Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
270f987f248e3350d16ed9cd937dc3c0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
270f987f248e3350d16ed9cd937dc3c0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
270f987f248e3350d16ed9cd937dc3c0_JaffaCakes118.html
-
Size
68KB
-
MD5
270f987f248e3350d16ed9cd937dc3c0
-
SHA1
ac202caf280ddf4cfc861f3404125779663db43a
-
SHA256
3b9ca79553e58d73ff3af0f6607fe250a28650c2c1267474812465c631da0090
-
SHA512
d7d6e7b1bd55504b0a804c12d980fed1ddda42161cf487ac3215cfd7af1c4c10554e599b95adf56a599e52349d4a41b89fcf06862523858e28ba6419dbdeca36
-
SSDEEP
768:Ji8gcMsSZ8tN99OIsEHTelZfyroT2SqQCZkoTnMdtbBnfBgN8/oygcRWQFVGys/d:J8WZyCkTEPec0tbrga6crNnz8PJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48061F31-0D8C-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000772c98efe4965d4bff7635ee8558a267c6d5e14ef64356256fac8361bd604e4000000000e80000000020000200000003153e26c321ca33f968d18b0d5745ff75ae90bc6474cfb812965fc47059ea4202000000058b321b52886baeedf69b5a2c5fb66cde0be966d6a7c93b398c8f75520bfccdc4000000053e5a46cadb48a6f455592f636044abda04a7ea5ed686f6c4ad5bdf4d1f639a0b48aa79162452051963059f6f569c075b712bd4a184d04989df7c3d46a54c783 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103b441d99a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421370031" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ccd2a450f07ffebe0f9cd0896fbac6e75c150fb4c93d67203df66b3f7fee362e000000000e8000000002000020000000eded6d642c260d99e269dc050243c38604df395bcb744e95874867c09edb5e3890000000b646bda47a336918cd1e219961c190f780a062b0b33e5fcdc480b89190611e3da9cd7fd6cb2bb2b0d208bc592b300ccf1f7fe90bfa0b59d0b21998f18c3774af45edabba2e0a604c45770fd006fb5e105801be9f7b966cb4b36eb2b47034b0c311b8ce007f68863950d35b5a89b9d37d563db35f416466e4f78b42299150be8ff4c7211b8c8bc17c6ee16ba81314ceff4000000071e6db0078f53f0eca77d786b719c994dd14d731c69832fcd67518c876622e4fcbee3737fc22b0063ade494cd3ba57346a25141226334f7bb6899ba06f19f3f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2828 2172 iexplore.exe 28 PID 2172 wrote to memory of 2828 2172 iexplore.exe 28 PID 2172 wrote to memory of 2828 2172 iexplore.exe 28 PID 2172 wrote to memory of 2828 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\270f987f248e3350d16ed9cd937dc3c0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5020174fe087f943cbe94c3ae2904b911
SHA15a4af5a5682a6b2977e546bea7104922337268fa
SHA25681b5b48cd04906ebf44cb671c6848f9a0b77284e099aa6084e621edc92b41655
SHA5124054eac28728eedb8129f357fdd3612e5c71114d0060fbb2256289ca3f61974b8ab5493e446184288ab0332ff25539d3cc142d13b69c2337171d4aa3ceef8306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a7b7bb4a7681a3a4ae87421effbcad3
SHA161a8daf17c9cd9144675bf94793f2b64d027affd
SHA256191f9be8e8d12db3648ee5d82e31906bced6f93888144d9c600efc4bfdc4a99c
SHA51261f74455c26ba84ff8a8561db67661944cc9e4316201a81a663b56d217f9a082883fae96ba690c644f8c15787e67d9f4294309eb73ebc539be7f7e5bde473cad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562cb1e7b5ee9044e89e50ac95bb5524f
SHA1b39e7eb164cf23e096fa947d0b0e41be8f2b294e
SHA256459838c221b3686a8106f707236d0edb74094444c4d8208b8ec9f1e5c9cd84ba
SHA512fe7a17776fd726d2dcb3442263d6310b1e48dc00596a243a8a8d04fad6cea7b2776f2fe6a36fb09b50e3306e5bb930138d9fc6ab3af2f40b77dbad35648b5eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faafbde2eb29c717a34ee978f9c0de7c
SHA1d9c396e864c47dcd4098de734c4c3e836816a549
SHA256b9671fb80fe47e079b33c80f0b31af3ba9e20e9a50d86a2808cb9da37adf28fe
SHA5123d1fa9c1f9f7d50bfdc24f8274819869e73c46cbee32aab59752f2e5db6a65440dddc334dde54686344bb50fd5587fe80589fe03d9b2bf15c5021173690c437f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5905ed55026969de547ea978fdd2e121f
SHA199054a0cc760f35e7fe6bc2f8d2a06db77c3e7bf
SHA25645661f575e041eee870fd9294cc812fb3bf8bd74af558555909bdf64334c7465
SHA512d14adb263db06d344e828ea385c96155fe5ddad20a106a21962285dfc94b65aa295eac1a813f935296ff5725d3cfd14b15213ba616b532fd922fd8992c8503e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5177ca998504ecde8322927c8da8a1141
