Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
2920168276ba303ac74e2aaaa0c0610b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2920168276ba303ac74e2aaaa0c0610b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2920168276ba303ac74e2aaaa0c0610b_JaffaCakes118.html
-
Size
4KB
-
MD5
2920168276ba303ac74e2aaaa0c0610b
-
SHA1
4c0ed7971560452c8f293da20ce1a231bf288221
-
SHA256
5f27a192ca7095a4b6739da13f9fabfa77c66184be0beaaae17c67d076ec7f10
-
SHA512
77ffb08a1d2f1f87a78a698a9d16cf2576e35df090327878369bdff4e047eaef7da8c6d86117bff49d833f71c186c67deb1ff81baa1270efd49e637340585754
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oGGBd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDo
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30858367eba1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421405374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{931461B1-0DDE-11EF-9001-CA5596DD87F4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ac934fda16ac6a3eccbc14aeff1e92b779a8ae5fc20c83d9472c55f55e8ad15a000000000e8000000002000020000000581ad5154455b16bc38ae9ede65bfd8f0243777f2f7ae8f037888a79471193a12000000073d673f9daa07b4594dacbc49f7b1f8881a1a9e492e40d65459e8cf34f32c7a2400000006ba68536113ea5627864c66fe81fdaa1d30e46dc0fec003f1edbb5aa2edc90fc11145afaa613fbeef8b404e98f3785c285b03b78ea449ae4a42abb14da9148e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d422ac1cfdfc96387237284d787fac8fb1224e3dae240bf3659b51ef6a86f523000000000e80000000020000200000009a93b713d94c4f7ee2fed99f772edb0fe4be8a9746b93feca3b5da587d7ffd2a90000000a2b16446ed949df17c3a8a9de412af513f23c1ce6d246ca3dc80068c5d8f67cbaf53602b4dd26919bca1d0e48ecd53bced6f6ffd1768ed3e14f817059a551b6376350436e353e455510a55902146854109dec664cf872769c009630cf3e24e43b1075c8a72aeb500a2045e3cc77ece518753db82730f0ee252eada3c962dc996ed404af12e8d496c61f837b00d3b8e18400000009a20c2254c3774ddc2ce953591fcc40870ddedcfbd0f0336ea95d82c222945e6f834733c6d63d180a684f12593a8507bcd93b9d09af0edde6e0fc6d28cead6be iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2320 iexplore.exe 2320 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2532 2320 iexplore.exe 28 PID 2320 wrote to memory of 2532 2320 iexplore.exe 28 PID 2320 wrote to memory of 2532 2320 iexplore.exe 28 PID 2320 wrote to memory of 2532 2320 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2920168276ba303ac74e2aaaa0c0610b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5669bfc9607c36b2c12f6904b51910bfd
SHA159f1dc7476d57bea6f84316acf14149fdb6e8da8
SHA25608494a37f674ff983f27e74d5a9502c02bd8a5a37276bfe52cce350a171e6061
SHA51219bf0ff4280153973523b02d74c91412647b7dd1d48c09745200e9daa46da20e4fa3950615c84bc7f77df04df947c2af2ca9c6e93f3b6897d880744fb8cf42f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bcbe0b0d1c5fb57ed2411a5b6e21ca8
SHA186be792fc975eddb36f665b519ebb7db32df6e62
SHA25606efc8b4496a705f196540e325afee207614cf9a918c37a756af03322ce4fe6b
SHA512657e3a517a85379ab6cd704fee157be58cd9d46549ff3d5eb08c7534b2ae1937265b0ac5f0b9fd92c64159b688d461e5bd462f096a5add082087b382cfc8a36e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aad5553a33725e941fd39b39a7960b42
SHA15c6398352c2a73a43cdafdfbd4bc5412a81ee689
SHA2565612af2fd2b1d811776cb3c6e04697e38d750ea38b5735f45efbd176a187ff17
SHA5122b78e0802a5fae0f4ede59e85a171b888e20d073ac5b04ff0e5df1bb4d30c8f16210e5738aadb6b1c1065b658e5cba4617b3d31db145bdc276009b21f940b0ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5592bd9b2abb719be91b86469d08b77b5
SHA135c4988af3f63768dd11aa4d3790e9d1435e5dc9
SHA25662806e4c64c2eff6604be56eb721c5e804f5a6d9134c00a661a74d6dff4207d5
SHA5125c5a5df8bd959367fac8bdcc24bc8d6971ce430108d424010d2411fd6ae5704c3db0c2b7db82790b10e38232bb7aa9d03a58d38fdf0c8864312c91374af2f833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bb949ac5d5f7a830775946180f5491c
SHA1fab1ebd634f7659383ad26bd87455efcb6f81745
SHA2568f5450110ce17f8a2b0e1aff73c0ac07a4c269bba36150cfcf07371820afd566
SHA512a706d1d620c59e34efd6d1e48684d380b48395b8e9804266f0ffcfb197ad4a136d0b755f2d0d366ec2f49c5327b4246fe703dc0ecc50499fbbad4627244c280b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54394ffc9a10e503ca7de4425744c08fa
SHA198fa9b7dd233faa17dd4c0786247aeb98893016c
SHA256cd156b153188f60e40413f9cd2704f69f07599f7804dbffb981704b16d4de4df
