Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
2d77f3fdf006a5da6c573418aaf61a0f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d77f3fdf006a5da6c573418aaf61a0f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d77f3fdf006a5da6c573418aaf61a0f_JaffaCakes118.html
-
Size
2KB
-
MD5
2d77f3fdf006a5da6c573418aaf61a0f
-
SHA1
a22d9a93fccb4f4046edc7afc71d459c24d2a415
-
SHA256
fa2caad2baa497765cfff0cea324fa85fdae55f5c9dc5375b889f0bb83f7944c
-
SHA512
d1b7184f5e8351e0cb1da4ffd9db11d715759f4cdacc2008f33f9ce14084d1e8aafc1cad2b86dbdea35ab9406ff46fbba83fd3ccd41b06397fb3f916436c8e01
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6095d8d096a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC10D261-0E89-11EF-BE4D-CE57F181EBEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421478995" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f0e28d7debbfce2184f540f04574b5d8dc8b5a2d40185224566e71f73728fd74000000000e8000000002000020000000d2ef79b3ff0bafa42482303bb3a5d8e6ee978864ebf622e8d87e3d1b0bcf689f2000000007765f96055a53dee7b8c5ac55c73816a393acd9210fabde7f60273f2d4a0d92400000000f781d7a0e51f344fcde03d3eeb46a83d0f25b1e9f9614c23dca73aebf9131cbd5a80ce676bd4766b06e5b039b5191e49391bdb5fdc1ad0a99fc74469a3a1dc1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000009acc9657b8ac81a061af68467d80d4c970c95e18fbe6813a8b9f57cc178bc432000000000e8000000002000020000000bcf6c0d459d237bdeadf81d690a3fe935feb6d10df2bca2b64a230f9b7a5f7bc9000000015c515d75199c3836fa63c197856c4a5f2201caa441e0d34a30d5e09603434ba9a2149b51d6a553f154ff95f672acbb165e6a68c81555fec658471f54716ec9a3402c443cff81b787c3d1cf97ed26bd8033382807ae0f99a655721ea15e95a8db13d80e4650574de8663b6f99a1ff3ac0ca67f5f514833ec23b8e39706c350f277517c5ed7588b38654ba64d3316056940000000419b1ca35adedb8601c5810952565b612676a80b0dfe933283896ac356f185cd23943ebb61a5286ecf479de1557e7ffa1f19389cb33fe3fcaefadb91aa263179 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28 PID 2108 wrote to memory of 1764 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d77f3fdf006a5da6c573418aaf61a0f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a30c5735ec883cf66b7943cb7993b717
SHA19bd8a4e776ce3fdfa4f74a9d6fbb6d1db650ddc7
SHA2564ff7e685e51171cc6e5d2e976a118af96ff8aac6e062ef62f3f2594610a95a53
SHA512926168b70ee3587608126897b84c33bbe14841f6289867e8129d9f7cd3289f82e2e42cd067844e6ed1d4b9696707e9300a3b37d4d3eeb5e2580d47e4f271ee5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b09630c5275a8bab8b5d5e5666b81d2
SHA1ed9556436c219da412cad34d18e5c160b65acc2f
SHA256b37c5d940fbfcd0127d1d792a5a73f6faa1e4169473acb5f961c2e8aea215483
SHA5123cfab187d7d53363702478e22cb5739df1da514fb9fe525f71d222059a20abb890ddd7916d1b7e426bee003dcba22e1e9ab73d1a4b6743e42fe1af8702a10a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a66d3970095b6df4c9fa847faca612f
SHA1fa94ec68549a17732943c665fd15d1c7462324f7
SHA25646dd0ca7ab7e7c749f63d2b11863cb2d32c0bf08242952b0623849ba62c0f088
SHA512c497b0803624cc2465f04ef9b71e31d75b5860574adb8249e2e430162e55c0e162b0356352fed89bf89c58f4e6d84472129afae73824b682e57c8bb9cf8324ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ab68f09263bbfb554cd01039362a944
SHA12a3a27b3cfd3eb0d35e0cac687e9795be1be8734
SHA2564d7cc3f58d621067e65d63348f10b99176ae588bffb2005624e46ff846389003
SHA5128385cabdfb7f50f0d5d4d4998393eb0f22f144480c0d813dd65141dca2bd5f49f1ea8f4a6e9b45271a0cc93defcdc64bbab7e162a165d0c4b69c35b9b398aed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ad2fee01a21b012115135c3bbe26de3
SHA11e918a381f1da0e6513eefcb8cb2a3d4d88446c5
SHA256076851dd2d1484279ff56055dfb9d82369aa4ba93430077a7421fa7f153d3197
SHA5123ae77f444515f4bc90f4322f9fb157ec1585bb1f594bd3ffca33d8c53b0ad86c175f13f1484364934edfe5035447744afe13544f58321c0a6b0c1b5aa0765f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2901a62db1ae0bbab3fa40b873bb143
SHA16846a684c5959e84f2dc725dfbc8f3664306356e
SHA256cfd7cf318f2d37edefc9ef2d5a3d93cd58032a273954aeeb0a227dd45528f386
SHA512d6f8f313011d1f79d40ea5a17bf02f69bc9cff6bf59c807d94150f8fa73f1edc12bee89fe50e6b7884b012e3591c3dfb0e1e8487d1cf09dd5c281d8769be7c78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542860fe0885cba99b635119a3744f7c1
