Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 03:29
Static task
static1
Behavioral task
behavioral1
Sample
2d1dfe22915786eeedcaa9d26e25fe17_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2d1dfe22915786eeedcaa9d26e25fe17_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d1dfe22915786eeedcaa9d26e25fe17_JaffaCakes118.html
-
Size
2KB
-
MD5
2d1dfe22915786eeedcaa9d26e25fe17
-
SHA1
5517c5eeb2e6984e3fd8f2bf98fdecd2c459c0e1
-
SHA256
577ed80ba5147dc2a7fcee04af4525d98e83888f6935bdd86c27d371d6ccb101
-
SHA512
e1d5beb027fab6109b2cf6c2b5830b38e56cc82faf07584ae6f9689b4bfc6b30090a24c54ff7d29d08ca1a42c8d69d2a8ab8bb4a0d9cb787be1f82a6e9d684e3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05e905d8aa2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88595F11-0E7D-11EF-A1AD-46837A41B3D6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000003a4adfae108a7b5755f4f4f1302a59c1e62514c33ae28af27fb5e159362d9ad000000000e800000000200002000000075c8d5c834c8a10d000ae26455541607a5bca6bfb58891f8201ecb0105092d05900000009f7634eb15fc53e6457d13c25d300502b8fda0d356966b02588995ce00b4ce27efc49e2e04a10b32f8b49c7c463902ea6d3fe00333f2750e2cc5b0c86ea136cf2628939b5eb0a35de092107b9dbdfd033ac88629f49a69f3d292b3780c18c21f571ea705da8fa44d7e6127ebdf5dbdefdbc1ce5451a14c6a75823cff882ff383d4657333aafaf4e5e49340fb19d2e6a9400000001d47abcc79c52f3a069e830f244926ede28fee8ebaf8085bb877182edeee095b5b4c787981b9fe270e53ec064de17c7719b515fd69c9973c9053d27d530fa5d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d4d1ac2eb5443c07dd0308788228f2ca7124ec7d6c4d8fd208c291d9a6a4a33c000000000e8000000002000020000000b7a53904f84c6ba99e805a1713cdcefd58b94329b6416e41fe602548eb306845200000008d534174ed4e0c8b50f31ad6ecc3836035e19e994df125f6b06f5d01c58682d340000000acaf058f69220355c6ce5838dc6c43f75a5373735073fbd5cd50c446f9853e364ee9517e72b2a1da0152c6ad25a3187b12f206ec1648b45494e69ad7c91ceb4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421473646" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2176 2312 iexplore.exe 28 PID 2312 wrote to memory of 2176 2312 iexplore.exe 28 PID 2312 wrote to memory of 2176 2312 iexplore.exe 28 PID 2312 wrote to memory of 2176 2312 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d1dfe22915786eeedcaa9d26e25fe17_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e83fe276c66088f0d6250f1e138ea16e
SHA164487be126b257fadb077f8c1c33a731f8689abe
SHA256aeee282ba0eee6bc2f089b3a5f31150e69ed40ecad4d7f128fc3a9dba5aabb9a
SHA512e3edfc64f2723af3f7637ef9baa27e6011f99d264423d24046b63e5e6c2c5dbc52d95d7cd74ebe24bf11f0ad361b52dd20026b2b5aab2a9389fc0d8b068a6c20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbab9ac7c6407a0a87b1bcee81bd475d
SHA124f41e9309d4fc1dcda77ce58d35c14d33ae1493
SHA25660e59f6be9166872cf38ef40ac02ba9404a42d22cc5b453c735cd149aed00df2
SHA512625f700d8c9b6e6296a31137ea0d60fcc443705d4a87331e110b5cd6a7de993be0289c51a39d2fb510c8678d28117449459e530ad26ef54d9413fe464294f6c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d625b5011908e19c4b6823befd870fc
