Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
3eaeeb3f2e7fa7d5c5ee00e4855bdfb0_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3eaeeb3f2e7fa7d5c5ee00e4855bdfb0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3eaeeb3f2e7fa7d5c5ee00e4855bdfb0_JaffaCakes118.html
-
Size
34KB
-
MD5
3eaeeb3f2e7fa7d5c5ee00e4855bdfb0
-
SHA1
cf82e421bad1fd2d5fd0417e37ebe8db4407fd4b
-
SHA256
7c370dd438503df1bd512e4d68679ce83e40f38fbc4d962bcf488f4094d7b269
-
SHA512
81f00abe3900e620d8d60cc91252bb7e5c91d686246209a2f6b0a4ebed30a110ea61b92001e55bb26dd78662dee32d5a6d2252304860b7af07b14e1240113258
-
SSDEEP
192:uwrhb5nzqnQjxn5Q/ynQieJNnSnQOkEnteYnQTbnVnQOgocwqYBcwqYdcwqYQd7t:XQ/7E1L5d7vGvxW8wL/8Q
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421752567" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006d3ba2cb211d397d7b4e7a3d8ff8890086f93634b1482e4eb3301e46c0857532000000000e8000000002000020000000da0291770dc541cd9ae9a3cfe9d8a91f1393090fc159d13015d33751fc5fd81290000000b7a010435628a3cb1d7d08a0e6f4b8bb2b71dceab8661443e627b2eff431a4197319aebc3b85aea2debc0bff2b41ea8614992952333d047749e4074137dc1b4d9c0b66a547b4be50686efe7d8457027294181cddaecbf7a82ca5404220a4350523ed9b20961939d4bb4552ee53e8f5e33a694600d62888ed11fc6f3847b44644a1e9f133b8510a056b71d8dec3511c6940000000377833d372d154ffdb9926672e968674f7df998535ef5698c03fff9973a3c4d6427419a6d900b7ebb106ae4662d5a78b8d8c2996ce388b5d66ed8c9593a2680a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c489c613a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1B45CE1-1106-11EF-8962-7678A7DAE141} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000edb073af9157d8503b3aa018c78ed4668e98f8a3694a26e3119ee57355e37b1c000000000e80000000020000200000002738da90205384a15b7a5865e2bc029eaa2721ff0d4060fce5f9996e9003ab3820000000858de13ff1dc17fcbd35e11942d1323034c8576456db000fe0779942647b46c9400000009dcb02d216523d182dcf0fe3bf054ddf417ddcffb6828c92af6a5473c66c4b27864439a17343b497f3e63ab42829ad9fd0de275b247a75116135064394c82901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2624 2036 iexplore.exe 28 PID 2036 wrote to memory of 2624 2036 iexplore.exe 28 PID 2036 wrote to memory of 2624 2036 iexplore.exe 28 PID 2036 wrote to memory of 2624 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3eaeeb3f2e7fa7d5c5ee00e4855bdfb0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df1f1ee74e8adcd1b0aca6c915078021
SHA13dd615b7ed8fcb42ddd1662e373eb6bcbe7b5c42
SHA2568a01ebb560d24dd4e93b07b3b0e659e3d1947bf2efa304f6a9f8565433c69010
SHA5129cac25513082921aac3a1dd8ae0cde8a6bc84cf81f3a71afe7d6eab0740831a8fe2eda9dc722f4f9153ff39ac496394961a48450d1bdde99b618ea135361a10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5190468561f07010f45c8a19a12e9cedb
SHA15ffa7f622efb69c82f21126218d7d912b648a550
SHA25653f8a0e1538f52a00d5d6f061498ad9006ffaa034eedb031c8c487d38074a19c
SHA512077f23adbd880945bcd2f9d4503a00e815e2698e7252146d4b64a3d4de46b4d21bd4eea12a60d774cbf3d21365cf4bee40284634e0de34fb13d8d49847fcf183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6dcd13a96f0f26eeda166dd621574d5
SHA1671498f068ca3bfd39feaa2c5905ea3538d884db
SHA256195a74f11d43cabe66a8630c4bfa045da6d353ea120ce230e11068a55efd5552
SHA51275a5fb738689541948a3031c72591eecacb60e3faf8462bba3b4765c5144b5d3c0061ca898a353ba3d23ecb6e7e501e99529d779749257dbcec43d14eeec70ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0f157ba8d00cdf621c2ae6634e9145c
SHA1e82310cd3ad095495bb6a33a9a959a892569c84b
SHA25636d2e47b58c4ecf2994f7b2962b5106a746754112907b2550c5908848f6fbed8
SHA512861a988fbf189466ad4028df00e3ce268cc7b31066bd2df5df682baecab84f8e6ab21c71db7ec362c17cf55382c955ca4fe6b880f0c04da7c2ff33587bc5aeb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c66930227bdb8764414fb0a3daa3932
SHA17682181460f7eca53c796403eff268a04f92917c
SHA256549dc26a1fc10ec6a078b95c95844886757bec5c0099cde5bee3576bf17eadaa
SHA5122f454cea84c14c6858b0324ea491018a3d11cb51406f8c6f564b2587c09f3f7a9401c90c1c8ecab56a220dc2b977c3d9a7b0b5c388d9de140863396923ecdb01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c4d1572fa5b1c3ea9e9dd05203c8719
