Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
2b5d2c0c68ec9e45ced51c30fcab41d2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b5d2c0c68ec9e45ced51c30fcab41d2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2b5d2c0c68ec9e45ced51c30fcab41d2_JaffaCakes118.html
-
Size
460KB
-
MD5
2b5d2c0c68ec9e45ced51c30fcab41d2
-
SHA1
053d434588c656dfc72c9903c03b23fab02e0f4b
-
SHA256
9543b9cd1bfad724aea81b1098cf79482dc0071aeb8ae52091f814e2db972262
-
SHA512
3c07666847a1610a1cb5471783d5c671e9a2508b5efca7c6c68cf34214f860527b48f125caadac6897263c059265559e9ed211a6b158c31d6d854f045ea23065
-
SSDEEP
6144:S8sMYod+X3oI+YPsMYod+X3oI+YgsMYod+X3oI+YLsMYod+X3oI+YQ:L5d+X3d5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b9f2f640a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421442115" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E6ABA71-0E34-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e88c61408b10bbf1399eb13a3b449de21c875cb9dd0ede9ea44da01c7c6257c5000000000e800000000200002000000057cec2859c3ac8a1c03c1bd60c2d7889da51760eb71a1149f658244c5bc2b0d72000000040566167fb341bcf213549cbd320a84785c8e68c862e73e1843ffd24f483d9324000000031f1f8ffe585b1e307c68d22d2fe8b6558fbb77ffc97b5e7acb37a1abc530c900b3a386d128198da57827b1be3f037c12b16db9d671fddc43be9d7cbbe5d56e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000578258acbcb7bbf270703f94b7790001748f2eaa721809607e8fd3e6e7c2a7dd000000000e8000000002000020000000516aadcc10b1f255aabfdc53f136d672c926e0661a8271e639f8124af0f1b6239000000001a77876f3d38ea57842fe0bf7a9ff28e702e6ea66a6d102252732122efc95b280dbeb27d8d72a1b8ce412b820f04a89701732dafa8fb7bf4e83ffb5baed617d1505ed33fbbd4c784c18f9508c804b8fa220ace57a788705b64bb750026c080b1c635ee4af4e1a4cac31cf635690b34e170287359ffcc883e99fe6a6e45ba7c615a1976c0175db8edf5ac1c9d8104dce40000000bdd730db8a21b0fef0da1b4b304f0e5534a03a222185918559b1aec3eaa04c4d30efe1fe9327913dc5bb3edf6f32cb1b2e3271fa143901ee09145e3866ffab77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2516 1932 iexplore.exe 28 PID 1932 wrote to memory of 2516 1932 iexplore.exe 28 PID 1932 wrote to memory of 2516 1932 iexplore.exe 28 PID 1932 wrote to memory of 2516 1932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b5d2c0c68ec9e45ced51c30fcab41d2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53584abbea14f9deefebe6569c47ebf6d
SHA12182402b887fb7a51c01fcc8426fab1d3b269125
SHA256e37dd310bcaf1a1dd83b490a5e213b0b13538ab784e8dab344b275591ebaa692
SHA5122b8012394f803b21553aef4641977ecd7a608e8eb1a6b5bbe133971840e966db638e46987dbf40e9381572be91457b0af9f9d443c49e43cbeaf8f6b32a39817d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567c318247073c59427f4e4867a794518
SHA163f48fbc4938d135e443547b8486c8ed03326699
SHA25670ecebb6955d500a80c7c771883489f4ebb612f8203969146054344ce7dfb5cb
SHA512b6a9895e04a59dfcd403a747880f6db14acbc79d6ef37ffe84b7239127becd0640fcc6a731ce04b7164c3d5dd89b1e8221a42490ef9708d09bab5b906192db7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cac3995875cb33be2ffc1c7e209ea12
SHA19088487ab0b237fc54b617e7ad53f6d13ba7ea0e
SHA25699b68784b50e74f535290dfaf116cc4b40bdcac343a8af988cbe7ef14cf59260
SHA5120f2bee2336f346d821cc1fff503f160defade43746891282eb1f362e588baf5d712e59874ea40b7707739bb1e67130c6231aa54754a86f03da4b92a46a9647c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58200ade7aa07eeb7d894af2d74067e6b
SHA192fb2fa768977a9dadc83540ba43526755776578
SHA256fc19c6e3fc584ac20b19d0442772dd24833f1dafae0b2d21aeca342031ba1914
SHA512977b9d9b8757296ff6fc02f84be46ed225c769e02d7e723083f88396056979e4a2a6d548efbeabe5d87edfba111f460c3e3f4593ee679b5b931dec8de05f6370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511578d691fddb2fc3acc3f0af8dca9ba
SHA1e0a5cc501d7e0af438bdb7db84e1b28ce434f596
SHA2561ff711d668f2178a8a97c0170985a8d47bbef1e5a5c6696544f6d565736bf4f9
SHA51226a40a875778d79dd3da2908042eade716a7e8058ba3807d3946c3924ed75c491d3d86f647a4d2137122fea80e196ba81ea2b4eafdf21ecc4080d2be13d52e2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d041f474622896f84ac8b537b1b9dd47
SHA178073c67048369f197d9430fec6d2bc9ee12f904
SHA2561b5ea6f436126e53316cddc53924da7df2e741265a2fa40578e289d7694fd0d5
