Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
6584bea2572a34f56f34fadedb6938ef_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6584bea2572a34f56f34fadedb6938ef_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6584bea2572a34f56f34fadedb6938ef_JaffaCakes118.html
-
Size
21KB
-
MD5
6584bea2572a34f56f34fadedb6938ef
-
SHA1
c30f7d5922e419f031513921e6640db9155adc03
-
SHA256
9211da0d44f74975d368f05e54675acce6c85224e99a2de5ce9a52718cc293c4
-
SHA512
244445a3dc92afc9b223bc4cad77ddc6999ca17cf795fbf54bc25d7c659d1a50c83962c5ebbd0a6e5de2dc197eca63dc5c2f403e85c5922850014ecbbbfc07f6
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIH4FzUnjBh/R82qDB8:SIMd0I5nO9H1sv/axDB8
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41A236D1-17DA-11EF-A5E3-DA219DA76A91} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1740 iexplore.exe 1740 iexplore.exe 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1740 wrote to memory of 2996 1740 iexplore.exe IEXPLORE.EXE PID 1740 wrote to memory of 2996 1740 iexplore.exe IEXPLORE.EXE PID 1740 wrote to memory of 2996 1740 iexplore.exe IEXPLORE.EXE PID 1740 wrote to memory of 2996 1740 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6584bea2572a34f56f34fadedb6938ef_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5365c0483ca70c5d8aa7f802081c5d710
SHA100d92e774a96bb9971f5e27120e876f3417582a4
SHA256116a28d8119c3f6a1aae7c28084bdcb96ae220dc75ee886efe3d4b4fb9e271ea
SHA5122daed1da173faabd101c08f7dd238f081e958bd23c46b033fa9611e9c4f862e1f58a9cf75a069188a0f198f59524db5a3b617ef23e9bdefb89ba48723b24f8f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53d6494a3f5e22fbd62656eea70efc76d
SHA1f6903c66138a67b959774bd53abb842aa01a0183
SHA2569e3619fbbe59a274ed009ee70e621370c4338ae21f964e68fd8da85259babe2b
SHA51270e1a1889d4214f93cb0d49ea647a28e053eaea7965f1dd531d3ba543cb803f7b0aa0630256542fcff3bdb02e64af709f3dec2985e1e401ad806f323f6ee1184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e7d87d18b41132cc93d1ca815e6e4e48
SHA1444eca25833ebfe7bbc7ab1f9895d6496ab39c20
SHA256e5c17b29e9880d22392751e7fab83204a418e407c325f4d5b2caed0536646228
SHA51201c762e8a3c20b1c3e50360624a7fdc38b7533480343a1e8c669d6d3eb37c9edb7df1bdcba982c555d44bf6d0bbbc63b4070214adc274ee109a078cf08796842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD586a90342cdb7e7b69318cdf02e13a8ab
SHA15ab3d30719d56951e4e9858424db78b04f5c7302
SHA256f4368283f4622b32fbc07ea98c452e20408716aa82b5b72cd211bc78d934d2b1
SHA5120a13fe558783c790ae701c20c6d449b8c4f3358babe0ed6a6548c124cd1fff30eac26ca87a5e62cb454a2709f596ebe261745319a4a87926bb6945e20fe559c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD550121f15773414e071d26a09d7bbf6c6
SHA1f4d1370cf4753053bf57733c25fb57c383fe8d82
SHA256b78857f9e8fa24ebd71e26bbccf78a83e79d636f2120a58ef83569f878f1ee3b
SHA512ec069436725704a729422b6260a9303570d8490668a977e17388599298ae896acbe4783b3c9375d1e771a21872a2a9d7b387dee0ace18b911ff8e2c2a6cfa3b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51ac7818f64bfb70b7f0259922fb1c99f
SHA13b20f97304a674a26f42dae1e9a7e82e9daeb23d
SHA2564b650f8ad82ff16263a6e90dc1840d76030483c5d0cb7ad5a98b86185e90e04b
SHA512425665b488d71d5f42bb7e718200b55e86ac1da179d7e1aae213bf5afaea6fd15562ccf9a115e4c63f94ba9040f01e59dac3ab9a3bc111c11eb8d0307d1ee6d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56e8db73c3432662e8f8ece6924d7e589
SHA1bbc0d282ab52982b6012bc75cb8fb7b4b4c7b946
SHA25680c81fd82e29cbd5ac4dece9d2dcfa9ae1f1f22da6108e47d35d1d43d317bfb1
SHA5129e926ef55199f329d4fa0a9e79c014849a593e04eec625e2cccc60e9017b79bb40d5e52f3a0530a6ef6108b04a25b8021cee3be06af6bcea32ef31e854b82f0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50874e9ec489a71e331815069c3887b23
SHA19e573871c9c4bdacace719dedacd493976154e58
SHA2566daebf804f92e32b4bb0ca08a9d77697ecca371c75b37606ff636821d8368474
SHA512fa5fec50a62d8ffa1a96c79c154b0d331c7f7554f832daeab7c3178c20b6e6d2160b65c44c63f3cca6b6138bd6c4c19198e152a2744a842cc7689987bce0ec46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a8de26b525dddf1074737f98e66b03ea
SHA1482708b5a63f0143d3ec3418f8bcdeda0565b275
SHA25636f354114bd9d7cf8f70cadf83d0e53970a476d0af6a1d1d75ac05aac3445e4a
SHA512e8215b865f8cb7a983464694bc5ccf05c75728bfa17393e6762700eb92720ace6bb170ae536d7d7889239998662dd52d0980851180891060818a958f70b90f63
-
C:\Users\Admin\AppData\Local\Temp\CabE91.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarF13.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a