Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
271a5d2544f062a814ae725464cafe30_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
271a5d2544f062a814ae725464cafe30_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
271a5d2544f062a814ae725464cafe30_JaffaCakes118.html
-
Size
1KB
-
MD5
271a5d2544f062a814ae725464cafe30
-
SHA1
81ec223e2a4a289a780fe7b4c2df38db072b098e
-
SHA256
3e3c6f4202f0e5cb328077a79ded47fae6279ab01b49878370745c0b28d98c6c
-
SHA512
d98d9906ba35e3f5aa83dec2112b2301eb55a399a1a1cdac2ba646296f95fa20c062513b35b913ec819fc632e4b04e5657b2836de2dc979986f341e4145030a5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ffbade19cfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{085CC5B1-3B0D-11EF-BF59-526249468C57} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426373130" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000003a684eb1f728482dc648f8d3a4affe6b1ae33d0a14f47ea933042d14e8abe26f000000000e800000000200002000000098d120bf518ac407ff77923ef213a9fd6a2d14d51cd43bba2874830aac4770e9200000004e9b86a026b00f11564683d5f7931e4858ed54672d15e06a51d055c2384034e040000000257404fa7257aff8432bbd664f2a7f1a4dbf5cb037dfff8f0a786e0ffe5785028d380ddc3f5c8d01bc6bdc28ef09e8b2f3e007fbe1f41c7f70f96c201a67783a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004de53ef42cf67e27c7711c88a52c38ea322cb968d9d32c364701974e05a8a187000000000e800000000200002000000032f41f598f63f7632baacbb43c89832b2e25220c507e32c90acdda06094e632990000000394d0f8ef09b99530e37ba09b9412d338122087a7eb70f76b53348f8ef3bb89eb2084eb50ec711e58ddf87070710cc56088c81800dad333411b4bc0aee2979d3eab88f06918e8d591ea3af9f667d7c4e710129a308d4aaac824c421f4ed959dd4b3eba32e6c64dab84ef69f9ab34c376b61975da91dc763921a37f5d54467fc657a0679b8ee6cf0e048d6984ab286c8240000000b1736737919a4bd9740328e59a14438ae63330d96dff1f3905bc64a601b315a357130a267bfd92d8f74fdae2f046620c099b51a9fc2a4e2c4d190fbec2be2266 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2672 1740 iexplore.exe 30 PID 1740 wrote to memory of 2672 1740 iexplore.exe 30 PID 1740 wrote to memory of 2672 1740 iexplore.exe 30 PID 1740 wrote to memory of 2672 1740 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\271a5d2544f062a814ae725464cafe30_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b3cf3443d0137fafb6130b678bec32
SHA1eae72445d2d76d11d936c329a6c05cb37e7ce967
SHA2560d94e92918befbcc1481292377cb874eedde7cf440226d5ab492eaebe4909439
SHA512e5f4853c1a030847cb514cc3516c8e65217c20f4234a4e48f9f640eb845e7d69bc543285b60442f0a8b66d529e4092fab52afd8fb315fefb7535e3cf8321fdf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cd03f53a05db25b72c73fcba48bb4ee
SHA1828df7bf03e54f59434eca0831fa5371b382c871
SHA256244a56eaf63b1a4b3053a304a8b8ed68dc86403492381c00199a7fc0611d3969
SHA5124a75a5edf15d03c0ef37da5f33c07d97783bf905936ee465c7cb3b7536f12e042baa7da2be5e4b8bfc91978c7f49a154df915904c493a443fbb4e8a6655dd25f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529edc6762edda2a260ca02d75741a8a3
SHA18d3e843ddcb6f64f7ed944aa4ceb1d1cd8f180ff
SHA25698d72a9a5ea9a4c0ffb273ef4f864259db4e63c5d62bd53933b3853dfe5c48ac
SHA51208df5fb2987490005e0c94bd93e40037a916be278b27c45fce61d5bf0a36a4bb7457ee945ae13e904ec6e3c699bc57fdd5d771157bbc419a76503fa03a39dfab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554ab153111106ddae04714af26381cab
SHA1823e3603a89a891020b9e4558bc228cebf66b5a1
SHA256a21565f13b08abaccb69d3219f451509cf3b8ad493d1f3b579fe374e85065e0d
SHA5124b225174b9e087139349f2e781c5dc43d578b967779216bf0534be694a4ad7b2e46b00274ab46a22f8eb8164489135886a204ec7476c26da76c9ff8c50a463a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1bb0d45ea5d0912b3ac7ae875f33fcf
SHA13c59f8b8bd00bb23a184c0a1f5918c29c954fd56
SHA256d5d3cf1b532d2d9726565841a9c13b03f6c0690cd18bd298e7a6cbf96387fcfe
SHA512eb2c8c68864154a792e7236385611ad290ac8c7932cdfdd405fd4598faf75d5c95a028f7cd5fa8d9235a8a02f51a1161a4fbb32f6b93eeca76daa0cb3308860d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576465fb2c67bc622b88a8232dbff8b66
SHA11a7ad630c0b7ea643d4053de279b53d54a32febd
SHA2562a76dbde14cb132fcbbc912600e05f77a039d8e41a271b5a8c6003c6c4b67719
SHA512fd3ed2ae048ce99cf31b15102abd25a107a403f1a275337aa7084fff5a5cdda9002b2a763b31111534ef5abe52d6ac16b2b865c0fe23448adc1e5a7e1e21890f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa60c3fd153ae55ff3fd1035463a9d00
