Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
027906dc065003b9fe317d2350aa2865_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
027906dc065003b9fe317d2350aa2865_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
027906dc065003b9fe317d2350aa2865_JaffaCakes118.html
-
Size
2KB
-
MD5
027906dc065003b9fe317d2350aa2865
-
SHA1
82a79e22cd8c17261a424873119635131d317845
-
SHA256
054aba6019d1243acdf49f5db5d958878c2486df32293f545d749b77c00a6395
-
SHA512
2815e3418ec854d108ea007dd7bf099aa46085aa43eee503a3d2ef0a1795105ef3048cdf0ecfb42d44387da371a5670995e3aa45e80819e21831d6384745a269
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009fcbe88be0912443273523d4ecbb15be59866b889e8ddd58d3624707d698adfc000000000e80000000020000200000005d6d81712a10343fa1dd6bad488c326513dcfa39f89f10b95506e113d5312a71200000001b30e760233e3fa142c047d45575f6e132869522ea4d2525bbad982ce47d2c2c40000000acade539aa52cf5109a95666d5c1892ddc4979efd22b4ed49ac86e5b6925c9ce2174e6968a46cfc1a503ffca9e933ac25ec3d2fa326467d80e90ec45126e381d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a041a9645f98da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002ca2ce7306a5148fbebbb0089766987261dbb89dcbe55a994bed6b56f6a961b1000000000e8000000002000020000000b57435473c0010ac424afdbea60832f04a414d871b0eacb333bcaf3a8b68bc7690000000030e3b80f6c479c57feb214940672a3ad399d4e9c01a6f79867d6c2363088ec2165912a99bbc7dfa442c9048e8f0a51011101e7b4b9351973d1fc7addcb0b45f53df1109e59014db180722c1a6bbea9b0231ac1063633da43cee20747d35bddbd8b2049855809a6f8d2ad7d70188d8bb0bef31bd8d099ee4416eac3d1ebc27d90cecabd0a502cf0940bf1467756b7c71400000007e252c291f346088b4f4a4571294bd0857ff2bde303ae20fa9fa0bc9c4e3f7f887d6d85c612188d5788acfd8541b75074151f6d2df0b747109bc30556ec9177f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420355679" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9016A801-0452-11EF-8745-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2508 2240 iexplore.exe 28 PID 2240 wrote to memory of 2508 2240 iexplore.exe 28 PID 2240 wrote to memory of 2508 2240 iexplore.exe 28 PID 2240 wrote to memory of 2508 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\027906dc065003b9fe317d2350aa2865_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3b4a057787abd0a77044be0f0c1569f
SHA1942d5b02be56934246604cc0e96d01461e1e00c1
SHA25626a41eb2bb99d9a3f9113558907f195abf4cbefcdadb258d595bb7e479bc4c39
SHA512132a6fc73b58c92b08dfeded7752266e085491ac99975d07db99cde1079207f6dae13c7056ef5fee3bb5525ec72fdfba3117e795420b478e070a67ea0df8c888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7ef190a34f9583949284665c4d82b12
SHA1eb6393c05ffd34f0def3a22337b702ecad2acbe2
SHA256ce42826245340ee2e2f1747265ca905247f7fbfa34475c63e867aedbbad9f605
SHA5124f462f7dc029ad6e07178abdb42ee829e0beca7bec4d9cbde00abb8577e6345f04c27cfcb555c29d2ecf7b95fa9ebd13e514e038f3a63873d17c4b0e6961efed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509201e32a7960c354dd2f7c0c25429da
SHA14a420f07cd8efc39787f1975e254669d23e6a596
SHA256f909f3bf373a35c21abdca49f65d768abfac2b43f0e818d25a9166accad0b726
SHA51262168b52e29009e8cde86be8b29edad0cc14b712ba4c190a0b7d1820c5455794b7def42f9287c103176ae404d49674cd197b333ebd7a46bd490fa2cf0c788a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535289a11985297066705620830ab6689
SHA1529cb018d6ff8785fcd9684bc08aa98fa03af0e9
SHA2569f4df0a54b5fee28221ab1ba80fb9c47c939f13c6666c84ded0531c13d4515f5
SHA512d5820a30f483015dce82a4d66c918d04c2eb91188f66d2b502c81360905b9a27ab755acc8674766cadfe2f09b1402f07225d4529bf159cd06e3e299c1256f605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503db075f5b7b65f50819aa8a2169ae2c
SHA1bd87a8fab5687e7b394b9ce64aa9d93ce2c55730
SHA256a98a07396523079b628e3fa1de6805db922f3492c3a08c834bd3592cff968662
SHA5120891ca05a925418e7df26ed15f559b918ff9eaa1c26c520b81cb7b8dc8a7ef82f68aaeaf2e624227c9985cd6c719a943a7eeecaac4eac754b6a75f556ab66d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59561984158e8bafd8e1cdfb9a80334bc
SHA1012aa61e5cb96d6f1aab91e7e96495f9136c8005
SHA256fdf3fd95abb041976d55958d62f4d68a143300e6f542e9d2d298cbce2efc4141
SHA512fa23e600d0ff03f0b321696db5b5949c4d2914465617ae060c314a9737100a2c73d2b15bae16519951e4d4ed9cd3c806796b3a8c49e53143db8bfeb3ca33f22b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50200fc6b3a0f74f6eff59e91ed419baf
SHA16e6d60f64130b4922672f98773ffa57e6d9afe30
