Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
b27fa87a5967ff2dcae1cfb9c8e909c6_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b27fa87a5967ff2dcae1cfb9c8e909c6_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b27fa87a5967ff2dcae1cfb9c8e909c6_JaffaCakes118.html
-
Size
3KB
-
MD5
b27fa87a5967ff2dcae1cfb9c8e909c6
-
SHA1
d6ead09036fba89b2da0eb84345d353b2aae2254
-
SHA256
2c50353ddf1e64d13405a0b9bba878150fd484bf6f8e91c0edf15eef93b49705
-
SHA512
db876a5ed1e022ceaaa5c3d3edafad0352aec9c39239e4d1dd1baae029fed53817f2e6e2ed4d768330e7c72f3b7b344112c3a5e56417e35858277ad1ae724793
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424687183" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5032e375c4bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e9c5e55131feeda1059c160b97231fb92cbe6eec9008258c366d569ba060372b000000000e800000000200002000000014f3b65cd7ccda0436398ad338b2fa8ca69cfd2ed498e7c3a64a488bad92b756900000000e5fe1abb8a44fd8aaf4a95f8ba3899d0060ffe906a634b04b2c85b9328b45c5e057bdc48b2324e2ea95722138a7ec6cbf2e3937a0e7ac8e0d89b7f7dca6fcc37f069300bbfb78a337522db555127ae6277daab5619c5fbdcfe5ca48efb675dfb4a04128313e9248d48e0a9306ce4d464887045a9ed4ddf9f2cad9a5653fbf0dc15cc879767c204363a3e44910cd056c40000000845ff40a29c5bdd9c03e2b0dfe5628e8845c14540c06974c6680f32d3f16c8ac593be38d83babdfff52adb79fc49c8e5d6c5c0951cc20b32ac626db4706d520d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A01EC7A1-2BB7-11EF-9E46-6ACBDECABE1A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000040a365c9d43ca8843196e1b32dcca00a10858012cb4fbd869e36fc2a2c51f39d000000000e800000000200002000000091522b65bc1d69e6812979f9b2acdf7820b4c676a250e16d6a1dbce40c62cca0200000006a5431031bba189bf2249b98eedb6bb4fd2ad1d37bd69df44ef475fdb00d8a40400000007ad24529d24231ec9aab86b7a51b27a63a8624f1f93b9ccc6d2621e8bc68ddbe931b84c628b00db1c46f61b1734cb6ddfe14b4d4bc650a4da59510d55eca336a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2820 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2820 iexplore.exe 2820 iexplore.exe 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2820 wrote to memory of 1932 2820 iexplore.exe 28 PID 2820 wrote to memory of 1932 2820 iexplore.exe 28 PID 2820 wrote to memory of 1932 2820 iexplore.exe 28 PID 2820 wrote to memory of 1932 2820 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b27fa87a5967ff2dcae1cfb9c8e909c6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fa3a61a2caf20d5ca1a755879e26510
SHA165b64907049b7c218cd5b06b566a9ea5dd7628cb
SHA256f6ff156ad5f25a91ac3dbfa5f3b54cff972a08651080c12cac905759f5f889ee
SHA5120e58eb388aa70e3c43bf8b05402fd6267dd5ab85bb5565ea93874ce4dafb9a88f10403eb6dd74fe50e6385c9c560dfa898a637d6293d0811d037aa420adbb6af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fed984c7867b26115bdb23a5b94155b
SHA180c24d30d041549d7308577a2ad9fcb07b2a76be
SHA2563c8d6c45ba753cf360cd9a6d0876860f40b14adde765993c7f934d0157535de8
SHA512fecb154be2f8c21d4cbdcd7bcce99d2d94e6ab76aa210ead1a4c61f96082198aa4924d83faae6d312bec6e4cee03633e048a4e96b3da14090fd489f180ac44e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551aedd22a46e0c8f433f8ffb30e28466
SHA1cd32ec1810bca8ba8c55b15ef54a27ebc2424ae2
SHA256fa6a934fc9b614a13a7d53ce976035b93e15bd31338610bf792b62381900d98f
SHA512e94cb24cb14fa6a6b5ba991007070d8e915b81f5accba8134125be694f47bcff39a177f49c1f281ecbcbc84799bf78deb94b992f5514f9bcd90924eaa20a0865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c68654b63b481f36e01b661e1f723ca
SHA18213241db2306cc9060752217b1ff985d0055860
SHA256e79d69f4740306f1a29ea8db4525014acc8272c470550760c6142d39d0ec2673
SHA5129b935c0effa14c10339dc4e00a70cc95295fdd4bac4719727d3848a3a2804976ba1c74482a0bd49bc7c69f39d90bf56e245972c49732d53d77a43d96011113f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aed2b21640c4b27ea82e1bc19b9f4e93
SHA133ae55b196346561502674a30841853dcd262fb6
SHA25620d54afe811b3ff1cdcf7fdf4272f9d4273ed618dcd16f6c7a426047b7668358
SHA512deb67fd2c7ca0bae8d48bdeebebd89259444a54338fa1c99687a0dd2f9582efeeafa4cecfa7b337ac35420ecf3d1140eaf7e700c20c2e55a9714e9b124daf712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448006dcf205845d316e0f014bd9bb22
