Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
3b2e3e3f99fc8379678234ecaf6c9fa0_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3b2e3e3f99fc8379678234ecaf6c9fa0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3b2e3e3f99fc8379678234ecaf6c9fa0_JaffaCakes118.html
-
Size
4KB
-
MD5
3b2e3e3f99fc8379678234ecaf6c9fa0
-
SHA1
bc22910ef4de1586fb1549d103803b087ce6945c
-
SHA256
5dc3acf4e86e4f755bf5fac4c4a976e00341b74adb01038fdc889ad03ad001da
-
SHA512
8f2f15873afae8eaab68872624b2d20b6bc2d17b82be782b341933b63b2f663c09df3af48918ccdc309db35b2f732510d8e1a1745f932f70a31c492b94d00df3
-
SSDEEP
96:1qDsrEfWm7QfLiWmYf2b1AOmoioxlzU0K3uF:VrE8ib1aUU0EuF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000e4533fd366177ebc5f394064f0fa008b9d9f910e23b1c879ac128a36cb15c79e000000000e8000000002000020000000a25f9e05cb928f865017cbe761e9197268966470eb749f015254e4bba6a5ec81200000008fe1dd61095fad2a7926f9919c7764b61d48c76d3f593da94668592714a3ad1140000000fd921510ae737ae0a77edd7eb58bbf970d1f4d3f40a26bf48add9065d9254e5ff832a044687b5c630746e80d737f883ad4315b4d18f1a74fc93fa85e607fd619 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000b117c32cced4f438f9b88c3061e05561dfc643466c9b3ced5a03660eae6e46c3000000000e800000000200002000000035f87c1c00865f301ee7d713abd8443baf18978d8e1b60a2f0f4e4edfdff5039900000006e0f495deb1995639f8e9507d31056756738b7e5d07caf9b11a21c6da575a4a4b8d44b19a8b47c0a61fbf09f4cb8bb43a1a865c5f3fc919ace3f78e19661e33d78f012ce9bb22404664986254b49f082335d09eca3d431a7e5ed46ea723d5561548405d6153600428d643183152959f1b70360cb576c78005a138e06523294c9f478ceda77e792b2cb7d69cd060f4e6d40000000f87a412c0f3f602d2ba93ce50affde9c7bb332ef7a4816e79748ee3c0d386f2f3b53e9b708061816fbd510e8ab1459603f1713ca503fa869a152c490f14e607a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426903164" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905265f3ebd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D401AA1-3FDF-11EF-A037-6A4552514C55} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2600 iexplore.exe 2600 iexplore.exe 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1632 2600 iexplore.exe 30 PID 2600 wrote to memory of 1632 2600 iexplore.exe 30 PID 2600 wrote to memory of 1632 2600 iexplore.exe 30 PID 2600 wrote to memory of 1632 2600 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b2e3e3f99fc8379678234ecaf6c9fa0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b765830021a708cd001eda5461963b0e
SHA172a7d5ed2f7e23ce7a944182a34456ec05f7f2e1
SHA25675d4d14d6c7af2b93826feffec7df215f1b9202cb385ae526c22a9983a0f13d8
SHA512d89d2f65dc35f96e39a08a6f53af41fcb1f1d92a183efdd15339254e69a9e987e65a43b9bba230795d006da956370910a8a9172f15620282e1a1c82644488118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554642a92d184b2109815511cf07f15b5
SHA1c6d15a5ef2dc87a78208feb5fd0bcb9d98096ffb
SHA2561e5abf00374fe7280380be6ff710d76f4777f7f5d5acadb8c32a527075852cd8
SHA5128607c749dd07e8c48ae62a3d42e7a0dd4a8c3ad391633fa8fb7e35976c37a3ac6d7ac998a37aa0ba600c2a8370c7e8ce9792c0c963cb0b405f540221269ab69b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e942745b391dbe0b383a9f5e65a215c
SHA193b9f25294305c8a4cd620a24eeb60b4a766949e
SHA25660231a46a9c4188847c832941698bc779ca26ca05135e503a4cd9b7101be223b
SHA512e9c326dc1481defa44f6afe13ae0102f752672579e4b8b3dc053f507410281afe8b81de93a40243c04649faa0c20a9958da33aa49b0df861527f14e27118878c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e64305992b4a9676480d9c20ee29a53
SHA13385042be547828bd8d83a4b3eed786beba65062
SHA256149899b252c55c7eab3b8963859ee331d96e4d062c5f5c2dbe09c7e680a7409c
SHA51201b1236f973d4c35937dc39aa8130fe59d82b56e4423a4a3ec558f2532ca9a73c8de21163684920aedd344ac7d977f105ae3b6cae202b49dd584b21b217a922b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54370e48f772af10addcd5b628241a350
SHA1c50779ba690693facf6bd249d9835d9541898bd6
SHA25681bbe710627fb9f39c5f7bf73246ea7a134138f5139f1d5a7598675b068d25bc
SHA512d2955d98740f8d62e68466a9a582e20fb6ba80ebdc5da550d6f74a139389c87f2fe4494bd7b61a1c382d55b27c6476099094e83a1d5796ac0e96c26b5975e96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc6fe65196ba088bff967a85e1464464
SHA122940a8147acf2dd69532ce2a9732a5f3741c7f5
SHA25643f9b2911279b4afef506aceabe9b60a906cdcb8b41fd96f113101968c0f9533
