Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
aefefa15c4b1455d1b6e6cfaf35c94f5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aefefa15c4b1455d1b6e6cfaf35c94f5_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aefefa15c4b1455d1b6e6cfaf35c94f5_JaffaCakes118.html
-
Size
96B
-
MD5
aefefa15c4b1455d1b6e6cfaf35c94f5
-
SHA1
96ee07463b338041b20b1808910052b3cafe4375
-
SHA256
0f2ebe34d630cebe7383795d130f64d201a766d7bb6d2e848bee6ddd85f671a7
-
SHA512
e1a59467f5f4ecf67135ff9f6694b538e0888d8141d0f791c92caf363ec5555048981f497389daf9998509b5c1bd22aa1501ede82a9a784bea7704ac0b650178
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005912324a31f4541b4acf1dd69a3fd1200000000020000000000106600000001000020000000c41fdf4b24ee6bec4dca48544f2178b6051f50caa6d3f910a7cd45af9648209c000000000e8000000002000020000000a3deb56c7d15e1fff2c436721d3fc2902f8d4149dd4b716fd1e341ddf4ce4d0120000000244eea9901f1e0f60124380cbd7a241dc64739b2117270ef58aaf31aa6cc5c4d4000000047beb6775f1bc8a91b812500eaf229aa6194d40a59e3eb1c16cd1bbdec8ac35c78a0932613a8154488cd155672955c013baefc461210997556f443c6c6d1840f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ED59891-2B28-11EF-B1CF-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424625627" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f8722335bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005912324a31f4541b4acf1dd69a3fd1200000000020000000000106600000001000020000000b4463f27aeaa0d2048be9876f3400414de605cd6cbb81ba5afbe8e03babf0ca2000000000e8000000002000020000000ea24efbada1ce56658ab05ebc3bc501d153a24b9794334797948faf17d38749590000000db651e936d118b2823ce927922a2bd6b09c3afd39bf9dc5ab80b21e13d8bf04ac1d5774efd63f2464c9a721f79d02960af8d22c4cdcba999b9914adae84ffa5bfa376769406d727ff75fca84a483ee62b9a98a4af302d0539146a7a3c7216991c7e1aafb245960cbc3ab33b2d1fef0e539251b553f25b5fbefafd1b55dd96d33b6ddc4a95538f42f12efac3b2bc998594000000071ed9dec1be0013ad6c63aa9d0a81b57522da66d53af05272a6a84a6fdbaf60f2093bfbaf0fea9f5fb55ae83ff3fa84f4ae1880abe9f6934e40b71476db0c4cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 1796 2168 iexplore.exe 28 PID 2168 wrote to memory of 1796 2168 iexplore.exe 28 PID 2168 wrote to memory of 1796 2168 iexplore.exe 28 PID 2168 wrote to memory of 1796 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aefefa15c4b1455d1b6e6cfaf35c94f5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51834f9718e2a42a2f6cbf8b656aaee55
SHA11bdb1e3b92140e085b214bb5e085710ca293c203
SHA25605085f0ba99547ae415dd88fc5823f322638d88044ccc6886a0789129555fcc8
SHA51249551f59322b7a207c9ac08d15514f38ed43e7eaf8183e835f3a9b7f41955f03d1cfecfa8bf016e89e4f7410cc8706764252dd6c03b1b450596def7ad3b9d9a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a62af3e1c4bfce88d74ce63c50738b80
SHA193146e1c483b9c00ed729f00b342ff460a79d16f
SHA25624e6996cb8b3408531a3dcdea319dade19eac83dd6ab8c50b7b1758dd45ac750
SHA5120eefe8722e3638316ddd715e067482c78515ef4f843e4a5ea58c4d19707bd7e21379feed25dff902ce1b83c8d6530dea67ef4fe1d0020734478d13a679ac501e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5234bea9a3db39c088c9107cde32978df
SHA100f8195a9347993b3f52acb55f838a0b627e5a76
SHA256398fad5d70584ecda69bda531b8771a662fcc60000c12d3c6692560514dc4305
SHA5129d778968148c100d08b61dd9c39f447e40dffd37b84b1e6cdab29aba3fd1f6aa20eb1cd73cc04ef25676c11f0cd28ad5b79cceb920faa7168b6c90086cb251de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52040a2fec35bfa4922a7d7194f295e6d
SHA1665639b46866b7461443da060b4ac4ff3f4d23ca
SHA2568adbb29f71e7fb3d60cc41731b670afbf637af11ed67e6b2cd919fcd08a46983
SHA5125a2370dcd350a5d24321577d14180d8628b3a99beede384d40a2fced9a639d3338c41eb9ed6f6c0754eae411fbe5aefeb3ba7af7ed325678f4ffd50b3e50be0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f1bf964200faa1a9e3f7345fec30e2e
SHA175307ecb3d7d27d464fab2f2d9320888f70de7cf
SHA25646cd7eeb831f162b2749af5bffa77263fe98fbcdc3542c4af107701bb548ffeb
SHA512f6e17e34db19a36db2f37df82c40dbd0b2e1d29b438de57f09f0598b63784b072edc1b39e145027f8a0f1b743c549793e00a2f73e29bc7cf159094329af4f85d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528ae392fe604a8f5368bd1971196e3f9
SHA1c40ec9ba583142c732434babeedba66b72be20c2
SHA256217130d9bae211dac25d88835bd35f1d98d2f1b56165fbaf3db91588940a14fd
