Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
427d4771d5d50e29a5bdbb7a423f1fcb_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
427d4771d5d50e29a5bdbb7a423f1fcb_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
427d4771d5d50e29a5bdbb7a423f1fcb_JaffaCakes118.html
-
Size
6KB
-
MD5
427d4771d5d50e29a5bdbb7a423f1fcb
-
SHA1
81b7c3e7b6c95eb237c45c6106845ae7a8ddba0c
-
SHA256
183c4f2da5a836b187cac681ebe25a202617c416a8eca029da7b07791b271908
-
SHA512
c3a82b1bbe1ffba9104c02db49ca66841f9fff984a72196d0aac68c94ce0551ee96fb2d68f334d60c41d0f58fa2182966bb32917cbf4dad413a6b2792a9003ad
-
SSDEEP
96:uzVs+ux7XMfLLY1k9o84d12ef7CSTU3LcEZ7ru7f:csz7XMfAYS/cb76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f8188607d7637f109229ca3030b937d93751221cccad610643cb9b68eb6b75de000000000e800000000200002000000043d8e5ca94d48c68e64890983ed5b0645d9aef36058c396276a3c0f1f2b4332b90000000b744fab222f138204221780af603306607002afc8f4c8b5acdb158c6250757ff26c6cecf5c436f1beb81417cccc219481ae7a49347e9cf33bdcca5c4b52fbfffae8b3969f1b512d3d824a1bc868da912897ca85b1ab1aaa1f5f65f2f3c49bba069849a33e81ba883eacc05c470e0dd00bce71a3d1797b1ba97370fde38bd25246215ac46c2d5de855f5b2137568a073e40000000895eb14628ea4b2e68158586b0bc6e1e92a3a0eab06564c188d6eb24cd8955c5ef93cb69694c303f38e92e992717199b29781f8701606fb31ca368a1212fb610 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009041ebbaa646062e5bee1997f46853b78a73e45665f42f7b6313b3684c3b0daf000000000e80000000020000200000000b1ff657e0c8fc3eb3982d7a46342af473d5f44119b53c855ba0d8b8058f939a20000000ac685a628b8eeae86f19622a6480c10e25b002f8821b3491f29b34f0a6ded48f40000000b8fbdf0d4c3196ddc7b5ff4b626698fdedb7ee5d03edc3c1799f6dea1c4f8c09ae39c0fec6b1d15eaf014cacd7158ce6f9fcbb863ddf2d8087cbaadaf0a41151 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9091540343d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427050511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E55D071-4136-11EF-B58C-DA960850E1DF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2900 2072 iexplore.exe 29 PID 2072 wrote to memory of 2900 2072 iexplore.exe 29 PID 2072 wrote to memory of 2900 2072 iexplore.exe 29 PID 2072 wrote to memory of 2900 2072 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\427d4771d5d50e29a5bdbb7a423f1fcb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b3451b45ddd5c71ee3299c5a3bb8aa3
SHA13091d4ad63fbec43042a397c6b201d0cd84d2fbf
SHA25650e17bd20009c607ac7e9c2c43cb4d091c0fcfba8ec68b65a85efca9b959c8d1
SHA512f4563f2130900c4c34a37a9d55b2fce424cbaf8074929f5a1a0a678c385bea7eca1b58e037d513408af68d544b687d7ed5727fa418d77207fa019ec99523f077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523e3db62bd23eb7ddf90ccc8d63ed591
SHA175df206d8045dd9517fd86b575d18ae42e2da96e
SHA25683dbf6c043d467a2784db30bc4eb0737ceeddc1107df6641dc077289a2579a49