SHA155b6921a98240b2080bb4124065ada3e06f552d4
SHA256b1bf8c77ae1c1f48194b94e0c3ab9c6dcfbd3220e36ec44dcd3193d8f07672b7
SHA512d786165a49786d6358384378f5363c815e761d6cba9b43ce510d6b83a245a858d7e4cf15f0ca3f3e3e5141acd796436f491f3f7f18204dca204b2b939edcb506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c4697e739b80267155cf91b43a2f0c8
SHA167851bd895e450e4510a6780f498aba1d6257f87
SHA256367e55d05e20648106059581af8b8a23ec3add6fa98c736a5f82896d4589e484
SHA512bb62f289f3cefff20a5db9a29568f69b1cf4879139f2d22af771f080f84920982e2e22c8623c734a15288e165316483c8ac45da8dc6631eed4967194b55146c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f44f453c0abee81b6979b094e513b4b6
SHA12986de286845f663f6bbae5787bee1ec95f029c4
SHA25632dfeffc36315b7b09a6da0dc5fe8cd2593f4555f7a93d0db6207fa4c1f0a124
SHA512f50e7e4794b9d06253bfc6b53374b1ef4500207bccc3ae076fcb06c77138ddc38a20cb5ce37b758c2faab07536dc5baa256b80ee161cc56adb15ce8cbf935c5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56686cf36e507785f96f69474c4e7e420
SHA1a97852f5ee0f07ff94cfb151c9edfa1a0187697e
SHA25668dee17b6d43d42244c3e2c78581d28f20dba98c6895e18c8a21cba532f2ea08
SHA5120263899c53990a51580a7233609cd671ffee7cb3890b0a24a06cb4fb182d6a2e8a5cbcd697f1adc2f92303a8339415c3de1bd34ed1dbbc8da4b0d1ec4371ca47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e800d3bb8334fce5b9f77c6c2e9ad7f8
SHA1c0132eca8e9cc989ea3dd9ddd70b184df42117fe
SHA25658b3522be25d99d140199d8d25f54c6232188e1964d43ddf0dc89a546ab7ab9f
SHA512961bd3c01290c3967f4bee4b2e4c85d6fa25301550233ba30ec9795757519eb761365ac5fc729159837e93fdd08c81274c846c54a2ae5ed02ae6a7adf5d18c5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542d2d8759df338a77170011bc389218f
SHA1dea5d3230afd2800e2d577804db9f0c8bcdbdcb2
SHA256ed0291c9464a6bba156620f3717fc9312a97b8bf16b24e9db2c53639c49aad5a
SHA512c552b4b4af0a12a97c2c7c60d1fa069d355c3dca707608989f016c8397c92199a0ff74579a7a9b85ef4c19c83ff228df1248e997bf3446993c047792c9493618
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ea94f06696a6c3d98b065037c24fda0
SHA1b69189df927b31995e35d439613510ac5c06da95
SHA256e374c7f4fde4fa4772a7f693c7bc460f47098ba9e59394e28aa0a8cfdeecea3a
SHA5125afba059267a215cf857a5bba9809a8e268ea4a77faf6a00db0c61b2f575512e381ad47fba50d3e89e96b452abf4638a77db515841f0ee6a635d91f565fd6a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fb16e076d0d8f5afecea08134369821
SHA1cf4444ab3e0d681fb0c7f6a704c9be7c7a67aa26
SHA25616e11903cd10a60935f5e73896ce9261d1775df409befc9c97ff1c8746cdd295
SHA512650292e8038f4f4ac65f886eb7a20e559f8d8133c393ae5672eae1a7646d850c2d43133878757e95d62b289d17bf7d2f674ad6d105ef37d4fb078786ceb8c784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcdc275b0df4ce38baf47a308eed6620
SHA1ab701076ccc87213a85297eb3d54a0f0c208aca3
SHA2563151237c7db4f1e5e4b0083edbc4c66b12a924c8df0588e7810639e95fc6ee85
