Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 04:07
Static task
static1
Behavioral task
behavioral1
Sample
b1a8f069359cacfae4e71587fcaee4c2_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b1a8f069359cacfae4e71587fcaee4c2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b1a8f069359cacfae4e71587fcaee4c2_JaffaCakes118.html
-
Size
4KB
-
MD5
b1a8f069359cacfae4e71587fcaee4c2
-
SHA1
22dbcdf51551fa05c0e0979447effcc4e6eb9dd6
-
SHA256
0e536caac0dc06e60efbf98677e626df1c79ea12f6b83c4712f93afee36ab7b7
-
SHA512
143b468cc764a1834b8f375800ab0af8ca2e05b2d537b5990cf71fce67d3e1a026c3d26479e6970cd08d25e42693afcf9a552c22ef6135fe93892823e6d00d4c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oKNh8tcd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDL
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F21F8C51-2B95-11EF-BE23-DE271FC37611} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a2404b1b850ba66282e1f7d57ed030450ee538767aba43867cf82afc9a94e654000000000e8000000002000020000000355689e621104ac2e164e662e5c36cc6eaa8f0f5a869c7f1077c6cf0556ef0ca20000000fca816f5b260c21a0e9a15141aad339474aaffbe0ad4283a80fa46b17b0e8e8140000000bf66fb57c05c487e5b6acbe5731af86b3ec1608da35b79b06b6710a4bc00d699691c50bbc6bea1fb87d2442fc6c763def4ece8480445ad88f02e5f9c4732ecee iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702dd0c6a2bfda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000093fa5ed95dd38a5d054d06a2f5e28737cac72579266e4cb36a2748581f7383fa000000000e8000000002000020000000669cea1df7a9eb5a5c08472991b4eb72c311b1a4fc20d846c403222028ac5f1890000000d3868675b2c46672760abdb60c6295fbd81767f0de4fc1fe83efb4a470d4044c4e3cd55c6fdbef2e397349ed8e13f19eae5e29febc2ec0c02c5173adcfa1455ac4c1a3cdb42f496fb7ca3406dcd1d99612ace07ba5a2021a09723542b542944ba80d93ab518bac1f8a793a7f42e34930c8e36fcfad1c30617d3faa1bb969e14987e9a6f074ef13c631787af616b4281440000000a7c7dd9accaba41a3181c22cdf6596dc179cd73a6c4037bb971050ef47acefad06cda04cc50b8e281fb795c1455a046f6a1b3aaba93ca776ec2892c23e1fbeda iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424672718" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2328 2540 iexplore.exe 28 PID 2540 wrote to memory of 2328 2540 iexplore.exe 28 PID 2540 wrote to memory of 2328 2540 iexplore.exe 28 PID 2540 wrote to memory of 2328 2540 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1a8f069359cacfae4e71587fcaee4c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591177106966b11b1360b71c26ed77ba4
SHA1d0057bbbfcf51eecdabcacc2ddcfd006a5f2f2bb
SHA2560489119a2b6752aedf608da0290629dbc86730eb456c68f557a3d4bb18df6baf
SHA512db48f0db4bc5903df4a255fd23f0f9707c4d9a99aaad11094f7422bcee090c78d075c047cdbdace660da3f161c470b1ad50a84549f4086280c95823967366baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f18b6032d09a9cff1e389710929f5522
SHA16847ca222b6d27d4ee341fce2102d36312468899
SHA256e7968a8a70dda269efd0462e554e1185261ad7322d63e5bf87a70836ddb6e21b
SHA5122c281da9d8d504f8edec855b2b3ce56b65f0de0612d9d3c07b836ca8213c8a62a35d2a76bba518cb1604398aaf3c957e9da20619b6fc84d6ddf2cdbe3963ac03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5885d729ec1825756bbfa1f4778638e0a
SHA13e77da7a1526694dd3ca9e311a623a28a45ea922
SHA25648c0750ab6afd41fb65542fb42a83bcfb2fa5c873505e3cfee47a2a996d026e5
SHA512a4fcb4f73407745c40f9be5b9a965aba57fd5d70fe3ec24a2d067b474aa970cb3fb89263b9698a1cabd760946f19f127e052b2d5466127882d5b207f2ca195c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b5d6debc50ac673fbc5145973b2d01c
SHA10123a611300b18e320b772cbd37c96602268186e
SHA256a647fcbbe98f85a385bd4b47a39d3a99f10666d89daf4f24628971e378ddba36
SHA512c9efa7678bc14c9983c97723fce474a4ff4812e3e0584dcc318965cabbb7fc30a8f04c3efedf0b1e135cec330a005467e2e42d57e920f8b49c2f24d79fb41573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825db0509b100eeed1d07fdd9ec89954
SHA119c973058109b4772a3e6fb4fcf6ba41a3c5f74f
SHA256faf8b82c8ca9d07394e99de6ced4a514e51d7fa6e5b71b6c90ee9d15ccb13368
SHA512eaa337f5ecd85df3886dfb3c18249444998a2528339077a512569fdf9cef9149ae90a19822ca1133941c61d959e364153103bf5bcde8c96f144d2cc0384db53a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506bdcf51c6201f25103908edd3840d75
SHA1183d2f5fa93c3c45cf7c47a8ab1a282e45644b70
SHA25625706d86bf4124c97d8a5c6fe5695c25bd61b03925ec6ff4ee63739c529f6c36