SHA256a6a9e4b293529f5a5286020e0324512c657560f771cc516f3caa3923d87158ba
SHA512f27c031d0d6f6e9625fc045415bbebbc757013110f1aa858767a938ecca6988acf05971babf9f734e053efafbe4a83e3a15f62bba43be098c9b28e91b8421ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5485fc7dfc4a69b3933325ceb2f9ba5fa
SHA10f11f6c3a87ada3c8eb1efb03a7802d6d69bdca6
SHA256e23b84d2bd7d210b4b641068400fe4fd57d332ea49af9079f8ac4cac864b3060
SHA512c015383dbc26b199b07bde56bfe25782a1ed1697372f791036bdd88201b6d12cf79128e259def70c7b588a83d7c6d7d73a8da18f663f5f8ac8f7126fc49efe0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d09ce0636076ebbf5776975592bd775
SHA17b17f79cf4b6e945389f0caf3b92eddb8679883d
SHA2561527524331979e518366405fa574c903a2a1e8bcb8ac2b5f436acc5b4a30d09b
SHA512e5c0e3dd2c2d627accc4b8cc7275ec3fa29996b82573f2f811a64fb0257e57ab5a98b1d1731934094f61ac306850a7f797c617d56c919b2278c361271cbf927b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5100a2e1dfc549a549625b2f5f333d29a
SHA1bc1f21a4294886ef8888921141906951febe03ce
SHA256d1863ed4221d647c23d1f61ded989fd093d20f3df4ec7b1f3e0d1b7bdb76ecae
SHA512d7e935b256cd58bc0c0d70eef033b437e4ff6c0cbcced06c98e9bb4eb68694583fa8292f2eb49a3d431600acb13ae3b295a11a3477d44ca7f908d3987c1124ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cded6985c1df88472a27c8ee5e0944f5
SHA12f77debc4367872596492742b86581127c737537
SHA256ac5a08bf865d54fe3155ddc08b2abb1539cf52ecb9a0f0ffc7e88910f1184cd2
SHA51276099e4b1878700b8655f2a86601c461278ff0119991a6bb600a16c7caa0983003477e7948cc8d681d364f94417e275980692edccdd84271d16ebafef2938e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52eecd13ed228f85a1a8b9427702c393e
SHA1517b50913d942ba98ef19b83457b8a01ed26a475
SHA256f81993c9e5ec40e1a7ee5932ff276ed516cd0394699a6fde4b3e33935d610206
SHA51261ee7798371dec57166810b02b261b830341e144445bd8aba60a219ad820b6b1889c042b2296f24868f88e81ea7f0ef24aefeaa1dd3865082f7b3d889cfd8e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e5db9155eca661fdb8944987483cc35
SHA19787964dd3b3b8f710362ec1e0cd924354da1495
SHA256692a44daf9e8b28cc0acf8009f34ea1e04777df919b674b3eff62792d4949061
SHA51235ed4824398d7c3b2ccfad21fed13900f0e615df490ad365f2098e76556068adaa744c6dce06e1259a60aadf0181213f426a491513b9049faf9632d454de5cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c278d8f7f3f1f8b40918a6934b5f080
SHA1755305690578ac1927dde51e675f9d767da03957
SHA2564822b0c69297f5dc1666b418805697d54656ce867da6adf61b52d985130cbdd6
SHA512d0a7a865848f0385c044e4fca39d085181da76abc61112708bab8e5d6ec09a6272aa89133f560f45b3b1719740ab60cb9ccaf60b0e00e53f773e210f3b93f563
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfbf9ebc4fc4ec0e6257daa74a3daba5
SHA1a92e71f25349e5959d84bf3786adb319286690cb
SHA2560d38c8b02149bc2dc22f11b8e23983b3c742aee7be22bea26b9a0a4570105d48
SHA51210578c195ad8df4a832f3e1e003eecc457354396de96b4ab5aaf56def7eb9a61e229f66a3a455a02cb6c3a3ea1cecb34d112ea12795dc7ef3735140f8be17ec4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584f5a8205d4f90b1bc9fbed2cfdf8f27
SHA157735e2090bf1704ad2b0fbb47a20ac995581a24
SHA256869e42099cd8a11c79ee7f6e60ee55dc51770bc31311d503306f1ad073fc2ee4
SHA51250004a1aef08c63b1d2363ea7914b6fd4485e61fea0feb9b8c79606e0d5913a47e8985d6af424b18c18070f381d9b8505a98321db051a707fb2fdd16aa135736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510ceafffabb6fc47ff0d90c0a6b6677c
SHA13abe6d39505605121b0ffd0f05c3f785c98aa1b4
SHA2566f0249eea5637f0eda5e69af3a3961e11d20649acc8c9b5f2d1460a2d1641416
SHA5126a97ea3855fdd3073ffb465cd5c99175717e26816507aafb253c142991a645c3fdf8c1f0d1949aca89fdda15608d52efc4ce5082e04d9b52f0d39505179bc403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5b520422323eb50a3fcd2fe6ff7261b
SHA166a26368d3ca7e755aecad8bd0f3dfe6ecb242da
SHA25605ecd19c47200354c6e769915acc6f8bfa62c5cce7b3bb8332025ec03eb34a78
SHA51227e3a1d0490b0038873fad28a7a8706a8aa2f9ef75e20150441048ffafef0bf8c91bd2899b4273b331932bb79c97bc6059834c4ce65617c9d840b947ad12c5a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d709d3dfe4e8af2ad7c55ee68b80be
SHA10b62a3e08849c665b40c0e98f86a384b422e4d32
SHA256df679440074d29c5fa198999d6d941fc9cc2f7ae449cdb344be811113d4ef3d2
SHA512a2e80f45b9455878daf006e7c411f8875c11f53b34dfba64da52f9d60d142e3c8954edd2b749628d5645d1641655ab2f6371f2f7ed926afb7b7addb48a8ac7d9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a