Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 00:00
Static task
static1
Behavioral task
behavioral1
Sample
9a4c6e70a3818f0b1083cc21b4c03d27_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9a4c6e70a3818f0b1083cc21b4c03d27_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9a4c6e70a3818f0b1083cc21b4c03d27_JaffaCakes118.html
-
Size
2KB
-
MD5
9a4c6e70a3818f0b1083cc21b4c03d27
-
SHA1
20b78f0428bdcb83e048964699ed45a2ea90fb38
-
SHA256
af7da1c4bc16104593c38d14ea810a93eeaae93aae5f190632e5405dc72bf6b8
-
SHA512
825dd2f22775af7631871ca4de1faeabd5dd0071525938d63241ef25a883ac3c1fc5c4486a87f5bf279513f91f9cafb142f9ae2a9340aa1d6b6c414ecd0a624c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b032fbcfc9bada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB5138B1-26BC-11EF-B944-E2C1BAF7F8C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f4e5cffe17322717a60ff9741c8eeaa7c5713b30984fe881a3b1c5d43d893de0000000000e8000000002000020000000a29ce9b91b0f3f3c4bdd1ccbad478dadebebc1d7a60c72e1fda7576f308aaecb90000000c4586e976be6f4c01811adbcfbb9a6e095d8e25ee871f1adeace1233ccb4b469e0590fa48692f06d85e107c244cb749aeb4c2a5710ecb0942cd1aec8fb71937b7b918e36fecb477bd56f3a461a481ee850816489bb4f33190ae9d67935234f428fb3791d7d310d065f00528320dc5ba563fc92430b841c317193099a2a9b8b9f2c8dceb954046400db6199805f2eda4a40000000bdb66d9a734974ff30e0f35696da34bb1aeafb0ea01e1137cb2e4d1e67f4bc3667a1ba9275976dd0fcb7d07079a0fccc98daee1f15d0a3fbd629665b46ded715 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424139725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000037317f432ae74d5a0df25ca9ec73331bd56fac91d99c16959fbf3c6ab81523c5000000000e800000000200002000000064a90e17d59f684eed5f18159a21c25b27549b0d4551b6169381db120921d38c200000003297acdacffe647e95f9b1ad6c5af2b1af84c5441e296584141bafa509d4351240000000eaf4bef2422e57b27fff9a6237e251300a5ac4e3ff8b9adb20b84e6c1f9d6eafa140ed3579d242aa33e783a050d12a07bc6bcf54280d241fb69461f52f5fc26a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2396 2080 iexplore.exe 28 PID 2080 wrote to memory of 2396 2080 iexplore.exe 28 PID 2080 wrote to memory of 2396 2080 iexplore.exe 28 PID 2080 wrote to memory of 2396 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a4c6e70a3818f0b1083cc21b4c03d27_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dce1711ab42e35aab04441ddc0a6c0a7
SHA1a341a3d2858d56e215314a041e0be81d0598b763
SHA2564817ad75938a1ce3a81dc917806f672f4670abc981f5733e5846bdb867700ec7
SHA512759d3815217538d7260f9183414cf1b18f3b2cbad407f9509877c01d5d306a442b741cd00b32b7ea9ef67449fd447a5f8e66deeed5e8012840c21e9b47aa4d5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504123a1d60f7ee7e3c9342b777855ce3
SHA1275956005f6af9ee852c3f57063ef1579154e12f
SHA256e4094f8dcb810b10a2ba4e709ec4e99ed15019afc66b4176a495f4db2a2dc07b
SHA51204b53e0a13b4eabf98716c5050cf2e99e51a58242866987e742508a0cdd77c4df4dd8a91316ceeda2547349dab1a99d0190b64bfc04f2faadb79028a1c648f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a850f736b996ab9060c0b0a94327c41e
