Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 10:03
Static task
static1
Behavioral task
behavioral1
Sample
78c76b29146aa8eb4eaa6feec6b20d50_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
78c76b29146aa8eb4eaa6feec6b20d50_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
78c76b29146aa8eb4eaa6feec6b20d50_JaffaCakes118.html
-
Size
139KB
-
MD5
78c76b29146aa8eb4eaa6feec6b20d50
-
SHA1
230b562d6b5ab656f3187c15cb7c01ef97ed2612
-
SHA256
a0ce96014301400e71f3645cd4038703d2cf04a267030846ab76fd33aa89eb51
-
SHA512
c6c5f97f8dc08907964e16c3c4a2e83c8002e3fd9388a6ece7175d414881e9269782be65f9b697ee87c2b90c8c28801d1ca8c38e4b62b91e7bbc2c829d41588e
-
SSDEEP
1536:SbdWeBOy5luuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SbZBOyauyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60F145F1-1C10-11EF-9A67-52FD63057C4C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709943771db0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422966082" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e278988c576a961e10967f23d75b1f46283a1d1dcbd47f6af97570b7067127a8000000000e80000000020000200000009d8ffa4b8a6ac2bf726da18a25d73d3ca73b9c9818887f6d9bac560c1c4b0a7990000000a51a6fb4d24f310b5513239e3e9af0f379577a4320b18b3a471eaecebb1e6e3f1961e1b605427fa81955b5d81d94e985cdd2694a344cb877618f9e860a05d2df8e356b85d82f4e8a4dcc936370b844589a0878c3ecbadb01805408db28d813fd7cfd7d4a028e457f78af46d380b9d4c5ec2659700061d1078a60f20a3d3901c56ed7cfe3bb42646a75ed413ad03d412640000000cb5e8a4b717283a43df4dc0dfc8a9754175652c00e4113a9cbee76101c622235016b4042950cde0a6c74971327a1ba0f98c488ef9ee53fb692cab8d5e6def962 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000080614a322e702467d9218c1ffca530a63ad605614f86199d0e431528e6ee71aa000000000e8000000002000020000000b2318ca1de79e52d9f78ebd2a2f3d61ae5a9c84bc46ddd3145f97e1ac900237420000000af05e471eb301daa3680b43ab455b19657823850f661eabfdd369093c9d4574840000000243844c2e63f64a1e9828ed05d4ffca05e0add1f382917db2d08595c69e2f6d65b04a420aefd85520fd679c0977f97a42e7f9092c3eb1cd25669aad3d29dd3c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 1712 2976 iexplore.exe 28 PID 2976 wrote to memory of 1712 2976 iexplore.exe 28 PID 2976 wrote to memory of 1712 2976 iexplore.exe 28 PID 2976 wrote to memory of 1712 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78c76b29146aa8eb4eaa6feec6b20d50_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ee54e2135240c18f5375e91866b3b1
SHA12c641c185fac649cee25dde7d5e057d9b40c2a7f
SHA25668a426a98237ad7e87f66cc37ca41aa136ee95c77d090da7aff5b5f003ec7d63
SHA512eacb96a14e5522597a491047e8a778d1928556b3c434638702c57176b0137ffd6f9c1862a3e7b5372f1e25c4c8b21c703fbdc78b33bdedb3f20b6ea166fcd5ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb4a2eb0252ba9157ead351960fc0667
SHA1309f2b3da0c4e49a7b8c0e965160eb5e7fc90f7b
SHA2564bf831679a1618b67e31bba45efe158e29f8540cb28af974457c7bfe64428d9f
SHA5121ce17167d7af92f10afea555653ca363be801076e5c08f03373fd02bed7ca2658d4152ebe1172b9da3fa2f5c07d453eac971a100200453ab73e4cc9684fb2757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d231205b21cde8827c5e6fc3ccbfdd38
SHA1ed8edeac4f683908ebea5fb2da923585805c1ec6
SHA256e1de53eca31cb144399bc96c0b7b5c2e9a22c897b7cf9d9c937efc598a979a4b
SHA5123847ba6a947b973df22aef159a0306ad28c95e55e0127a16017e43f4d3333d40e55108a97f87c3409aae1ba750fcc1ebe5a587b51d89cbf19e9038c12cc2ee95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520cdb5d27c37d293f12a7905779dda01
SHA19b5ea97fad9871a9d433d9c47a8c85b7c03c76a5
SHA256663631ed9eafffdfec17176e4598619affce253aa16aa4d24cf3014d80b1bf6c
SHA5121db0bdfcc5dbd545df7146db577802b193742ce4c29a331fd294564eb502ba3a276e1789fa5f43ba753b89ec0768f93396282b56a97e54b48de3c2f832174ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5ecb37f79f29d70861976bc70390e40
SHA136509f8b9a8c00e8102b620e98a97d309ac82c2d
SHA2564862579ffde9f5cb563a1cc2d9125b17099f356a37142033dc9f884aa24a6990
SHA51272c845b25f92d13d5fadc04e79445667c3a8b832c08a0c6a5773bba4fcc5447e13f72c7eb78c5333b79b681822f311222d7f0c088e25d5133ecd36ef352c3671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53de3410746851865ec1562114625b31d
