Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html
-
Size
18KB
-
MD5
183d150d0c0fa29e4ead8b4f64a9d6a4
-
SHA1
a018f42fa3c9a280f8f38fdcc037f060b961ad90
-
SHA256
915edac7250b0005fbfea0c494531ff1ccf4b90aa4801b9d114743281b1ec727
-
SHA512
cf3cfe817110913d92a58d7623252c6233825b2f90fac640a2d1de5e1d50d19567fea966860c09b43c9d5955961c5f10d790d25cb9b99584021dfe6f4397619d
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIW4MzUnjBhAK82qDB8:SIMd0I5nvHPsvAJxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE11C931-0AF0-11EF-9340-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421083431" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3056 2924 iexplore.exe 28 PID 2924 wrote to memory of 3056 2924 iexplore.exe 28 PID 2924 wrote to memory of 3056 2924 iexplore.exe 28 PID 2924 wrote to memory of 3056 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\183d150d0c0fa29e4ead8b4f64a9d6a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a5a3a86f12854b3f733a2e4b99328f9
SHA17e2f7713b65f9139fa97b5d6d2ab1ab8eaec1367
SHA256ec9b217c9eb03b84076aaa6ce49e32a893d1e643f966cf8a763da82f97408712
SHA5124a74512d65b8689d07bd64a75909a937381ce7051e8d18e8c4156e563a4d259ce2154b7c3a41e57932af4a0e9d7c95e7ed5069f44b07adf1599886cb624130f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0c2c837a8538e00e79047778fcdc416
SHA1851283da4b03db8eea1dc514c8d431f7d4ada011
SHA25615b070fcff40d441113bbe0948d4b0d54a22b190858393ca4bc61eb04c4e0771
SHA512e887d4728d842299e56cfcb5f7b3035f6efca92165975df976c8e1825abf108a14211587294e51b3729f8f3c58eaf065f85cb0293614af8fbd56f80666c0de97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a31ce11371c3945a0e469d4c2c13891
SHA10a6b5b3de1b5fa6a3e4093a5315736d65fe721a6
SHA25633dd9f1a7b0b2e66ebefd098e45c11a5c57f5ada96272bd4922b446282db62e5
SHA51209366e7f4db5776bd09bdd0dc9d35925895fce00efe04a5b41a30438eb78964ad33d77813f4fd700a08b9465e74ea3a3f11afacf838071c53f2ada3788aa9bd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584ef6d115778a35710174f2dca0e5f1f
SHA10dc01701dafbf1bfc7e187299bb08415636f5e76
SHA2560113051afcfcd6cf300f7ecf92f6a17b135a960325f9c58e5c347b9283c7ab91
SHA512954176dfe82a2fc1310dc115509ea4ac10ba7a2e2315338c91e0638699f393ca572ce6745fa7df3aed01c871c40b210743d41bda025304224932dbecb511c22f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e24eec56d7f7ca94d7e2cf28d152b6e0
SHA19e2f1147e549702a7303dfe41615895fa4b72d67
SHA256b5227d6df1064562a8f00a849fd072f806350911fd64f47dd9e6b28e265fd7e6
SHA512654f6793c3c78525c689b0943c14f23345316585691f438a518dd988ce43552dd1a743f71c0c55d147b4bd97bd8f9741438f1f649e312534aa8a9648b2dc8e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518ea3c8478a3e260b339b4f10f4a5310
SHA190f8536bd7b7953cc5da5eeda96d39bd68a58490
SHA2562ec23692b66df527220db90ac9ad00c6e54e0517f035b9b1c0b104cc1c66d1f3
SHA512c544d08eee6247847a1e2e541f5768985498fd23ba133afd47a7ef5ab150a35315aea82a6c6b0f6fcb23d044748d74c8a9eee6be38cb0172cc86a97ceb830758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554495b6fec7a293a07481f9b651d0215
SHA1309ccdda0e62dfbf452a97d3dd6af724a0116efd
SHA2564ac2e34414625a6d6191ffcf6f147e7f04c3a6a0545d8d34512c47e79135d91c
SHA512873c7366fb0389f166a2333c54f1e0386c8e5cd3135b0b701a0c1517e23990cce0701a8b6ccbacc0e02e9566e92839ea4421975afdb746be986297b611d40957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550013a116b8469661d8c240546dd51db
SHA1c37a04fcaf7b482671f6e3b96a9f4ec9fe96d122
SHA256521a242ab0e07261891c9177674bf2ae430ae597839fc8100600e1793fa368a6
SHA5125d18fbb0cbfc4596df9bec54aa40f1d2b55fd2d895e53b819382de52509d55601ab59ee5c78ce913038ef241f050057ba83a52a71bda2a9decf5dd6da1f2560f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff0bdbc9d574341278a8d0614d243e0b
SHA1986c093e11193e0e522648c3e6435916e4cfe223
SHA256d5aa2fa1f450fb108f6ec33d0369f90e0c02f52f31317270eb274b76fa26befd
SHA51287202c8ed0ae981d8123b7af7eb50b5ed68de5fbb280ac5211ee892baf1cb334286b0b547922551c24e7b3f5cc0b3a21df6f9531550c010f65e62a83d907d787
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a