Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
27a83c66eb7de55cd313963d36e75dbd_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
27a83c66eb7de55cd313963d36e75dbd_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27a83c66eb7de55cd313963d36e75dbd_JaffaCakes118.html
-
Size
9KB
-
MD5
27a83c66eb7de55cd313963d36e75dbd
-
SHA1
f8bb223002121c3d6eb63b15dd191682dd22b054
-
SHA256
1c9edcdf03236dfe32f600fc13f42e0fb1291cbfff881c650be17370103be382
-
SHA512
4a38a9c8bbae31fcbbcb4c98616a60eb4843bf79ae9b8f3469a38bb043a3353b56abc811c065c351260059cf82ef4cefe990b1b63241791945d5bbf19dbd8e63
-
SSDEEP
96:uzVs+ux7wGLLY1k9o84d12ef7CSTUaGT/krIwT6pTFlVHcEZ7ru7f:csz7wGAYS/rrIygTFPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E813BCB1-3B65-11EF-B6C3-72D3501DAA0F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000dbf7409ae20db109a53fb9b2c56168a0491a5b768383c17aeed473d9c37476f2000000000e80000000020000200000003a8b094643085a9297ba2d22b129490a77d0ac4fc7f3972360ae58562242dc849000000011f4bee8bd190938930b0f1ee5ef5ac180bf34264c72a1dafe698c4ce59440687c7396656ded06c6982a329d9ce8721a73572053aa9c321e9f01e1aa19d173bcaa01775d244894708c168192f9b3c83bdd867610702f8f9336de4331e637942d18ebd2303caa0e105e8b1039e5b6e1714ab77007ee6eea7080605584938109a52daf0399f0ea623471815102186447d74000000078dfb2e694ef1d83d51aaa7dd5eee3bf017eb25d4157fa7e9afbf6aaaab1df8f2e5d448a17921950d6080ba970acb34644b01ed0914406c96dac2da6d5e85908 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426411301" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a5ffc549381e829d5b8f291377ed736a3b000ae873fbfc34f41b60dc8200c7f0000000000e80000000020000200000005213bcb6aafed96edea4264c384fe718a8c1667f2b3f8b3518050811b1b0f42920000000914142f5f1d7f02e2084d1264b2951b3485544a619d294623ae8fadd30c2205f4000000090a3e5829c60ea82117b3a31749927bcb205f89bb3cd5960966792f130dfccd667643dfd1f97040d11d0799e61a8050cf4c1598aea664e9a80c5373b09077943 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107390be72cfda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27a83c66eb7de55cd313963d36e75dbd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f990a1c1920154b1cfc146f98053cb44
SHA1ce7f1da83822a12f40e5136a5101dbf9fe6b4436
SHA256afd1475aa8d4ff73887675eb77927b63a8885d35ce2c8286046988847ed87ccf
SHA5124527966db7609dfd383e86f8075fbc655782c24bf08834ba47ef78544b680f394d5c4b29d2f0eb8d676fbefb7a178fec75ab7a86bb0418dddda8569f1386a21f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bf26764373250022b0b8063ac10c2ea
SHA165e6ca14dff0b2bd546e88a900bf22e3cae1ad81
SHA256f24e0dbf3a3a62c0c4b0603ec92b9f70f9b61b2a0fc24afce4893f431751b365
SHA512eaa32030bb2227c93b6df5117d207d4e3c71db6f6007f733cdf23819f98ae0dfb11456dc36b803c29acf65d66af8c32d9881391973c0e844393272414dcd1613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dcacdbe72707e0ca46405ba727e6ae7
SHA197987eaa94e284fae933ca93b74a930968c3e484
SHA256084d1a3d32e790cf10d3318924e84120db789d3c963ed1c7532afe1e815205a1
SHA512481f49dde91cd7b3d4263efa9b340fd2adb257fed35726691c492fc08cf720fabe88b3b58e76256d3ac04f02db37dc45263590a78be5949d168102c6fe775a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f72ab94078dbb6e183a614baa4958e6
SHA1ca15b2327dd9269c070f9c7fece1ec6ce043d6a1
SHA256fb067f731459d1046e09e5eaa70cb5a2cfcb9a028e7995707d424af017f13800
SHA512fa18a6f458bce8e0f9580a117abebd1dbc9e6ae286edddc68dca46995b3c4de950773026d6913bdb8d5bef51f6f71e2046cb13c477878012dc029b0c77e6abbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc0af5806bca18feb81037b4bc23b2a0
SHA15889beb9e2d37d3cd8b2482e6d48ea89011bdf3c
SHA2560d2409946993be5f9afe24a2af6457f37b2f0b4f6cbdc777c026e00e0ad11fc2
SHA51221af4183b8fb1ccadd7a47be1daf16c0e8e83962024330cdc1c6d5b22b4a8a405cdd33b2cc3bc9c285fc81606cdce2a2d4b6710d109b0cd6b3b34adc050af416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535fe145350f0f77d619820a86f7c9036
SHA194ef79684f610adfe245fb389d120cd73ca03c5a
SHA25684d1b89cc33085ed2b591549f3543491992eab7a042e26e84dda12aa83b7cfae
SHA51285971495ff09bc63a4f9bea27193769ee1453ecff5da39c19d98f174f0b7ffff26f313883b1000ce9dc9e0bccabfbb285cecb112750596927197369df08831cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7e19af51507dc236bbc9e0ea7e35c48
SHA1557353273b22038d74acb94f4e6cecc980ed806d
SHA256ac113f9407f548c50dcc90c5384637ff786fcb348678712cae171d7e6bcd119c
