Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
272068fc435b697ddc84e725197d564e_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
272068fc435b697ddc84e725197d564e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
272068fc435b697ddc84e725197d564e_JaffaCakes118.html
-
Size
70KB
-
MD5
272068fc435b697ddc84e725197d564e
-
SHA1
6a3054ba2ad0f53f30657d29612c10cef951d851
-
SHA256
225e1dcedbc580f7fec758e1e133b226efea76b746f8241585fb85bbf380355c
-
SHA512
be5428f0ad4588cb4e1cfb599c2c942828cce83afd8179332c1ab0758ede141e78e0ed484d7a718e8aa387990733bd9b429eb4660bbe257095b2e3d4c3296ef3
-
SSDEEP
768:JiXgcMWR3sI2PDDnd0g6o+Vko95H/Zs+oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcs:J1cko95MTTNen0tbrga90hc+NnhVJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60985cf59ba1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C7A531-0D8F-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421371253" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007f73459345c1065ac494b193ec545825cbea2b12dcb833144738ae481c064ec3000000000e800000000200002000000061bc58bad6e2ae52625fd8588fbc0ae139412bd84ea4afddf0f1361c4d27902290000000c7885e094754b87a81183b5040d0b3c6d4f147c8680186ac8fd5da860e37c6144125311761e205c14b03e41bb902ecddee040160c401ea4f8a7f25b6d9b8df24e9818c02e8c991328761be8bfc6c5d67f5383e820df9bea2d8534926a5f160065781c000c0bd50ddb3c8cf2593fd8781501a5f1cc194807f1e9bc9d6de02dca1db5b4973dbcdf50509f0008f4a91e12d40000000ebb9d43dc06998f7f24e0a0f397d9a3e9cccccd104e7bbb36300a459f25ef59af16d4ad9b664b273cdf660a5f99d27be1b6ba08fa928b3f02abc87d329f7e021 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009d599509237ad5298d54031c1972b33cb7a4f2d3342b7325fb284404e07e4442000000000e8000000002000020000000fabe5bd257d3300ecacbf9200c57039c9ba2df667c9fa408402c60a97489ca9420000000bf3b873d5b350fae6181ead2caf9f370db6ef0f1d464c2473ebfd29d6d6f692f400000004c7476827f43cef928ab1d476cc0d78be637cd2a9547458dbb04e37793fbb0eda9ba7f591c97ac27fa806e176f7143bf7cf5b2c923b277a5312c2039c8af8f52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28 PID 1700 wrote to memory of 2832 1700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\272068fc435b697ddc84e725197d564e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c0095e7c72d4faab30db4218476862d
SHA13f223c5b61d76e151dd564d89d8737df4fe9a124
SHA256f183ea191a1dfa13dfcbc4ee7b4227aa11a1f07be72d9ea7ae1aad20c57277f7
SHA5121391500ae7f55af078ce46b40ca4e00cb3561c332a7e121657525f290726f73e61cd04f4b2fc579db71f44ae36ce493434b5ead796b73bbed6c0a480f377ff4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d52275a60fe5a5e14964d1f47dd53ae
SHA1d4792ef6a3fcda6ec650467ccaeabfaf8b92659e
SHA2567c9b95aeaecf2d5c87615f887ac44b611547429351494f91e2d6a018a657c5ae
SHA512ce89f9f8079b673d8003b934ad62f2406f0d5078afecd3a15a8862a8a8906e2c364d7a73a527e603d6126ef40dca9b8de30ba84e9db1bd776225b6ebda4ec1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e4c957e157e57f314bf1e3a68162932
SHA1d6e77b11284cc7ce4e28e2ef28a6bf2a09b2843d
SHA25666af557ef12636ccb87f8aa5a2df4b5f667caee73e7f1f4eaf0c9515254861ad
SHA512912a404a912eddb27d1dd2703179bd7302701f242d78c5f51e78a1b35830c3b619f3a9f1d2875d55733a58a0a8aa0acc8fd4b94a00b324d75603d0e6c0f85768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6362144f8825a148e071ddaeae8ff5e
SHA10cd9ecb7906fa0b700c8d3a8932966d0f077e3b4
SHA256b2d87f9e6c91f3eeaf701a85366c2d2de68ac79af557f42329e7de762c6c1802
SHA512118ebcbb21e677877b85a94bce64077622bfd885c5a7e06c2fc88b2ee5c76474941be98a7813157eeb7a7fa7bbfce0a4240c9e93b3b9fb533fd0b35a588c422c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527001c396035ea08fb92321b72960bc5
SHA1ca52b1c49c11f009526f585361cb5229c3d6d1f5
SHA256ae6475d94b60abcbb68d6827f57e80bfc27479ca86d9edd0623adc800ab0b4eb
SHA51268639100764c0a367fa9dda54b395ee2840db65ffb550f7f57e92c1dbd6ba313a8ee3eb7dbedbbff9fc64b7e7e8d673f66b0126b18c327aef66139dfe4a15131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad36f8414fa880136e9c16bfbb23fa80
SHA14dad0035ceec974729d52748e7f395104af85148
SHA256df6eb311d5f4bc8ffadf063e89c97195c529aa10c5f6b70f972b7032012430de