SHA12a1d4b0890a7c554657510cc28cc9ebc58f3bdf2
SHA2567d62a46bddf026e3e291de69f1fbf8edb7744667c2a74e14493fdd1160eb0eb8
SHA51234f500ccc75de3ddbf7a6e4d1b6796dc42918cb8e36b33d5894eb87623f2cf0d24cb2a391b70c510d7072168366f977767f1eee07611d96b0f50ec401ab85d01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501025dd60c7f16ed300372633b6caf0c
SHA1875492d531c01f44e8de1a7ac62bae8802982958
SHA2564ec6150349fe14d767243f0a262f6e77507c59cab302b124ab951cf31bc20f34
SHA51275ae7b96b465f5d7a160f09322394e32ad1ed353f6f7fd78d0bfde540196176bdcaf09e67158471b59a6a37516a5bb3ffb0183a2573b371fb491e88093467ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50955f04d29f70b1d41c96d4df4e542e9
SHA16df5d5e839d49d38e6c4d41ba7bb52f738d5d0fd
SHA256e328dffd76d8930ceaca51803483aec080ce0f121fd854e7887e2daea0fd05c4
SHA512b189bea808cf762789f9c360b9b1d09f1d417fce38f4b0562c193e7bf72b225c30bf4401352faa7ad1ef02286fab0783810a2670142ee2b1cf37f7c864551d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c1f65958912b3440eaf59a70a22c80b
SHA1f66173a132f8181c889259869c3fdd6ea8f951eb
SHA256ab8a561b097aba382ec4d0e62811cf028700916fb448b4b10a55d253ab2a14ca
SHA512cf4cb92c4cd579c769198bcce5c2c4f2c7d978c8f4cdb5c15a9a5b31c1e56277b3bcff2f3a804f5733ace0aa6d61c0ffa3f91ddc29a0cb722788ae93b364d192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8ef22f69edafba59d361b66d6a2d1e4
SHA1d2e9a3b86858e0d477b0f80d3faa66a6525a8438
SHA2569b082b5bd9426750c6e9e70db18350eac2457add576a2f8a94901c42496edd88
SHA512f98958be8f2362dca6166ece669f6b96b71f16ed4ef6ad6760e0fe694b1d1cb5c530c3dc6e86f37d0c3dcb7af8a609f462af3e2cffdc4fd4f7a686916c70afc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d8f9953e7eb8b211cd64effd5eef118
SHA158d4c9768345628b3dfde45f2e407e59bf1758e1
SHA256fb8183c3676adefce6c3bffd05e3b0ea97144a0712c2bc2c6557f70bbdaed373
SHA51243a7c85c2ce6b741bf8e60536e2ad5ed805f39e90d59ff1c2ade8913bfa7fa4abc6ef126b21db91585028eea07c4bd297568ff231a15b2d7bcb1517e3c12290c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cdf07b879b20559a3b40f43621ba678
SHA1b28f0442fbcb78f3cce971ad7d03b5a47db2a590
SHA25697a4586cb6845ab12378c8973600d05425f3cc60ac526b320f3a88156bd6add6
SHA51280ac106c90d257208d7424138864fea3025e79582733460c987d353336fccfd66b9ba48f33a60549dd6920cc755e0b5106c499e21775420b36426552f6f005a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52650f5004ecc8be20317d5f2514c62e7
SHA1f092d149c4e452fe5df5f1f9198ea541e24c0663
SHA25684f3ba32b692158c992b4de4b39f9553455328efbc94a4f59182984d2805f0d7
SHA51276e7f1c25bf9f9790d1a94b1798b8b68ff41a061db7f99ec437612d4b56c85c3f5fe7f00371d4a1d0a7bd97b4f8e84309891f9b970d3d3e413294a0f3b9ff409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4a23eea71352bf7bd16356666ca05a9
SHA1896add10c5d439177b459ad8ebe8562ea13abaff
SHA25654cef391d9ae8c8aede607bf665d848e914e70a6966923cfec13dc991254c7c9
SHA512e40dd8b8cf08da8d5f977bba417ec694bcdecd2e27166e71cb6d6ed18d57449b9f5b4eaa130f558b90bcbb10ab7329c116a5b680174f68fb2c9dada04b3312eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cf010d2eb53a0a496713ba095d4fe30
SHA12e55503b00aabe107096a3e930d7b52521ed9ffe
SHA2563866d58a09b7ea6d7cfc3a872813642363f803c2601e1c707bd63ca8fdfd1896
SHA512c33d6c50b5ddf6b61690ec64de3197b279ff4d48251b6ffb57afaf28fe51a3fab8b70ca2e8c5d557ec1e301d976bfe83caf53610201d722a1649e5cfa0aa8fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6babfedf8b535e37fe2bccac467597d
SHA1f8e9536ddfe502c89684f0c918c10fef6ad23f91
SHA2566eee3997e54b0b8be1882977ad35d1c64944e916f6244a71bb6fc571c0cf5a5c
SHA51220a9627a98187cab3dd662af3a51854b8d4d47ab31a98053f05e2837d16dbe9a1e43a695e98ec24ab9a8599be9e1abea1833a10f2c36c5ed77ec43c2752006a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53580abbdb3e44977e2b75bf6794ff03c
SHA149d68537729389d2787ea4cb428ee097435d0261
SHA25655962b63a470f0cd20a29137be8ce1da55a0fbafbb4af4c339fb9b2c00c1232f
SHA51215e38f5f28058eb6119cb1ea7b09fdd966f77e6294952ed89aaacbbae62b326ed43e7bd2717f7bc547c030cb2c868ff1d46dfeaab62f887973e11d3763dcf140
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a