Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
3736216ec2eaddc09e6cf6dd3c22868d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3736216ec2eaddc09e6cf6dd3c22868d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3736216ec2eaddc09e6cf6dd3c22868d_JaffaCakes118.html
-
Size
6KB
-
MD5
3736216ec2eaddc09e6cf6dd3c22868d
-
SHA1
9429eb96810567e4586dd0f24a7ff31cf1d15dca
-
SHA256
d7e8e7ea4c3939f38497b7f8758d96c9c2d037bcb0903ca6caff11129f336a69
-
SHA512
cc957ff2a2d1c4a790c1b73072b71a08ffd44f6ec7b36bde870249688e0c7b9a38924af60b6e4490dc5d51bc7a457b9bc34c3803bde12e2a4a561908fdbb286d
-
SSDEEP
96:uzVs+ux7KoLLY1k9o84d12ef7CSTUcN/6/NcEZ7ru7f:csz7KoAYS/L4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000005108269205c444dafa21c6cc196afb9efeff22050df4a3a732a07f39e792c5000000000e8000000002000020000000468ce1f97e1af28010be64cd19a523bd6e1ac9729f0cf602746f59b68c688076200000003a58032bacc4f32f3445110a6f1684d196069cd418db9a30454fde835a50c4a64000000036930a1e5248d519497d0aec7c0c78dbbf305a51d2a614b5f44a79c9efde6bc68df50c4e1e37b330dbccbc4169d409766bc26a63cfcc367eb7cb707b8078c0e4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e5764f94cac3d95190fea4cdf6627bc364829355776f5628645aa5a018be97c0000000000e800000000200002000000041c97a537f1b2c9797d017314a9aebc47d3d77e43f43b52d994f974ad79ae1fe900000007d1123d25a37d520d68a25ea2ac2cce040a031d6965c6082db4034efbbdcd0237b3cca8a4cef74cddb82248ce64853290af3ff2154f5243ca4e567ef5f0092e7f01379b2f5923d4c7c99eeed7951ad83ba803d6eb3142f35d4083f7f67d060ff51eaf1b7bd022b92410e86d8622306c2378a6ee39cc13ef339a7e9259419b26da667bf6dabcbfde2d9904a04ddd6fb9240000000eb639dbe91d94cbbeb6c8bb81d55d16116909991020f5221f8e90376841bb1283a28d5f1fe784ac28ce9a4154305c6e4603afe1f4956975be4fe573dc1479015 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426823474" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4070e28032d3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91CFF6C1-3F25-11EF-BBF7-D6EBA8958965} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1880 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1880 iexplore.exe 1880 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2464 1880 iexplore.exe 31 PID 1880 wrote to memory of 2464 1880 iexplore.exe 31 PID 1880 wrote to memory of 2464 1880 iexplore.exe 31 PID 1880 wrote to memory of 2464 1880 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3736216ec2eaddc09e6cf6dd3c22868d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD553d9ea07f94c8ac7a71c341ee754ab73
SHA1f3958861909b7a78db161c6aeb852b8fe56bf4f4
SHA25627ac0e86d881c5d9b8a945a6ecb70171b5c31b11ec18f8f0957722ea2e994e7f
SHA5127069c4a96d8f3f51bb81bbf1267212b3a73d26abd5fbd2125d96d13e4fbc0ae052594f4962ada41414eda44de808b0a9419d731a92628b89aae05d3c435bbee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD537127206d6079280ad401e35449a2f01
SHA1302c663c6f5e7a29568c3de96558f4bfda93f2f8
SHA256590b61cd7e5837635be2be84ec65c852780bef1805c143a4880af8ed1199a78b
