Analysis
-
max time kernel
106s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 07:51
Static task
static1
Behavioral task
behavioral1
Sample
27cbe734db87e90ca22b654f23f38e6d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27cbe734db87e90ca22b654f23f38e6d_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27cbe734db87e90ca22b654f23f38e6d_JaffaCakes118.html
-
Size
20KB
-
MD5
27cbe734db87e90ca22b654f23f38e6d
-
SHA1
009148ad12232838f0308909745650218861d82e
-
SHA256
45c9324f34351b7c56d14f07156eea855534c04853b6dfa78506ff9f5dad0d74
-
SHA512
8178eb1c9df87ea1f040fe31714c1ce39a2a910deea27bd271c76151752fbccd12fda37754cb1bfa1893fa1e6d74a4c3fa9aec10d51cfbe3ea81caa1b1092f67
-
SSDEEP
384:Ou6mKmo0lAt3gBKEtSgwITH7tTfYxJI8L:dlNgTJL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9589DE51-3B6C-11EF-B39C-C278C12D1CB0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426414172" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e1d106dcc3e0b41fb722c9eedc41c30de00bfc288edf68a1b2cb913bea058f54000000000e8000000002000020000000fa758b08459a8e227e15d5ca54b9b81acec11565c2803268884ba5bacd41938e20000000efa3b50ebda26c097123ef36026e43b892c7304a1f53d7df9aea6fdf588c443140000000c0871b8ec393077cef22bbf04fa53b30992578b1a386e9c27b1980728dc44004f34f679acc03b81b1212395ec7b1502533112e81ea4ca9674de4b937f7b76d41 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002e86ce5feb609fe5cda6d4e333a898a540a7869afd2ff0df49b01039ea8078e0000000000e8000000002000020000000ddb64873241cb98264619448e61b4b25cdfb3e92fe3f7cd15b239c4af433629790000000e3d10023ab68614da4f561cfcfe7fadc0e505206df712d3f69532950144bd022d3d3fd72631ad23a0f6241107a4a96b1ca440b13847e30735dd6839f0a1276a1c32c987cb800e646c19a665c280f0ddbb810e8e55a65a151b900a69382fa24980bb7750aea6c8b6048e8eb47a55f2ab44edbcc5296f933da9e955f13d2e17b7bf531da0f2ca04f167e3b376aed1b4584400000004089993bf929445bc9b6b85fe8197e1507152cffceac290c2c8b978f1bc87c4572139c192dfaf3730b6d87d4cba9b1183a695f8e155440e7908096c716f58cfe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ade99679cfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2372 2296 iexplore.exe 29 PID 2296 wrote to memory of 2372 2296 iexplore.exe 29 PID 2296 wrote to memory of 2372 2296 iexplore.exe 29 PID 2296 wrote to memory of 2372 2296 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27cbe734db87e90ca22b654f23f38e6d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5908a889e598b83f28b69ac3757d4c0
SHA19c3d3048952d965a51655c433582c9ac101070ad
SHA256654611e57e5b33b0a4a19843dc11d7ac6f48158e5f98c6af271ea8cc2576309b
SHA5120358cb045998b702da1f9028fa1ba4b8379abdfd28efde19325a0040fdedf7255aaa6cb1d7b5ac414ae9e21ad8b610e7df19a3093fd0d135d3730fb0b1425576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a50c28622dbd24cd96c47f3a6c67a2f
SHA1d0d4f3754452b63c2d611d925f54121dc38aadc8
SHA256d533a59a2acfbf55d3a2cf7437bf0b657c9e78326da08077438248b63b91a674