SHA51219bfd60ca603e8992db42e2b7379b8c30ff7f0dba581798b54032b5ef51fd4567efb740a68c2e82d4c415b2fe4dbee540d263d8d78c0c7d22a7fe2e72d1095fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c97d44308c421f893c156c3c7c23a163
SHA1c1e32b783122fe978556f3ec2de382e83c3e9fe4
SHA25646221ee02fe8a8a6c65e3d0603acf75b9675d4a1e7cc809b557e068f7cdb112a
SHA5128aa917e1310915283f845510cacaec2ea9f80d9a552bbab7aebb9c64e514df5dea755333e0d152a2b11c753a0f6631380fafa150309e266a5047b06d1bf833b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c747d8d5142c505904712b15282732a
SHA19fff8c69b4f82eecbab67c3e940ad917bf62e1b5
SHA2565aeb0b8c78dab39ed51ca944ef6c5b2dc032e32ebc81c9d604b1d5a0b5b6adf9
SHA5128d187ab49109cb191f3f1c75be65c6451e4241f071fd2809af08050e14a4a5d1052b71686adbedd72457bd69183b2dcff8770398beb11d4805469d78fd712eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5512ac087c98167d5c58be3d3d73a7dbf
SHA1f43e0ee5c3a02531135842efe61eb6e2e7d15075
SHA256df048cd70de263af4beef680048e616d25924f38eacb7c5dd4ad118808784408
SHA5129bfc83a2c0fde7c085a225a0e2839adc1abdebc4146d77dfdaa9dde620a78a26823487425ba33fc128c1c643a3dd556f2e3d5f877f68f06d530ac1c77a0226fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b1cd3b456783db1249f8b2c573384d0
SHA1c7a3f9870212fa07d70c69034c025b4665138ee3
SHA2565dc96296c10245af6c4d4aaf0b656ef1bf7bab37c90db6a54604b65577a35e85
SHA512169a85ccc83e688fa3b71f7a76b186d09cb812cbe89d0d4a7f7b24f5ba5e99518f2bd67a61e2016f080af2174f57f64f8f3a82671ce61141f90c8d14705ab30d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58596ceb5472eb9da0ec6cfeb1ace2c24
SHA1630502f0ed573dac1261c059beb2f1ea95f2d688
SHA256b08f8184b4452f66d8693bec0ed295eb10a620bce7abca6fb0d3ff0330a129b9
SHA512aa93f7d3bafbd9b4f8e8c1da9421dd4dcb74e4566039de06baf1ecc429dc0195ff83eb4a51dd0f21f975805332d154cf99ba11f2ee4b3c7f47a8f8d99c9e9ae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554054ec55a44ea1688a6bf13405e04a6
SHA1071503e734008d6d5d8bc175feb5f438554c361d
SHA256b3da6dc726334e420f919a1f6834af854c6e41ebd008dd6cebd11e1c75d4452a
SHA512fba619771bd0c92dffdc204c63d037156d1228e064d34816065d2be457e845274e5f13511cf897326a9b8a27ad45bb918d07fad168d1c76dff4a8baceb35e77e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d695d35717dc90dda8172046bd54ca
SHA1c2adeef44a43b5b3b1055ee9ce7a73396aac3d30
SHA256f6a6bea5143f31d1af79057691616677e02fd64a99192cf51f5a04e4343866c7
SHA512d68c144e1605418ce0c29154025400a60221088348e3f924d0609fbed77acffd3b259379e5cd4f6766686eb3efc3ab9d17d58a946a5ffbedfbd2cdfbeedb873f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5156ea8e4c40062f7d0e86736e5417b9b
SHA1eaf1d1670706871c92ea95e72ad4f300fb0c5a98
SHA256a4118f68a1ca3c5c825c4c11dbf550180a1b644ba937db50e6ffc59e182aa83f
SHA51261a51521d70926c0cfd23dbfaa999fb3966f212acd8cb8b4c3634eb0c721ed76c88b875a651e172ca03c6e09baefe3409e82b0aba536817e9cd0cd86b24c7b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567e023e523c4e42b4f68240fd3d6624f
SHA1ca7f346302f41002629565e800fe108912372185
SHA256edf168c72f92b04eb5916b1644c5bca3c0bd3e570d9c0d98093c1aa9971c8410
SHA5121fe6d83a11f57c139f2121c117827803f505b63dfc86557c46d26f3063a2eb60eefa26f8d7e0564206027de3e8399d543a8e92d493b06bf9a3c0c39e0c49ca2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5150f0b563db4050ac46818b3d6084e36
SHA1b1f55b9d8c922ee64b4490dfa5fab38de20209b5
SHA25685a9ac7d500d627b5363d31c59b59eeb886ac1c3e29bc2e673969bd9f8ce7875
SHA512e6e6a272639d9c32d52a24f041f0d2d84269fe7207e226ad80d2e94c252c460760d434ec4f48a7d323971c206130dcccf9c6df89ec7a42c0b1db9496e17d6a89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a647af58a6d334c70bba86752c5a4e
SHA1d1d306a55a865c5d2f32ea723854c4e95af737d5
SHA2565ebdba33567d06e71c0ca528d02e4d63fc4bb4af6e7f965234f184cc6721a394
SHA5122312e950793e51759ad08af768099da07cb60fe24f2091b4205b8632c4f83889a6015acabd560d45e874e2e52f46446c73fd83636a5fe055a640ac3ef4a34d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5932ddfdfd97582fa43aedaf81fa9d9e3
SHA1a5b987357bc37d4a3085bf89fefd35b70345f44c
SHA25621ff814d9a7de4596b9320ca2596fd8cdcf45b6630555ac569c9b2c62d5ac24b
SHA512123553adca803b7b4296cc721eba6b4c381064245725a2ade745f66bf372eb6c3b5cee1f3b9b17ee47f470cef22b0a08494bbbcf063c885bf336fd4274b9b00d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b