Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
62d437238114c31e91c3c854c20f9918_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
62d437238114c31e91c3c854c20f9918_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
62d437238114c31e91c3c854c20f9918_JaffaCakes118.html
-
Size
18KB
-
MD5
62d437238114c31e91c3c854c20f9918
-
SHA1
e36b51f23caf26ad59e6ad02235c7028ee24d490
-
SHA256
d3f8eb491172e724e8d17dbcfbfafed34056306c0d0ce035117f85d647eb6fca
-
SHA512
e7c4a1376f4cdb448a315d3ddd4f6dff8cf02aaa41463a5163d8456937667ddbd6bacb3a32baabd002254e9e38eb5c28ffb37f4f8419df9415d8aa8e093f373e
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIj4ZzUnjBhT182qDB8:SIMd0I5nO9HtsvTOxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9820AD01-1755-11EF-A293-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422446054" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3064 2172 iexplore.exe 28 PID 2172 wrote to memory of 3064 2172 iexplore.exe 28 PID 2172 wrote to memory of 3064 2172 iexplore.exe 28 PID 2172 wrote to memory of 3064 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62d437238114c31e91c3c854c20f9918_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0bcdf6a0a64c90aedef16a7cc03eb99
SHA172cc6216089cc246ea952103fde935ca9c22efc8
SHA2566e2114e19b0e3bf092cd2034afd213e6f493def8e27b23b0a8858d4b7010b2fe
SHA512fd676e397eef8c708f8ca85f17cc67a0eba222f456798f07df8d767ae50b3c15f4b60a2eddad6b4f0b83ed002f1374a229893b2e7518ea7480feb4a21052e75f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbf66480ee2a7fc1e1703bd0af4ea7b9
SHA11b8b2de7dc58e0443ecfe77b965b967388a62ea6
SHA256633cee078abede557ad52eb1636e04a1a04b26a555f8d670f9837f696f5651ab
SHA512c9a08c26eaf7794deb84c48c8f6a5984de04d60c1b22d9616c4f354b22d04f02f3f91369123d9ba4860261b2d4529924277025a94cdac11804b3430b4c177433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585bb13ac357e26eac5496bdb6c272c8a
SHA1bc5700e572e550ec9af7c810686a4252948691c9
SHA2562202d3ada2bf3ae4254f18946befd66eb0f06260a3b27a71445566f968549410
SHA512420b4b93cfdd55ed2103b81bdd90ddc9a24e75b04b7f934a2e0120e27f3245ed440adf9f372756951bd081df5ddd1e805d3dc4620e17c2680f333fdf7eefb06c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c85c12bd6691e4d34b3bdddcd058bf1
SHA1cb7ee39a8faca0102d848243181737d22de902f8
SHA256a6c01c2d8936f5cdba58990fba5c2ab1a0fe16c843ca1b294d32a05cb1dab653
SHA512b344e99e0c108b9d04953d05d925d5d8d8e6ab1e0fd46ae9974044f0245aa1d50e5595c88b40eebba5ca8f705cc5c77ca389094a4664eac55300f25b19270ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca4e9df4ad2a3af78ffcb77ebb29f60d
SHA1ae798827154fccc9e063d9ac4ce9b0b2dadad4e7
SHA256b4bd56fb26cef0b477db121efb1a97d5d164f236f169c5258b5a3b29da336eee
SHA5124a0dd7f02be732e81a315c2b0d65fdca7bd720f28e64a5ca37eb8987feac5aaea17ab0f2ad599dfe46ba354f97445aa7090d6647935350693a0694d370f2952c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5144deb5692fda434020d081f9c5a0351
SHA132d0f38f34f2bf372b94ad0e1f7e8657f7651dc9
SHA256f1c9cd2651efcb488cc7d558eab8b3b33aa3ce6b341a99e407bf15daae68cbf1
SHA512523ef65eeaa4d7fdff82f166b4f1ec54201a67f763ef4d87e403fa89bcdd7668764c033bc08809e769b3a9eff412977c4afe548c92087764996be5404cf83769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54761dc16d2425016d25ae16eff841591
SHA11a7978b2543825c48fcd95a7a1d6e9fa74c37f09
SHA2567d379e240ef46a351ad4f9e4cbc4a9ca5223e43cfe33ef99fa6972fb5aebd2c6
SHA512c615b0602ea4de42ccd0c35e9828b4969e75e71af86311bca16fcb1e3b08982ddc65a5591405cc5338e0e4fbbdc8d75627c3a6c7a7e8a7abb6840dd8690e882b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5590061bcf25bb56b0508a2529626c00c
SHA1e78a8eee6265754fff90da8c52a0d7053fbd083e
SHA2568e47d71854b5763c6221178f81d280408280c59d77b48a06f031f4cfb7c9b835
SHA512e593209aecba3cd7c6db7b6dbaa3528537563311bc8c44bf7dbc15cc314d5f455f789e3a545f5c3dae87b5f5ebe243d8ac4aa49db6084aec133f38628c3eb81d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51386112fb5f125f03b4bdc6955413072
SHA1b5c4c43935f311aed261086228c9ae72afa884ba
SHA256dc87b220298500c129a90c3a3f03a971341bdac04fcaa96720f4d64ab7f4421d
SHA512bdc4cb9aac93ae330b2ce0f3128a752c159fbb4af8b19c657ec40d351309e7648af3bb3f543458f5ca0cf7881a7e0758279eddebc05db39925ea54fd16a8e4d0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a