Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 11:16
Static task
static1
Behavioral task
behavioral1
Sample
127bcfa960814457f7b47f89ea169eeb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
127bcfa960814457f7b47f89ea169eeb_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
127bcfa960814457f7b47f89ea169eeb_JaffaCakes118.html
-
Size
55KB
-
MD5
127bcfa960814457f7b47f89ea169eeb
-
SHA1
2f7a4663fe5dfc124f983fbfe9e5edf026477287
-
SHA256
4fac37697d30865ab7da38a12b7e9c3970f020c636c4aeb44d041d463fd250e0
-
SHA512
360ff926c2c9c945ce2bbbc4df67e4a8d6762e5cbc41aaa82dc76a2e3e2e71dab886af18082a3b124f0d91979975077770b5cae756a431bc34881ef867f2702d
-
SSDEEP
1536:tSsIgSyEZdsj7reguFuMPh9EKwFrUDXgaHNk4RW:tsgSyGXRW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000159ede7f79aeda519f91fb648aaab2cd0cc69590940da229383dcdc0c26b4907000000000e800000000200002000000070d735698c5a84081b88e5a4776252f53c0aee34f4e0b27b1b2db43dc6827f64900000002fac2ac8f19cb73b1aca43cbe33c88e549c9b9520dc6d389bdc0f1cd10dffe604fdb38a16f4988648ecb10ac09eed1b026d6a8e8080e972d8391d8b534fdca0155f00ec8b18d2549f2c671476240b004d91ff46c4b074edb4964d3088071edb0bf6aea10fbcf0b8f3810f8fd9c8ed75d3aa1708e6d743a1e609d9c25cd78fe8459d40034b09a34762ab373878a1bcb1240000000d859ba8603972a12d18ea916582cfbfa8eaff944c8b9d4fe342edd0ee5c1696c2d850e0652c48efb1fad32759a731472afd0292bf740f33e8f3cac7e43dd9517 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420983242" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B835E7A1-0A07-11EF-87AA-FA8378BF1C4A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e2b60f72d0c25a8198209c15f0db3f49492b42d2232d28ac749cd1e6367243f5000000000e80000000020000200000008c4923165e20f5b76084a6b3e019aa997b770d9e05cf56110da1a2f6024e2680200000007fdd0ee34bae3bcb7dcce97ee980efab0e11d3477e2241d4f5535fdc1e5a9e3a40000000496d53439dab07383c0c7ad564bda8b87f903e29bae8b879a090392e274e52fee9bfc63f066d624d9e23a736b34a663c9e72bc054f7bcd688b524aa410c5007c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3028fa8c149eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2660 1984 iexplore.exe 28 PID 1984 wrote to memory of 2660 1984 iexplore.exe 28 PID 1984 wrote to memory of 2660 1984 iexplore.exe 28 PID 1984 wrote to memory of 2660 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\127bcfa960814457f7b47f89ea169eeb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5568ff8fcee2daab1bf039092f5443dff
SHA182ec0ab3ef5fa43d6628e77e07446d350b85f10a
SHA256cf8bf678a6dd0709245fc9411d9be1bba2ea67bc4759d55517fc6a5c075358a0
SHA512766fe1af02aea0e25bfe309dc91d525de08186728fef616586b5c35a628f1993edbba6767f0c422b7b606d6d828a1f67b39b4080145cd7fd1a80bb0c55e2d1cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57968cb553b310001ee007cc71c445a9c
SHA19aefb0fab5b752c8c85ee03d71508d0e26cda6fe
SHA2568ebbf70b97ad45e173effa28657b3acd22798a1224853d89fae334541cf1975d
SHA512bca0e3807b8173eec983b9f7229827b0b19a8c5a5be6c220a11a887388659cc1950f038ed4798dd7f6813db7cdb82f268cb8b73e357eb7f5ddea61bf49b46529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c9fad010e7a38be2b43a88d194c418a
SHA1bced6eb51aafe023c79197cc7af678aa085c2691
SHA256fe49bea2de6ae97b6b12e09da488c8e38705c490f2bb7ed1c180cbc13f73838a
SHA5126b09a1f6dc6a83ee3304eeda6f9efe091847d4eef320ce98fdacde945591adea546623c06b44bc8bec4324d6d36a668d16cf36e7f3a27be6a0c138941a5a6084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d172afcfdea72d9bde79a5fcc720066b
SHA156a4a2c7569fbb691c21b98159626d0e19d50344
SHA2568040044f4832481be753bcbfd811c72c6f43b248ca7f3f554c0629ea607c9429
SHA512b41724810dd6f50d28d7b8b2f201988cf7b592b165ff71d32397e0a467911a588270bacf3f54ab82c4ebc8e1155ff66ec7de3b7b008911e9435863c8464f5588
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5440f496fdc40610c032e774884305415
SHA1572a1e80910ad41598965b3e9496d9e969418034
SHA256f2dda23fc8250a9f960642bf0857e566b32079e09b4a2ab77795ac750ed85bbe
SHA5125d810284e7526bd08916fe726143a0037dda6987100a1e5cb1583f0b875bcf616f98fe7abe352007b78696de938c1623a82a8ca06dc617dcd1a8a15bfba20141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514ca72f06059ced2c5516cffa90e4641
SHA1cb04260f8a89a3ce2d98bcdc9af5388f34797633
SHA25679fa435333491fda21420890d97cc9a45d9dcb76d4d8a9fc5dd8e311e4db345c