SHA1d9cf57e261688a0ee24dc5b6577d33cb9fd08aee
SHA2568aea0df50e6833a545f38a0e9bf91ad405d681c9cce7be7b9de50c29ece73709
SHA5129b87cd8a3bdf00fcf8ded0eb32be01a6ddd1717b50214af748567c1491a87433ffb14dcfcfc29c491ca47cf5af4e45a98466559adf6127074297d168019e986d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebeaa724d2ffa48273ff8bc5b5da153c
SHA122342f5c739b4152bb1e8fd713e855f9a4dc3341
SHA256bdcd91c8220bda5b92af24ea34060657f6579435b9a8950dfbc13a3692e01202
SHA512cfa7dba25acc4b26554337f35cd4110b5253b91075c900394a796f9bd13fceffba63ddc84da7f6e2b596573cae819a39a96d8b794a1400019922f2537dc214dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d46c59acec799ca79243f02ba6be52d
SHA1e8ecaf1f55287ea9350416b81ba5cd7a302c95c8
SHA256370d8d91b6c3f27398a98f858701c7b16e2d46cfbec883442ab45369f4462a47
SHA512bb187ee7d04d9e3f301ad32328bb7bf3bd7fc6266ea403920b745de73e2cf84d44701f4c21b3ea2e83b128f1825f582aa6cd57b85d3ab552e8e8f1b6e1ffe778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5443825fdb7d225d132fb1143626fcacb
SHA133a65606562ab3e034db5a14aded9ba78f545c24
SHA2568400e6c58c9a668679c02966634b5a67964c5044b80af8e0ba128e7201bec7e8
SHA512dfec158589088859b9e3d6ea6bfe9ce99e5b108998a6b2db5ca39e06fb35308eafea2148358f0a23fb659a0d6cdcc6d7b49199ad5bb7b8373a6e9b68553e6d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bd6f36f4acb7ac05c7153f5430b9823
SHA1d6e4866d898eaf5b6cce38e90a7907823b4c4f87
SHA2561c7494784172dfbb2168d3b928ceadaeaeb3e65458b27504d0c5446d059c243d
SHA5120e32acba6389367091d5a6082036775e4c790b95c507b019706317bbc8bc28044b795999b52fbf2a19ef8e6d33e383790d00cc32ff3cd41af4db44a9c8eaabe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593d7ee751d052eb1d9f1bc81b4bfd7e1
SHA15026a956d66237f629c3b9108c2f2e18af22b680
SHA256ca768f719689ae2515b5b9d04436f05208fb9d4b48b04834185c84949f6f3552
SHA51253f18e7770c09d79bc7bc28755d5d605898370869843fbca99d4efdc46fc52c2dec2eaa62c03be8749fd93310abd3aa9d36cf5626b3535f4219a4c33072d031b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc98551ce88d3a3f6f280dab5dd0258d
SHA1eb75d39245a601a7faa4183e7c48d0e5a498fd5f
SHA256fdfb7ad1fff72c568fd26b57000445d9093fe45f88f7e1ddf3e2ac0cfc3b4e7a
SHA5121010f35d15520c8a49017300913a0f4a064ccca47f574e7051afe841ea88af265a035671f54ec4b4dfe49a4725ccf9409b4785bf59e58bce8270305eccd6e5cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa932d40e8ec89e8ca123c93fafe5045
SHA128c18cf8bb66eecbe7856801dac6409eb7c82c77
SHA256ba9f7fea2c3403fe98204ce120426e4a928671ee854789a744e097ffe25043c4
SHA512b06873f0d0cfb33ccb8b3ed4c1fe6e151eab9d08334283ba076a4fcc3f5be3af810626a181898f6f61e55c094f68c204f60dd3cdf36deb68928b6617f57cafa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822b4d5b1f26e9f871f905f2fb6c85e7
SHA19df68a7c4bc8182faa9052ff5389ecda9e86be73
SHA256ca778b86f595fa9bfbf808180bdcb0afcb89fae2213e7156dc0573398029a49d
SHA5124f794bd0a4fa302f204ce3fa201b7007bb5082daef99a50a00ca8ace1483a717c7085ffe97091527489437d0ba1970fddf773a249a398e79812273482d79d47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c169bd068669b3c43abb78d714fc9b17
SHA1d3259ba1611343d139c70667e39ab3cc79d41ca9
SHA2561904573e12c292e288d75482a6a8caec99a45182ed6762256fa230f450a98560
SHA5120654050968e525276ecd58409a92210af7af1c392ef794041e48689f69d2788ee8689fdf73b222aae7bebba408288bde157c010910f96c7eaf5dd22c7ac3a50b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6af3bef2409e0b9ca2ed6a30f8b9fc7
SHA109ad8d410e70c397c114b35fa5fe3e39c72702ac
SHA25657bf4f835eab8d5e52dd7cc9ef88faf70bd9dc25f57df686dcc03b1f4f788e77
SHA512bf05c938f8ef16530095728e9e1a81000f2afcd606275a4295f6a2cc27b9bc6d3ba08fcce5eefaa4ce9568c75e30bfa54c63458e4bf3b1a497712979fa01aca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555735a9f2c82c2f15fc1458b56e954af
SHA155f2cce7c34131eb753af2e05be5268ce292e7a0
SHA256e895c92fd1ee564fa05934e741779cab8b182c346661e9f4d94bd35de92a8f68
SHA512c79655ba3990d80dedc75ce713b25b6140057498e0ebaee37e5a168895d1069726073bba98f87c4c6fade0c9be933c9d1f574643388bc63d196c81bf0b2005ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba6538d124f40df6fea344bec0e3fcae
SHA1e07833197140667e9949686915bbc65627456234
SHA2567cade0320358be8bcecf51dbc2a7ebfc29f3dfdbd228c4c96acdb1db3c830a50
SHA512f250bb7979fe133743537a4688ade44037f43857c2d865a6cd88f7eafb09067ee0f1e217b184c0e7965db9c02c456999e3f8b1529308f814e20a8e0cd7bae7c3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b