Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
-
Size
18KB
-
MD5
17ead75f6aafb900bc77ca41d3a9ae3f
-
SHA1
92314ccbcea18f4da70bcb98d6474f93e7a1ec28
-
SHA256
d09e20155e3aca4ae7d1d04e1154d2d99efb2ad7e32a9f7ba0b69f1843ad1acb
-
SHA512
699780cb364c88c854913d6d05d474a42657b25f7ed202ce484d96e88ac4b2598b96e18f966180519eb99ac16e87416ab31736017f53a9e197dd96d13f58108b
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIQ4azUnjBhuw82qDB8:SIMd0I5nvHXsvuzxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421078030" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A485FE1-0AE4-11EF-9DC0-D20227E6D795} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2676 wrote to memory of 1988 2676 iexplore.exe 28 PID 2676 wrote to memory of 1988 2676 iexplore.exe 28 PID 2676 wrote to memory of 1988 2676 iexplore.exe 28 PID 2676 wrote to memory of 1988 2676 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549d0c77b022d9478053f06466ceea5e1
SHA16ca4cbcd7388959cdf07036404fa0ee960f18043
SHA25693d1d0d00378a0d4455284cae659725a257a54f87583e9846383e16276ef654a
SHA512717aecaaec7d2b0c9f9bd70400b3e40dcdb12eff159c3b9fdde5fae688bcaf8bbf56dfecdfbe82ac21ad50a163f99f9e8203c7a99151ed22984ccb47bca6a5bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59148375abddf400a2b5fedab36aed87b
SHA14f6c8a18eecc33cdedb64549ce6e0d2a62e926de
SHA2567f35aef361c8d77232a673ed54d2244a81bb678f464528f1e763bba6c0a074a1
SHA5126f6931b0c3005e6c1f6deb1d7624eef3aaf29d681fe2da94c36be21a68b2a5b7cc9543f595324c21d72d80e5b94e5f3bc68d7c98406961ab3dd340ee61b1f855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598d6c0b4d9f1130d7722e2ad3274b854
SHA1bd7c4d1c19562a4d89e86bc3a1a42e463893c5b8
SHA2568c4b406f8d6fc68cb50d15d4d46774eb9feeb3f6fd76d435e6adc075bc403c6d
SHA5128827861ec9e5a572dabaaf472c210261e115d4bc51617580b336e6d74f57b9ae4b7736f8cf55915a0c583d70ea4d6463e949c844315c18115bb65877842ec20b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a8320c0e5a06a5be24a7aacaa3b93ba
SHA1953ac47313913c61234f995c3c065db78e8794ea
SHA2567a9aa4fab020d41d6d9287a8f6cfa689e0dde5ba3f5b8c1910041c5067e37d74
SHA512324cd10985c130b0146083a7b24b45fa04c7f7acbef322070a1c528fcdca5a27cd8eb431ef3d709440b0afe460ea328b0164a45b14b13034d1aed7def0fb6750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51adddd97f6e21d6886cab07ffe514335
SHA1b42c7bf63e412d709e944e38395061f6478eed1b
SHA256d31a41770b2fbfecefdf0749ba2ab7efd0166a5dc22e35f141d8f99dc7330ec1
SHA5125e0f12b7a23fae741337e0f0166536c65411663a8b2eb11a844ff6e3f2432a6ba05e4ee4d3a368bd7dc44096655c2bd290ac3011bce2b97c4a8650640a5473c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4143b4a64309e9b9abd5061ea84539b
SHA17be3560945b2cbce28318c4debc11647af019db2
SHA25691744f592f1ed52943eee6972bdfb11e4e8fa6b9c3d6335af38a2c5df03d0991
SHA51295e091c68d58a55e33c4d9d19445ebd58f0d344f274ce10efe531ec0441d200dcfa2126c73d298b64a19015e0985cd57ca8f6540a2c69f0ab0e5e7ea09c83454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1f4f2606b7867cf9cee0f5ad176c20
SHA11e1cecb5b20854ff02be00640b52241305585a4a
SHA2560923a223b9c5cb9cbce256d8c0d8a9add03a2cb11978e9e1fba9d63c89504165
SHA5123e85acad421afb182d8c4e0c8d64803d15f17e554de73c8e9c676357dfd443ca7d4335e6f476f9f9c5af32a1b1ee6bf100917eed237d72f893f35d1f98f74d90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac8b31b75e4a849b7d9be042b7ee8e33
SHA10cb3667bed6448383835123eccfa406dd6cb86de
SHA25670d9e6ed5e51c3aab325b2409a0d0f73a143cef2acf47f353b5a9b12d42c4882
SHA512ac46cc2d8956bd49f337c636dcacd53ab3d353e27b61e4dbd47124d90a5489ca8c44805b2759fe577be5ad4b8778d367c794237545a18bbd4beef32e83ea8d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524fb36b093da1add5fd7a60fa0b7f85e
SHA1e6a236b1677b58b76106321dfb1ba9b5e4cfdd0a
SHA25633cb35fbfa75931e9d52ca83e424c6001451586e1b73d1413cdae34a5fd9698b
SHA51275b954c3de186d5aac2a6a54c2421f72bb97c8c9baf45721cde1e5d0baf4bd30013b8ae9e0c12d439fab823efbf4feee76ea04f92eeb2a5f6e1a478815797bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b108a654e13249c6032ab3956e84d2de
SHA1ccf8e21c7f763d676263b92ef079a65a6becddd7
SHA256cffefd3a8aa272e1abc098d42399e9b557f141eaac2cbd1551be53bf5e166dca
SHA5128f781969b5081a8179005b3a4df7f43164f6ed2bc41ac419fc093a1cfbd71c3d04f9f871917e241bf670e48ded502d8142f6771d8c77c24da0b1c801fdf464b9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a