SHA512ec106781506269f26fcc1b3aec32aaaf9f9a4ee33c370ce5797eec863c54a19de966837bff2990ed123882cabff869f7d1c289130b0a2722a0b6c20bee6782ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5995d221cacec6084a0118fb62a8dc3
SHA1b2150b14436c0902e5e17213fc6d64c04c8a92f4
SHA256e4e75b16f9113a0c0a0afea69b1c410e0626d2c790a610b0bda0558abe2ad83d
SHA512362c300b5f0caad90d735ed926171dc3ce99015cf32f0a6df790e06ffd7e707e087c98c7fc62020a118144bafb3b25ab24fc2e8359b92a77eff7c42373d37314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dd473f9fcc680b0e6d08da3b629628f
SHA1bc99dacb468b9d746583f6661b77735d692c2f6f
SHA2561126bd71a672a6a3430eea33eea933585f7dcc1c13615550f17a64ae61608dba
SHA512106ca8343481ea4d841df58c0741feb265f62577ce5c9221fd6401504fa58ffd2bf67768e373936af8356b8c8ba5297b1c68f1a479b02028fbd1012f119182d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572569b4bc9b4d43ed9ff280067733071
SHA186ad638bcd16e9a45da0d6a09ea573f5fe82af86
SHA2567b7b78121839d642d7ded87ea8f2454396124bdb915b70a0657c9d4a5fd17e78
SHA5122b2708e4937c073667b5c93b5572c0cc9d2b99f3c320d0fcca182c004f2161c56ec2d683fe395b7115d34f9e8b52a8ff77e47e768ab84754246af099fb016147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddf78ac38c25d8e847e668eb129daabe
SHA1d6870326bbee4ba60039a2c69b29b26db2fdb1b3
SHA2569d1d7b1b9de8ac62859480d4fcf0044d800cc99a82bbed77d1244858ac733ac2
SHA5123a8c283b4b0778871fd373a8176949578aba2df23b3419f492e86230b83a5e1a8976a42c24b2ab8304919efdcc9d64547961183d0bdae50c6fd90818efeae84f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b4f562081c2efcd0b9d562575bd46a9
SHA170c0655f90e9af1d9dda49eebf73ae43e432d2c6
SHA2564026ac74ee7f478ef3fefb622449bc837180b7cdbd52c3f765fcf94d805ca075
SHA512f566309419e0214728a66781521cfe9f89a16f04a38d02b8ba6c16af09a4f3fe9fd38cd543fd66a3ef1dea000bbb9d642e41b5250305bcbbd5a1bda379dcafc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509a3c0777c17ca6bfe0042306eaf471e
SHA140d69a1471fcbcb3052ceded0ece9bb3041f024a
SHA2566b814c880d18f7f433ec27add18881812ae60f613ef0e826e25f53cdd0da0c09
SHA5126ebe58c432aed444a794ff0d02bf2f9a616611b6dbf9edb13f3e99f03a0030dbf0309143835c76136fc7aef3d70c1ee3b29d2009635c0fc6da42651a89f6d2d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c71197b2ff77920dc3bfadd06645a41
SHA1f624bb58fbeabb01de4be78848917ff67b14fd6f
SHA256e590c2da082c5cf2dd09c6fde42f9ad301ac0fc3934c76bb33b120a00f7d202c
SHA512c72ef86d6cf687325fbcf958e31446bc3b5e11c302a664e90a78c9d651b36449097b264af4702e9253c9b9509087bc35c84fdc9e15a18387ec6595aa3c2c0089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529934e01e50ecf69de963032c837f4dc
SHA10c455c0f1acd325b3e7d50e3e275b0d7bc0c33d1
SHA25626d3415335b0a28c5a4b30f526dded056aa037391c8626d81446be70245d4310
SHA51239808a036389032b1e3c43eb95ea684ec6834ea653e3c4cbf7d7b22d62bd5908f9d27bd1d8aeb318df23acf2b89368f8986c14a19ba0af15cc49206b74462419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5850f57c617330b8b6d5d294d348a339a
SHA1848c069ce8cc08c55bb5ee2e436dc9593606cdb2
SHA256e1ca6bc57cb3bba6224369185055fa6bc2d0085284a3e18c0f8ebaaf8b0724ad
SHA512ca0fc8bfccf20c42ed6eaa54e3e040c1a5012966852086e53b060cd221e267e5fb724d600edd11a46540f1092754015c2785c4bccf008d8ab75d0d4cfc25f188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5961110dbd8a534d39c147f0b86eba958
SHA1a490f3dc01fb67f1f88fbb3801060c855522b91d
SHA256b7fbaa436d419bfb65e605d46268da6e6f098222f0960e21e272bd2207b59e9e
SHA512ff33a6626a2b7c1925bb6d6f70aa8e8eb82f65b07e287f3e3fe9b2b311e325b6e542d5f4a44644c7bf4263fa0b92a3b12da8f28b5bc2f3a48ee78f4cb570b31c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577106da2e35e73323f029f76f179ba9a
SHA1eaef1593ac358324fbb58d5fc9989b9dad694a3b
SHA256ec6b586692175873e4991a01e73eb17f8e06e57efc3b39edea5ccc87c0a63145
SHA51214c11a5493095831f1b8ae2f4b4e6148d5ca69ab821c5bed85ef4a5860d9ebcb093443089159f19168dc8fc7fe916d2970f2d2d809bd61a4eb9b1a359ad5fd27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa9c0c6011f0a1f466e66b4d33221a4f
SHA195fd2c0bb04ca6569fcc0b846cb13ed2469bf6fa
SHA256978a7ae51234f94af77288a0d5286e7db42c3976c3e68fa9f83e5911155e3b83
SHA5123f3cb646caf50f33a91f8401534e4f114fa9a88f2842eadf9a8fb84167588efb48947f666d7741b6d86c0d45ae267f8500fd024516f380ff93105933300646fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a