SHA10cc84b2c17f4b51c10d78818d49be656388f7536
SHA256c2cd5693064bbb3cb6509ad33337939382dae33f66bf0472207c571816261cad
SHA512b55021e6561c301d4437fa67dac08d57ede2dc1ca5ed0b10f04640b03277b42e63fd415796fbdb209c1083205409c1e3cafb163dde4c05995d2c6b5781b1d925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5186683cdb0c9eb977ad8ccfd252aa7dd
SHA15f3c7e55fbd112407c2172edb0d5f2372b4960b9
SHA2566fbfbc455610c6f2b9e76f26a40edc7b8135a11a59313fbea04cecc1b178009b
SHA5125b9f767ae84a343abcd2de5be193768aeff182bbe648845d9f685a6e2a9cab840fe49e181a47b48168781efaa3a4b974368b9afcc10636f5319b8fa5195bafc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58328dab7763e4b68273fc1528be439fe
SHA1e6716ce0f1ab4277cdc3a9385dd8eded33a8b7b2
SHA256f9abeb85e9396635ff8800e11da15ba085fb7d3b812727bfd7a13380be5e69c0
SHA512bba812987808ae60d2b43bb284d700a901fb998e687efddc9a4fea4983d0cc15e2b63d556ab240bf194a6c87c8f8effa3b396ba8d2d2c4ca9b7998a2adaa415f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a67515cbab2e89a1c96454aa4346463
SHA1ed42129aa9a50c99035681fc803fb3627ec07c8d
SHA25667225a4d4cad72f53983795356fcd9806bc716a1ba320a9b85419eb38a735f10
SHA512e178fd09fffb1a84cdc1acc004759ef8326ca39c2c5c9ab3eddb27ee0d8c0eca289d1c8b0b3d6408fec0d10226674723f50fac2d443289967b387a232ef9a66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56682c22e9b31ef4d263fae27783073cf
SHA187b83380c6be06f21af7c61801b5c093eacaa6a1
SHA256874a7f1f9d8d9a91fd871e807df95aa1121ec6e73bf0829d358010043440c70d
SHA512573fbcea669d13a000cd497af0e00a1e34c2e406406cf9245d5937324182e15833b92aee73207539b0b5420d03b492237e01acc0529f1bc9c8ec6eefd2ba7849
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a26b98b1d2ec95e5bb0a836df9656417
SHA166a9e0aa525576eddc1e4d5e9b8f502b4e916744
SHA25648c53c47f4d36556c67b377d1520a1ff9a0558aeea4454b964087b0b03e31aca
SHA5129ad7ac93301f5b42296feb90aa33d5caed4fe7c7fbf3a209f1821ed39fffae3504c0b0653a81e47cf59ba40e1bdfc22e1ed2137de37dc73f39a9f39e6b9befe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b184ac2c5d3b654ba7661775e5bbb73b
SHA1be99338dd82730cef09b35721969a03b2e273c18
SHA25604103163787c8a183b4f18b6e5efeb4df86ea44548a71855b66660ce749c266c
SHA51243f41daf003df4b9c9bb672ee924c822a5e69511b0a51e7f1623360b1627b28f31531c29e401b573f5122c81708d81910e85994ead3cd0c34024143df34e6751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b9433de89d2f3e315afdd5fe22e6d86
SHA157c888fb86db840bd070bed02431918689478401
SHA2566bba2e3b081e363373e248f75f6ab4520050efc3eff51f561c37edc193b8911a
SHA512e16c1953e68d2909306c7b510dc72dd86a392a60e8c2746c91c6e51be0a79dabaedacf42b3b3a63e10a9fb289d149c75171c324c6f81d7bda0fe93ec4c71eb0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b10f196bf2416e57473374f34a0775f4
SHA1fce5f096186b9f3ef9b34921e1e41410ce151211
SHA2567054afb42e22119a3b0880b70e8dd8189fff93d975ce9fd36d9ec795f742ae2a