SHA512a063bf79e437741e48b3153530df05c629d26257540da34f18ddd013a35e873eb24f43d693f2646706c94ce751dcddafa294e287e2a96e8e10898f3fc5c2bc6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ace0578dee6e90d77ff643d2cf99521
SHA1944d9e0112c4b31ad69a37d3f042bc12c908957a
SHA256c1fc31fb4f135e5be091af8b30329a70d32a92a51318ed9a72ef38e440983419
SHA51211842fc18c7937a645ee7c0468f621889ca4c461834abe84bd1036060714a27e707af96f71d170b101fecc2ccc2214ba887d6a185a2bbae051fce83939ab8984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbdb052220ee2f068cac41e31cd71e43
SHA1b9e867fbdde21e94f165b0e4027730d550af1d3d
SHA2569dd43a293076392307bb4ac07c5634cc1ed2afa8e4a6dea0caacbc2d73c01726
SHA51262bff7db1ecb13ab62268292a2f2433ac97486be4f0ce5a733d2e1e07291c005aa0ae399abdb8bb7e11af9fa7d878cde98dd33c8e84b0dcbcc388252b421558d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51057913444427424ef9a0108b72d73e2
SHA1d04b6b44166bbe903ff6ab442960bb34e043e872
SHA2560194cb195a272824fb96dea12223e8ddd215222bee50578b4e0b399386f1c719
SHA51280fd83e027e4e443e3c3d19fc2c0bb81770cdc809a6469af1fe3b63ece5f92f823d9dfb2e894bec04f65fcc19aa7b4623df93f52f97f38d391cc06ddf92b0428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dadb248d9e6e00c49ca86f487f9363a
SHA1515e0a78e1c4fd21f5a4a87644d1494785cf1bc7
SHA2564d824064e1e351c7c68479b85128a4d16046494c9d0c815f47bea31914704c3c
SHA5126ae08602145b51eeb8468fd5195dbeba0b511f96416c26a8c6ea2276d0b5ae5f0af53dd8889dbe5fc6b371fdeb19d98c843c68163b9599f42bdab6a6e756cee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f403d46d3b4e3dbec25792a3ead1df8
SHA14e84ba5dac79211474135eb9507a208fbaf64b1a
SHA256d3f49bfda95e9a73ac2db85d4bdf8ade47e678df4d438e1dde617032c2451a1f
SHA512db9a4647646d4a29ca76993456b42115c141e26ff67842c1506e38f6606e6bb12a8be34e8357439450eddb98a8df847ac8e2a352a172d18eab36f06705b9d153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e491e3068ccde9be73f1ec0ab3a7a081
SHA117bf28d2ad006475e4e726a25de2b6e3050c0da7
SHA256262bcd9277cf6e978c7095d370bd1849ba65cba140a61eec35578f2aeeed6440
SHA512081b3bb8984710f2f983666539b1f06ca5e9d63a300ba5dfd095f2d9a07b522d04166a7d1ac53439f6eec8b8920ecf6aa79a7e308d69ad06b38229cc234a8c77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e4dc8d5547929da57668c7888b3e5d9
SHA16b9044ea5926bf44c09e9a008b9de60eab161fac
SHA256450c75eaf4cf0741b2e741abcd998f04e89b744083bedb99fef3091fde6ddf45
SHA5129dbd10e24a298dd0a72b390283dc21eb795786c00f8ff24a23b2f7ea791af7fad8f20a6a528109b11f7a52938a913cc3cd2d9199988a4f1833d43017dc0b586b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b26c6be5b06b70cefd36a81a0206553f
SHA1397ba2982674dd0fdd346e6835a89b8142499726
SHA256600ffe72cb1ff25ce2758fd070f2af3f4a3195d808c4a1d3a9fb0d2c63e3ac45
SHA5126b373ed3d93c4bb0dd6577dcba76a9ef5d5c0cdeac6428f0a513248263db0c04d70d9a959e9d7780c3807d1e715cd1eab13ade4946fda0bc023296f00ea5c218
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a