SHA51299b7a8c10883cf15870bbf7971016ea40a3c4f59baa5f6cb7cf10c2578cd37816d20abcda070de40d240848c6f05d880a74afac2924551d01ab2760eb82cd246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d39b9b9156601beaf782130ea997d99b
SHA1584d5a49efc7ef8e9e0a228393fcf9a3f4f9abd9
SHA25608030f5659ce27507dacd91d09a699042f7ba63038e13faf4c4548c2b0b8f844
SHA512a82b021aab2a7556d68c1c629e9ce6214055bd605cfbbe98e8dfcb27a0bb1920b1e3f76b4c22cf5f9ee289d5cb002cc61c249d787e1dccd169143d25c9bf4e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f484fbac20ccab5a66014c15679c5ad
SHA14d2e12a4f36c6b0243269799f1d8ff5045719e06
SHA256c6e7cc1f9fe36252f71981fbcb61bcbf3541b24f448f8094181629e0293b82ff
SHA512e874eb4603ac918ad47d9a0b9d5736d373b24f437ed680cff32092231abf537343bba1ed6252b9b109745004b33cbbca389ce14914df9313f5d8b16eb4f66532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd0c8263a30558323aaf9d27de576ac5
SHA1fd3a8f56b3f6f7457c9301f75dc549f3b711a0f0
SHA256156e5610589800f432acd0a33341b96ed9b5c52accf1f862d950fd3405ca1119
SHA5124ab03433e9617f6294f6921bc3679da37078e2ebca88be41ac8af12a1728743027ed5eb7f389ed42ab1aab7225df5afb7177d8ab6a95e1750e608983e568bd75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5970eddab8fdc07851fc34b46169ec3f9
SHA16288d554efd52a8cf0344f8a9a84fccc9bbf8658
SHA256b4053b3ac6f09e332ed836daf395c620c344c756a498721ef6cbd882bbebe003
SHA51240c4fc8f5faf16f399d83fd112c65c8f020f8ba63963d76da7a354e550168561211730d391a62ddd1cde5c180363038aeeeb8c6ec03f42084fc66c57b410e2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcb5f4507999abb90af245de3727e201
SHA1519ed7b7174f02f75ce09e87a093c87cb8436567
SHA256d40ca737233b877a4d62f53950c5d2e5f72c0e7ab833db3c39992d61dcd73fc5
SHA512db3ce622bfc703327c0bd0ebb9fcc4eca18a50b2b666b0566067c5200e215e94422ae2df15fdb52b09a6b151e13b041f889f2695330a6593fecad1278792ebca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581c69e6c3b77b80b69cb6ec5ec8d82fe
SHA10f6a3d91c5f70cb8f4badd9bde952b030fd7108a
SHA256745fa1e452874741729d9a4b6b98ec783d073e4f39462ae03bfc2a5f4b2123a7
SHA512598a497c3e471c830b39dbf66ee8193648f0018ad6f65c8caa282895067b4b29b3621f48652e730b0205200103468c35486c2c5e19d92222b8f6eec745bb4137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550ef4999f612fa14e3004074d67046d1
SHA1c4a0a4f55f2f13c43a5c3960f3c539afda636f57
SHA2561aab7ea96867f408ac68dbd58116b28605e861c489ee9760a5b001bec6c789e8
SHA5121e12012bd6d631efab271b32ffed14904aa543eca3a7e8299ccf69ca376cb29a642318ad6a59db9bc3dbd675e55aa37f8684fd8e003d002b4eaae13112e89621
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5259311fe2ca5c77c0ce2392e1c4ed20a
SHA1b0770ce78b03a7e9c2013e505acc67d696567b07
SHA25604a3197ec9ff80cbe77c3d4339b17cd8fc6621582fd31ee1d899371f77af9517
SHA512d2ff6306146213a614f6277e0e99b0611af41b1658bee031d8a7fe531aa5216a17b2eceab0f6e8f5066c3c9fe61f11480591d2d396d3c0fcb9d56c4ac15dad8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c74c4c6e0f80f6430f73218e123f9def
SHA12d9fbb00bae77cdf2d12959725549718b3cffe50
