Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
24ef62c8ad02d16fc387adeaba0f6b93_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24ef62c8ad02d16fc387adeaba0f6b93_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
24ef62c8ad02d16fc387adeaba0f6b93_JaffaCakes118.html
-
Size
25KB
-
MD5
24ef62c8ad02d16fc387adeaba0f6b93
-
SHA1
cb3deb91e7304d6b403b4d1e96985e4ab84e4d10
-
SHA256
afa4ed9712e42fd86a594a868c05398988025394c2fbafe6aa18dcfc3eb47248
-
SHA512
47584de95cf3694747bb9d5352a5079c1154e119c9e77daf030e57ebf14edc40732ae10641cb495c8a075a6cfbb302f616c098573dbb7441a89e25f0abc32b5f
-
SSDEEP
768:0d1cuGV/LewnSZFe14HpQtWKXZVPtmygPtmy/:0d1cuGVQKXZttdGtd/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00f9803dbcdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426236185" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E102941-39CE-11EF-9E55-E6415F422194} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000fc39e2ac3c034973399212065142499ba651db412ca40d327d8543eb12f418ff000000000e8000000002000020000000d7a780736c79d3f1f613168280e70fc8a88cc8956ce8a7b66ea8c0dda122bea320000000f1bed675c6cbf150f0fa4dfbd2d583b8d2eb215a10dba259ca8624ceb17e4ca440000000409d150fd9ae17ea6b31a06809e632706c50c4cac14c39dae62b12806e2dc2a12d8172ecf25b95b371a6f5eada7c9bb0b62d45d4eecbc669c479fdb34e3fbb3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000091cfdf9d2c6d56dbc586ddd8995bf770db29814e635b3b508c0629af6d4c49ec000000000e8000000002000020000000871b7d25c674fa56657a39551d2b8fbabcfc98dab97b48d773a3e6bec8728a059000000072da23f691b0b9b46c480f534c2ec0e38f094a10ab3f5a93eb8b30e2c88557526349bdbc324009e77c983a14fb35a66d5e4e2542b7e923cf1453b7706d69fae8956589dd6e2bd7d69e2e33942aeb9ee464c256f003f641e755a991b52806446b66b1bb3512684ea94c8c88081f602bff928f81233c5f582c6bb6b2c549ba9ef2222258d1f917d9170e999e28735f38b740000000854d7a5d6e3830eefdaa04e4d7204870301ed4722212a0b2df180baeef7d90f4d915649080b244d4e836774e7443a9b529ad25fda8dd4284080413840ea7d486 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2124 2188 iexplore.exe 28 PID 2188 wrote to memory of 2124 2188 iexplore.exe 28 PID 2188 wrote to memory of 2124 2188 iexplore.exe 28 PID 2188 wrote to memory of 2124 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24ef62c8ad02d16fc387adeaba0f6b93_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529d1160444e27ffe6eca0e455a9ee574
SHA18bd5436756b37689dad56172468e46ba0965acb9
SHA256fcdf15bdfb5bc7e0cc5919d14c922064a6e66bc262c51b1023f9b2fbda84e9b5
SHA512a20f3a725d865fbef18518cc39075039db3a9e76ccfbf0dc9e8069ca50451bb2d8a2c58288c530751c4ab42d4586e7d41a397528bb5f592f6aa47679b7b20baa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5d9e8c90b98fcdfacc66ac0ab2a251e
SHA177b03fecfb8ba32e394af292cb27d60c4580abd0
SHA25645bb5328ab9a251f7df5a8f3ced9d045509c6f9a65b47f9ffc42cd91dba8de13
SHA5121c7f5f9a82b8c98f12430debde48261b252b825a835810e5a5992a2df86350712b642f4b00f1c92ec8f8502b5ba1706b26534ca3d2ea6e6ce84d9f133e9d8573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e11a7ded8bcb0cdcf003132d3d06769
SHA1bb63a3c4fefbd335248e2337420ef7ed233ffcc1
SHA2567984661a8b23ae0db085c194bce25e97943fa5d79b2aadb1aacb147bc793ff92
SHA51206b5c1e1d896b4c7b6ab808b99639c1cb2b94f3ac04389ce6baf544b40e9e3f4885bd90ac105f84114fca8262185e6d10c4caa9082c06e845fd42ed85815b27f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec7e3fb1976cd44e3d31b0a0ae6bac7d
SHA1f2157c140387549d99d6ac5297ed7c09d834e99b
SHA256c0b719644fe9c208461d20381604d3a7fbf5def4a35a350e2928ac3506cc9108
SHA512a72fae5e5b60bb770468e6dd81b85b4623ca0e8f7b834e255d8a19c6080dbdafb2e196ef790c4839ea84f1ff2b6551e575936fd0ff0ce4a4b16c548c59367876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a194af75536d44fed769e1beff2be87e
SHA129f7ac3ade4427629b093ac1843a019355985258
SHA2568a03522bb8ba6405cc76f7d2ade3f40ee9e78dd6a5e023c2f635e62bfac6ab6c
SHA512c037ff134fbe9e6295b182e2ba6af4304e13dbe69ff8c778c25615d1d5ec71fa675adc19567206d1c5718b3b07e3a6d08d09588767b3b8d10c61986864aaab3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56367906492520426da5dfae58890eb8b