SHA5121fb061a4ca30069f7c1693303557de0b39f786216264eb9fa995b7be71f5d88ac1096655e31605567cd529f53e3bd551c088e470f864ef525d8315a6dacab8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5858a8bfba64e47eb95f0fbb8f356b028
SHA18edd7051b72f191ab553b25cf5ef57ef610fa0a0
SHA2565254c1bf4454cbd8f2181cdf912be3ac646944284adedd9f64b9f50a3237529c
SHA51211132c6b45cf4c1f2c6988be90e5940cb865948c9291665035956e744969f40448b049b4f2f257745f0614615ea6837943fe2c9bddc7b02cd03d0805a136f356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55fc1a4c31fca187b9efaba71bb449b57
SHA15eda917b8b4d3a16e5ca5a9042bc2c243761d7ca
SHA256af43e7fe7bad5ab5d3abd885bb801f87e28cc782210d9c5f2e6e39388d3e5164
SHA512020f5501511274ea379b2f57c7b13ec18172ada1567e67069e5502a8beb6485ea15be6df6dd251d584a924c0dc7527a28718bfca34f156d32234c49a551ccab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD530d0ad35b2ca9aea144ac256c34c5192
SHA1d070684b526b6fc2445c79f1fe36e335a5f6bc0d
SHA25697dab77f1f6aa23ed8d2c063c110bd8dca77796badd704bbf14b1d8f95190022
SHA5122516b69918ae66b8e5229fb04c9b228567b518f6e5e105db00f24fc410bb0b0605274c2ad9677297c97f10d8e9defb356a056663a210c7d66c1d9823b2d5bc6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b5bbf02da621f8d80423c41977a8fdf4
SHA111af68fc6da83707e17a91ebca7fc6182d013e24
SHA2563135993b859e79d02f0f02d480244c32130af75986296ce0b74160e76d86713f
SHA512cae99ecd5796f1d98b30574c12f9f343ed65594018ae3297c34ecdcdb3a21e87d5e81c6373963aa842afdb4282ceff7ac28f2ab8f0dc12f59bdc895e538799ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57be05f8cfd81387d638fd261ca1124ff
SHA1886f5f3bccea57bf2958bdf82e505dcf3298ba2f
SHA2562d8c9697aa6247b1953fd8bac3d4871a9f6c16943f67602bf6a89aaf9e7e994d
SHA51210d9fd81102b0e8a370e839d4a804fd94eda6037cff988d634f906522a2094a55d303d9c40e5e409e5a636b17f6c2badb3410b96b7c027f6910a2904e738d2b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55521e7fcfbe289784f743fc3c6023aa1
SHA1e136f11b2c6a66b4b0f38b4cbd06c60b815aed2f
SHA256f154a5be7d4ad3957273664d364b0dbfaec6722f9a4ff2104285db1b202c3c3e
SHA512b479a1aa025861abfaa876450b4642cfef1d068662eb03f11f492236dd161851f6dfe65e7be812b7c5d2baebfe4cccc79470949fffd4aa9d9271bb8b29ddbff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5496a6851ada67c0614a315dd4d4fdadf
SHA17922306d5d2d4c7dc2c522e3f57329db1bc6955c
SHA256b6e586a5413ae988f0b7b6128e55f50e36f2041e6f2001b652a367a8b92df4b7
SHA512f99c78b337ea5104134d385cad1e079bc34cdaef1593e289d56dfeab22e354130cc48d1dbeacbb17ebd6ee72d4ea2bf6e2124f78ee672bd2b33f3dbc06b3afc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ad841ce9fe20d81782458172e903b678
SHA139cefcf1247776a4e208d0ab732a2b60e52194c1
SHA256bdc3f45b5d7a4bf5302437330f89f4dfbbebb49a1d515dc1fe4ac8ed8f05dfed
SHA5125bacf9204547def452ebc13c2a1dce6a5235af9f985ea16ada6205ccdaf1dceccf72f81ca38fe7796689b31c17859750216fe9c7e3150d68b7798f88c7fde950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf738ad780a1057ed38925906b85f4f8
SHA1a061374d846a3bdc856260bcad492db2d595f5c9