SHA256470b504df553952f8ac5a8cde1f88f7e5297924f1133cc731ea35b88893a5acb
SHA512eaf12beb596474d442377cacb511ea5257738ac5e0e86a51665e6c35b1f4dde9c08a11e9b9b6393ff87d02d4ea220a7e8bdf8f74c94e3b2c4f0813991dd2724a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e0ab7118fd8f93773e58ddaccc701c7
SHA1d6d442ad6a12a11d984b747e4228b8d0966cb56a
SHA256bac862d97f18f214467c93cacdce43f884dedb2050f6212eb9932f4de0794ea3
SHA512cf9a9d1641334d147f5948f07c518cbebca3d8ec05e8bc311a4b9caa79fca31dbfac671ce941b4b2b919e64e5c55fb5a2c1ec1af9572901a8fc533d14bb30fe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e2edcad0209f4c4863d7087d6271e0b
SHA1d2972b674b5e8af8115ec70dc24a87c926f3fae5
SHA25694e92ee58bfe5a4fb1e03c2c5a70877bda5ef047ca8c72bb6242048abdee29de
SHA512407ba5f5f2b0efddda235280db31397eb03552ce39f4cd1bbf269a29a045f50e9f50b15e996bbd296be5c303a048299190277373f314a4ed0c71f4fdd09fcbed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d30ca489a1e7062ed58b03f9f996387d
SHA14a1fb23eee533b2f9901a8cc4518cc95c76b449c
SHA2560b6c32c2e89500b20fb8e34bcb0c2db69a77b7d61586270284e91332b62811b7
SHA512b2854ce582d23a68d1ca98f2c3d396bd637037859f258b916c65ca94be2383ae25e658cc38ca9a4b8941dab74ba943dd9222951fe85fbf3b460666e8217f586c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f621ae27b63ebfd670de3cda1753c4db
SHA1e670f9802fa50773c7e97c8928c7c83e6fafaaf5
SHA2564cda2251fcf8631d2f7dcc2c4e304de180e2c386b5ed43c83a33a3fbaca69058
SHA512399e34033c55102ea6c7ff5c11759f28efcc19d708863a97cc308696edad8985bd69969fc94dff3c958dc56a4087b692433db332806d89a33b1df1707d6cdafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9c314f7a55a326f91aab19da2e220b8
SHA1b1b36b67de187ea8b0bc53c9f35c60395c4d0118
SHA25602910db5184436195c2139f353f042fe43e335913a73f73d57407152cbc5c824
SHA51279261090328d421e4213da6b0a82b7974e4192f8fef17ac57e376e4c63cf64185e98c7631f2277a9a0d045e3e2ab2dc4a08722e13e5e156018c91c14c6fd2301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b86485a4bf705c5bae4ba60ff37a3950
SHA19d22b7871b392864a35021d231e03bec1f530643
SHA2567666b9f6327ec8b6916d69d5ef537ca4e85acb1319bf89d37d8a847c8e80ede0
SHA5129502b0902f99f731acdaad29589b6cae526a3e2f7bec39c5701d6cceec40c9b3778161c071ad115bf70306084f3a4b66460dfe7017b517a51f767cc760a45026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff7115c8fdeb6a59e140864bac5d022e
SHA1a25f9c644b38503c8aa3ca6e8c27f73eb68d4518
SHA2564975d687c02fbdeb902faebb9a924022a57fd4eef0f1f3ab8181de376a1b6380
SHA51276b6cce7595fc005fe889af57465508ca6412f6722fda09829de4a2aa4f39e8508a174ae032e95405a84720c71e2b7f06394ec8c3fb4c1c386acbe5d868e7c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b50c1a21cebc2df30c8a20da82ed647a
SHA13c75cd19d2429df8daf6e7f6eccefb67b3767b24
SHA2566b19d64f7ead13491fbff22edb25b155ba19ac6f8d1aaab5b48a425e6d44d806
SHA5125d203ab7372dc4db6fc104a0fc7320d64ab4203c4d742b1dbcad04a431707c10014761190518007f2991a41ac9c21c80e4d86979c2be4d95ac81cb788566cdf7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b