Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 14:40
Static task
static1
Behavioral task
behavioral1
Sample
63a6ee34cf6c5e8faffa824ad0085629_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63a6ee34cf6c5e8faffa824ad0085629_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
63a6ee34cf6c5e8faffa824ad0085629_JaffaCakes118.html
-
Size
16KB
-
MD5
63a6ee34cf6c5e8faffa824ad0085629
-
SHA1
8807c1ded660072c825843a8263c9903230c7974
-
SHA256
34dc5cc70d9801c1eef0d3981d8e0b089a35e57c992265b5da210375641eaee0
-
SHA512
40e610f88c79a640188b3583da50c4b40dd95b68ee26ff276b35ac62e947968b5f9f6ea91c6ccbf849f4300b15b88cbb47624ac7c968660cfa2acb1886086470
-
SSDEEP
384:GEMb6+iR3/jIBrPzw12/tgUQUGjEXwPAfcNu+0nlM:s8xjI8ktgUQVEXwPdP
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464324" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21D366D1-1780-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1920 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1920 iexplore.exe 1920 iexplore.exe 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE 2512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1920 wrote to memory of 2512 1920 iexplore.exe IEXPLORE.EXE PID 1920 wrote to memory of 2512 1920 iexplore.exe IEXPLORE.EXE PID 1920 wrote to memory of 2512 1920 iexplore.exe IEXPLORE.EXE PID 1920 wrote to memory of 2512 1920 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a6ee34cf6c5e8faffa824ad0085629_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59a0aaa910fc1d47139bbe06b75e6f334
SHA13f7e4296bc2d7bac74c8646952f9446eaad11831
SHA256e7190517c2c489deeac6bb04a0f3fd2604c28bea49e6ba97e3cc50119a4388b2
SHA512209ade98170f738ef08a429e8077d9fadf46788a7abad15d2d30d0e3e9f3de4f56e25826449b33db74568930075d13127f5f8fde97d382e1f0912a9094dc4260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bed3a2b398bd7f68c9214b603de13906
SHA197f5356dcadebed4e985ac0291ea84ac141e9c77
SHA25698ec44f9d2f7ccaa65fcac7839db1dfdadcc9370f1ef5b45a1b6452ac5a46220
SHA5123324652e14c8c38fc1c72ba11dc4b3058e52fb5df4611643844aef81c7daf0686fcb5aa6d2e6d4e5fb87ea0ecfc85e1a717cd0be6bcd931ce0e30837eb4f59a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d6d362799254010280d138d97320c884
SHA14732ff0b9ce38404e2af7bcecddfaefad4c9b9b3
SHA25646401e9e30f89d692f05d16ec39b3f1efdc467d66f4a0866787abba3c5d0a5a1
SHA51223f45cf2168d4864fea18841fe051b9bf523403b5c0572bd3b5108a8cb82ab8ae5479ab8bc8eca0d4b68a7d64b3f0d95378221499f72831cb2f7e9cda5784f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54b36e1da141a5a7869ac84d5be95d345
SHA17c9d6760121f1aa72c4829db00ce70cb0ad45d65
SHA2564c1f094e1617b4dc385a043edf8adab658ac863a3ab323dc53ac32b5fe1a6281
SHA512b0fe97eb1d1ca8c3b4db2cde44e0056d2730af3b8e58ec8b6d407f4a14bcedde63857c8b448ec2acbc46f60a155fac53d6655599c8ae3342bb03fc9c3e1e3fbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50dc972f58462abec65ccbffaadc26f41
SHA16cf10deae4340bf630ed203ea7c259e58e0f8416
SHA256d16fb5d61d8fe555509a710e4a98492cf8711d2d20c2e6e5e6ef2e9d7ab8595a
SHA5120405719ab6920ec1df6e189827d39af52a936ea7be907623c8b2081a21c7986eacbea0b5a533efa2c4edcc54accaf4e83abac7dc19410bfd9940eb57f0bf8e16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54112f88a70092ce351886d262d08ffd8
SHA12effce4d6631e8a1d20c6752c7a8ba58fb23afe5
SHA25647208126f2006cae2da03984530d6e0130d012ae79eea212217b4659a97db69b
SHA51222ff27e26f9a4ce6c07b7b4db6b08ed4f240c38a1c7cc4aac5d290d5b4244fd912e25cd47271eff84e2c0a68400e7ed5455614f0af61c664f290549239369661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54eb2117fc167498ac30b493e741189b7
SHA1c6cb46d67f4a03bdcee952fceda0e20eeff25325
SHA256e53bc019607bf2857bf3b302c2a55bb4deee01d34b0246d3881eb3f31e674870
SHA512b45c936d6e94a236ea3bb2a908757046db1189cecfcb3fe50dc0bba958f00710dcb0aecf7441d38d7c98b0e47ed02dee7f17e56e94389b18ddb265f0f43f840a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5265e41557923343b4a01655b173e5969
SHA1617d6f72ea9e32a98f29a17c14a4b2f545a4e61b
SHA2569a839251d69296ef894facaa69317cef6b69c4e472bac3b9378bcf62a657c862
SHA512a5413eac77e3075f8dd7e3d89f36861fbad731e6ac7793e704f8f1d4007978f99c3492576300b39e30fe70fdf68a50f9acd76b9c5cd57f49c4727a48d39d9e11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53eb2b126cfec6503827e46f7c6801901
SHA1c90d16830cba315c43ee79fcf0cc7d483e45003b
SHA25638df9e360ae6de27b761a041cc02626f4f2350392ae04d6874aea70eec9a025b
SHA5125f2dff8173830fa6aac98e2b293f2c13d8b22dade2158365fdef22319c171d3ef67dd81bdb0d684fccb2fc2852e144fcad2fbc04fd1fb6d5817e1246dee6e976
-
C:\Users\Admin\AppData\Local\Temp\Cab1EC9.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab1FA5.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar1FBB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a