SHA512cab19d9f5bdf5b2584c4c2e07bd3bc26d2de4e70cd31c2340c1465de74e921d53f83f9cd7c3371918f3653a06606acfb4b1c08b478f3a8e644047d732fe2454b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bd1e732821caaa12234f120b906bcab
SHA179ca19f2a144b1401a8c8e5a108a5425572321ac
SHA256517fd4e7c036f145467c911d44240ad70b01d7d6e5eadb1ba4268fbd88f27575
SHA51253af4701ed3edef9c1d95513752eab670bed707de3f074234ae667053f54a19f32455768c334272f11b89006fa197b514284478f392d967c1640d4228f67d9bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575b6989ccc04efbf3befcad3070496ae
SHA1cd994b48444cc26f89cfd01733bfff51c83ee23e
SHA256a63765271a9348bece61b1bbf127ed9f79569877e4dc140e9caeba7930fef723
SHA512d432b7042a6c3a500bbdd708fdf16e80bf3dbaa95bcc9e837850cdea838092885c4050d7d1042fd9b1430465681a2e7f1e93a75d7ce9177e58a004f001567ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a967ff349e630162c3fe05b78589ac53
SHA11ebc0f0575a99238cc6a65285d25cf20341b87e3
SHA2566760ebf6a7c3718ec859f9ae5014050bce44b9ce675d86df2f64beadb2dd2901
SHA5123a8eda5b8bd1e69f772857cdb6f75ab79b3a72ecc71372718d62a4277e25b7e45fa2a76babd4b4f753d8447ba6e8a95c8b5f5a0f776a419dcf173d1dc7ac3a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb957d241877ef56ea8588b7590b3d64
SHA1e87fbacb6fe56ee0c5e91a820431509a33cdfe4b
SHA2565d86034acc52b72b81dc707de65a03d172e526b5e9296256726d6bd47b6299da
SHA5125c7c3535b9f6f910ed5273b3208481188fa3a0e63a9e99fe87015c47aee4ffc424e071981bf2411be2baec2b9b8a7c9883054fb35bc5c8276c80dcf849c834eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfd7e29a3aefc9aa9db7b5b7e3ff70ff
SHA15705303feb0540115256e2c27a3a21e8ca980ac5
SHA2561aba9e4300ced2cfa1760e7b04b9273f188f9a67eb7edaa5bc87be06b21edbe1
SHA5123fd235a87751be982de504ab859f2c929e560a41206da1da59b1a97fdaeb7b0900633d5dcdacff223a54ed0a029b71f22d2320c15def7570e0a59ea3094b988a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b236bf3f61bc247795e9106523dd16c
SHA11fc1a1337ac11e29ffa84b3227446557386c2f64
SHA2562492710eab8a560cccff9631400b714e9812f5d9b3e68076c7b5b6505b634274
SHA51270e68e1b683d99637fde4faa81b745fe55e8215f5135758c3623129df05fa78a4406dcedae4c27cca83e125619e3dbd4c674c1dc34db3fe5e7212ef2a98b6fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b37b914a6d48275d85c02bf97f3f9a4a
SHA1d6dc5bad3b6e15c94ab3e0491367d1ac2bd04eb7
SHA2569aa1506e1a41e6e6e28c6d7578648f87ebc021eb785031b6a7b4d7a5135b9d68
SHA51250cdb6093bb5ba452821b3045324711408e9c2f9594fa4ff1001bd5ba47d6298affdad1191d3d7f49fc5dd7231e96de3d4282484191044196c13e8e6dbedc996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524887126f9cd43f17ceb9a71caec78f5
SHA18826db1d81756a165d15348fae45b67119967fd1
SHA25678068e9b6a8409e20f3b149445929b769002201ac092a22bd1b9944e7fb42770
SHA512330bda90cf75b1e4f227e767892df3132507b3940d2de144200f89eef7c1929b38896593edef4942d80b1ab2daec58f5e31930653e32109ebba02d1ad2c556f4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b