Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
8ce4ab3fbd2dbcebef2e1d3bbab66c37_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8ce4ab3fbd2dbcebef2e1d3bbab66c37_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8ce4ab3fbd2dbcebef2e1d3bbab66c37_JaffaCakes118.html
-
Size
917B
-
MD5
8ce4ab3fbd2dbcebef2e1d3bbab66c37
-
SHA1
e979dee33afa2921b45c9b9f2c82bc3a4203a026
-
SHA256
62333f23d75dada9befba2d553b2b5b0a50dcd0e884d5f50057ffcf8431d4428
-
SHA512
e3e3d6421e867459b11d9535cab269f0f9e47303287e99383a1a71074faf0318a4fda634af9ef9fc3ffe0d36afb75fcf01bb30a5c4b3baee22b1f2105f4f4a5f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01ca38aa5b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423464441" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B60E50A1-2098-11EF-AF73-469E18234AA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000390eccf066a6e74d95cb4ae9674e295d00000000020000000000106600000001000020000000895a51240b99b737bfb18c10e906942a5c02b3743a1b6e27aa2a91c276e6eccd000000000e8000000002000020000000c595124e3f7e7680354aa9691605e7d751ea19a05c10b29c6ba36fa73b80235c20000000d04b010e919c2f36c59209465c354cb7beb19ad26d080986deee3ff7c22ab48b400000002e82559c93111c44736cb80d76280c1cb04e4e0c4888d977f6f5716a2c881286f3d4415020e29a63899001741822b7e11c4b2a3bd00dd0add0b2e04078f02785 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000390eccf066a6e74d95cb4ae9674e295d0000000002000000000010660000000100002000000081719fd58cb354c0f6047520ae47c2ff5b197011a3fcb691287ed0d8b214274d000000000e800000000200002000000093985d5f1013d5ef186bf1678015fec365ab5ef6fd13b4701ff083f0f283b1a690000000dc4114013cc087a8931984d49cb0d5525c48168f965ffc119a9d79eb13fc04e132766f4f59de588f038531bbb63edf5710435da1826221e5a82df8f6272137e5352b5ab2c74af37947f60f47db16ed4c7da167c59777aa596bf9062a9d53cebce4a3b17c643bfa5227ee2fa634115f0821e3e6dab054dd24711802e9fb32659675decf617ea70c2727f62c5cb510a67a4000000030d943d4fed6fc84cf6f8a364bd330fb015c6d963854df016f87c8fe272ed71a2af95ebcc97a606f4d5ee52b18ee13bec2481fa927effe57550444849d26aa0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28 PID 2740 wrote to memory of 2200 2740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ce4ab3fbd2dbcebef2e1d3bbab66c37_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5862d8b636ad4843e3653be86198e178e
SHA1426fe0243f570ced195f4f5d1548d6bd74f87d78
SHA256aba98efd3a878e462da2a8b13ba315f36d7fff7b36c5c7c205ba617acb8e66b4
SHA512dcc2e41e7660ddb3997e9a7e5190c07e418564c52675ff34a7adbc42557b53eb64518e133f4d2f9ee9e3cbf53cf9623306adc196c441e521f7d5a62585f5ba3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd6b1d7f9d8abf2b28971b4d7e878b21
SHA111f3665945e8ef239a201c678d0848d217487709
SHA256280350e7f90f58108b156a7b63d276182bba6d2c8b562f558128f2da467c4169
SHA51287e3d7f0c1df29e4eb3f694f5b32eeef627538f098edabb33625a78da30d9575f87df9ad61e9319138fad6b5cd234cc36d02148681bb36f250973474a631b05a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5091e1bb4ae6de7100be68480e32d1aab
SHA10cdf0109e293291400776444b6da12cd96368d50
SHA256714a82c8692d3185edeef4704631b8c29480f2338ebfc042ad708a2b0c9902e2
SHA512fda514634c6bc47eee08b249bcb7bdd8de458667019ecb34fb1470beb3bfb151638bacf354db39a044821cd9bcdeb68c37eceafc77f3a5c05008060a41f71030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7e3ef318808124f79440b2861325edb
SHA1ceb85ba0281be3cef77174462e9397975688ff79
SHA256ae7707c99f8c3d3602592403e4ba18ab251ecbbba86660a890144e5de44c8647
SHA512c33b71a93a9d26d29234007709414a03bed9bbc2fd84a925d6cce596d6a0ac6c220d0ccf8a5cc5683367c878b92ae5f1f4508520e6596cad768fb97a92c7d2ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5968ce134cd5a54f496a0c1046b86b884
SHA1e6bf0920ad158219da6b42534d1d85b3870810b7
SHA2569e4f291a9671c2fd4fa34f7857c7ffee7e23f29e69bc5e2fedd2689438c6ae3e
SHA512deabdc283ecc7f6e274630f10917a7841e57b983dd20ef9419aad54a023cea7922b924a5aee1821ec8ad491ef08d60c5107d495dd8e0dcae792c60842c5f03c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54aba7e9b6a10acc4fec6b6eb8cac4ee3
SHA1791f16f52df1497a4ad016e7895eac86878d1525
SHA25689a0191d502cc3134430c7fbe43a42cf60ce086d5ba47521c12ffac23f92ed0b
SHA5122fef86d5be71d3c471824c81fcecc501896fa694dc0ec3a5e9eb8b7e67bc626adc89966e2d61e3a5e12066848d73b1ff5e0f1b2a431ac82824d96c211cdcf230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522b1379b96fe8b7c5c5999263d5a8dd4
