Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
-
Size
79KB
-
MD5
454543e4a1e62c675b08344ecff43a6d
-
SHA1
ec6c033b8af9603a7c21a1042a1182b1e3669e84
-
SHA256
7aee5281ebbad00fa0580dc8f1a06570edce0f61bbff8bf29ffa2d95906c03a5
-
SHA512
2fa16bc3c9bee3cd09861bfa9512e9639c03095eadcbe3ac80798f8b67a26df361b6806062be47c7e1b3a346495d77782326373b3fa845ce23f09e922ce6876c
-
SSDEEP
1536:mUpCCcGB7FDOGXxqRg5D4CnuI2VfJcM/g3lAYGT6k2N0bWQ0Nxabp13A5rg6gfOT:zB7FDOGXxqRg5D4CnuI2VfJcAg3uYjCi
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421922765" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36EE92C1-1293-11EF-9034-729E5AF85804} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 912 iexplore.exe 912 iexplore.exe 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 2096 912 iexplore.exe 28 PID 912 wrote to memory of 2096 912 iexplore.exe 28 PID 912 wrote to memory of 2096 912 iexplore.exe 28 PID 912 wrote to memory of 2096 912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b2302d6c5a448beb42bfe33c277369b1
SHA1461719ef5041768d0c175d2680510c49f4a657ac
SHA256d649bdbd3df95b8e04a79ee5d6e5467526efef769767a076bb2347be0588a375
SHA51288a8b6ace25bd7ba4b42981397a9d6f42523877e8b87860da4129d78837d8726da6c2056d41d17d0fb6211ea21fd3339c0a30a619ab28d3421a8d45b1e9e6418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dce8e8218a0550fbc75b9d8d2fe21edb
SHA1c6ae5ef94924587b9cc8d040ec99b37aa9e74cf6
SHA256e22c20875498a962447f8a3019ca329437cf9a08ce76458ab41b612634ff14d4
SHA512cc3a748215bb7137bff1fa60d1ad16a1118beb4b5c62cf7f914e101780e166ecf3501eda0f19d084c9bdcebf05cab0f82576195ac4151c21678ce41fc30473c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540d2a46ac4f593dc9fbebd69329b2908
SHA18d320e1ec2e910f2de5ced084e8c81f828d5de41
SHA256f68918eb00110b4837713491dcb9d18a85d152fd1ddd6959d0fd520defb1480d
SHA512ace9ada5a2ac9240008165f662c17fe961a530f656276a18a47071ae52500b1daa6d7117a23d35cdc0525b13c3823db8d797bc99d4a335d04e7857589f2ba543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c3bec96145c4be5140a6fee3829d400
SHA1628b4afa4485158d9fae429665396a39df503830
SHA256374c375b7bbf7722f922181a3d368c3f3154a1bb9e5d3de97b9e4c375fe2dd65
SHA51281992235cb3dd70d92873cd4de992435c55efd3bac9e2e67c5bbe333e4452b19fac43dd9bd15216b33b064972733f63104ebd109afb2383b5a8dd50aa1ec4c84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a42b5c3f0eef3856f4cc339473a3014
SHA19597a3854a5922c7262f5a07f0ac55c2702838a6
SHA2568ffc9df83e6407861286723a1c814eed120c43a231ab316f2ee1959d80cb56d9
SHA512c209f85d3fdf462acda6f54a77c8a8607c5ce349406254879777a8e704e70174e980cdff7c02c142cbf8a0efb1c51b0acbac7dd27ea957e1724893100bf8f040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c27ea6837c92a2e9840a419a8aec2ebf
SHA17e32658f05017b82921139640b39c95e694e32bb
SHA256ee59fae1121127ed446982ad362fda0f53a8946b58fd8c4dfa9d42a6ee7cf816
SHA5127ad78453d4766695f68ff7211d45b9fdd8ae838f0478f69a85762f692c2a99e2a0ac17103f86896610facb0df1bf32736b048f79d72dbfb3ff277fd679983a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe23b05c348a41c49a6f64e3144574e6
SHA1283d0a4bc1f2c9b0e08dc54ba24f3c861634d5d3
SHA256592b18791b1f98fd0228d3fcef5caca1e4a9af3ed2c4ec83aa242b42027b845b
SHA512234cdfc29a142ef268ddd1d8fd09a79bf84e0d2ef1b77ea9d17092030e24d2627641a7daa94cd83989ac2a4bb6c42f4404fcabb97132891a81b6ccab9816ef4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c75fe5aec0ec9a21a83ea23d0d5a096
SHA1aa795405440869461ecb1ec4cbcc37febff244e4
SHA25627d844f8f6159a1d44c6dafdaaefa142f220c41c23541968504ad459f49b0dbc
SHA512b3fc00cfada0b7b0536bebcefb67bb2492a26ece3703d4a3891054fbdc8c519845037d04678e40cfa270ac9ef834aaf3a7696d6746383af33ae43f356cc66603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecfeea912358754c1ef18e9700b6641a
SHA191b24c0f9132b545a2e3cdd8e2d10c4524222d08
SHA25650525f9306063aa623ef976edb40bf89a1cd9a221d140c3fc5af65ba1fc1cdb6
SHA51245db9dd48e81b6c235a0fb635d54d122d261ceab57df0dbe5c90262fdfcc17f83c7d16e2490c5fc41b7e71a981483660c8c23ac870bd77251f49662c012edbd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e679cf6c54b00c0aedd7880a5a6a4151
SHA145a8f400f0e07873beee00dc088c71f25cdbb7ab
SHA256103d7f6951e78f84c58ecfcd056aa1ce43b275ccb9d4f71059d04a4297bd108b
SHA5125d09f72ef9b1e6b856336db320a871f43110aece924899dbc04378bc9897f1cef14ad02639a619fbd1d06d69b8cdca69533a1f965d956f15b37cdd6365363ecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e0130e23371b80f6cc52c681fbad8069
SHA1af79bd3f256a44ef848ee8d4515ec76faf954336
SHA256e2cb5e78c1e79ae3715201dd5069165887cfde1df81ee8366f205c6ad5ce6d2d
SHA5121080cdadcbf75d93f52e4655c7887ad96d8f898032534facf57d68f7938251e1777aa46e76eebec9be2d7ac1dae05572c0967310205717985df3946f47b50e0c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a