Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
4b16a83addffb6eabfa85ecaf75c9355_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b16a83addffb6eabfa85ecaf75c9355_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4b16a83addffb6eabfa85ecaf75c9355_JaffaCakes118.html
-
Size
6KB
-
MD5
4b16a83addffb6eabfa85ecaf75c9355
-
SHA1
5b8e949512a5c1c02e656099d29d6ef0b9f0a4f3
-
SHA256
2f57100358d2cd686fc6877b4675071d2fc9082aaf715a4086e650e5c1be3434
-
SHA512
0ffcf49fbf53e5d997a6ffa836f13099d1ada8d58b8442474de2f5653a17f279b4fa673a066c537e604e05e6413ab05c982f6611050422c36e3441f069c51cba
-
SSDEEP
96:uzVs+ux73GLLY1k9o84d12ef7CSTUeZcEZ7ru7f:csz73GAYS/9b76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000cdc7df506f61fc5111abdb6e3fd554953ab5deca3f08028a846dd3fdd5f6f0cc000000000e80000000020000200000009f65506bac95bc1f38c6fb1d13c29339e8773ab9b04c54ea5d161b357639f9f790000000be617777f51ce73e271b468a597eab1f98ef017a8cee6e310c505db3a7bf859011004e71b1a20167c6c724b7f46be54159f081fe05f582143c351e0d1ffeb0ce5a718d58a5a8fbc2bb23f38ca56f695882000769991e066ae81b145817eb9a46b8ca0a93db9f448406adf95fd393afd38f6855655fed218f74490c60c1c3ba6345fa3688cb036a92428504cdf330c33d40000000867949f56f3a44d437986b04698ef6c87343884635ba2967d27f28055ad5a256a44d2256c117421fe4314deac1765fc1991eca5bea28fefeddfe7a059634ebdd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005045ddf9a18644a8c1cd400962dad53070bca7e760fa75c13aa269bf98282a8f000000000e8000000002000020000000ccb68544b2f45c77d955ec9105e7b10f78905d783e1320c22bd197a4810279be20000000e282de73829cb4a1d34249ce81fd4e3ade0a2e2c568ff502c8e7bece2e0659be40000000e20fb40c168578374d0af7a9c52ca1be73377d8bee78164f6927fda341dfc789fa4379f720c6c8cf85091bec57ea1df70b81f2d01c504485a025632f034d858d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427233808" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3F65791-42E0-11EF-B33F-CE9644F3BBBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fc9ccaedd6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31 PID 1976 wrote to memory of 2276 1976 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b16a83addffb6eabfa85ecaf75c9355_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bdd891692cb7ef9a05c4ad9e84676d8
SHA1def9699bbf79a42927389a1f7e1ac8200e72bb9f
SHA2563fe77b780c95517bb8a1739f0bc291072968e45651929d05e2271afa814babaf
SHA512583721a7ba1d04edf9bdc57b3c381d302be30ba2cde2b69c7ee1aaf9884141ce71d5118b5fe2155c217de4b9a74aa03a039012d22980b4eb4cbcf498226921cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5934d83c7834d3d5ac6b1e51e0b957d7c
SHA1eb37d9455a2979cd4d6265645af4ba1a0160e886
SHA256d6b201b5c9e1be80c8009331c6b4f3d757cb9d8de13e35289037aa5bdd2846b6
SHA5125702692a3bed0ed280c9711da8c7c21e4889128905ca5a057f45a61e99e4e0ad9df12acf1bb2f689cee24c8e561d00b392d8a8960210a40d39008dc8ed413834
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52521f9ff0aaea184a07d33f9e3e50742
SHA15180c152414a5472b918c84904e679f8c1bcec45
SHA2567c182153feabc3fee755e4b4c9d3bd84d8dbb623976d53f2a7e9444566ebd031
SHA512b0923232d3c4ab70ef42a85407d4fc6fb9aa28b67d85ce814b216cdaa0c8ec2d2da130fae9b48e5aa854364b12565b235917746c78a7d28b886adb0a682e0381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5142c8e8f749b6d98ff570dcfd5d3138a
SHA14fd077bc5bbb957fa6d3b9542f7c68da5bd0d368
SHA2566050533fb1b079c78812e6d9a3b34dd5023e84cb28e69230c89060b57da8a395
SHA512962432de0357173ee2dac51621bdcb639ecd2c3527450ae6e28a257289a1c63a737b5119d95b9939a3e9ecba238ebaf2606c94487614ce79ce09958d05d3dcd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59552df658d78fef83fa2656a474960b1
SHA1313713043690db542313f3f5171897f624f3bf2a
SHA2561a996cac54f195c6d2e3c81c7483109301605a8b1487614127d96cad5c897d0d
SHA512704df387f69a2859c3a9dcb575da5b04f974d4eb475fda398cd5cf3f128b347bf4c0796cbe39f55ce099cb2e50d8322922e6ef0e8fa1ad8414933e6a79792ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5118f86346a2852616df2883112cbf8f1
SHA106b58113b5ec76b2b920ce57dff97d816db14b92
SHA2568a043fe74d3f3eff0841fe3bb3ffe16072f9469125bf814da9fb7b928f0037dc
SHA51255a24aa93e32a373b99623951dc9cebb9ac3562e6c92c3c84f66e58e5d99f79992e6cd2b762f63ba8cf236936ed2561ba6a55159877525d0b8f2a7dd86348644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fbc3b42ac10cebfbb6f6a6a0f8db417
SHA1fccd0dda9ae17ff6bf5c1cd4bdfe4e0740c8e0e9
