Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
80271c730fefbf59276ba7bcd3ad96db_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
80271c730fefbf59276ba7bcd3ad96db_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
80271c730fefbf59276ba7bcd3ad96db_JaffaCakes118.html
-
Size
4KB
-
MD5
80271c730fefbf59276ba7bcd3ad96db
-
SHA1
d94fff7cd3dbfe4034da72e0db2d72d408b32779
-
SHA256
ab3d6d52c977c53ab1ad8ddcb91389d39b6d0a94387ddc58c86aa317c131fa9a
-
SHA512
58dfbf557127f632047c86101c39e7839982f71cfd7065dcaef8e12dc3c1f00c3ea1b3447027f72fae20f69a0ca5ccd2f72a292c1085eb118172bf5c4c260696
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oEU4ZZ5R:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDl
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ea35edde9a37e4a8c4b74e02f74f86500000000020000000000106600000001000020000000f6075a454787e0de6d8ba780f48ecc78201e5eca5a644259a485227adef23eb6000000000e8000000002000020000000d670100b2c9d2dba42517181fa0d096301175d3d402f0a727b0a57f0168920d090000000b2b25db5ff91cbb988ca1a2530160493d2134d40ef40a72ad52ef66f469fe4d588b2e4d5f23488d56bd08ebe89acb71fe052239094f50ccdd3110264269ba68dd91e267d45fcb787c58b3d52844666bb89245fcb56bdf91be4c2fa528dafc3c4a8920118d23579deb5de1d6767c2235ce074337a1ac1401894317c61fc5738596cae9ed482008d32afb7929ca4151d6d40000000ef513c2ee882a380185013818b58632a25c085400d0a01fa7e3678ff43b8599a605ccb6ff807a4ba6554f2e7b346bf62b76258192184cd37bfabdbccbe6d1a65 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423134349" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27EC9FA1-1D98-11EF-B7A6-525094B41941} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ea35edde9a37e4a8c4b74e02f74f86500000000020000000000106600000001000020000000032c54a1605c18547790be2cd6b125fee739a8b9095da10396e061e2bfc29ee4000000000e8000000002000020000000b6195ac3d927ed2226e2d2ee66653edaa899499020e229a7c163e424230ed40c2000000018b583936870347acb32b18a838be99a8268cfdccdbd40c706fdd16a981cb2d140000000a829ee57624e3ba7073727da8b1727eab6ff3190761b794972012ebef172bca1d427d154832cc031b34f877384627f5015aff3dd1c39c0d1ff81a6d9a382f96b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06660fca4b1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1304 iexplore.exe 1304 iexplore.exe 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2008 1304 iexplore.exe 28 PID 1304 wrote to memory of 2008 1304 iexplore.exe 28 PID 1304 wrote to memory of 2008 1304 iexplore.exe 28 PID 1304 wrote to memory of 2008 1304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80271c730fefbf59276ba7bcd3ad96db_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c6e9c52bbf0bb47a186dedeeebf0f15
SHA13760e26201530883fb4e4e05e14902131e382473
SHA256d952a0285b46c5ff0436882de124191462f1618c432b60d769bafb32e5652ce5
SHA512a7ffc387c6d1d2b251210d9be43ebe11d8aa395b47693d9a649abc9c8fab61641241d4afa8f1c06e5636d29ebea440f9cd22da2a9b1219934a5195069eef6a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596f2289d1264ceebaf98c6c027205ef2
SHA10b1e305598fd46ff64ad18b158eea8fa218a1126
SHA25660f7ceebff2a78a681b74ddd6712dd84536a9e359a53e451374dc5f50d6afa1a
SHA5121b87004db0e54dc2c66a48a6c8a368ff7be13cc9c292344eb69fd3e7f58a9714160663ab9d08b4edb6603847ea680642b06874c44639e81820c5d45b9a174e4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5605a7584a01433f22a2d278f054db38c
SHA1561e6b3201af430207825e1f1ca5769702265cd0
SHA2568eafd5d14166c25783338a1f67e738d3fb478eeb893828841a2a031740ce92a3
SHA5127d33c9945efbbd09aba563995de19b36cec5e5618e51e6d51d31b64abe16db358bfecd1a1e97cfaaa78a8a2fe640ddc3139ad8aa5454240ce1cbbf6c43c5dc64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c1f24a4d790828b463ecde4b23221fa
SHA1212a0d6de8d04d66a59a281fddc5273a15423c6f
SHA256704eac43d8d7dc84013066dcc2dc6e31ffeb5a4dd5db1469a5163ad51c919537
SHA512623b1a8621f3672c634716bffafea5b276e4272a250b9b82c78ba773abc930092c7773e5b5c49d0853a09e970924cffa366022765d3dd51304d45eedd0291e16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5966e0f810270688ba5bc9e69b34b9b99
SHA10270b93c7c88611e42465657fcd649c30bb2aae4
SHA256f5c7b10db2085ecf0a62a957eb9f5ddfe6357f00409e9794210ae7b7ab5461b4
SHA5128760fcd2bc53bf721828588c948fb788426ded6a6bb72392b6e8a5fc14e8fbb70ce2c010a0d046acdbdc331fae9e6faac940323c0fe8cd220089826d89c7555c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6824918baa2a8c437ee111585503af8