SHA1bc5a4d76513034210e4dedac7a7fcd3bc4ea1939
SHA2566a6bf5ecc8c0fabbe5474d6bedb927cde875aeaa00f65fcc17b08de63e3427b1
SHA512d13627aac2541835804911a14a5f4d6251359c1b068dd7f113d95aa2c13e9954132c30466e0ffb59cd157fc2d0cbcd748aa7975158819a9608fb93bfd3e08ee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51951bce70fffba0a412ede8862e2e14a
SHA1706b477fa748a34350316728e0cae43192d4a199
SHA256a6f716d530e243eb4a92e13c0c63df0ddf8ea4c4221546dc2b485ba44bdcc44e
SHA5126c3fe26e4513cd9a556b3b864fb2f41033b0e1b116d22bdc9a10629a901f49c15f063542bce1c7ec080764aa5a62555ce8efebfd3773f4c8389db402b95e4741
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558534b1d7e79771f5214151ee8f7eb22
SHA111dbfd7c18aad713a0c83c425e84e0f078aa4880
SHA2565e7df44750719aa717e0d3001af8178604953bca7d64845cea6c7b2578b9abb5
SHA5121bcacb2e492e056c4d358307bcae8ab670f1dfc3fad4ace1620b4e481ccaa018931ea93a65b5c97be92378ca0d245a2e9431d50f47596ea7d0b54f7c905ae9e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e4029ea46e175a5db408ec76f9516fa
SHA10980fd8c6455c7bd01c575ce3e21b2d0ae51b517
SHA2563e8213f4486765f14de3fa7a99d14bacfc29c26304bafd020fc788c3333dd3b5
SHA51231172c4683e4b555f8542c86b85f22297f0044d8a9eafef3fc4eebc07c8c7eb12bfa4bf07d7acd6563384055f16bbe121e70c6daff237267a1490eae8cbef1f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bb2d4a75c8354f1a984eb1101d8bb15
SHA146026d70cd7413ff3d6e888cdf0bee1b928edbce
SHA256f58f242b0ca573ddfa6437fd4dd7ee6ebbf81a86317ab4ca126075c522cc064c
SHA512fee553b897f2c232de4ee7841ef5062d1913f5aa7d3050201cf8ab3ab9267718d2dd6b54ff4a7f50a653bfb2a100b6b5f856c1be76b78506155b153512600237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583f327be40a8372f4504005c831dc3b8
SHA17f044a7a2242bf9965c0249485bba138dc8a5676
SHA256dc05b7caa1040cbc554979531362ba60450a0bbdc15fe5c3c32729847d2c5eed
SHA512cb027be99096ca878e850fd2862f81e3203765969f4a7911fcade6b2b33c0ffd998eaf28d2d085e8ab51227d33cdab467d1b726d1b382e1b8230bdadb52b34d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c89918038be9cf77915b67edded9fbc
SHA13a763343f0f6d0be16c44923c18d89d6ad0c5da6
SHA2562dbcb20d46dcf082012227083c48b23d534739164e80e1e62689de600fa46b65
SHA512719417480b0141fb769ef4c1f958122a4f2043b4f8ee32c749579f792e34ed66170499e1c6f0b21571979ab00674f2e40dc4515ce6390a0ff800ab6ed62bfa8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e30a4c60030f72c716322e2b63d6a470
SHA1b9915a15499106e525609614a114cc63beb6896d
SHA25602be838747d94e168f703b9cb6b3f43ec8d5364add253f3f0bf11265f4deb9ee
SHA5128f09473fe2637fcac3948d5408cbab48bc387aaa8280348462833de63eb71e8384e5c2e2053df3280f994530a78fe8443c55b8211ee631185b203bcff070d196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519e8627c7792b892cd1d40fbec5a1d3a
SHA1daedfb5c82dabd7a40141fd9a8b55b3579cd27bf
SHA2568f279f8d1c4bfb97da024dc6d64e306003a087e986397201619330946e2312f2
SHA512b1257284c44e0c0e7226ae9e91b665edc61051b72cf7af9ea6c931361805870a45791dd1ff190126b18c8a5eea872ea6b1360fee9d20ae968d13bc3074f2b151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af221a60d13a1d08506815533e62136f
SHA1829e3b5412a6879d2fc23360901f8a6b7f969b05
SHA2568455cd064af2f5e0b50a841a8f8f771587c50e629748214b87c8472f370e5c6d
SHA512485a72dc3dc31ac56ba2429a275733a4de99e7c718bed6cf09559538a90a286a10c656b8459b836470c2702107d36ad7d1cc2d2cb5b916aff49a81a81e681b07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506970cfe4c01d8a89bffbb3a06060ca2
SHA1903b450297d980e9f536d025c7925b19e5cf95cd
SHA256543db4149c7d054d8af7bb31428bf506d15c741f1f13e7d584041682606c0e27
SHA5129ef405eb8c8d4326313813c905634aef66a528b079d0cf459d4f50ca61c792d93217097ae1f14755629f2b11e70156ed5fffb2d9ac59e00bf7399850c2181017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5986da715f45504188fd23d49dbd674a6
SHA1cfb2a5fdfe642e11aef958b14bf019bf925a17c4
SHA25698267e2b73130a8c61e76da470f5d7c514afba205b4b1f8f895f65947a79af82
SHA512f778c028f0d80b29b05903a4ab01047306c41aa93b3cd3a28cf6a6bcac9785cc8514b654adf6b48826c16001589c35460c92682d1ed0039aa8a3f8fcc8196a3f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b