SHA1bf6a8185b16e3b91c2cdfa0ec9b92576da9528c7
SHA25670eeb897eb70e3e90a07791b3709577623f126be3a1df1d62b050dc4734edde1
SHA512fd8019d5b2e21c908dfaa396cc451558a887636a65cfcb30d3e7a4b29e9f3d2fd7ddcbd7a45bbf576227576c42d57d3e465a008e725f6c95ecd4f16f314a09cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53361ceee9d867e8e9165463392f5056a
SHA14c259ac85963212d016bda0204510c759f11d6ff
SHA2568870ccfe4522eeccaadbbb74320ff81c85f3bf526dc6007e2eb2c23cc5d6a746
SHA5122b1e8bfe2f0774c768e6b409acaddf775e14a4ed318c8b2810c0af772968b478199f6a385f34998a3876464a3fe899153b58fe275dd1412ac83f542c3ef20304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e379db1d3231083033b3189fb19e1e2
SHA14b85b64c241b5c36b0f0f283a560129066842351
SHA256341d34dd3aa37768323a5fce08258fec1fe9fadfc831aa56a254bc1678b4d609
SHA512be18800e41a1ecbf2d722fd2f90f3a4faa165ece934687f40930bd73236a57b99de4f90be87b10391478313d98fecf3b1b416c846a2fc46ef24d56948e2a5381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542423936aa7ff3f16522ec8d5fbca8f2
SHA11e2a7aa61cdfbb68b3e9a1d1f72cf2c003d955c1
SHA256bebaa53917980a800fb9a21b2c25c887c5badc4744201cb68a9f1a38d8b588ed
SHA51215cd921d3e836a4bcc7324aecdf519fdfaf35d94c4a0215bb8e035d21f1b9e04cef738377e5bd68d5cd0642d588ee2dc797e14f86152cdc2fc350a701e6dfc04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531e5df91a9d95d66db0e3c531b560af4
SHA1a9f7cb5360c6dab805c28edea6b44522b7b9ec66
SHA2564831aaadd48815e40281e6430fd4777e6bdb61aac297c15fa259120f925f530d
SHA512d8bccfd9b733df02d108bf1f7548b5b4b9aac833be883061f1b496c96ab238a77f18273ebca927b3685743e0472db5a1303f5aaac8a0d749eb083d5427cd7c8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa908cc265e0b49bb666f19ff2a55d5
SHA1fca84b01ffe82541cd63c017ec306db55213c3b8
SHA2563c83d3432637bd9871d5c9cf421999d336b04b4616384b951b9bf294ffcf4423
SHA512731f34df16e94b47245161e714ed6c630057453220f413f3866b6f04e14c2171cc69e469f4a7f2f1457cea4f5dae5f2f4ec3fd632d728128516eabec99d9c06d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5720396cfaace0bd362263648413d7b05
SHA12697a34e2d2de220b6d24a2b45c8660cc11470c4
SHA2562eba6db505c43a8a43ce38a6c0b2b5e21341c8ee38343f6d6216985668c0f6e9
SHA51268b60ec99278818324066dc892c80c0dd215f46bba19e507fb7bb75fc8b2bdb27a742b7d50b296f7c798b49bf5fda4980e9153daee9efe8e7266026ef900bce4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e83c13b2576b082e3da936cac31b47
SHA1e86a0dcff7cca88953281c14bb5d7bcb45006241
SHA2568462898592286b0c3c12620ffb8beba4abf67bd1be9e5cab0c94fba8da67ca78
SHA51238f30c94adaaf75f127ae1fd8f496f5e1a2115c90b84f7dcd00460c39d19365357761f1378047f2ae036ac78aa9133ea5c810baf4194f5da57b36ad8580bf56d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0101d371d95216083a4881aeecc483d
SHA1030895cf6e31132480f4ce75d7485e03a5d4ae71
SHA2562ff6253f5c2943c03a5e6e0acd1b933db16abae7c76d29355f3c30cf7e929506
SHA5121b6f395cd561297e0486232b5269bfd594d18cf00af3a6e4b2af8b6cac3d3973b4d128bc7656cf8312f47ddbafa9da02ae67d22d93acfb062063e369bca67fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9acb20d371c31e72bc23c5ffa7459b9
SHA178e42f461738ee74fd738a76f4f68c4860da5fb9
SHA2569b8ab6235702c21c2c20ffb519c21bbd5cc824f0c23d063a9862d64dd51ab4fe
SHA5127f0d89141a95c3f98d74587ef767260f09e337b1accb237d4f9a20c5543c26255963c9eae34d689f3c48672490987a0f25b5910bf2c69db4ff769032a53140d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f147e3ec2afd8ef61d8b1a140975d41
SHA18c25d9dda9cd7e8a9a5e68e4002045f6b07cc7a3
SHA256e3b6bdef90d957dbb5dbc83f16a2818959218b5ccc178c40b8590448df0d87d4
SHA512aba1e34096d1b830538a78f86323b5cd95e42fecb848039e333c19d0a99943888cc3ce770fdfef0a67b427952838d659d212f3aab00b8a313de44f19dc5ae4fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afef456eeed7b8999b484238821a88f8
SHA1d1c1020f1a808c5513051e5b65cfade9acc61217
SHA25696c0576beba10759ef0c5f8b1280b349ff35d4edc8fa2a52905289237669d148
SHA5123ebfb3668ae41f57fdc8d09b1a6e4475115b3568efc70894de020733ee0ee6d9ae9c8c281918a5d7b8ecf2b06a6076c0308f37830f1f60ba45efe5914a5412bf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a