SHA162563d8e82385cd740c3ba1f0f86c4d33946f3e8
SHA2561277980b15e51c5b33d12cdd3e7763a290bebba68afc623a9771a72358100ba7
SHA512f8fc2acf48a883c64918b7936fc3185ad5cb0b9e603a3d134023d3778d2666f07069db8f00613762396e03a10efba6f351c09b944858f64e98f9d54aa3723298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3658aa3b492c5630b76a7eb53c703a4
SHA114569225197df152ecd89fc64ef4eccacb311ed1
SHA256dc45cd01e35b8c579babfb3b63a2b6aab96eb71aa9e5b2e5854aa18b1066f111
SHA512bcc6571eacf496a4e3c771f610908a61052702ef4c6ebe2b230a2804c05f4cb8d4c5a2cb65be12dddbcafe46734c7e2470e8bbf6136c2fbfb5e0ad396410e2b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5bbc7b21e1addc1c0b8448eb6d71f53
SHA1e4c7a154572a0752e477b187fa661313b2f319d7
SHA256b3ac06145b0f06d476d0444f4c901c39475ebdbb84436a92bf74730bc4980d0e
SHA5125255fd486f9cd3bf5900ddba91949f1a1216f7b2dabd3c949ab9f7299f175bd82e2998a2d1fa215ba59946c4df342d77efa837fcfc0b46056260bda9158f7af2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5615da16b40a276f5f5251534e102faf2
SHA1cc09efb64d0991511f74e0e50ef890ad72169f35
SHA256328cf931c0d157b9eeb20c5bedbf6a26728fcf7e19f749abdbc8ab8ebb64719c
SHA5129b026c9eaea8474f61ff1e22aeac5190123e5ac039f20cf41301dd3fc7ec24f9610b21cfbad111ab65261676ed88adcb1a97710846a3d2467fb4ff0b49b604ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549dd2920bde86a04aa2e30dd6127f445
SHA148098ba282e9bfdf6fc4add1224347167a671d00
SHA2560182dc5d6a9f7d7eddfdfdaa83f7c3c628c0035c10ab42489e3ec8f2f5e78923
SHA5122ab7e8fb4c83f653cd9b4998836cc23c8ac05bf91a7ddd1aabae79a67e86e0fbae688c9167f2ff4265633162e871064bc63cd693aaec007211574f13a40378e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c6f8df0545b30f19ff9bb2e2e493c98
SHA1aef8805564bc55708bb6663e48e4964828161437
SHA25612fa0839b79dc2e5497128ecefb67346a4d3f867b54b84de30f6e268c0c5ff40
SHA512c5628e80e8aa496bf4e9cc73fc89ac3b8be024d4e6713b0107e03862b490a9b67bba9727d8e05fc299fb3225a20ddfdd4d0529fe0b21f3b157ab3874e801d3ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cd33e555408df4cade4e448e6105f83
SHA10644ad38100eb651cb9ba0757ad294a7d0c3f0f0
SHA256ffba0d9118ede4fdc9ca306616026006963b1115c6596d91fc4bec567ea07acb
SHA512776e27a9b58cc53320f9cfcbfc09968308cc234a2959c0a5f8dfe6d1a612afa7543ac02ac7a8d1a5a719eace6532409e41eb28a1515b19727b6f454c1409d641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e96c826b2aa7da47071b4d54bb54659d
SHA17790c8d4b898b2e60755abc1bc1db3c4ec2573a6
SHA2564a2d5a5e605ca430fcb6557e962b2f523ae2bdb6c232fb1f6de9597ebf3fd8ec
SHA512564943355d6dec0e7638a4028828e797e4cf70848128ba1d71457e731003fdf8d41232165585f022480de726afc3c813d1acd0374d5985c0f31ec848eaf139b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e68a612ba5e8324e97f507be2525ada
SHA1f667aaba410585f4686c25853529ce4ed376286a
SHA25611abdb9e5e969916d018f62e04558a4da9671fe91b1609a999d36238515e402e
SHA5129c7e4be25de2eaf912d79d2beb408edf90550f36d248e5907e757ef924e0e9dd9c1bada4b1c0af6260f67e5985141de51376408745217a3d1c630c032f284b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565c60fed5ef62b7e5fc7443e4a5c6c13
SHA1d7553252b85bda9b7a25c74b0b60f4b43f185542
SHA256b3adb08af54fa52d4623e4969dbdfb02bfcf29c9b7af9c7220cae7b8c366d4d7
SHA512c1711c9914969bd3ca4f18f3ea3db8d00d142405ccbb8e8f9f5350b924a6fa9bd6d886d3a7ea5d66fbe68af0cabbd1c28340cb13bb4d455121e5640dc26bb7fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aa10721be98f289ec5f5655fd5ee204
SHA1d534be4d078e62fa813b0760f89463f33b4e9801
SHA256ee9224a0bcb4fbf1352f5692e5ff9deb0e86197a1bfe723bddf694dcb5885c8d
SHA5122e0e527272ee2094fde58e24cc5d673362ce48bdceda5897217d87bd45c163b4db5fad2bbe4de4dc38f36effd14777b6a51af1d34c27280f6b24d178e075a747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584c4f2c9b4a1edbf61ed943391af668c
SHA109f9f54f218aa41720974a9918a60e771161e710
SHA25636ad779241f7cd5a67b2785b160d402191612da6bd93341804c4005e90395748
SHA5128959836c30f715e43bc83d30decef2246b70f13661223cabc12ca911b2e3f99c66013ef3e04c5c2e138273480643c78ea18fde81f83840b7e2c178e68ee08654
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a