SHA16c8dc44a15490c69f1893b218c6f1570cbb23a28
SHA25672e28969ac01abafd3f13bed0358974f12bc8e49a2226de885adea725051bac5
SHA51298dadfad8fe332e1a3f2786c5e912b689651d58ddf7146f013a767b233c3384c529843bcfab9dbe1ef4bdc6a590d2cccab50cf3c1ac27e12897fdba13c50832d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d60cac074cfe3c51f3b86bd0f8c8258
SHA122032bf35bc7c8e901eb751b6df42eda047753a7
SHA256dafdcee5bc21cb1f8c61facf534dfe901c7f2556fc6c8fbdd1e1a247a4b459ee
SHA51245945ddad21d030503116cc94a84fa265e9f2e2aeec07386947c58eefeae1d6e4eebb03491af41d22dbc5dc838fb60e7a20ef43559abdcc723b91451f068bb46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f908b8fcdca54548e5fe54d861376d13
SHA1e681c4e8e8519dca2cdb067bee8adac695d17835
SHA25645ad5f2d2a690058f833c70d72dc0b8f218376451642f13925d40284b3f0155a
SHA512bd74afc33e1324653d622d44aefcfebd4b5b100f69e000b45e6340912f9bd491b7c6397a4b6a0248f3dc4540b3cc752e0e48334a32de6901130dff3931088430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5659e43420b4c3b7e8358ae3188133da5
SHA1d253f1c6952da973255d5f53814b097aa20b83c2
SHA25600a97d5c8d16a6685347c3c4d2a16a4e10d6359592de23e77d1af08a09d21212
SHA51271b6066cf4d57faa132bf2ddf7de122a06faa7015f83214dfb4e107291702fc898d24a9f04ff11d4370ff409170a84d4bfc517eb140da6f952b98fb5f30b4541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e1acfd8727badfbf5bca84105577392
SHA1c66b6be0bbce2c88b61fad44a5032a03c9006c4e
SHA256879fdc1380a72f2d7933d37d49bd63d6dfa23e596a82c6cb888f3acce4c47c03
SHA51237d0264c662e976d47c0c9fbb55252c3eabc4060721b8746f0a6031aa8e8739e29223e4b842524191cf2ab62ae93f775d16f1085713ce07eca9d6ea79a0b7949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1d9c35c54b905279dffa50d9d3532a6
SHA1a4135daa7ae30acd70efad73775166d188cec78c
SHA256a1329de146bf917fedb783821e28a1d39ebea3a106a4e0f3c58d3b5975fc76cc
SHA512c83b9ae4caf0e2dff4c28bef48d4a004bea46c86f590d1a2cd6cbbf84316e3d19c212ee5f9d30c70d826ba7b1f2cc5d872c5d04100588a61aca42ed6c0eb13ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c5f55efc2072652e1ce56c8911b90a2
SHA14a7ef00d64a2ab704c076c934395c68a75508a75
SHA2563155a44aae4f82403fcbc8ef77accf096f027ef2ad1d8834a4cc2e5fb0c37f65
SHA5123f23da94828837bb539a322cb1ab56178bd0af408f8e31c9d54f60b37b6172a717b7babb37289ede2730368352e7e81f291576fa570ac68645930d5b2b8ef1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56477e542be920f40b0d681d012c3d523
SHA1740ab41d50e244bf3a890e81e1c50a7048aaef04
SHA2565c3eb50714363d79ec6c2a8ab5517808911b8b56250782036f877c47e4810404
SHA512268ed938f6e9cc427a2ae64cc4b74fda9eed222e857aac629e614d908026f474a1f65005078eaac62ab25458909ecbcecbc7e8c8c8ae36e660819ead1a5c1686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ccf72501ebed68fd2bbba5262e93add
SHA14e85f0854f47e8cd98f60563aad0fdf2e564d808
SHA256762464ea43ff97890e4692a13bfb6bdb6078bf25947e0e72459c53d63e4cfb91
SHA51202a89ae614f22124557642d14802b5ebf56e028b49630497102821710adad1c395f531fc4407ef31bf38b02e3503440c458cf73c8c3d91d209a944497195c295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9e9d215ff5e65fddfbce3e12e7937bf
SHA1ec2cf3652812538e98a7b4252cdf484d445161c0
SHA256848798445810b40422bc3b139f5a07dc9a7fb0a2d3f3d21ed24f1501aafa9ba5
SHA5124ad24fc441332e4343db85361556631ea784b646f86b7341a2fdd8781d7ed80256bc883d802159414eb6c488055ec9c1d321568979a92567ee76db21b8ccbec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5062917c691860fded91bf8e306252b94
SHA1777fc2b586de6ee92fc1eeef8cb66b2296f10ef2
SHA256570399cf05a4d494070c7bb68b1f1bc052c1d9d3c332b4639f148855e07170c6
SHA51209449cf592281bbc198c4873b02ceaf63e33f353ae1bc652ae76597228d6f877f1b091c06bd25b9f6375e6b941b6d895cef2f46c2c901fb8b991376b07bcaa45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dbaf3d8e72c222475dc881eac847b02
SHA1d277e7cc04b4262d568fdb55ca4c9e5ba71e6dda
SHA2563e64026153f99839b7a9423c7304fe9cbc4d6cc0921702d5fbdce7fba4f8577f
SHA512b01b54202287ff66a2f8e50192ba6a695e3e41c30afc90d96db2f85d5dd195da12bb7c887f1610a507aadaf3b0378422f6afe4f3e461d87fe9878a61c8a4793f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d69a9b8ad099ceb9b8119bc6535476d1
SHA1a7c15ebd554380451924f14ee9e141e33084cbdd
SHA256d592fa4c724154a96b18b67a0aaa8497522c1bcde52db4e6b286f595d4250ee9
SHA512688d79f870c4a08996327bb3300d6afe45d4b92882a966939a60e52e008feb50cf1218d4359946d7fb9380698070b257f1b1c2a201f2983b39cd3632e4f3ee5d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b