SHA187cb5453190ecca1308dbc5deb2d1764d56655f6
SHA2566aaf18903d6f37347283a376cebaf5ad4fad2201a238448cf846a000bc9c81f4
SHA51208ecbfbf98418c6a21afe68f2c404408c898f2ccd49a14709784c4379860103029fd6ad942afb91313d7bcafc966be67f11552a72e6466c9f28bd4d1d1aec255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51625e34398fcdb3011e9ffaed13057be
SHA181f2e93e1e4dea0f44ce7a874ed7b52ad6b5eb30
SHA256636694905f06ff5b36eb608d4253a7b1a999b4be55fee529406a711affd6c748
SHA512daac7f7f0e003d60244930dcd403d0f5ccd2d925fde628b0531aee46493f2c123cd1c0d5483f6e91ca40f54e685fcfb341abd0fd562686ef439a213b0fcfe068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a6e704205798e8e5feaa54af6bfb9d4
SHA1fdc68b4838bbca59dcda1a737e8b93126431b17b
SHA256272020b567842069484b4d149beec2973537ad40580d1cf75e625c250dab7338
SHA5121bc4881f0f3765cc10e734a12dea422da92673fd2dae4098a855125224482860863756ecb616cbefe800852001fc92d5c94ca98f295fb3b04c0ad7fdd6b02b61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5081a5442d52b4d80e65888a41569df61
SHA1310f44597a5d8b0a53d357f85abeda6f037d1db8
SHA2569e1fe52e13fef8fb8e1ad966859232a386ba2e1dd43820424eceec0223b10d63
SHA5127114ea32ec23d88a046a7585f90d7649940294d32e2585f77cc1eef6861744c27320aeae57a8058b3cb23870cb3ae0830e118a8a3ea5513120a41fe950eb43f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555eb79cfe26c963a6b929e6001067230
SHA1da1722948e3d2d2352eab24c9f7d10e6fa614831
SHA256d572b3c2ff679d8b4e900ed3065fb8e5f94c638367495b57c25a8075c8239306
SHA512ca73a55d2ee2a0b0e7ffbcf604c2911897f1e1dde34cf86d83004d9ea957dd79d6c89b93e9b9ccd1b13929aa1e2580b275ca007582eac28e573a1a167d250503
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59960d9fa794c1bdd08afa6da144ebc23
SHA1bf9e52db350415fc4921b800a1eba9b0d03f5692
SHA256fa7139c5e540013a02360c8df35833c53bd13915da6d538dfe64e72e7445ab33
SHA512c0395e09dcf9df695798155bafb432ef01102152a136fc51073c245206279fd4aec9fba29bc5cf2858913750601d55e794a2090e2d9bb83706410930d7335761
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573ec59e7aecd5a3aecf5ccb249034c93
SHA149405669fa3e8f5c777daa8b6d22ff78e6cfa756
SHA2567ffa41ed4c56d9ad6f3a0728331b6ccf9d493dd54c081f342821935c902036f3
SHA512721e683f4f1728635fcb0093145ea2194d583409dde5bf8bc3041ca4358673ed45ccb9e38e932250b3615602319a9999f084b6caf6d3a4867d23ea94c2ee0657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f79ff52905aaf701fdc64fa1e6777e96
SHA1a80332c3c60b5ce4952cf71ea7edd63dfd93a95c
SHA2564fd370300f99cbbb47bdba32321ffaf2d76918f89b7a21381ed1d853bccbd2e5
SHA512ece8660936df67458853fffb5b53f6aa6efe5d2bc1fc869d97319aa3447e29ddf16f66c699599973f4e2940dc6af7afac0b5e3dd8c4eb9567d009dcc4ee5aad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3bad745164c3924d9397112e1f352ac
SHA1eb7c601695b3691888c88abd92cd1d86a8bca948
SHA256f745e3d2242cab434f826921f91383bdf0b4b75c8e18f0327269a1487e591a8e
SHA512706607d4bc7c642ac1cea8a1fa6dfdb3887c9a8bd262def6d6dcfe435958beab0ae9c584d4188747498f056573c85e6db7de8051e25ebd7f3571a04e488ceb13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd01300b8279b707d43f9cfff52fa081
SHA1c144fe7f028638e43c644460fa2faf069b61f02c
SHA25667c2e5932d3c0955c9b6a2acec39a0f0d64f9037b8a2b9c20a93ed119b8d6976
SHA51260c238fdcf2acf9df850f8ed61709fa42f527860fc528afd4d0a3ba66ead5535df527283ce52963f8515eee6a19740c04b5467e440749d14a1e52b58899250a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55608c463e219a77bd99aae5858936103
SHA1f0e709b0d9a431e1c2a8ae70c4df6482fdc8cf22
SHA256e74f7541c01964df6fb6fcfed7eaf4127c80e16b143b04ddd76ca7b4e54b0f97
SHA5126142499ec8216782bbee9b541406de3bff4149d4a18093344370c4ca62c3be9332c9d6f25171767280ba0707e7cb0f7ef6a764d62d1817cadfcacd78cb47374c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5885626fa00b94cc9b77d9faaf28d53f9
SHA1c66b702cc3553d0c4b4b08f35cc6323c81bc19fc
SHA256e38497beb73ffe6bb567f80844908c9bf3e19093125ac7414faa1cfa42064718
SHA51253c0744de1ff3abfedd15a06c31cdc52a1df91cc6ff6d8c5c9a50b66f2e7ea424688948877a3a865ece20ecf84a8ddd93754846a30c5d55d26523197d2d3fe6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54529ce953ad62fee031df95d48707284
SHA19ed57d3a752249370470dceeb422146dd61316b1
SHA25625964f23858fd8944183cb798e96dcaa0158e88b076a0bcd3f6ee18e408c18c2
SHA512e9f34a33e0eecb32613354640e539d78f4f5b1342a5d6f54c429ec9a00699505dfcb85d9b7ca9d6a8c18c1389a29b5f9798eb1dcfc920e2dc9fb435011aaaf2b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b