SHA512d378d6cdb630c617d8f6fd4534971928f897fed22ea94bf2be48e0ac18248f49b96dc08cb4d167abb6f72b455d6283acde381d3f4c4eb2a4ffae27a1905052c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd7defd6285ebdb4f6f796950648b49b
SHA1e1b62f2121d45d46b2f26fe461826f1007a47d6c
SHA256530814cb058e2342117d2016dd3ff46b96467ed450f35138f70203ca09ad0bf4
SHA5126211fa4081730e248d4f18fffab7eea9baa93257c3767f0cde30b2be7f43843a20a7b86d0638b59f637bbb63f34d363f53b835bdb13096e0c3ff2ffda4cc2b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1ca61d2ae6e5f7a0a7655fca1674acd
SHA1aa558cf25f88be47349a724cc59d8083e8742522
SHA256873e8a1c836141caccda618385c0e6029e9f21a38cd93b370a81c8699dc19473
SHA512460d3faa4e2688e18ee8c454990bfcf77a56cf2089aa189b5188503b1f58ef3183e89ac010a2033758b4d8aa0492ec4cd6e43d78f18ae484652a8f07f8bce485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576794ecc344c5ca9edf1a244b964e2d3
SHA17f45295b198afbba6886988f10ad1d8d122c4c22
SHA25622f9cc791a5dfd5ae8b39ceb912130db7ffb9fbbfef6f0ecd9c52b175a838b74
SHA51258decf4c0032863c382b3ecd5ba90436090dec902b451a4ac17d801ffe23add60cdbf27de184caa4e5de22469719d7ab4c65bd6a89377a8f1389ce308c45d561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e6333e96a772ba36415d43d452f1f8c
SHA1d5275c24eca87717f94489bd9cc60d22dc6e2d30
SHA25632b748e063b4f74a163e228fa299dd6a32cbe37539e7ce5387bc7ffae75e7733
SHA512e9ed72cab2fb46323d4c5f03c163228e77f768e0218d77980535c35af40e9c5b7fd48750690866db097a91fb1552b571884b04dd6082533a99512a8246d286f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e6bf638142696b13c76fb8560afe061
SHA13e9e3743fd6e8569f46d44e55d964df2dd03b98c
SHA25604299db05f032c8fd43010864c6b9e949b9b3bfd01d0aea44dac99dc8f72e67d
SHA512c62641baafc71a382038d1eb5ba962075f4abc53ccb1e8bc0026a5f76d2ebadf689149eddf62d469008eff71d729a1b3a09fb0b41d7e611fd21b3e8485719fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5937c6972803613d9537f13343e9ed825
SHA178d8978421826fc88a36e1ed39b63c73a86ba392
SHA25646b8856e72846aa7fd3d8dc39dc885783828e0e713019f172b28b640e447f6af
SHA512fcb77abdc8ab4c880d57a627190a48b39c32cfc96eeddae5d7bb501ebe237a49cd7b3b0a6a351c69d64f492cce92560257c49f5573b301d266d3cd14718f9e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553d900a1a4f29cc2817ba440a01fc579
SHA113b309cb6efa8d3e19572c6a24da04d1a2ed671a
SHA256c8f54b11f18678b71236198a39d49d16572951051cc85658da5daebb2c160fcf
SHA5126e21e85fc3b51b5240c5514434f2bf29ad5ca5ac482ba13a1d6e1b725b4e73b304a1c2dae0bbe44bd206de6dc9b880c4d5aa04f22cbc6cf536915cebaadfca29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1ab36273189712feddb556918ffbd87
SHA1cd0b07030f0fe10f12cbac0f24af42f220429c13
SHA25691668a1877483e370c9efe8923088c24acc6e89fb02c8c08cfec664a8938dfda
SHA512fb5aa6b0b2e47eb38e11c85ba50002057467f290322a4022300f16534b83e7be703d6e50e9be05faef56b9d689ea2d138660e15e54efbc45d9cc9f7171f2077b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589d30f6393237c18b6c0376262bb9466
SHA14abf53391caf5860a6c3cbcc5855f32dbc820bc5
SHA2563ae3ca5a215a6a9af3b910649b89138029521ea84d9c083cd4fd594f0fac53a6
