec757032b24d787eecbcfdbaf803b
SHA1ffa3b6b477b032df187eab023c8872d113e41a81
SHA256597babcd77e34420c51201d455fdbed899c3a742c788efac36bb278e88a27600
SHA51285bdd73eeab110328b02d4bac3393d3f8ddc6c2cf0ed9719be2dbd03c6150ea562d924e0a9f3162a697b5cdf37922a6603060dcc9ca48038211d4b9ef8f611ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fe39ee49772756266c1e465104c0ed2
SHA182840b7c4c19d943283c27ec4cf4913fb5ffd446
SHA256185c67ad55d9689d750530111586000e8c7a37d92e6993c749a0e1942f36c856
SHA512743bd25400211d150907c6d77a3a1f3a953485a78c9dd85b3cc5a98bf644b401de7f2b6002ee8fe83ed1596e774747e1fe1319285eb4c743e51fc00b81790ed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a085b4b0112796a41a2744b17e8d2f7
SHA100dbcf8b0df43387a7f27b416af8eedd6d48c4ee
SHA256e920e259da2a487aa0428f66ebccd0206ad9f052a9d932ca774fbb97c4cb9755
SHA512a69f04ced55ab5ee278a91206a2ebceffab5ebc5f8908702d068d38b764390b470eb4bf75abd45bd2c5136b83e433e3f60f46d67732d32391965ab5bd3e392ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed0e37f26b4e558a32ab032d713c95a8
SHA1c4a89f219d8342bf9df2a49e3424c37e7289ca48
SHA2562276556c91e3cc61792ddc961997cf4827bd019819dec8fe9aba4c5e27c372d3
SHA5126f1035e713363abd6f5bbdcd136fa8c28d67facba7cbcf39861f90d9925423a9917eb947db1fcdf2de5acfa1151295108d1f4fcb6a94f3e084e1329521d260f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c82f57c210ae89a41d0f9c7a7a0eff1
SHA14d31ba924f2e16f4d6ebfbe2667cad2e579f4b95
SHA2568caed594b3ef47368f0e45cbcc67c5234bfd921c5c63104bd506473e89d75de2
SHA512d0060036059d424155f6327e54ed8a51fc3b3e59d0b5a8b09cb2d6d6511fd5638c43dfa771621d00aa53abb145f8d341139b60fe75168b902306766a87b15758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5327558acc7aa0d28c32ebabe1ffcd88f
SHA1a7dffce3b0af92e2afcb89afc7cfd0658e8264ef
SHA25603f64d5e66ed1b1ea147f6d62f05ca44ac868646b858ec39b232e2042db73138
SHA51254924ac44b13dc90386cb4cc12ed8c5a9cd69ded08776171bb6f0aa7f761bbeb6cfa95488e2953a7a302251e1df6a0f0a166166c7b35db012341a9c83f44239f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536dfab433a3bdab3967288cb2576b169
SHA179f019ecfc44062ff4abe1ddc69e2146e9aacb84
SHA25645b0e1941b0c6b6ec395de26ba6b41860a49e09dc11927277a944fac0c702ff3
SHA512a866b2357afe2c9e7f0da9de968abb4bcb45f98909829d56ec25ec3631482733591da93c9a467b4dca8dae37d2732cb6785f4d24492cf832b3c12c5547178d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feb4d95d9a2c7ced8cb8d45226c74b64
SHA10d0edae710e4aeeccb1933e996ac633306f54975
SHA25600016dd6b42caa48901b87a2a60ef5935572c46c67468c203f60ccfdb71cafb1
SHA512827b8942afb2a50b2505c37e0e6dd447b0366f548210e22908086c92d04d06aa7b1a5bcca9979914b4bb52ce37bb27064b5e46791084b0e7b0aabcdaf9f43f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cf9abf948c7ab6b7556e1b1fcbc4b20
SHA1f04869917b5e1aa8558dc1ba2be81e0e7fd75392
SHA256daa08c0e5867cbec51b18701c975363fac3932b445a86923974a83f337d2275e
SHA512539210615aa837ad432bcc6c763282ba62b8a613d57de5da4c5757271979f2621069867c7e923d970bd5ebacba839b4360a5e15720d93aaea73d44bda132855d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c4ad486d8959189142f02f20c99535a
SHA1ab90d54419f76136fad72288801aa8486d5ebd56
SHA256aff842879d4165ed7608a169cd10c34a8963a0911d549b520ac1b6f7e5800b90
SHA5120cd0be7dfc19f6ce4a1dca53bf561c862b431a03f101969f4b1a1fdef561adc059f4ba4fb7f7ab549b70caf57adeab508bf098c5b4b5f394b0a9b1a2e9f35f0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c04ebfd08c1a5ededb8130cfd436c583
SHA10a8cbc78888bf091cf51dee400454159586a87d8
SHA256acba38e3c8772be48735839b68ec63211fe82fe46e583b1cb6c55056e47c417f
SHA51206134dd3ead500093223b6b31f8e9f6c6eb745de33fa0b475db4f8138421ef49119c03467fcb73f551bbe5177d491c49e4f8cc04a1186af9dd6387fe123360df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cecdcc565116ad03d31aa4186ddbac7c
SHA1e6d4ac68e5c1c50d677ad27cf323e6c22da676c1
SHA25604eb219255c5a74c6a830807cea65d0978f718631aa249249e2c61a56092f8d8
SHA51295193baddb185859a1f174f13ef04b1f5e5e4455fc91d0fd1b09b46097ed8b48c5f99ee493aa5ad31696f6bc38e9cf5bc018008247d079ccb62b681e248e7193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad1fbf6dc58897c4b80e306e4429300a
SHA1f997c5e5366d88f240bf44bb9faa1fd46b4ffed1
SHA256624759d32f45287e393d6765d5ff9e8437034b41a56e3e1734a0a8a8def8b0a5
SHA512ec4572537a4627be49c6210721a9c3f6c202ea02ab1e359348556cd78e77f74e435012218aed4ad2d44331ee683825541a8aecd368b09ea4048edc9afd5c0480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502300b71df4ceacafbd4f2224a4e43b4
SHA1b59fb025a018defa66ff2f40b5a843ab62647e7f
SHA256cf2e9a8455a616bc8a386eb1b35865900ff8270896a05c1f09c37ec05c78e831
SHA5120fa41236f9c4567c9f62fba89530aa141ae0fc576b573e38bc37be3d871713c83a0312bdbbd4c4f878d7029e4961628e404ee77930e45fa08b5d9f548da4ed85
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a