SHA1700ae29cdb1ebdb20c05de37094544dc67b0f9e8
SHA2564c7a054fbf6d59ee29e7c51f2ccd4539e3990ec59a800a7dc78e5d0aa2397bda
SHA5122f9e9553b03ffb6ef602380178f49a450b7a7c6f9ec953223b88d8dd2cc10e9e15bf1491a5a0d2d4cbc18c163d66e357698bb5814798f436dd17318e019f4239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064c792dfdb53ba92971cb0d46871a27
SHA1dad749755a92319cd747d4655e9f18c6feedd4f3
SHA256d9bcfc7491ac0e24cb0d71cb3dbcaedb29b191321e4b86b081a4cbcbb1085a84
SHA5120f117f12775289f2e02810179c6f70cbc5946aef53e81f2244b79b2edf77f77c42612c49ca70d8bd7e51e9019cfb9b1ea10f9fc739c6336a9a19ef5556587894
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558446883bd0e366422fae42128116a6b
SHA199eaddbdf893b093389633c78c15d6a5467a555f
SHA256090a5e51b4d7db46ec16459fcdf22d55a01c1d6cf0dc761c73d39445212f3503
SHA512576c8ff689867e5bf0bf38f82ead48ff163fa433d218596d6a65e38f417f4be7c1326c6d19a1d4097fde439bfa8973cc5f8df9a0df61fdd5bbeeb9be14f96ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582f3ae5259b3ee44bd77ec5e351d1b72
SHA1d595a9a81621f71d7607f1c7abb899d25c5aa955
SHA256d11d0911194b1990fa38ef8997392dafb3c85b1fe226d55800068ea42c1a7b93
SHA512d5fe25a5de853c569d84145206db61cc0950f5ce9461ba4a0766a8593984ebc578df88db2dbebffa5ceba4a33f9d84634527e7968bc2c068f02711cf6c437ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8b06839ca1cf058c93906613d77a980
SHA11e4a5ce2e73119e5f509819d97baeb910323b9e9
SHA2567bd5583bdecbb98f03e39233e3be3f413861ba1e51d71117d2b288c22bfff1b5
SHA5125c3e1373dc4212c85582b5e042268219cf58c9b2f074899ac5d8ee5b09294cda9e8cc62a419c38373f2e11451a15fa183507e90069dcc144e4404e924fc6494e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7ce088e80cf34fb504e50a1614ebdc2
SHA1dff86b2d9de090736a02f320bd44ec88c17797bb
SHA256019d77c485fbde1509e76d089e85e5b987faabe13417c68efcf9dd8da6e75da5
SHA512aad2b6293d855bd2f5dc5edcd1ae800b4b976212f5d17fbd2bd0763a02b97ce2094f817d0c65632249ce92f61460002bb3f35237a4b3444023813850d5e7c88f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d03c81d7fa15cf6bc14c90cf775952e
SHA18dd775c80cfa8bc7ac4ff5929b292980afd993a7
SHA256c6b673ac011576855cf8df6f9da9459f0e31cf039c729f56c9302837ed491765
SHA512df434bf42aaff5c5afc3500a68d97a7fe9120811caeaf1be359f4d156afb5835f9a7be3aa581f000e68837584528970bacd3fc658f03aa48821938c87919cacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d206c89d4f7d0964578d086a96608530
SHA14aae7de6084287171f9254e619e487db38da650a
SHA256748ded8e36778fdce139d5da0591172c5678806e9e5824d257a6dcc43678f969
SHA512d1dc991491f30ab37b47018d3b37ddfae9ea88a38288649c002a9358d078a852fa1d0ecdbe5356ce6db85c4349611e2206f6e1ebdc5b21f78e0419385ab0b9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f33864d22bd38e07af682dc9e6b40f5a
SHA175115fa4b135391bccef4348a9c08249fd4d29d9
SHA256d72dfe459af007d2b8043ccc5a99fc0cc9cbd7c8fc0fa090d47a4e0738a976b5
SHA512d6e0974e7b0ddcbf6dddd8554e4ef0caae94b1bee2d5f45f46ebd24513377b2f30ef1d5398e1f0f0f1caa0bc3e9a517c6f21aa0b0daa270613c07cc4fc60e218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505a47d5cdf0992c6c7b2cc25dcfa5aac
SHA14663d73b33c0e468a69b245362a36fa0311d394a
SHA2565e15af8f32e5b4bd883c51a181374d8a01b04509dd1fa400f224733b2cd980bc
SHA5128ccdc1afcf50fca1a61a12cab4972ec6e408dd7091a4be5020083cd75a6f63d1f705f141075dd4b3be0dbff324d0671010bd3eb1386caa8446b4636d1ebd6763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50314ce653464aeae6a374b24596798af
SHA1fa0281d08f2b32208b85c0f838a4d0fd7d39ab3c
SHA25673e866c701502be0017715f52e8868af15cafb42f260d70a9cb791d75ebab3c8
SHA512dc01ceaeef441c04e478b505c97904036b9729a854a5cee3ab826082b31c0f632a9b5b6089b9b344c3b7e3562e2b1aadd8e262cefd2d45782e04505b409a547b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7283a1db9bdc1634125815abd115ac6
SHA1d00369aefdafc4b357ad893072f155a52d237d39
SHA256ad7240dc67ffff36b86d06700cca3dc92704700a3f65e4c4d4b6f6b5ff8c90c1
SHA51231a2e93dd043db8011182435b23337dd6dffd333fc3964a093afe23c462fe3175ae1cdb08cf78457213b63fab05a1a9a959196023e0a28f0ee74358200e2b64e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a