Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
8017b1074de197a152669c140efaeb90_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8017b1074de197a152669c140efaeb90_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8017b1074de197a152669c140efaeb90_JaffaCakes118.html
-
Size
24KB
-
MD5
8017b1074de197a152669c140efaeb90
-
SHA1
65d2475536ef91163e8a84affb68d09d4fe43f93
-
SHA256
0e65aef5e1ec45000b4014d259bbbcc482b4b6c843348f2cbb094ff067f02f51
-
SHA512
d04f76b4aa6e90656306a2e53563055bf2821e10a9bb17541e184ee839136c37a40d38f3661d897de561f5c1cdde6abc19146f644364f51773946669052bf1de
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj4dzUnjBhXJ82qDB8:SIMd0I5nvHtsvXixDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423132915" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0315CE1-1D94-11EF-9511-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1152 iexplore.exe 1152 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28 PID 1152 wrote to memory of 2252 1152 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8017b1074de197a152669c140efaeb90_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de309e7b084926866f468e88ab42357e
SHA1e98dbd1da37c0fee8b6b6a68fc81659adf84a26c
SHA2562f1a7b2631e94d111ca2e0406818b16f9852057e4cabae13ceb98e361514b198
SHA51298d28e5b0aacfca0c03ced8117882cecdf3b601a39e7a27268f684c33fccf6ffd8ca75475dbe888ca0ccd2ded99424eb1654b689d117c08870adf184e0407bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595bc99d3b1dc109328ff76403f2b45a6
SHA179fc149da874ceac5cc0d663a7d7ce658c256e92
SHA25619b0170e58b2d57a0a414303ab15b55ce564df08b6f83d558364ce880f0f2f03
SHA5127d4fd4d4b8bbda01962f65e2844e6d3e642399498a7cf4ce83555323538cedf6e521cd9a7281ec97aeaba56dcc64f32e4bbe031331b8ac58f280e560bc20811f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556390d50cd440914d07b0969301878ed
SHA126a47b3c357c7b47bd45465dfa4ffcbe66d8bfc4
SHA25604643dfc85b6f245caf70db7a5f758f3666846a3e498ef5b9ad067e819b2e611
SHA51246276818062544eba622a856ba1a7e78ed5ac8dd3c70b492695accf1fd02aee84d04f6652fe4678eb3bdb36288afc9daf6ffe68cce1f47b1cb0154115e66c559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5774fda9839f239f6c0cdabdc38670d5b
SHA1fa83dd67b26215e8ad977b31032c670f50af8947
SHA256a687add72b88549fd97531f7d78018ad6568cfdbf3137a1747d42fd8ed7e83b5
SHA51241762b0be569e987d5d8b66ad5aeb0df38297bad3949ef271105c31aafec20d120fe49600de015e99155537de98bcb04b2fb0bdfdadcc19a475a60cf0f49cad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568bb5d179c278469603bc567df81d064
SHA106b064f0c45fcbb9cd0f342e37a15e6df496c4fe
SHA25666681b75e9f230f843fa95cf2aa26782b61c4868fa1c89c15ae4216addc3f136
SHA51212d40f181a27342852241f0d17d22995ec78103152fdaf83eb356ee6d8b920b20928c0dc3df9e4713cea145e9c613c9790c4140bb9e3185c2b70ee8dd397e14a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6171221328e2664b158b9bc8e1760e1
SHA163e4d3b5c4c24c88eeb4ce3ac7eb72a74735ad0b
SHA2566f815b46131f85d7fc6da742729c6d47bd25ea2359bf89dfc05762cd4ebbbe67
SHA5126f8583bdbe070bfc6a927c7f44064dedea5b4b0747557a4e649c15534eba29808f3e65cee19178f31d12a0d2b88587623239f8648ceb50c6deb4b42eb1c91165
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8d9914728a9a8d805d937e624cb3ea9
SHA14d9350a1de09e796f37dddcd0c6306a70a1e35fb
SHA256bd738c5929bf7af5fba7c6145a17fa821870e7f2502360bb3ee298ed56e2eefb
SHA5128e7ab1558a85716976bfcc9558de129689f8b0734554bda119372f7e69c3f76cb7eb3536e78a2047c01c4b2108730ebb2c933974e9f322126370e22c4e7587fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3eb312cf51435185971bcbd36bd8275
SHA13f950e2ae099945fa072e3cc47513f211f0613aa
SHA25652876bcf656292572335f885064c8d0b693ea59c3191eb294c9c8a0e45504390
SHA51275fd9dd75aa17597e3c48a7fc7eccd8e1d01c3c9ba9293793973ccc255dad7b887e1b9e14faa47962fd24d10be5817e205792ca11d08ff6ccf0b343ec78028ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48d919e89bdc04df4aaad1ab84e2977
SHA1b1d9c7d32b159857082c3f8789508d7f96442645
SHA2560fc6fa697082aa44e8f9bea16673bd51cb02c4d5105287a7d1916bc51beaf764
SHA51233213cf1f9d5d8c769d7b1de4a0aa0313256062abea9ff204323d9b794507aa46365729a3eb8c96b526af5f8d0f12d94d8812a3b39f20f9f6e5463424d4604ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b