Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:45
Static task
static1
Behavioral task
behavioral1
Sample
692ff0cd9634ab7f1fa46e7684c02cb5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
692ff0cd9634ab7f1fa46e7684c02cb5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
692ff0cd9634ab7f1fa46e7684c02cb5_JaffaCakes118.html
-
Size
20KB
-
MD5
692ff0cd9634ab7f1fa46e7684c02cb5
-
SHA1
1d0dee410c4c4d972c3b41d73095742033ca9c4c
-
SHA256
602f04bfc7786e07525be4a3a747c6ea8066793c14f4754ee19390cb4932891c
-
SHA512
fcbfa8704fe4249394dae621d99e709f71c4900b7e8cb2d44eb413236392313072f0fef34af5144a99abea9fa5c97f686566ed0669dc87680e5dc8ade6f34cba
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIU4UzUnjBhg682qDB8:SIMd0I5nvHpsvg5xDB8
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6092191-189D-11EF-8C89-6200E4292AD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587005" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2232 iexplore.exe 2232 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE PID 2232 wrote to memory of 2696 2232 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\692ff0cd9634ab7f1fa46e7684c02cb5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5567190f220080c7350ba31bece7321bf
SHA140e2a3cc25569ebde81b7ea423770aeca0e59f95
SHA2563c646c035acdbcd8651fd516fedbbddc7179cfb9e1f7d682d4b10e7db6ee2478
SHA51246f4f6bf9f18f564b68e47862b67febae7987774fa712eef7d98b748c8140c4673b0671aa7fcc13c8b1b1af89f386c38ae195d8c0c7ed2948152abfd9fbfa1ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD560a7ff62b3439374234dd8ed001b1ea5
SHA184d996fa3663b19673f354add81c8d11d1d94e66
SHA2568cc7b51119ef774598ed032cd23beb58dcdba7ca1d644e302415f2ca67b08cb4
SHA512c8581a579782496dcecb820cee1eb949351b002ea90eaebc20942faca4fd9d92f1f98797751e39170e69649cebb654c018713cd0c92a3e4f142452750b72ba25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50dbcf4823e959076f6fa3aef01d2f597
SHA13cd96cd3ed1f884d001b633219047df6a8da74a4
SHA256a1d9266759442ec0547bb188cdf954a3ef217583a3109c32feb7e0c6cf516308
SHA512d3e31dfb4fb7baea0a5258ac9e4332b379e3494a4cb7d626faa246b33b3c5c1603179bcc86a5af92cc73035537b63202f9a16c924e179d2c58b89490763d8572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD524e816a9b208d8219d84c3533aaa76d2
SHA1e027fc34ac913b8eb1d3deca3ed0d170c4f8ecb0
SHA256d3ed2051a12c78e3256eb00af75888d2b0aaf5bb571af9151b90ba4de86f99f6
SHA5124cf4f53e807bf7a37401f57dd11bcff333b0100d32cc18cffb2d68f75907ed68530505bd696712ba566ec0b8a3618e112986c420b7c607335d423f6dbdec8452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD571174fbbe63c084ea92c1dd9591666f7
SHA1678cdf6efb8b26f712c5e9270c82533014e63ec6
SHA2560fbaa9adbaec9b3ab43bbfbf08a567d5afc3d32f0ca27077439d1bbaa6fc7b67
SHA512e240d18e60b78466201cc6c67d9af69d8f22f57ee4ed0338abae7a525d9601713863e8bc20b69d942f729b9615430e9b7878695a1c511aaabc50a7d53ca9c284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5733c1a1fc532e124f6050d030bbfb503
SHA145a27550cd36073c2ff52b68d2a6b255faa80c99
SHA256221f11e1bec5280cfe154702e0cf8c8e557b703b23ec5cd579de353774dd77d5
SHA512f9321095727d08a66908fa5dd596d0dfc55f8e34e14a3f2c41f54b2deebc06df7647fc96fe837e06a6cc6fef2ed32ed444e2dca0782bc3bbab2c0a802f4d7948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53df5b16bdf11836e1957cf76089d0e13
SHA1d73c086e7ff34537af49ba6e7b1f011f13811053
SHA25697c0125aab4c8f217bfe5890a39660469838c87948612c189ebe366c7f9e9399
SHA512d14a98458f5c91cc656e31cc0e9d923f3d5e36884c9f37bb0e2d98fe040f9448f2cb73413d8efa2fa5ef9957dcc1b814d6487090d977965b3a97cc1226fa5896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56348b538832b6e62026a7d3de68e7d2d
SHA172220588f22d962330e9025db8b3457afeeee9cf
SHA256d3f757227a1c5c63fa0a56ccedb2f96dd0e74b9cba4688da9e72d51de091a01c
SHA512463ec41ec13f6e2d42c94ed24dba004ec2ce873a0468f8329ee927beffc1d7a817a045887005710c19b41a112babbaeedb32b399666593367aa36a58f9a5c0c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54ef7f1f6c2bc30d03cfaacdeb61f4e08
SHA18ba5d25d92e62d0057dae42c06345089844c31be
SHA256d098ac635f8a58d4fa05e3b52278b7d7fca7cd6c8dcbfedc9a7b1bd96d941485
SHA5121793cfa89c6ed89a3ae92c2fec543921de6cd90a1146727fb23417e566fc304e3a6f0a57d6e07ac30349a83f58ba40db09c460713d943d68f817f18c519a19de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ae0e4c371c70ddb2dc11bc0afa3841f1
SHA1390b66a887ba45d8ab3ae3de56a4c725f536826c
SHA2567db7b1369939d4c775c6507fe96a14d077136ffba8613a336cca6c6c70f680b4
SHA51268877158175f38d1d8ab4a519a6dfe14968a001a0f8a738abc9afd3b695517e6644d52aadc00ae2dc2297ed1100936948cde1d2576086fb5fbd04a91781d66b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56e94addf8a17d94a8bdd030a760be81f
SHA1f956069927c9fedce8b257cd181e5e85b1ca2c53
SHA256a79d71624df3312d4078791e92f6c830aaf7f387a6f99281de48b35fab4f96d7
SHA5127f5adf2565a31d31cefbc6c940419d8f2ea365b39aebdbf6167f59de1ee0b778061a65c6373acdd9de3ef976a6697ab368aa5c2eb5c08c3e2661820ca67317ae
-
C:\Users\Admin\AppData\Local\Temp\Cab230C.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar235E.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a