Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:30
Static task
static1
Behavioral task
behavioral1
Sample
63f7eeb4354e03462aaf47dc8b349126_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63f7eeb4354e03462aaf47dc8b349126_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
63f7eeb4354e03462aaf47dc8b349126_JaffaCakes118.html
-
Size
18KB
-
MD5
63f7eeb4354e03462aaf47dc8b349126
-
SHA1
764d2941f16c0035bdddfe065533aeff5ff2f4d4
-
SHA256
47b69e8fb5f300856804bd71139f7755837fdf58978b890f6d3fbce7c657eba0
-
SHA512
859ea76ac1c1d54f4e9762f5f3c0cedbb5cb1c0d9f44a20fe9dea6e5e5beb99a108ead241c4c748bcebfd8b40ee7eaf583de3e14828b2f43124f91f9e6dc2000
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI448zUnjBhAq82qDB8:SIMd0I5nvHtsvApxDB8
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470921" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DFEEE21-178F-11EF-822E-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2340 iexplore.exe 2340 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2340 wrote to memory of 2344 2340 iexplore.exe IEXPLORE.EXE PID 2340 wrote to memory of 2344 2340 iexplore.exe IEXPLORE.EXE PID 2340 wrote to memory of 2344 2340 iexplore.exe IEXPLORE.EXE PID 2340 wrote to memory of 2344 2340 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63f7eeb4354e03462aaf47dc8b349126_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5515259f7ea05f56b7e251ec8815508ea
SHA1070e75435f1fa4cb9a97ccb143260bd07debae2c
SHA2565aa5297710b2f35df2b90e8c07def2ad052839502a0772a3340cd87c3d549c02
SHA512289203303ce72461a8f6706d450f10a9348de30af0c0621ae00e028b0dbd8abcf79648ea23c7ddd3bd865ebbc73a1c061a3c9da05eaa4cc085170ba8cc4df074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d201e6b27620dd62332859528e8654d
SHA16b0d4405b12bba570009879db70b17ffd6bdaec2
SHA2569565fca9d53c66fa622fff5fe969549707e5626c88600fa1b65300af12597dc4
SHA5124f3fbaa5a4ca1215cdb0e689e07c3deceb4fdab61496df7819e13a2eb34e5f49ef7ad6c52858f8052e2874ce6eef527ea93853c6d6e0445e5a98299c3960120f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58865740e87b98543fe0cfffed1d61e82
SHA1373b02ba84ba7d7130e488295d5e18cf767b52a1
SHA25608eade3bd4a65ef4c49fb019cc5860ba3b75bf33361c5c37ae94ec5134c22caa
SHA5125b33664b681e66606a0d8a396176d34248140e7effff50a0bf4202bfe680dc6aa7da6b1ed110cd5f40ecbae8412943dba06e6006701784d83482ade00f82a0e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e9e217616d62e3cbb863364844bdb65
SHA14bf4c533fbac72bed231cfaacbc72b278aae2bbe
SHA25632b71101737718c91731a5b84042f14cc53e217ecda5611c6e554602cad3a586
SHA512d76495ccc48c84eb1bad14d1c33a072e0b4daa4e4579b935c6c6192ac92ad5dbf94619f60d4fe5bdbf2b5d396f1216df2e67134af489dbf3ddee7da9221ec694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5292114cf620a8ffb6b0755f806c06d8c
SHA1a28ca079cc9cb0c71d3c9a43d1458a55084f86e6
SHA256c54231dd6bc75c60efcb0df879ada33618c9f72587810f69fb491fff4514ee6a
SHA512b1340520eb2ed274cc8951269d1c6a48d7e6d210532ad5c600c5845df958812d2d1755a34129e109de642b077f7e25af04c3d33de9dbb16afabcfafbc8f39bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5776e0a26eae27182e03487f9842eac37
SHA143561bf53e49279d8d8ac0d6981032a7ba83e3e9
SHA256910a0e67f1b76299b8710da169ef89f2e003d8579e0df9108ca3169e1881094b
SHA5124a9877446c7e5be2b75bf73290d161ffd7c1e3f3cc1e51067514f7811cccaafe011c5843fd4714da3b3e78311ddc7c48ded7abb004228e4445c304a0d9964c8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559199300a65cd12ee2fcccd1051ec270
SHA1167a2965fef2c8aeba8718b1e9207c3a022ec10a
SHA25699db9586e01742c98f67bb2e3e96a2c04eed4f8cb42cf2fec6790cfd758cf11d
SHA512cc6b315cae04482c0e60edbbe1d0242ee72890d0a3bc64340e66a85043da5783cca114787f3e937f96b888ea15db72c1ff5e2f2a95c2126bfde60f292dc83336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571d966865454d4ae5096ade61954fb14
SHA1e82c4a1d164f4e07301054fbc9270b6f261a6613
SHA2567fe640e633463ba614d68a974c064182d73425d40706a41137c6918ee803fac1
SHA5123630d05124c84e9add654beff62d5e38f135c236efa3e9e597592be9c702666287d0f99996526bf207c154638e0e9538681881d2692a381a2c03ebeea350bde0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5f26c22fa249a4f8c46b4b24aba4211
SHA1c098fe4812c1767666311daa5b48cdf7a1465320
SHA256f590b5f588684ec627bfb2d4c068bc0172f7d7606ce3c7442b6435fa138a7bd2
SHA5128b554ac701a4f8580ac8a0b3a63adc1ab2de146e0d1d7e722ee9e4a881cdafdb0f6026f8818086f8367bc1c9279dfcb6b74c6e4de3ecc84b3360a73942911370
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a