SHA5121c63ab24df6bea918308b3eed065800010c955a738c70019b2f97ac218738f9b75009ab0abbdf55a41c4c60ba7f62c449699f192ee2a9127582f482e5822ecb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5396cca801ece01d30aa42a0cbde6eeef
SHA1b6b00f6552642a9ecb778eb4a9b179b93df44633
SHA25600506a509fb108e9bf6dde702523d1c7baba69205dcf0100b9c443ff369b8949
SHA5127cb0d35a86c83fbc4b978f4befd1d8149400fa65713b3c5ed35996e10d6fb0d1035c67354dd31ebf4d96569c918b571b0a80c8c5612027718b02a1a1596e2517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a67b9a3a0c0158f5d224cf357d12342
SHA135945d294b98c391c7e8050a335b2c2a852eb10d
SHA25649a94af6ea7eea501e7b81931058eacc48368ad2219e7742706f445d678b5ae7
SHA5129bce39cd98ddcc09846a9d3dd1db371d7474d6147e3861461c99ea9fbda5ee6f8b932ba0deb08f6866d7085e5064a7a54a7d3224eb1217092ca695aa72ccfa05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5324f4e762bc9a2801dfc5578ad617868
SHA19bcc5980985a59dd76a19c2c3204ac6627ab6b29
SHA256a5ee13ad40a13a7a61acd4f678daf88f5910e48c1519beba9b1e759786b3f637
SHA512ce8a64fc7acb1f5e5faedcf60fcec6a0905c20d6e3963e06b8ee74445a33d56cfa29d6ddea4fc538b9cd6b2ac73101c8e830039182e7d75233e88a319a3742ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5634f7671b0e5acd6da736f09d80ce2ad
SHA19dfe7cff53d4ae167e228c121d5481bfb7ba44e8
SHA2568751f3976007ad2fdc320aa75c02f0d31a9f8c32b77f4444f29e21c182f8e24b
SHA512c8a22ca039b7784f98b71a6dbfcda8820935e9953982ea74f517cb94ba4937a960d13d2fec2572bf545140e94f049d7ca6650338fcaa4e843d155e63efb0d19f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7e66f851c41a3b6fbbe8586b3a9915d
SHA19df9bf63cbc73713010bd9ab19ec72bdbeed8002
SHA25641b0d35905f3c5975c0086153eced9b12be02f514025ddfad2a087792029bcd1
SHA5120a9fb699c0324c8ece8dfeb3c099b075a7ca096f978a5363cc0776b0c2b9cb798b62ef3556ff0d7a8efdbb917de474182c1717ce294a6e9f4a83ab5c353d6830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e10db72ea549a5870557aec181bbcbc5
SHA13ab1e4d1d1aad8a550984aa958aa5e710396a679
SHA2569eb2065055fe329a3dd45166062aecf7ac7fd08f6e9bd4305d22c23432de3c03
SHA512aafaf9a31514a8375ed1dc7058237cc0e1ab89f754f1128507e3af0dd16d814a9ec3056b14bcd70606ae99821e8d8504f8284c075357233273d73f7da440d2e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1256197f8c9a084f01cb5ee48deec13
SHA1d7a0de90b970fee3a13e9df4e3ff65e6f0689942
SHA256ad6b57a1d58e11738e55c1a25983987428c30718296e7f8f6aaed063299b991f
SHA512ae367f52eee88f02ebf033613206d5abd2f0f1abfb2d50406dcc322a2959004cc61036b897ede2859389dbd4d46b729de30e47b7db8b94c18cca4fa0430b28df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5945ec96ea4196cc76b40a9bb5a13b6d0
SHA19e525d772845132c62038eb593a3aa5511c6ef60
SHA256131a61fb2743028f5fe86a2e0c68f9eacc298f63464ed8e0e5eaaf8582c86709
SHA512c35079997cae249e9d655296182742dc3fb01a6650667c08a644f4eb394a406c48e3c3c4c070df52ebdfb3fc7ff63676e8bb946d3811d35a6ce4f5a5d1e3d383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55371866257518a81398454c9b51377ea
SHA1b04ff391dcb5a3ac6c6ee75f1bba29de3a5d8202
SHA256cd3b76f98bf23b00497f30c3c04d849e059e7a1178772d4d0a7e00d8e36e2acd
SHA51289a5d98cb4514ebf4465e3bb459198f1a8b63273a2d3cc29cb7f2e540688f81599b4b9028a2dd9a0b71f0a0ba8947accca02af47f999a8765d0c9b623c1b9175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c878d5ba8a4b3e83a20da41543eb73f
SHA17c220792418399e1575f88d8a453cdf5fe77a958
SHA2566cbb400890f81107b3bb7e974c55ec60c62dd57efdfd02ab96f71d8c10fa86da
SHA51215fbe226f8e84430e68b7b546e10c49ef8a55964716f062b46433398b7285bc5d57a189d52093b24624169346a073f987bd9c6b14234be3868ae4af5c4f3b829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5353cf30ad7421dafcd3a827ffb3cbdda
SHA17a35c6a8443d941feb38e8c0fdd9eb3a0fc59f65
SHA2565b2fcd32f20e01218a27993dda49ffbe1714d34aa081ecfb9cc05714648e4858
SHA512e385e78c5ebc0ef2f1f173c2ae40f096a5a58575d8a8bbb3ac0338d02b8fb220cc6bbb0d572a5d50f6b8343049c8a101e88538efd86377003a62619023daaf54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbe3718faad8d8fc692caa66110d40b5
SHA14fad9727ef4f450b484b50573dd967a2b26bde1c
SHA25661af13941ffc6e5c507fff9de34300553df746d88e443a04103ee254b5cacb6f
SHA51201a4972a3882481bc766bf2e8ccf407ec20b909aeaa8daf2fb687f8453dfcb35e92e5783851af1664b4e94742f0a5a3e1c0d6f1d64fa2952b2eece70ce903c35
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b