SHA512c2316c7443d6a67b141149e254c5455e0499e7e6077a5c117ecde7516597d27e1dc6f9767d74e4a6fa0bf96e353fa6928bf9d89df0ae9df4b71c6b9fb06bc91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50547bcb4dd1787c40bd74b63499d3d3b
SHA112fd94df85caf795e7edb59a0ebba91b8811d961
SHA256d8df94169210bc57db25a29ea6b6ff713ed72b68296083580f0acdc63209cbd4
SHA512615e567cd26b373bb8999c3a73447c09e152316a1187ff5c2a5b68d091ff0057ae9c7da35a982b9ce2ce3903132ba9acfbbddf93afec7a807feb33cbff9f119b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f2be2224988959b78a45c157cd5d857
SHA14ca69dfe3410c1fa887df61b1051c92a31a40efe
SHA25684a57c4e65768ebf791ea8dfbf39bee6adee42cfd827dc5681b9483ad0308b77
SHA512a8bee91f37c7ead95c794e258124cec13ba56512e0e50f903468056359af53023e021fecb867ad5a065e02fa4d5725b4e136bd49097ffdf642bfca3b56965be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518f2dca0a42d169e47f37dd841bf1d2e
SHA145cd375c59a0c46d906ad0060baa2c083f828ab6
SHA256c37b7af687e767cc73130888788f502e29ce1595ccabf5e2ea17e8731325a965
SHA5126f49acb9af913fd5e282407be163f24c4d0e9bff4b1b7b744ecd7b0ce9f390da2d422155e72086b7d9ab990deca2d0f3bd8c5cd003c66e44ea2c576a1066861d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4dd6b50640e74d7ee74194a4241d3e4
SHA1432119a33bccf04d64ecf9e2ee6f66096789b4e2
SHA25616ecb0d55295a1dd290380e09d479c85a6cf17ea3221b86c31642811506652c3
SHA5123852bab14a4eda89f088f176356049e61a24065f212f8f058eeec7d64938220d8db5897767d1b595d0e231518a7f62fb2b6e36a7b7d36098f1eadd2b434f7f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac59910f8ed484b862291471feaed8f6
SHA1a67d02d53842166e72d0dcb928e728f505f27955
SHA25618b100ead4bb399659a1bfca7e54f1575678f17d2a25d43e934c9980509cc6fa
SHA5123113d9a0fa65857b27456ec4c2ab7b6ab92bdc63b0e70ce57b0323ea57296be602d018bd39b0d5ecff835a49ed999fc4ebb5d11668633d85b84157c096fc15b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdddf36e56cf82f69a036382d5cfc52e
SHA15e7b7822e67cecf7d1028c7f69df70f29d2d6b44
SHA256134466b53c1e1d155017d142261ebe4a72d1047425daf1fb73e65ab318347d98
SHA51286c9f27c5b18c31f895e29b26a9acf6001a4b919ad946b4ec3fb0fcfb0a0c86584e85d363e75e5e12b65528e686ee1dee5b1589f1ad48b4acf8e914ff78a77ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab2abf2621beac66ce0b5bae01108ac9
SHA139ececb8faa590449fb78a545e75817d6171aa26
SHA2561902e22cefb908428373e2ac25ce73bc2960375d2bc1a61ef57fb2df73680db3
SHA512b4afcdc82c2a0215726e9bcc68b130df16201d62b11386869fa37dd3fa8ac99d9db5517ee1aa510e6bf1c0da57198af161b65b8c4cc9b96d62882264fc18df0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598a47171161449b77590039aea28a736
SHA154ae98e0152a301aab3e63c9980e883f473cf685
SHA256445b1cc15817522c96b4136473d79fca20996abec4f304743f1cd4f18b5fdce7
SHA5127c5c438c2479066831db666e654b9e71d77c9c29c9ad660e36c307a7d8357c9433248d077ab31003b35e6ffe61b8c6a0485aed5a717ef99b1ddc1476a5197604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5749f04555015ffd1eb7ee9289f01e2e5
SHA140e80e891dae8d342351b98949ee04b48880203b
SHA256dacace1f91caaf7a61ea0e6b2bae05ca183fa3d607ac60f11c2fe9bd13a8dc76
SHA51241db75a1b9e569e2dd59aef0b9054b367103920f7f5a367dfe777602374e50c39f6d312b506233ae4820b72f2b807f44326e7f27bed101629243eed7d1233316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb3fdc954ec0aabed104d9f8f67ebef4
SHA1679be4d0c7381adbb97aecd392d3911fad6ddd3b
SHA256579da853f85d348160a3969b845e407d2ee3116826725165b9c652a82a8e05ce
SHA5125125b1ef60a5ae84489d6e7aa9e272e2d681aba0f72aeea0acc315fca1dcd6de985f7db3f680fa12d3360189baa50f0e36c1b190bdcc93dc94bddadd462532a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516f1e20e7809024107faafc220c40ed3
SHA130b54130a05a9aa863d55d809b2dadce2041bd71
SHA25620072991f56b221661aa69bc75fb9373faf07037135d569cb092c9e0cbbe8abf
SHA51235121abd6fb6f9938471dba98f8e1433b8788a3711b77527c0dc793f0d8f2d0e510e67a780e1a876a2a0e81269488489f0559a06656faf6ad911aee05106b865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2497fcec095301e0c391a2502773764
SHA1a140c3a7f9814e54b9ec48cd9f56a4cb722c5c0b
SHA2561c06bd0ad74d9b17c21e7f52258a796f5daa5711634c9359d81603bc3a9593df
SHA5125a40be35283da1a5d3bd6fdd55000a352f45f92fbe2ee8c7b9cb9fefa6e0dff788a8edf89f0dae2b3195ed4cc1646206d9558106b487e92d9d45c19526dcdbb2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a