SHA512fe4cd73e8e44a397019cae3585911c6724d519c7b2d7da59a122b766c2e15b64d5ca34878016c0857ab2837e7273ea52406a0954edae90ff675a9764230c6be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed0fc8e50b2b71ba3d9aef80ade3c802
SHA140e61ac74c551a5c2c58edf8ed54bea3dc063277
SHA2563585b9c3bdbd74852504d2f0b795fd3275b5079109dc2a4cba362a0b490c052e
SHA512447dc1a6dbd3e258c912126fffa062cacee74f59f4931127b8b3bf59b3960ff29f6a9e5e8939b8993729a51747b8dacbb599cbae316658709989afd1f10de9fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5538cb42e985a4d7cb667292337d60008
SHA104cc4cf37fd72480ad2bc17d888406f87d13a6e5
SHA2563d260a1788b49471b10c0e79482d80ffd15ce51dfe1737424fff3690f48c5dc2
SHA51267030c8647de75cbe925b3bc053944f09190a67b8d55ab78a00abf89315a6d75aeb61133276f960ef0e917e523934814b3537b71cd9d8840659078e8b437cb72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3c7512e99de24683638cc260672d8a4
SHA134cd29761064f14c8cad53345ae2cb44c107597a
SHA2567cc95c503aaa31432d1f5fbe269a00d6e179ad7c1c835ff71984507f3d52b59f
SHA512964f93b5daf1c7a1e3d6b4bf414cd983eabc89f1d3d0b1ac773e35f5d2ae889723ea0d963394b2ffabdcd575c39ef9c39eaf321b89703222ced738566c562613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5312c3ce505ebb0ba64a1d7341b30819d
SHA15c952c3969b8a20a9e11b08268c3a16cc0a153ce
SHA256726edb6d5525829343d58ced8b6ff609cc2904e827d76d972939bfb2463afae0
SHA512f6e7a7b42818eaf06dfbc0d481fdabc0e4de74f54f378e8a47e9b363ad14125c120c7c7045b92492b95ee4a1087d5d31c7ad9d7623b1608712ba30fcaf514c1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518f8c7df89f8ff68b04b5ece2d211835
SHA18e87beef3c7f2f8320a5f6021a9ea55289d8f711
SHA25649d81b75c43b208ae761ff0241e2ffc52c2ea2d269435a484834d093e2a6ab80
SHA51207b64613a185f34f04332406a63088708a7adfc8a5e19ee91fa701c3b2ab8c00ac54cfbd31cbd810a53bb6c1f26a1f8d45dcd342b48be926813db7aca7402fdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afcbf8fb876e0f2e7d1257a1e35218e6
SHA1c5f884ee76a248d20934a7e39515b6df029b800e
SHA25684bdf8203d587452d30666d6d879a00e8732aef9e6a82d724565c307fed77e03
SHA5120b31118ab512ef4737e4951be8b6b670d352aa89437332fec40a254cf503057d37ede36f10b2481d18b1da7662864f558d94ac807118a5171da2da73d25ddd20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eef353bccb1c13672e98bc5d8b7324d0
SHA1fe406b241ed050132121019d9c46f43712b5e18a
SHA25665f8d5cc9013a2ae7289f2941eeeba11421c1225b972eb3bff857fba07d83d43
SHA5123b47db42de28cef1526b4737cd21937278ecdae4750dc5af3f3701bdf0206f397d59782cba5c4fedf43acb069b7b757ef6cecb3068dd71bcf04d1672e1d6a6f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587eceae4cc40488d6079c09d951b7d7d
SHA1bd7ea120d0ce979c5b342a3834f624eeb1641218
SHA2561bef86d90666d993a2060ed5a6e46783ef5ed9ebdb62d2e0bc7f4e8193e212d4
SHA512ae533a1c2834565d39649db04577d01c54833f88de0b483906ab1cd5619a1cbad6099739dcedc0f3fb7a07f9bef55e136629785e5c1b02069210df5a32884e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9f5b6c6ca6e40ad425f537b8dcf27f8
SHA16985698c7ea472f1fb7b5b3c712461dcc9450fbb
SHA256e210c3d62aadff4c7731a513cd1810a257ca8ac48f2f03c42c1950658a3a0b74
SHA512cd51e8bf3bf54498cbeb8c2e665958bd83667b14eb89793d3ff6af7c9fa738608b70f435a10d8a059004a2ca22ab22ba0ae2f3dd153ce0460a3d9bf3a5813fb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5708586c137bd2e701543d2a9afd3a9a3
SHA1723e74802c8e4c942b51e716dc573d653f50ed55
SHA2562d4c737b738d206b57da5dab931dedb931be7e6e60aeae9582b1e7098347a03b
SHA512ea492a51e208ef0a4b9b1be8cc08f16a56208283d0db00f302a4f2db90d84e55a3140ca216e70e7058341a61afc59005c9e944b8693a84b57bb294cbbd14b757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6c101c302c4ec563d733515471fdc9b
SHA12e1e55130feb8ceee75ac4b9b6616d46b867fde5
SHA256cc1dceedfcad927e40fc7ef2cb5c1e52ab3e990c984473ec36e205cb9f5e0dec
SHA5123f1867eccd00a4da64da3f2ac07b278354a64097a8a8e46814c6da6ff32bc843cc859ea9e9681f376d9b0d46afa4462190cad7852c888d475abdf8bd3c220fd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574a31259ec9df48c3f5ecbf8a97d14bc
SHA1e2e64b63e74a0656188ef409ada3c9a1c1a9497f
SHA2568756b944ba2cf39e2221e80c2e01c442c32068a5ec011105da783b2b7b992682
SHA5129dc61d99f57e93bb17b909481f08d0e7cfdd80f42d5f6b4489e1daf679222e04f785235b9a277f71d72ce21c9205af16e07b7d8862f65bd0499c29dc248d24da
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b