SHA512a38beb10bdd7adca84e58dda271ec8a07736e1315d7ff2d78de00680b2ac3902870cb4ab3871b44c18a0ac350c4d8876de780d24fca1ce28d4fed0181ea1a1bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5577cdefca22ccc197a2346dcf598a9ef
SHA1c7d5e421fbf886ad82ae6a29d3fa292181b5d61d
SHA2565466c8b876bd49d9dbf19f9abe605dd3d8cc463b3328494ee33abf8ed71eadfb
SHA5126b5bc2e4fd03951dc0dd3274c240ffda003b7f56732193cc4f6603547ae5e1cb6561dc3a8cdcb5f1d331e0b702d3d9b0c2d2908fb3c315cc5fd0601196a12c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d71c57121beed26c1a4b30c48a49cc23
SHA14848c2da931d5001cf563b28bb5ae739fbc205bb
SHA2563e72bf83ca042a80cbe4b1c08b618b39bbe93e19cbfd1195541416c42e958d1c
SHA512737bc22e6664c9f0f028dabeece0979f9dc527731a946d3dc7b0165c07bb12e328df289c2c49279052082cccf576b3db88cb3a89524856f1aff8e835d0f0f799
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b568a377503d5a4951b686fc5c2dd7c8
SHA186a6f2d8d68237791a4d7b321096d60c72112b55
SHA2562183c08469179f4399bd24b6661bd12627fd74f6f0993668c9b5490bb3440855
SHA512ee7c9afbde0e9161f007f4548a8b80e8d83e68274cd8bc7bb96c9ec7794038d5ed843287d1aa3808a3a93d90494719baf08704ffa72f0cb859af17d5f9e8341f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a92b08441d52f7e08df2e39e8c2f37
SHA188a874a980699ad7f6329d9c4ef0a9f2f090120b
SHA256c163eac32b651169020cd29b61a90a6c5c0c193cc52f0760d5cba1f8c3874ee0
SHA5129ddc11f938dbdfd5b9fca0668b7b2f943dc006f030f754ec40da99a829f71f3e73c8072b343ea4f7f88add5f8efc1d9ddc00029d90a09dc32ab24de6b9a57302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d1e63a1f79ef8ad6100fa4b43c8dc80
SHA1fa8dfaecd54196db85737738570c96f1f461d6c6
SHA256ed26c6ea3008611f6e5a66aa5efe644007256e0c18eac5f1ef6b63e033f554bd
SHA5129e7cf1059ecb9cbe8a6234bacd4c4a56844a6b6aba98afa221c66581b81a06a3b0ce5e202dbd77229e381a46fecffb32cecd0600028eec93c63c92d89b49a78e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50544ab0393398e83b758b6a6a676bcd0
SHA1acd9979526b4162f58627f1826278c84d11eb5ce
SHA25614dd0885c271ec2a6f0e4d81c1666b40e8db7aa488892021d5feddd02ea0e3bd
SHA5128641590314948cbaa30ed8dedda2757b06a11473206e661c6b1f80cae1ed716a36a2a80ead90a90057be154ec0ef858e137e365269d00698679a9f0fbfbfdfbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58442c5d2ed4d4227b4da98edc9866338
SHA1f14c0ac8c0569940923d4bf14656f9f01f15169b
SHA25605b723926bc120125be0278ed3efb17dd989608418b0c347cda2d123177578ee
SHA512cc28a087f64599ba184b32cf21a2d8305686c9c4980cf4950c3edb8f8023281238a8ce289a88fb5b1425b0b091555bea799ebcdbcaff79a26c025a61c2dab316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d90d7c5b879fedff7db274983d54afaf
SHA17afac9af5b4ff0506c1910d52786f79994c7936c
SHA256f68ed66417346536ff150845403a4097a84b1732c379a09f6d1ee8643cdd9a46
SHA5127ed5f12c1707f71cfaea5f0085d19a98e753fe230e7fb98b8f985c31918bef5804c5108f4fa66e5b5b3c59d50d6e51d2e6c5f6e0da2e966fcf1ce38b76103455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ce00cff2f01451e550a7994023e9a5f
SHA1209416e0dd513b95f67db7cc59184c1b18f4ac40
SHA2567fddff7b796a067a9c8223e67c81334f3e6ab3a7d259c6f0a311d9f344748721
SHA512386785f4a145027c3ece6df3a1009798110833307240df4736f124b2dd02899ba4443d1769229d39cfa80cc721e7de7ac73574d34bd41980fc052b99724bb21d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdb8c89d58dac05972279443be00cbfa
SHA1804f40c4a360498683f1f415e8ed00aa91f8d999
SHA2568721e2a89e06d506ca955c7a74261d04fae0fb95f8a88f0b38cd6c26588411f7
SHA512ad064de42cf1fc617ba669dcdeed0f4f0bfe76498e444fda3e4d942c3c1462fd348be2652caaa8e9acaae928834ac2f7affde87d8429178aebc98cb65128a65b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c759f064c86adde01cedf06e4895527
SHA1ca18f0ecdaf59082a53f72182839623c34d18865
SHA256ac6ab3c73012c552e0598d35ed1a3f7bc2f3ef1132de84237a4bdfbef03e12de
SHA512b8f9b99a7cb03d9e2f0c5673882e07e265dae6ed237889cd4b2c19c15296e4be6ff3941d9ec3409ac9df68c346d23dd56f68fde405a4c318593e0c7544c77c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e08852a9d516ff49242ee08eba4c03c
SHA1f337d154b481addd9699fe17f9abc0c7d3e87a0d
SHA256fef7e7558fca0f2523c20f1d387b00bc130c2b6ab105b860931a56af583b0a93
SHA51224b86c3e13e28511b7184f037689f8ce6a6983870772d6eec1fd6d01cd6ee1bb964580b32db725c4664663ff9fc554c1d74abdb7ce6810907642419d88d39de7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b