SHA256dd243b61a7c6d02780de1d324b350e819888871e3518ef3aa3b6c31fff812cd8
SHA5128369da92252f2cbb93307aabc65b803b8d753040a02cec7551b4d94a0ebefaa74c97535488b9227497df85334c8e5cc7ce243f5e678c3fc2f4dd6313f51c1f53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD525d3a86f3ec5dc28733321288138fffa
SHA1b33e750bfa9cfe4dc93c11c068c8bd9ea855d3fe
SHA2568a2884d3a66eb0ee5aa2442fd6f46ea197c86125aa4e065ee155db192b0c61ab
SHA512dd0114c998ac9569c65f7fcd75fffce3c23edec0c3f5be07dc7ea80cc8d89f289bc9344c99f1f236d14f262b552e0798338611cd6dbc146887ad91306056320d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e6232becb35483933dfb87da0eacbc59
SHA15824d30711db90e7d0b2bc50f91e508c51e8e30c
SHA25661b195c2be68013af818074793de17ba127e02f7a612f74916aa5821b60a987e
SHA5127d1895313d14cc34dfc6a796775c6393c4fac82d954da097bb180c6c0f76207459a26ae2c3176f4ad3c8c40f838500102fdc58872f7307b14a60e1ac696b5f5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51801bf022024b6c1ba0456310b64b647
SHA1a3b96fa3d7d1545345e97c5b3e7e1d0267e0dea2
SHA256b8ae2ba943b0b496af8451cd38d0d143782a8f8a6174f22011ecf944d54da339
SHA512e64317e1414570eb5f9e0c192656a1dd0cabc7598654e4e07c28968b3c46b4d702a962901f675bdb4b65121feaa61b982570291bf66de784fe36957e48c27111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5538adcdb6e906ca42584e9e9d6fa1399
SHA174d2a8525383b5bb962d4765a70e2bfb315615d7
SHA2566aa1d6d4d20a34e4fd47b5fc55b77e5cd6fbbb26791e30dc88b81a8324798822
SHA51206f33c695c9d5619500defe22fa63d8815e4eb91b4cb8a93def5028c937b3edd5445ccd6060fa7dee293b78ca6395751aaa7cee000a8e32facba8f9a3917b559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5519344ff0169fa75f96f74db5951c660
SHA1b4f3e03b890e6e47499b7eb0746eb740836981f4
SHA2564af7d3806fe5f9c0847d479490dab4fd32a30b7a92938e15dbd64bae7c8e3095
SHA51253ace9741bc8cc897cb552aafe6a30d6b296236e8487e4ca4f050a74608c263f682b2ded3177b3b868934cdaa4494f3abd6a145655801579c14a368da8ae159f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD566e6f2423e9a18b8e2ed5543dce9ce7a
SHA1e924168115f2015b9c9dbc85e2841a280f8cf588
SHA256b1b941a75b1ca31258444972bf34155eaf2dd9f1bbbf91e063ce1337b84ccb77
SHA51279b9eadba431a7dd239cc11463691e69a3584e5215736bbaba485d24d6161877d0ad82c35b8e4a6d125e32972a5af2ec0bcfc897aa61079e8fe528e8033e6d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c0de0d743079d32c1fc942537365defb
SHA1f71ce3e3df91edeacf38ccb66bf11a465c5a6ae8
SHA256246187e9d6a6dd81f5058cbedf8f726229249d6a84c5ce880f660bb97ddf2df8
SHA512d04852d5ac566820f2ce7c0ac28f1738029342a6f7f385765a8adab871fe22116135768e56fe5376176b30833fd3b4bb48c88e67cea27380610c086ff32b847a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d50e98bb37680add9c541ab659a7cbc3
SHA15975c747d1265d8cad77dfa70ba361f2639a8ed7
SHA25650feb1a79cae9c30569a952a754ec0acff41d4b6de2ebcb6b218870cd7b6755c
SHA512e6e52597fbd1a7ca0d73e292a92324ee391b8b77c781a76d64853e0866432ca58a5d43de8a4b0fe0c669de8fea6cda56833b7aa1ff6d9f78cd4cd482c343a561
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b