SHA5124382f0ff3f85c4ccbc61039d2146095a64bd976357699c6b036524a79219295f49489fd5d6e45b2713c13ec42eead496933b5c21c83624d2283f0a7e0e7ab26a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582c0b69912b3a931e56bcddddcf0db1b
SHA124d47660c6de85494cae1679c88df787891190c9
SHA2566a6445035c6052ab3f7391d93d77756566de32a707c04a1e41ac5d2b6cedc4d3
SHA512d160663a1604941b88e0e3195122887854e0207a509047ee31230f0143cad90dc6de608c4ba644b00d92ede9c207bd5f1178b78a6de4612fc6fe0b2a468a46ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e64376e90e44f47f1f484f8f61cd3eee
SHA1d8a654085d85f41baf05647ba320eca69e3b2d19
SHA2563e9fcac8899d7e5525f02e4faa8972dffe057f044e700c29b72a5db137c07808
SHA512311b1b7f47f545e09a1f3f02956f81e1ae2ad128397ada0d7171f731a0833ce5aca4d8cbb989b256142786c993367b392856798510b048d1e7e6902d6518eea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6d539f136a5833ee7b6901ca61b32c5
SHA1e9002b634d2e94ba60fa21ba5c4798e117410e5c
SHA25668b011b54f582180ef5e83f923b7c44e5fc8747235bfbbb085b9e5f33669c4f4
SHA5126e1d1dca162756ccdb1954807a1031e95fcc7dabdee12f4e9b35fa3362995b3e2b4f093aff3185334456fa94ff621023e3c2e012cab3460e5cb181dbe06c5454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb0f8a73541190869747469cf002466c
SHA109f657e5965462ee7aba722e1519c0233df2dc8e
SHA256d4862fab71da5c31db6fb57322adff317f4ea1d2477def862d14c6760976eee4
SHA5129d48950a3a34e82a273f09d220ac70eb42c6e20266b2fdb4d268728df0e211668b49e7b9b3e90e347d34760f6dbd1e222f5d68e74126d243da07cc5ffc054c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5516592811999d05e6b2fc9d89383802a
SHA14275aad734f97a51c94e185b2af3f3ba4922de29
SHA2561884772d03e9dae3dec719131be30003e718b8b5e8fa257711bf33034ed80ff0
SHA512b8df30efe2e62ef54736c80502efc10253779e37d779822a0769e57d9b70e2fd7c559d4585762bd5c39aaf413fb8767064ef6846fc2b6fd3c57c9f7889f0cb0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597cb8e99d66b0de766eecf528def018b
SHA1e3f07e0666734d93f81396d2d483b074f22b95de
SHA25663d5ab0d2b15734d719caed4e3d5163ad6f0c384285f676c35f703f8b8376b40
SHA51297929e95bcafcac178cecd8432e2fa443e394356395e5acdf3b0f1476eb0864963a56fbbf38dcf19fdb3202264ea13bf78d5d0c4a5b82aad119a7392f1308484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e043874fda59aeb7a8dbb4cda95f782e
SHA1732494e3e5767664f8abde4f0b3666f6ce8d8336
SHA256ad359f59cc24b51cea88722a71da3ea8d0f2fb96d239981763ccfac3d3dd98ec
SHA51218d5dcc8de2f9922e82cb00b3d4a128175f851d279baf5031c7df21b575714d42ed3c794f8ab4d2463fc8e33937c78d534d0d84d77a6e0ddca15ae91b10b69ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4604f737c0d4cc5534edc45c99345bc
SHA10d814db5048ae772b00eedcb44bfe82ae06aecab
SHA2567f182ff955e83e6c7d7206d6fbeffde4d55911a14da4717be0d0ef3cd5dbeeaf
SHA5126f0a3089cf6930872e358ad0759aceab707fbcc03af5e0b9227df86384a1c3e2ebccb7eb2c9370c58155713ca2d0f5d62ba14d86b66a22427f5371a8bb9f786c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b8b012d4b9d7bf9300716c5d972d444
SHA1b696effd4bd695586a0823aced5652a9e5de41f6
SHA25699ad28885576102bde8b2d85ba7a98c3fe9fd49ef86a10a813df624cd42b25e3
SHA512b29e38ec5da060ca8ccc2105f442b12b38d29909fb9fff939222cabfa5839c3c20ff832cb197612ae50d439be99c8c19275b508f7c541ab40318a5164103352c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c45b303908600e1e3927983becabc198
SHA18b7ab8960d1d78d5d8c14e35c39d54d4996605c6
SHA25624f03d8ffdc4fa2adaa2c223b2609d0c9c5e89ec01bead0452585fad2d9d39d1
SHA5121119aabb5c0050cc0d854d741718bb463918a716fb3662ede66da23a57b1a86197ac71b5268510e9adbcdd000ef72b7dd1967460d3648ef711391587fd8cc3ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597b284aeb6a3da031665fb85cf1c7f47
SHA1545a67731bd64b07f282d25cbf9ca9d387c61dac
SHA2560edcf950b4a4c4cdab31b3454b36153ad20e303cb6cba2605256c80e4dfb4ebc
SHA51234d10d24e9e91a4ebdd7ae367a1f88d981c074fcb7790b1df9b5a35fd0a42d2794015e4a584fc4c911bb9ec4692ae0f70b15e88bb66198a86194e92cca9b06fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a03d0c576c72d2a1e6125063bcdf086b
SHA10a77b81799bfd41578ab27231b117abcd64c497c
SHA256338ba71f15ed754bd0f53406ffbfbeb79137c4e1620cb52570ee1b92c2e17a9e
SHA5126d94bf927da091cb5fc00cfed913ca87d51fbfa8d4acb0e19b60cfbdbb5d0e478ccf40e2941ec27b37e9eb67a956f95c97edbfff2dd248c2468dc9d09781700a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a