Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
7dd81a0248df22bc818eaf662fc7f2bd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7dd81a0248df22bc818eaf662fc7f2bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7dd81a0248df22bc818eaf662fc7f2bd_JaffaCakes118.html
-
Size
68KB
-
MD5
7dd81a0248df22bc818eaf662fc7f2bd
-
SHA1
b4242b39af6f55a03b8eac262faa470b0d9d95d3
-
SHA256
ea419006de4cd1f883c049ee5454e6aef324dd5f5c4fee693b9773d68fbfe379
-
SHA512
28082177f322a9be8d8c60a1dd94d1bb67b9b9a783553a9ba097561e6ea21918f8556d24d6f87b037ab89a7c52984af1d1fb39ab1899266f0f1aa023a0a9d443
-
SSDEEP
768:JiRgcMiR3sI2PDDnX0g6KJ1j1nqUemfraoTyv1wCZkoTyMdtbBnfBgN8/lboi2hX:JVZldqpmDDTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c38fb70f72031e4f90b3c672ece2d5d000000000020000000000106600000001000020000000faa310f7d0339498e589dfd008be62d471db7d75fb8b6df660ab0f3662a3e444000000000e800000000200002000000071e1087ae8cc3da11078e71fedd13b22ab39de432873b4c97e05f7305d9f999c200000005d253585c438ae7b427b8c6787a46655ba599ee321f847786b94c4f33a835d4440000000e39925cf45fafe5b5968d7c8a564864a3b6cba33af583355416c9a88a7651b4bf74819e94cb53e395475b9590280aba7c8c96029f84a5964f5ea1d606c0414fa iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1063d4df27b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A9B5811-1D1B-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c38fb70f72031e4f90b3c672ece2d5d000000000020000000000106600000001000020000000b98f96439a7439f590d3ba0acbf6640b2a9ba0fc6ddb924bd1898de8a58b5303000000000e800000000200002000000066b47c86971887575c2381c7b6dfc0b5491ce9d2c361472c59eea53c11ea619290000000699a8db4982217254904f184d38a9e5244de2772338ba8fd2ab9fe71a023b8f30cf7aa39786745dcb19b9bc11b3448abd95060f8fa1210262256d09b54bcb9e4808a4e8b1ef60460b02a0c484fbefc8d462d7eccd2ed47ee06a9993f48c9281da7602dd5226db17883956733510b5ef2ddd6be5753b0c25e100c53c74d67e44a1527d9cc5bdc29f9d3906dd0074f3a00400000001d0c0cfed1096c434dee6f72ac7823e862ae9bf6923e7bef5994649d69f90a38301c69a48f1b394e07f3aadc73f2113d9197bb3a9843601120b36a22d85c1c7f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423080615" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7dd81a0248df22bc818eaf662fc7f2bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efe49f794cc002bca329bee67883d3da
SHA13845db875f944d4880eccef5ccbd44d431ad2e5b
SHA256e82bf037d778a2731379c9aebee3dc56ec1a2f0a4fc87c90d09f4d0dd1c56098
SHA51277a89790e0453e7447650133bd13caa375360b459c3f80c34e5e72746a66bb8ac1a152b8ad1bd2c9d52affd65911a5c52d30f307930cd229cd67313a50e26fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553dde28a6aae94c8b21eff7f66b9bb32
SHA101f6e7675182c869ee833f71f43725804a5c3c1f
SHA2565fd043e6149b8947555dedcdf763a4e7673db607a9507a5a9ac6303c603206bf
SHA512a8397c36653c80a63d675757468f18eaf5a89e0cbca54e1804a65fd77bb8793c2ad8157d0a8c6b829bf7f09ff744564321521b0491fddff38a021cd668722d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5423d36c94ec80da8ba82ba3c369caba1
SHA17ac31d576359b4f11f519434318847e01581b761
SHA25636577037b8cb2d1514f0491bc62fbfca9ef9c30821b8684903c40cfc416e43cd
SHA512edc43cfa7e2532145977b22c049a08d1123465954657f0ef3f98d1d6c8dbb506c3976baf76bdb44232be81cbda3c62c77f838604c7f5a7d1a1277e179ab8d46b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d9454cf4f3236a64f4664abc8c075c9
SHA173b65e88be85a1470c2958beb50b4381e54bea3b
SHA256183d13a5f8ad066a58c6018039cd6c6d57bdf5a2a55c5e745d1c6e99f187f276
SHA512c25c3e32fcb84f8001f79fc53917781c096825d3c0a12951b4549b274afcd7dd29607c0aceae907621acc159cddbfa927a626fa1f3fa8d5e1e8a55e6536ffe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537afb1dc3e19ce6fe855ff9a0e2533e4
SHA170a2794b6c000951d0cfec613365b43961769cde
SHA25682f501b71a3bbd17b8e21b30c4a06220248fc8655b7098cb747a9d4ecb511a62
SHA51200b5f9e59ca95a36ae9b2b6e0718297ca62affa66e129b8dad80f5b1c4debe4e8ed4bfcbd94672b8485c45b66a87b3dcb720adaca494e035ba3ffc2c794e0a35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d573e91681d5d1f743a0e82dd4bf2460
SHA1db88d9c247699346890525a81d809aa530e52c5f