SHA149e3acddda33f0248099dfa2ebdcd110b52615f5
SHA256b1169eddfadc14060c76be2834d829bf07eee195c6326c84366d9677bbf686b5
SHA512a2a8d7b7b98d255b53a762719045bb09970e8ae62eac5cd137b33392c918a4c747943790aeaa73188f34a55d789745ecc71932d9cd49336b7a5deec2b2baa5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dac0924f25cab801e3b7961ace2f0af8
SHA1a624498b4c502aa99d9d6d8cb3a5355d497f0e3d
SHA25610789b9436c6cedc477907b1413b648ee1cac8d2eae8a7dc6f62c946c1b084d4
SHA512919f3e09bf05e90b74bad8e9c281b4029a54425cbca1e7dbf92fcd099037a2ce2f1e62546775b7d2bd6eeeb241f2df253f24126507d6904da4469e27b17813cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574a699a69c3fbea5876b9f8ffa0f9b0f
SHA1d237e8aab54e4da20a1b34a17326486f51c5f87b
SHA256637e63ad01359d0e6b360a52ea019dcdd107ff85d1543c5c6958ecc42c26baac
SHA512bd0dbb2562a5e5b1a3313059510fc410366ce4758776af37bd3b238e2ec3947771f31d551721c87aa7c987946993b29ef6a4d3e20914febddc865583535d2ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf85026bb4218790766112ddc8685a08
SHA13d0fa7fa329b543b49ac186ddd4ceec574a71591
SHA2562ed48abcddd0ca6cfd93ced45b2035be58d13ac6aff5cff89d87166ace343fe0
SHA512ee7438192c30cdb589286d41aae9b483d6fe8d846af4a50a53b99faf89692e96d74bfa51f77d7cd1884e206f5dc8b55c0b4c46d802c191623f338fab88c4fb02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585dbb53739dc256fd6b3a90ad8c775ac
SHA13b271489757ed87e0c1935255362c2abaeb2dc9f
SHA256f7330936e8abd7fa44f67802a90552e9695a1d47a6adc336f838c778ddefe194
SHA512847c0a855b098d66338eb578b5a9013dd4d424b1757fc72062f3b1a6196d3631098845b6127376a705159e4aa7938d0f246b9ab7e4ddcc53987edf8a2f4203cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7a658bd5f69a02f27b3004e76f20540
SHA12e76dae9c51678967cf7caecaaccab993567624d
SHA25697f9290edcd954ea0a660e16dd7f2e883d77d4e71364d65df5aab427793f216c
SHA512775b7d3bc3ee6927f4829b54fc4d18b84557cef64303b9e20c20456fe38184750c1248d09e54d59176672385e3ee4f3ccbbab8f25c3246622fb8ba0f1450d4c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5545992cab1c5139525ec6fb99219e0cb
SHA100eb3a75bd1f95f839fd36fc90e224c205a496f8
SHA256409aaf6a8ffa7f1ca2e1590b3c98f25355668eee30edb9a3f10c7fa4f903fd0b
SHA51236400840878988d041e16112e17c94816826ed116857b44ab539bbb9ec3362a6cf0e0caf5d0ef7c4eed9311edace4b5230934f5019b6a46b53dc22bccf30a661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fae0f1b06781a294594a2d28552c0a7
SHA1fb9e429150fc797157c063f26909adae0e9e08f2
SHA25687165c177424b716a0c92a3a4715fa49f6edf9da1edaf5636c83ed022f2619da
SHA51277da14bf3e3ec6c5697ea0da02c0c000874f68681f49b797a00b2d080c0531bfc076058cacca1a308ca40a9e4d84ba7f8f98684ce5e4819627427d8ea23e7a7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b8ffe32e9b750e0c640af563d748fdf
SHA14780eaa1c91fffcf2d943ba05def88ec3b24d309
SHA25615aed66ab4a9ed0b75df2b558e3f98a7f220768eab34f49b14b502bc941159f6
SHA512e18eb8245546ae5d68be06779adca73049c9b0e10abae1ca490a13e54bc1205500a6c2da2991a9ced278a79bc3e124392fdff74100d0db25bdcfc231053add40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512cf93e184fd20bcc64b76b5a3fb071b
SHA15bca980728bb7dc3994eb45235991f5b1d769451
SHA2561c1edba3f8cabe97b8dc44dad69ee07570a6531e0b564d37274a15b2d0c7f399
SHA51272adbad1aadb8411e5fac19fb1b33ef06d67530069c936a8a58006523f25487723e62518a177b462fde43c5a685d95be84b2792232e48cc858e7b114f51bb1aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562769316810cfc693ba191d4cd0c7070
SHA1cef6edefcd168388ae6b41be6f72f92ef80b4c96
SHA256cddf04aab9f11a53e74a9cf05a64faf8e479f4e249515b5a74346780906912b4
SHA512cf83c8db0477e078f7fd745d1d510dca2b9f3b1240aff4e4b48449320a8a92615a9983e6d2211c232433a9a1c7ba2ab1c7052c388553f3e7bf0ccb5c178ff12b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5857e4601a4a5681e57c500cbf5388739
SHA17acd620fe9aaeac1cf48e4de4cea36fa0b3664ed
SHA256000f6589d9113d7e093867b12ab25edaacbcc4a84b28247d252b87f11718de39
SHA51246c59f416612c96a6c627a98dc9106accd879f297153666080ac465b0133e604af5cb8c94d5b3507865fda6add39e5709f3542ae8ff58a9c15d95843dcf08559
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b