SHA512a6baa33768d955cdb8eb8ff91493aec2e19f7af05123fcbc2863cc64b51fc6eaa3c47b7eb0852b03c503f4b404bcb2e8d4fc4bb7c870a396a1a5a6b126545409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea85555a5107825a779b7a53c4784763
SHA19ac9cba348b7a5959e4a6059499a54a874fce4ec
SHA256c50ca32dfe80a82f951d5a5ba28d91dfd97b685a8b875e5c6ce706fb2abf1034
SHA5124e32a44d40b4513972ce53bde61cf4515c7135c955ca9a73d8872d76d06a035e0eea94ea6fa5b5d593ad139ee72669105ac5ce073467d043bfd3547a07b5d4ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c585c77a1d3fa778d8aa38351b2e6c92
SHA1cf6ec1ef4de6a86dec699c7dc585171a899c64a6
SHA25605dc5b5cbfc7d6e90f3381b92b91f20c88ac920047119c874f25c7553841b8ca
SHA5120528430d29c4d9ff6f033f6a874ade68092bcb8a728de809abdfdd329cf37122967519aeb51de1bd0021750aab967463aef012900f87c83ba13102d73857a3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5848e69412c3d6c3dbc56acada62332cd
SHA192ad12a643dc2a8522694acb0f16f12394fc895b
SHA256fb20f035dcf8eb0327b3aab6523e95602b4982364ed012e31ee6cad40951776e
SHA512bc386fb80c260a525f5d8470aeaec6135a6fe40a8ce01b564fa6ff3b56f9d4ed49119dc90225ff4f3dfd1abf93a86fbfb63f5f9d25e57760f238a9c65fcbaf78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50886442eb10144297e4c66260de297db
SHA1918930dca1e48ec16a5178c2fead9992f6c6bbd9
SHA25634d525ba6ce54e4e415a46396808057decd02a87ed2d7353e103532b420c102c
SHA51287464c8ad4bfabf4cd7690f49e3dca00bd4bf008ba9db084bf51b4d54d6abb5440922b810da96d3d9935a3861bef9dd4551c1ae451dcaee2544164fa165b557d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d47938623289b652f70da6cc24b862d
SHA180acdde4dd0e883a913a31e4e94abc9bfdd63e76
SHA25685ffb607cd17bf0ef91c84bde02766b7bf6ed906f9dbe894d37ed0401ad3283a
SHA512c433551db75c1781955cb84eb2c94348d4f9cb1ac55a6f398971aac670173459a29f4aaac0887c4712676d3b677ab989c1fca5f6c05de42b2dcc5bcbbddd17da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787b4fa2097fafc1834fb2029f0ffaae
SHA12b88f029a3b25ea5c8022bd3bb9dde0165e8531a
SHA2563101583ea62240a46798b16225a1657cdcf87cc2d4689f691b8c9986b69b44c8
SHA512e4d8b59db4d08475e215f9ccce836f6968559c2449e20c58d587e83d030b08b4dcac419e39c1b002d47ef8bd255c2fcdf8dcc58d550bc6cca055beadbc39cdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5ba34a915810a40213968e644de5cdc
SHA16d22c2920e687b5c40344b61617a44841c7863ac
SHA25674bdda75dcf2f0276651816110681bd127210a9e4f2065d4d7db42039c1643ee
SHA512b1eac5ca7ba5e25b155ed21e25dda394ae472ea0a9912c6f577b3fbc68481c14c4d10059870413b3aafbfe5f52dd2db5024492cf762b1c946fca1a43f4c6321c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca57b0c8adf630cdac17f4186d9d5805
SHA10659198e5c1906d4f5eee9736c0269b4a7984f17
SHA2563b988828736413472b116d3c0c01f1174e34dc963a3fb5580f8c239c7752f87e
SHA51231c51f80d9df1e267de01aebf22a16fdba390a7137660cdea5eb6236d9a6f1320d1813497d54f928361e7c93bf858879e63985169b25875e3185e615665a9998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bc7cbd0b1a8e7be91b28b27c8e075ff
SHA194bf4bb771925667a49fbabf9c3a0dd2c05d4fe7
SHA256f2074cb91f8705c75d5ac7ddb623ac1d78e6b0e769057c703926d2a9062955f6
SHA5123d1e6184cdf26c3d40539704a76730851da7c9b32aecec48281a0ea5da384075ea0149f2a82518d977ffd5cee7aa4b0f7f0678a4fc3ba9265b8e62c0d99146bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8f3e61a143b49f88a8f9e5042da28eb
SHA13d897d4fe422081afcc8f6793932a67ed54e7bf2
SHA2562cabadf933df2e16d9892584ccdf71d2052a3e9d4a35977e39fa94325b68dbcb
SHA512ce1a69aa37345ea95ddfbfd26a49f2ac58e2b66aab2207bd68bb4fb6beb0ad3bc9ad4221c1eba67e68155e918dd8f34cb7903e47381301b41b9c5da6a590189d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cea7d876084f3e44779f8804162f142
SHA1ae4a3f10aae15e110b3c7f58bdb3b162359814ad
SHA25643cc601507327fce100b01849dc028fd0b01b6b2802f2edc0729728b10325e5f
SHA5128ed82718dc15832b2217b618f8b2b9461119eb69df39885da9ace178b717527116cea3a25c0aab69a8d253da0c6a16727bb9d215e7f2cb8bf453dffd35a8bf87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5299c34b1e342eddd0cbbed0bd09ac30a
SHA1d5fbf7ec865127e9cba99841d2b6e2993e0c1008
SHA256718049f68e28e92138248e8251a82e0e3f4acd0a15a0bf87d44c09925ff7f936
SHA51200ca86b184ef79674ce1833ea9d4db99d0ce83879f724510fadc46ebdbca9be5cf322b3cc6a06adb59abe97cfb5ced158d288205a0738b152171ec4e72b75375
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a