Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
a2b35f7163f15ed1fbf58feedaef3f4d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a2b35f7163f15ed1fbf58feedaef3f4d_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a2b35f7163f15ed1fbf58feedaef3f4d_JaffaCakes118.html
-
Size
3KB
-
MD5
a2b35f7163f15ed1fbf58feedaef3f4d
-
SHA1
fc98f3017f55b9d8a65364616291915fea9d9260
-
SHA256
f9e69f395d25b4e59ad693bb1022a53362d58c5b3bae06bc108c0abe072a6222
-
SHA512
2038e919aa186f86fe1f9be88ef5ac5b16cb585b1e5733fe9dc75c73723eebad52eac761526d480233269ffbe921fad67796e235ac8c5e7e0e8f685a4967bf03
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c31ea98e610585de3e7eeddf165aa0520b95e62f78379a8cac5f27d315581d20000000000e800000000200002000000054dd9a3f9a926117193d0d3941b08988fa00967d6f10ad872c045a0b87a84c2d20000000f925db875b6f7af39609abf7917b9fa3a53af7b0ad7e6c67ad89dc8904bf2685400000005a1842f15a5dee91d078433336f988efca8983fb96987c1db3e7f7696e6e2b0a9b4bb01d5a54e25783415f7fba329e26f6478f203181435c1e03378db9a77102 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3217FA51-290B-11EF-9302-CE03E2754020} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b0d9833e5a7fdc003e96d716ecb4dcfc7a666ab8356a7561c147ea49e77af972000000000e8000000002000020000000e4912bdc47912d2902468c364473336c3798bca82ab54296bb0e97fb5168304f9000000036905808729a1314ca3fd590c4c72b4c591f6eefb5cdea7819b26adeeb2eb30b5cff9517a8f4d55b87c18647945629854e77757a2d8d11243667606019a9e1f5a79b59dfea86d8b49eabbbc4080dd18583b4a26d4e267f9053af52bfc674b3bf64e5398a38aaf52705c897f5c157c742da248ddff9e5a2c9de50abddbbb840f82be5dbb8b67e6305477799e477f1c5cf4000000008aaf35c637ab33fa0d4cbc0463b26f1b4fd90331dc15338d4ad4fbb4e75e39f6554da21ad83c0766f8126fd8c1346484c6fa2821a5de8c3ae9ad55fbd06a1a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424393220" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306acb0618bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2b35f7163f15ed1fbf58feedaef3f4d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512275fa595d93cdc6c557318c4b6e4a3
SHA1a8438e9c0c4c6a53a5b0aa0476ddd92a60c45600
SHA25623840950202aed7a1373e7dacb4535d79d44a6574fff9540d7ca855b91769953
SHA51235b91f034e87bccd7d950d3a48e29dd9460f7dc3e9bfa29dfd72251e1c3586e200db21451954c9f7156067d50adf23aaa4cc8f1ebe9792706dbb3d177ae977bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58335d94019e94b0bc8faa2e121ffbc78
SHA16c8a9cf1bf36d37a3755b954a4965c97edc3cc9d
SHA256a72750d2312da09e56827a62bc12bbd1c57f96b71a7fe098db6bea7503332c43
SHA512cdeb3ab8e089b1c4425b9c4d20d9b5c4e3b4660f5440133aa4e7f3b8bd731df6c01da77ffaae06ef70a509a273a26ddbcc933509d0ab5b79af203ba2b5d9e2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccb96861b4baa088b3489bf40e581b74
SHA1b8c5d66d0ab63e2d6c2861b352ac1fd44f74226c
SHA256cb84fd3d5cba5285681806f961c9d55f7b2892897e6094afb296310c2a5a285a
SHA512339769efecfd2f0698827e2863bb9c6de5e79153a353229882081a749887e86fbb2af7ddf316431d8645707ac456004d1de4033251f9cbda3d94eb330b086d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e8349ffa15323baa43080135a7a051d
SHA109d40f08ee63e6f370695712279456edea330fd6
SHA25662ea80080a03fbe651734c937f9a33ab419e84cd465a29d7e21ed819794bdc0c
SHA5120e2430522c3ad9e94a2f94ab013431c6a1e056ae4f8ccae48ef9ce879745151ba941505eccea0a4df626e6400022e296f50182f8f1c9305f23ec7bc6b46d3e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ddb525d9d6ce72b3ff9c4fae21decf7
SHA1179d584587bb521cb242cc848259c06a5193278e
SHA256720959d3db89efc6a7ee9188b41c951ae5f00a7364c6b5c5a641957687bf76bb
SHA512e8fdd2d7b2ea7e7468a68203f24a2881244a5b15a98b08916bb4c4c090b8c1dbc1c4c851dcc0fb481a14e61ee2bf914de1cbd2a28b4d77210d7b6b82961ea0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7996c915565e027c9069a1a89e163e5
SHA110ddd345159b3ec88c8f00a54855528aa3c096b2
SHA256922625e996b2d406abd25038bc05ed1627d15706be8ed79ad02a0a714fa55c00
SHA5125d5e21dbe3788feeeb50c102033e52ddf046985fd4d5758c676c8e58613dff6243c6428aede3e3acaad8038b3e3fe715fc98973be12a604c886c1324e57d02fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595bb3ee70826099069ce78937a05f38e
SHA1d7e23b5ad06585cb5e3587d796630488a31dd982
SHA2566e7e71b458aa74ecebbf87627a195abf9b2551ca2b888c039476195abc4c62c9