SHA5122fda54917b61e8664d26a88e1d485a3177fb8a91dfae22e8ba0455858daf1da6046a5afe90fbbc3973f1ad62b21e100bab2a96a8ab56195c3251a688ab246fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f627f25fe171e2067aa3a11cf7332698
SHA14e3d2679b4bc4002150daa3cc1bc212a717ac34e
SHA256d33e7775cdbbef3a3cd6bce358a19550306241ec0b7b13766ec0b4635d1ff865
SHA5129e7841aa71ad07210cd2019c7a338dff365c8cd32fbddf292e6a84ab99917c33a2e24d2d8d470f313e07d0336fde7be25e79608d1b3775c046200438c9e47fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5facdba7611765e48e722eb3981433a8e
SHA1bd8943a4f7251165a171f696e4d6ab7c7acde0f4
SHA25601709ffcf6c85345e0df3295fa77965a9d39111f920dde33752de282a3beea23
SHA51276ef6b5eb1c27a719971ead2b72e0376f3872965443cd678319f0f8107210c5bc81605e99a74723a16f09c71c0205f9c8b0df8b5465c979a55599d1b8ac0ffbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534109a5df71a46a9babe08bfdf1f8847
SHA1ac98462835223d9265cdeccb65de0abae70684f3
SHA25698ff5d87460cd542e2e38dd1289426b0032b494d22ed31abbb1b0c1b0a129031
SHA5124a09dc21edb51c64c1a3066f35f4f1604f22051b7ac40252d3522f10a84562769a5f17a07dbc87b8a4c98d7c05a92e15f4688e9616d5ac10d16bf0e9ac61bb21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5981f94bbaf051e30b63a20257f68e50a
SHA18799b6c56f80641d04fe20dcb6104bfe767360bb
SHA256a35fef27b2adbcd013e2406bbb1d42a8d75a805420cfc03a58c8f5c99a46be4b
SHA51222ac44a8188eca8adfeec42100c28a3f0ed75c53e3f298297ba17ebf9f0e37ffbc738a37ecf2b85f1e5bb07141c4fa183e01828447446f38ac97d735220d56ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52922431417b3e5ec9f1521dda935df7f
SHA12b6dcb7b1d01ea4b1901a97a03e02d46e20325f6
SHA256114e6b3c87dab49d1ec2c7784f6447a49e41298bc07f3a23baf46543ea8d4849
SHA512b5afb59b3385ee76a0ab719aa8a9a9a78e8bb558c8a3106e9fc8a0d8387f85c151aa6f7361ef5738d395fbbaebec4c1dbafd13259f771e79a81db8644ede1b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58006e62a5c82d4f24de726df262e1a99
SHA15b49c33fe866023734d914a2259db61ae5fa2052
SHA2560f84932e071731fa21d86407fa9c7ea9610e044b16326bb80393860e22b2cef1
SHA51201f1e543e173c07ff8f3e7fc33006bc69e64cd628f5b4529bdcc959ca34ef89151974b41eeb884d78e77b0e6fc5e3de5251f3c704d22763bdf0b1455a6a9786a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a5ec7f94c4d1cfe24fb59c8b0b7ab7f
SHA1af53f18c1bd8579b838e724c6cfea5aa23b8bac6
SHA25637ee8023e7f064e3589a7cdf58d7883e3ae1dd33e36a8a530cdfdbe6b42b4689
SHA5120928ae1c4f9fb51e94ed3526b9b7c04bd8bb47c011144a3e1d3ed9a5fb6fd96365921740377472775f318a51aba37189107ad7eb303d438a8ed7336da789d306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52379fa9ee2963c3f23018f5a85f7a7e2
SHA1caa65022f574603554ca9515b7bda6354758448a
SHA256e194113471501e9541102efdceaf33dfbc9f99389e1f2a11087d63361a4f617e
SHA51297e9c9df338a4b707afcc737cc85293ee259e114bd25303fbd57a63abeb00e0788450ea5f024c2d601f53ae15285b5a9d3704001dd2de6081378ccea4a48625a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b