Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html
-
Size
26KB
-
MD5
4caf8374b9e71f5c0a0f1054c7531c56
-
SHA1
01695911e370fb997384fa944b843ba505ddf79e
-
SHA256
3ca8c077bcbce4b456bc6775d0b7d4b824d06aec4fae783cce725c5bcca874d5
-
SHA512
4cc566f47aa1531712a5d317c06188d55b56a85daa077c0b5cc657fdcf796f0b5f7d12b8c98a7ad68674c1390662bbdd29aaa0e7d7c69aa9ffc9c180d976aca8
-
SSDEEP
768:8m3Qr3cKJpnQeROq1Ampf986Hydo3WOx7pghbyS1Nmdl5r08YIxJ2iuhWkF9JY9e:mJ+BEUOFC6Y
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4D95891-13B9-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422049302" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2696 iexplore.exe 2696 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2136 2696 iexplore.exe 28 PID 2696 wrote to memory of 2136 2696 iexplore.exe 28 PID 2696 wrote to memory of 2136 2696 iexplore.exe 28 PID 2696 wrote to memory of 2136 2696 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7f8c1ee52a7ffc30c9753f6e3086bc8
SHA19777da4f886b0f4a76cfed1b8805d59a1c68f550
SHA256f7a4107a32af7a06edf20392d30655244cf19e7dc5cc8e257d473be03e6779eb
SHA512af9cdccaf9017548abfb7710126a69d1e0ddc0839ae1378006cb96bb086664a514a485cdb630259ee034b5e6e36a1606eb2a747f75c39d32fe1f035b3e9c0fe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51334989d6e24d8886387d4f60405a5ef
SHA11fae6eda47731301a056c471944b50809bbf830a
SHA25644bede78810054547a4fc593cbd09fae2cc83b1d1cb9688d2ef6d99e1f5ed2be
SHA512d06f5f8b442a835a2eaf0bfb279de84413185d589ac32348944c684d876afdd2abe85445616d7f1e65809b127503d9997cf263543eee2e9c406d7262c20630e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a44d3ad1d7808551f545ca6b8adbbee
SHA17307433d57513fd2301bb91b2a3e585a82d805dd
SHA2562c33d0b1f27cb3eb9efcc5af835cbe66d6168171570123ed13c6d97192b66ad0
SHA512b2a489adc12108ccfeac2f783899b11dac0f5e8a97932258a3576701bc5924659bb6259d49a4c174eade85588f687980cf4763647b7735f30d6258b5fb9f4c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e4c5282c7b6f51db35f3869b55ff0af
SHA1da27fb8a0416d484e3134ca78cb9e8fd6d67bb88
SHA25648f68bceece459477516967fa12f74e8d19be387baaf74b5935c431a43ebf84d
SHA512c1e32a27997e734637a85f288e9d5a0ad70cc3a032cbf480eb09ef086ce66336746656afb570a3f32df77ab1bd405d31cd519b73ad371ec42f2942e10fa8c2ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cca7f11b7083101d85c4c8b3b9f0a564
SHA128cdac4d04477f4a11bb6c3996f581cb8075e46b
SHA25621ada8f9761390240ce383cabafbc698bb084ac1412798a632f2864d4f0d7f7a
SHA512f7099ca47874b64d984a0087187e6f7d9125e0cdab38a8d990bb032796884bdbfe46799f22a766356025ecf2f4969ef5e48ed4e47eb5052cf5889ab14ed7f35f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3264bb0f3da5d3fdd76a6a969242aaf
SHA120855ac1ee530a1b382155fde0723994cc70e8c8
SHA256f11e7521000b5cec55780357d5f1987084a40a3ebaf9cdfc480133982fb2dcbc
SHA51212dadf862d99d08f4d5007be25846e2b57aa752a7c0dbc7d57b0bb876fd517f1e65c0edb57735c5643fca5643eedfdbfd9939267f8416b2a2987a5f0c9cfe584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5719594bf9f33a15d03b9ef8712da59fb
SHA1e21c2f195ec02335cb48cde3d7e39611dae9b4c3
SHA25601df22b7075696fc9e41e8c6a5aef40fb7be99c9b1560c6e4892994c3d3724a7
SHA512099f6f1d46a6624eadc8f3192f482996956c26e4e08ce3401e7c16553f7f8fb81498b03e296944e61c7b8d0aec4a6518d1647ec180b55a3c2057af52398bd405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537ba477e6f84265fed4db936684f1321
SHA13606f90112825f8d14ccc3b7b39e173a8c16bdd8
SHA2568a5ffda21a29e48cf951048e30c7415cb91fa7c23901d548c113a05a0d730ba7
SHA512c2c47efa5bb08cc03295742166e78668ff3be09e7adee4b4c11789ec8ee17f0acac89fc86590175b6452c3f70a0143a9d68e719d0e0f7cf68c9509bb8ccb14b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529d4427dd6396b3fcf4542c3143d28c2
SHA17688314212668093fabd09772054c996f9e96ddc
SHA2562c2c04c289ba3c5a6a6eb406ba585de5ff7e616693b51286e90c19f68c844adb
SHA512792c63fcd09ab7ae97ea16143fd90900f842378c48799a7c09f136de18de9ef352a0f9a5823032dedb27641b9256ffeca9ff3bb33e0defb6ac195267d91b1cd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508d142bdee0977674f44b2eb60850df1
SHA155ea7609132ccd0b62653ee8a2a772d43b8cf1f0
SHA25621f4b429000d2a1d395a34a1a86e23ddfa585b0fee45e905ba5f6baaa634a951
SHA51211963c6b3f61afca3719560f3b3279a2bde557995251ae53f9e298e2c72f1eaeecc21f0f83fa5aa400118398c28e6df7e146edb11d5274997458eff00b7e1a4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506da59f2979aee5f1c48821324f6196b
SHA15dc48b7dd7d39172764274995f3bc536a2df27ab
SHA256e9239051108f9b479d9a102693f447df5ba6fc1ca0ad924ca7e95258e26e0b34
SHA512b16fc8337596a11634598d17b6b0b20e27055362e875648b1db00e72e26cdd8d5c6593df428306d58ea0eaa69b5c83cb080325c8616c35baaa3721f7e8cdb5a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b003d23913631ce4c83c45406c2ff4d6
SHA1441ff33dc2ecaf637a2a950f3d2e12d1942a3909
SHA256711fe292fc6b050003d779892dd08252178b43c9bc7b76529df06dc9a31d4b60
SHA51291194251706ffa7af14f3fb2ccc7014b72ae43e666eb11eb4beaddb6b8e7039090ba8239a47ebe81d2dce45aca8e0d87edcc8cd40dc82bf737a4b67a458dae33
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a