Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html
-
Size
35KB
-
MD5
712d3fa62a18c3633bbc15d885f2ee2c
-
SHA1
5fe6ea849a65c9a5cc1daf188e9f2239bf58e08f
-
SHA256
bc5d63ee4461a94cabbdb93dbe2df09e411a558e433a3e9f4ea492152e26b5ce
-
SHA512
6f8b7e8b8d8cd68ad2c9b8afe69315c74627f38850cf008336d095339f2db3be704cd63b5ecd61686bb473705340f4faa1068760450d8f25fcd832cd8c1bea95
-
SSDEEP
384:+YdrTOSDW7rfmFMMYf+XxFaFzFGyr8cu5av0/eEfsMU0obQOcMXYbClbMUmMCi30:BcfmFMMDXk4SpB02vb9uUPa0C
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55AA5F01-1A63-11EF-BAEF-F2F7F00EEB0D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781808" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2748 1868 iexplore.exe 28 PID 1868 wrote to memory of 2748 1868 iexplore.exe 28 PID 1868 wrote to memory of 2748 1868 iexplore.exe 28 PID 1868 wrote to memory of 2748 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e63b386edd4e05f4f6fec2529b3b8f6
SHA1f3ca7cf29e4bb1fd5e506347e6ba1d548c8ae708
SHA256351b5fdb29076f24a98f84ab001458167449bafda7c9fe2f725ec4adefd2bb06
SHA512983650fcdd4c4d9e8f532d8f891795b8a443b06a837cb54b575a169248709f1b3014f704244d92e677818c48894afcf6ad1dcd4bc5f20a8f3f9048695f238250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dec263407f4c4c48897a221cfb48867
SHA1bc37d4f2f65983b6fe1df1b0228f36e25dcaa94f
SHA256dc5bc1b74c866f77dd3209c99bd8ec355e5ee8b45def4ecf03fe9f246f13528b
SHA5124a073329a74e6fe509c6381d5d624cde94ac1449ca9f070931c69c25b682902855ea35fef8bfca73f6f5df626f5665feb4d638c6c50563f595bd698e36bd6007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5730b1e6934b5f343f82869a7f14e99c3
SHA19e19d77328aeb0a72f1fcd74e5a51e4ba8f62cf9
SHA2562bd8c15e9c215359cc32b19912d25aad2ea4e0968bbd1c82b441e93f1945d714
SHA5120d9a269425b3e47c568b5b4cdea1d5c7ecb910a48570b7262c992ffd9bfb33f7c4e0dd3e371f6b92ff2328b5f0e21a401cb8fffd4cc1f63215f63c9a52e079bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3d099b9525e9c2f4bbda199b3e11292
SHA16e2d9af91fc182bb4b3d01f39023cf171eb0a829
SHA256fe951894939b9b95cfa9eebd4448cf84d37b822701222b6da2252cd76df12855
SHA5129153f52c0674e286d8ee237da4b5cbf08235cf3800a2c184da1ab8003ecb3edcc50ed10dd212ba309e895bb488e8a86580507deb8fe386e20bd44d9a730b9b96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb462924a699af15c8ca07f1945e7c6e
SHA1337c856e027cff10add0816bad7f56339818f409
SHA256b506873831be01960be21aa426c9843b56dd7e22264a40039fd9b0a4c2f92650
SHA512ab9b522ef0807baebfd6e278aa45f99f179ab7e0a01015afeb3a02ffa45ca1914a1ad006e62c4a8584924e832b4f312f2621954d6d15a4282a0a0fcf904e19b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7996dd38a71f21a8377e03f441eda2a
SHA15eda7324848b986069010fa84d6129584cb1d054
SHA256f20c9ac59577434fdfb7e8df80d2a36e9fc6b3ab121076520fdaf05332ad7297
SHA512c9e20f0c329421f8f4573d54169ba3177d30d04c27abc2d963ebaf202c08b29cccd16e04f87db6c9b84169c7942946ba0bf03b4218e195f2817cb01e7da5542f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569b4b7091d2b7dd413235746291522e9
SHA18835d4bfe85679f3d8be92f82d871541563c3063
SHA2560703e1eeeb1405c5288af1b15b71dbed74b177129b6bafbc548829974da830de
SHA512d66dd329ec73e0e4ae03882e3893476999f7e8d0180f82edb0973f1ccda09ed2658f129709cda054f16551bac8131d7f06049bcbadedd4a424104ecf9108d09e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8cae616772c3b18a6cecd38451d8f6f
SHA19806e8a62fc968c6607f93121a1d23ec855aac30
SHA256a5cd852ae3bf3428c3e1b1ddbe416555c3d71b39d19f39b43c651b6bc00e4718
SHA512d4fb6a52e82a94d3bab256f813b0832ac9bd45aac8d60348106d8e1814b5e8cba6de838c56a63ae39ec23eac1d5984f21d762b8d1618258a262d1f65e62c2337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f285b9a0ede31c893569ef222c00837
SHA1c4141caf5ecde8957adce22a41c107a681fa612f
SHA25611feaa0e5c8a422d22cb3a8fc420711923d47a639d513ae3afd83ca63186430f
SHA5127862616db832c17a8a6bca6230ae30d36955466de65785db754d9afe218f5f65df634b7e8a9e2e7f96fb8fc033d42b808d6468ec50f49b9c7eddedadec415118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b7849a25b0676775d93ef4c5f8c6138
SHA15b002ca1e6d6134cdbb614a4db7cdae049780a61
SHA256ab9a31d9a91b974c49043b3f722828dddc0eab2bd9a1ab3b274ba7fb9812f5a5
SHA5127736284f08fd1b69ad7ed7a7961043a8d26d303f3c3354b48cdabe18cf9348e05d7385670a867e7c19da4a6aacc316425d29047fd570b8d1c5fc246c4e2858fa
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a