SHA51286c53632d278e3c2b216ade5edec6d41eb91628cc96150d115d629f15e77820df0c3b14f0dec776651f4dad7d80f92085c4aa96f685f88d8b555c4295c6e2905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5572f8b9d10d86672adc576a563015df5
SHA1ca0b04dcfb530730d66c1c1f134386c049eefbc8
SHA256bb0247fd40981928156cf3df26c8e11faadf04ef61ae19cff744b99275ea53e2
SHA5122159c652135630c2d7f85b1cb17f113f0142f4391a135b6fcd270448cf0e4b0fc288fea77e81daf120d5d32559f1ad915b7f4270973598fe830295ee1a98cc2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5146645aae69e0d7e5b2b8cb9f785bca7
SHA152db3a48f37e36a714241b2d82f3fad573e11bf4
SHA25675c6104cd50750bf867fff2c3821a8a025590480259a6420bc33aca80aa5d290
SHA512cf053623c657ef0d35d99d2014f3063e44fe8e8d25757e45511d961273b5863dc41250cb94e94844681db0adc710733da660d6efa9b79eb48b38fe30323ce1e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590ca4211a0515e0ed5f67cd9c0f9f4f7
SHA13f8dd1afeda8d938e3f05a4c22814ca0c5d567cb
SHA2565dbf12fcf10408252389e9d851e105e21c204d8381fba97e0be0eb4f1a7152d9
SHA51291065dbcaeaafa526d94a745961a6ee0f7485a87b0e3da291a087a78001f7177b6deed9379410d07aa1187e8414a6a930da55125d2556aab5e973bc55f485b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c5d709979a3e0d918542d5ece6fd48d
SHA1a0bf23042e793cf8f102f45b02830d61de2537ea
SHA256504f8dfaa0ec81205f6e9b93bcb1ac88fdda1b26ed14ab4b566db38057dc14f9
SHA512a9391cbb98d128c1bf606f36d2f9b839126d70978e095fc717bc02b9b7ac2aa4e009f0f1893202870d3925a9d3ff69f375c155487da330232b744916923d3d1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5789b3fabafc2df08321df7aeffaa3207
SHA151b0c28d55c0f7796bc94e4045596eb3fe2a0c9c
SHA25618ef70800e4e0ed445930e34621b5c62b3a5461b51d265d414fb1b58ebcaaf80
SHA5126eb57d27c935be8cdede30d3dd57255a0b8f1e83ed006d62a5c65631e6a7c9b96ff97935cb2091a53fd01922200be8352bc0913763768e816a404b46f1b93ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53cdf31ed811e6e0cdfc1f211ac7ca3c1
SHA18de66409fe60169cd36a1cd7d51639409dc0e6d5
SHA256ac2d66e84ffd6a34f024f339e12c6c0cc35415a3711f7c10e9db27d4f6980175
SHA51238ab960dee28e4ebc89f702507eb6263b2e1e39ab373188ec6e93acf6f2b39763aa0bf49ce02dacb206089376af2ef317fc0f06843b53aad02ebd4479409c979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541564fb5fe426ca8b162a101b1c5ed74
SHA1b8848086784cb0f647b242f1a51e17c47382e9a7
SHA256425688b4e52be6b9bac71d03851bb7b961f50f9bd6e44e185559119d54563034
SHA512886d547dcf1825b50693b3aecf94d1ed4442f2417bce628e922dd4dc34ec079124afbd8b921891cf1119178876d851bfd1732ae2adbba5c539f284ed4bbf1ebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cacda690d0ee54a225aff4bbb332aefc
SHA170adade0351617facba730a63623ffcaa87ae4b8
SHA256ab645715d655f1ddb636bde61b32c799f4b6ffb797cd1cac0fe4380528a7beb6
SHA51256c4217ce9da95af0af0410e253175ec663e759d57f52fc04124aba0e3fa9a0fac522d0edc3fe8ff60041af0434b675c20820dcb55aef831cd511f7a83b0acd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6d552f1ecc26f671110867ca6499370
SHA1bed95ec7afdda9ebda61791c492278845738af99
SHA256a59c3498c9eb6caf966db82e7d787e036128305b07dfbf4e08cbfacb71f5fa5a
SHA51216b920a846a34e2710a23e5af4ebef7fd561dbd2fa2c478846be958bd89ca2f514b5060acfd9519c3ed6032a3bfd466cf61e7b9e9b4a25e9fb2feeed2d9baac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7dd116a69e157b18a6852ed621bebac
SHA1a73847e07ad2517e731f357d9a260a1fac75f838
SHA2563b39c06ac17a44695cbfef88d75b85f65cfd0d2834c8286d3022c0368ec7d65d
SHA512c7e4078c1e3e1b1fbb29606cb5aae4c40df79039624e3940eb4f01599ed12488edc475c64562378037ea4d9a89fb479506b75ac3057cae8b4aa2d0214ff05cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2872a7d4a6015367800dde13e0255f6
SHA15c338f814b92beda8ed0a11847bb0a2d29c51cec
SHA256d447e62a651cc068b3654c0e2de00589d4ab9fa001e49d9e2b47df34f5e1dae0
SHA512ab9b2cc4231c028564bcca6b424400fd804bd8277b231c6d1e25ca0a99999e18bcdadd74db7736d253c1cb772e724c7c9e85a8bfd941adb090db88df9e996975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509573e201b20807153ab3e8cbdb1e4d5
SHA19ec202533370201666af782f1344a60312e5cfd2
SHA25662654ba62ce745d604640ec4a426c0b663e4e3278a922032551e5128fd83137a
SHA512fc99088299ef2d47cdb44948aebeb0c501b120c685c26683d6f40af162cbf242b1943ef6c687eba9e33e47f6e56ff2e3930d89c2a0f16bf1f1283a4afda84a72
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b