SHA2566dabb0af2e4d2f2183c112ebc9af37356f76c93be1bd15ff0935a01fab4e7d26
SHA5126af2b5242da9305c318a9dae9f7d8befcfbd7b4a3dc0b4d0849ccee3b15d0002a736dcf17cae637381e96af6a1e2ce651c756bf2cbcac87e70e58da8f2b68a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58339ae108fbd077e8498a569bfedafb8
SHA139f1a594866cacaab1ce6cb2da4a4c6778b40ab4
SHA2569c3275ac67e519b5e65ec2caf8a631e097eb7a795237a6e7efd7672806c42df1
SHA512ed9dfcc5f67286ac6c417649244841062f5f924ded7ddd838679a608e57d2ae087b822f02ff58b4868aa53253ebedb4f17f359db3665eddf72ea26f2747563fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5402caa2925912231d05c91fc60b59f58
SHA144bfad538797e1d4e992ff7b06fa919f3fe0f81a
SHA25678741b7632f53f5b152cf79b4a5f5eca615adcb8e68590e2064dd3998625d66d
SHA512dcde05930ecd34af8fb3b1a4c112a5603b8e644f66d905dc328356aefda18726183689d952b7c9fafe6ae861c1892e9cefda927fb7e1f531f3947326132a40fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5774109ea99e40ce33b70193ca98dce64
SHA17d832775aa1df96d3c4af78bd4369dc3fc8996b6
SHA2568b5c5b242eeb252eea8c9c2aed705fda7401bdf40d8b89a8ad5b55d29ce7fff2
SHA51258598b08491b295bc1bd0e5b52b06beb5abdc90191d3d38d41b37fc295abc458792ec065779c8f5b992e4a2a3cedba16561c56aa27b1b9f923b8f0e9458bf688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55710e033091e024dc96a881101a5a32e
SHA1de4890d01e9af8c541b0053b26c38b8ccb053090
SHA256bcfb24a2f35791ca232a140f447b16a772f1dea828219fa773461425e15c2571
SHA512e704d5bf3902f9fb55a10a2d3d355b6102d486707e5c176171c48dd941c31e8e8e7cd3c137cb16c6ea214c102966b6803dc7a90bc56d56c58e860df4188ae036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c4f552d306fe548b6b26e06e41ed0e
SHA1a7734d0dacd0958e04dd59de70b8d19cdcf8a638
SHA256fe4e4271cbbda3002845be0df1e55e461780aa6ee6f0bb97b96f714ad4244c4b
SHA51271655e3b2d7ed56a1a6bd635ad917e75d170b094cf754115d0620e9f5749f321cc27512e32e4cf76c03934cbedd4fe738fbafc1574ee01e0b83280c131819fb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5867c20f224175fc202bed61b7eb2d0ea
SHA1704219307f22265e21ba775083c207bb490c7c2d
SHA2569bbb8c5ab5a62c2714b207ff81079042f1270f2296552add2187ef828e82b12f
SHA512c4086ab67510db5280cea28ea57d220f716347c72a8907eeb9c6adad8218bfecf0fa70b9332fbae7a4e302e0927324b68cd54d55f27eafaf197bb58a770c63e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cb98a53dc2f8cb865b050ce8c4e27f1
SHA1adc8ebc4f7ea0f87a0c6d17d5447401262b53a3e
SHA256f71fe340e4b30c5890ee486b3c8783492ced447a5c7ee611dbcbb269308494b2
SHA51268fa6fcca459d48e0bfe4c6b0db2619e989f483a4ada09474cde11331e0e1aba5e08cd90828a3c25be2e8cec7081dbdcd34ac975ed87209dd7f48d279f581330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ade66f5fb327e32d04f2dc719337e850
SHA194adb0b5d88824219c8ee343cf7e62d3fad1b772
SHA256d1e14b5dc209c2d9bd1b61b4ef3a537f167c3c14db40d8801329577f18939913
SHA512d2ccd15f38cae14c5f81bbb25f68043fbfb77261601e5a2d7f89606efe83f7ccdde101f7cf3ff6b9910bd964883e22bf704c47e5548a5bdcd1a117f3a617507d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a880fb1e69a0531a21153684f367057a
SHA1452f45461ee50efc59ab0fa67c8b0db845d5e998
SHA2563eb606ebe3837124ebe37ae1401813d87aaec30e6408503b4d95a5769775e49a
SHA512ccb4f3045ac999812a49807e7f9eb19fe6807fdcdded59998415c18517ac9aa7eb8e9a2e9bd448a0e6cebb5a0eea507fa16f09a6fcba842b6b34405e39b8e13c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50048e3ac7c43e6d4fa539f83b8b18651
SHA1b5fcd7f56ce1a2b75bae6dbdbcc70eeb09c8feb0
SHA2567cd4db89a19e7b7dfc14c8c24cf01159b4f029c2f5f30a423b54d52f70c830dc
SHA512b3fc2ae6bb36ba350d99183bed776b27fdff3dfe425868e50bc490bb0aa580d256404765ee1a4d6fee2e3bcee3859d80b105dc968bc74d89d804a0948ed7f744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51024995275f333b2cbc1302b5bffd32a
SHA13732b0089c50b26dec233f77e4d9bc67c7f50386
SHA256442f00ddedbfa5612b156e5a19c5fc0750f671ff8508e8de42016714a0fe1178
SHA5127a62f357e4c89a9e902d7fa18d1a77d1565f7682120071c5158ded26c44d2245ca293b3659c9ad9f82a2540ca542cc33cead33440c960a7ec38b127d8aadae4e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a