SHA2566602e2ca6355203882d2d63767955388e88fc5cb2165ad9fc8bfdc62bc8b580c
SHA512b89265b9a8ad0ac9b41d701a12b1fdd82a49a713de5c4098c8c52a672ad42d32381de33df2a051fb4b48fa0ba3b0d299bc2b323d9a690110409516082eda470f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527bc53624787174652c6542079a14d63
SHA132bb3d257fb6689ee5b1a4054a90064cc09092ab
SHA256a9b4a6b22b09ad5d6071b2bea23767f882406eb66b87a8b4bf1e015460ec1999
SHA512126d3efe26409c2d36b65db8618e24cdb95b55028bf1b6997df58a84e1d24bc6a0c4182a52c037b339088ae7b5e0d3d2eecd3dfd42de79dd198857c4d21e1e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5666bd12a16e28fefee44650e60a79586
SHA12d7477ab28b11e528086752986a145204942df30
SHA256c1af524b5d99ef61c768afabbef8374efcdaff473db8a75327caf8fabaf24644
SHA51282b0e4c0a0672f4412c84c4b09dbe99ca807231d7edacf11b1bd44a29639f9f62cfe1feb69ee5b81b5322cac7b7148b2bf9ce81a206288a7b5b9f53ce2bfe867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5694ae03cad3e2838a4f258c04d3c5738
SHA1f8c111d2c290114b591efafbf8524490e7e08c80
SHA256821cb58edf31e6ace53b4463dd6ff2816273efd4a8e89228d5e0677a7fca0f94
SHA5125432566b19f808557a14759775573fa0588a2c1749ced8feae79737a84212c39f88aed30116c12011a285a9306ee9d7c6d3d177e81b8e1733bba4faec47c01db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c59cea4a57093cbe58ba82c87411f8d2
SHA165ca067630f9723b9365b18564359d53db8ad589
SHA256940ad04576e22a4a901852870a38b0f73ad348a68ca447feda33dd7ccf94f768
SHA512d768157bf19d717c9f80bb460e17a1007a917838c2ad73806540f24d3f8a9e335863ed0df26840dde42e60cc3b922f8f33e45579cb40f270eb0d1fa3f482fdaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5389d93583096afc2b0d03fb3fb5724bb
SHA114a87529ce00d8f64ec1b5dc43a140b126798a57
SHA2566c4be693358fa2973b67c61ce97f8c2549dac975e9d8eefdf560fd7897a1b06e
SHA5126ac59007d4584d4ab03d9bcf4e3bd8c95d61995394d2cb3a09f0338066963b384dc3ff2e38288eb1785e680ff9f6a3653871efd69fe7cde48fc2fb1da68b301b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d2672480b1ae23a405ae2daa309cf74
SHA1499fceff11ec2a253451dcbeeabe9c14bc65b9f7
SHA256c29901e2242e6cf2991768fd5a9410a97fcf2d71131c8ae726cc4a9f29ca2730
SHA512a7e973a08d6ea8fcae4dc25dc58dd3c322e69033ffe671c5ed9ed05ec1c316089d39438db4ae1208564cd05d33f2ddee4beedd2489b835c30d6bd71febe09a82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da4a5b645a1226df7e857b83060df11c
SHA17efca0201cbad9c015b31cc47b8f1bac848adfb6
SHA2567ae17ad64b3d067fdb56ff2200775fbe28d25b625fd5f0417b22b2e83c042183
SHA512c8c6f0af03a8f85af431f1051c265181441347df048526decf1cb2744618b3583cc81805901525d9bb3f48e28047fd86ddce55bf031127783e675efddba37a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea4a37b94d879305379c70f5cd881fee
SHA1b8f15513fe22bd282594fd4792928384911be58b
SHA2561644133767824e8f9b4775a6138f0b30c26de59b2ee993f59c2a8da5f563f031
SHA512d21548588ab9fa528d3d0653443d7698cfd316ee2c9f83609619324a3d31ed0642841cad7b40a5a81861fecbfd97c4586723143018bf12fdfedf944026fe4549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542909c255723ae9b6f64ef5b618ea55e
SHA11e20bef388ecdf51900ff105cc626797202fb6ce
SHA256385a87a9c2ec01ee9244369694eb031e72c7547d43c9ee84105754efb956d5d5
SHA512e817b57f8097884ccb3f4c3ff640a232ded2b1389419a0382c2c98dc40e4ced5918e705d38c9b7993a8d11418bb84702ce5bfeef276628e761b4fd8e2ce23557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a2fc1a0525182769673f371d9d373d0
SHA13a3b67ed034b1ef1a5d1c79beaeb16f31ae4a956
SHA256660e25b0fdd90ffe0c74c677cdc702c296d756401ff84bd216447dab2d219cbb
SHA512e3369a9f455879400dba081e2728d4fb8cc55c4debe8a66788a3735c09c2bcabd507ab34ea6eb5a54b039f1dbe4fb6bd44e47d675e142b430352829b7913cbda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53391e08144464ae1bde9c0bcf4522172
SHA16f1de6a4e08d423394161ded566d2868ca465bd5
SHA256f91e074514daaded8e9d5a5e702c22bae68797561959387517f40782c009908b
SHA51279843be9b4e81ef57c309f0f3e5ae44b8da8dacec8cea75cdff7dd1ee05b6680d1b6834f2ea1f2429d47d6fa2052b3288b90a84a6d86cd4a52cea22aca9a36c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7525ce71c80f2a1817db3c9ccaf8d88
SHA1ca589baabc942eb72a1380b1dff6f86c5cf2d3e8
SHA256b9181a2c91d614677909c606a3e80cd36dbe89ac283d1fd4336b4598086ec657
SHA5122e216ade4cd1596f2e4a2e25be32866ebf679052541e7bd17714d979d8c32733cefbaf1833aae8ef00fd11d35ced08884517919ba0df5cda1bd45a5305855bcf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b