Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html
-
Size
25KB
-
MD5
4c3f8ce840a81f7faa3b06a526c4e2bc
-
SHA1
e1cfe0533ad9cacb6edaf2e23aa0f624b83e1c9b
-
SHA256
61c7aa592c5cd8f8dd5016e75d9be6405587576ce5eb8029e920b7d9e87a3968
-
SHA512
c07e6b4b1b78a622c2eb5d47a955d30424b9e9bdd4d227fc3906c60c9e53fec64143e9f45d69190fd36f788356eaff453ba8fc498f5937733dc1b26ea98b620e
-
SSDEEP
768:SvlRhYp+VWjXedWg69N81vhMSxAJBpeq2mRwgRpjVB5A:SvlRJxAJTeq2mwgRpxB+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47464BA1-13AA-11EF-B781-461900256DFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422042620" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE 1208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1208 3020 iexplore.exe 28 PID 3020 wrote to memory of 1208 3020 iexplore.exe 28 PID 3020 wrote to memory of 1208 3020 iexplore.exe 28 PID 3020 wrote to memory of 1208 3020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c3f8ce840a81f7faa3b06a526c4e2bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5501705759d76c9b0a14bc030f7be8f41
SHA1f003de8a6c0ecc03a4829423ba3c3c6387feeaad
SHA2565ce323e7293f9236cf8556dfc5f0e7d156f5604870810aebeb6443d28ac1944c
SHA512055d23ddfbc959415aabd356552037a45538c821cbf59e28f7f1ee53d8d1202de4d1218a9348647cfe07b5d2d7d344a1bfd6f761c8a8c403091f0ccf0ab80b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b148f0d257bd07b05ddadebe6d14393b
SHA15f6b6a69d3c5dbfffcba76d8fed0bd199666e51c
SHA25676c8c07f3389065c738ef54dcf80479196ad5259670830dd02f0ededa747a2cd
SHA512c1d2d260230a4de9757928db37231fbf23a7950afdccb96c95a2c62259ddbe656d3219cc5e3f98ebfd5703abda88d1f6e04815ca8215a76db8c46eaa17460f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eb7b80ce5177f2a279475886f9e9928
SHA1c801971740347d00ba628c366273c1f471e9f2d3
SHA256d26e1680264ea4f2d0fb8d7cf29ca377978232f4ae8ebf8b9f9ce1f205d6039e
SHA512b71d636f3c19ba25f03ace97ac05e77ede0477ab454a77cb81417518276eb5b0eec972ca5f0d19a30a482596c00d3f23eb785a06b53c585bae8d1e3d03a8debb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567d48050076cc57e2ba81a24d05ac7e5
SHA174d115f298dc9abc148d8c81e3f5337db960498a
SHA256e2f39cd587c64b436e2ff903f379e3f03586a0413cac3ca484d3f8d05d8f27d5
SHA51246d96a1deabf1076787962928b24772c4156a68688b5b63933c98c90f6e9c8cc8750273c15ecd34363daeba2b0ba7cc99846338aad8500b1d39c7a4bf0b5facc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fec6f7081191d0cc3ca63b322d8386a
SHA14ed1b592b66230d684bdd9bda980c251900c865c
SHA2569c65746a44794663ccbd9da4858cb0833c391ea1aaba90240fae7d5e501db4e1
SHA5126bac49526ef2486933b45c77a0de52d6be4c031f5af33d59f721aeaaa9bad8513f2699b84c8742d5ef13cdc32916e4e32b4283d7f16d9bbd02d525baa7c1ae85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f60137a0c576dc54d12e751e5b069ea
SHA1bfad9e75a5571f625619502962559b65b3f05141
SHA256764898d3cd0db048937f1dd770a2991f946a7355b80a3071960c4da8ec1675b8
SHA5124f02e9cbec8a9ddf2a6e4dde8b976af14c7018d3f4ddb15876e256aeaa758b7a2c249b2d7fb84a4b7a0e6041b8009da9b8b8c3fc9f42267ff48c039644cdd509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55581219b24c69f97878960ae4457344a
SHA1b5ee8fe125ed465e368bc98f6303c3e8d302c731
SHA256a73245380f4985966ecc129d88f4787e71a64bfd009916a4adc85257d6b797a3
SHA51283a142f281812a7980c465f147631ea7d4158a023084f9580d6d49d4f1360f3ecba4f6964682477fac4aad94440ccb5743e4b4cf588b4a3fdf0978f5e69f3fa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560fe8bbd953773cc3cfa559d4ba3af25
SHA118f4e316ae057ce33a40b2af7a9b3368a6bf22f2
SHA256d757bfa34612f7b293e67e8795d74f58d94fcdf55c9bc452cf3c00d89bf51c83
SHA5129662d421dc0f6a76a7b70339480d6662a13fe66d2d43b470df300d2618f46ac897e664bdc147513e9a2ba4c1798b33faf3460612b2b8c67cba03c5d48dff614f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceb1b4be716df2fd0ef18735e68c2fbf
SHA16147e00489c45e46bfee7846452a963afebd03ce
SHA256cd9dce1a26b12e23f7a393cdf07531128de642672d3151802c7b820284b5515e
SHA51287f18570de7ebf89dd841fc9b9497222f55f686a40c7a107d9769944ba36f648f787efd3e623790f4eeb5b90f245258606185e8efb7ed693a97afae519cd8dbb
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a