Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
8051e586e834104a1d1e4eb0c007a1be_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8051e586e834104a1d1e4eb0c007a1be_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8051e586e834104a1d1e4eb0c007a1be_JaffaCakes118.html
-
Size
39KB
-
MD5
8051e586e834104a1d1e4eb0c007a1be
-
SHA1
7a22c4a160aebb53d1e1b1246fde74e868cbdf8d
-
SHA256
a64378562efa2b4a8f18202bfd243dfa7c1794ab492989ad6ac7aef09afede51
-
SHA512
2c5a62ddd2d2405a6347215ed5fef9c5edca8cd1d6fcd9613076e1aaf4294bf3212c3bab3d2054e0053460f99d5cd11505c31c7f3aef2ca2233d2f934b4ae6ba
-
SSDEEP
192:uwHob5nd+nQjxn5Q/xnQieMNn28dnQOkEntbDnQTbnRnQmSWx2VAsYhbNX9iSIcP:GQ/w8WdxCcb2eJJ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0AAA7A1-1DA0-11EF-8004-DAAF2542C58D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423138094" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2288 iexplore.exe 2288 iexplore.exe 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28 PID 2288 wrote to memory of 2260 2288 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8051e586e834104a1d1e4eb0c007a1be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baa00354e270c1d6f0f3df0addc8cbe3
SHA115f720f17627c8e1fa3545a989702c7004610dde
SHA256d72e7ddb5a54756afad7ddc3a9ab00b1add930b278ce2d27e19f6ba301bfcb3a
SHA5127c5620e7a3a5d9f7b422998274c0c6b6fc96c9683f24964845c2270cc32f447fd5a235b326c0f5695e386899707bc8d3c39d5d1eb5f43c915413ca5dbbf0135a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c19e8698f7884bc26580f637c6f98d3d
SHA10e7257b2355df03dca739d61e8d4851b5b4d21f2
SHA2565627e52073f69bc5cd5ec50ebaf052d56bafb5491cb52ca1cebc591ccc73d78a
SHA512e5f119882ac68e8edf060ce1260b4c0b755ef315d1643b12c67881df5b12d13826e749e8f057dac2abac404f731e62d41a82c3c420447571b95123ca2304f365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e57c3d5ea50b3a3962aba5a112f85d9a
SHA1be8fc2ca86ca0c1b4a108a8998c96a11efe0921c
SHA2565fac9a26bda7a6bf70ac9c13fc942afa0719c2de2648b69b828b2fdc97a16cef
SHA512d9fce732691079338eec07968013bf7dc1bd03c1ba76b74733454513c1a2c06af1b3b0b424c3ce982e65d1ec16a8a9becca51316f8a0052aea1236c37bf6e727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ba78ed87ea2ae54fd65f054b93aef2f
SHA1f44715f81047e22f2a2dcc59f056ad1fc15f8bcd
SHA256f9f1d5c9c9502cccfa7bd8e72a32408e2eb34a96c13a61a676630f6f72240ff7
SHA512db3ee988c177a7d8cf04d536c3d3942d0053cc7c557934ffa3c08c87cb71180ef0363c2800e5a5e2b305fa248e264e00d998c6c4273eaeab9839d59c5e9e42a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c52f4e38f2038159dffdacd31f7667c
SHA1dc282d2be969928b5558273f7da66a92212c3388
SHA256e5c0edcb9a9b904bfe9db1d3ac77b9633a7ad551a339d0554e807c478b3a0e6b
SHA512046e5f5af1dc60623d68882ebc07096d91adee736212a26e206b617f543e99547bc9c585ec42fa93a91992eee67214a0cd9550027ed615a86c2869924678a1b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56943ea811edaab791b3e7fa41a8d7530
SHA1df01ab79f728c9b24a92d465ad2b98234c7ca25f
SHA2568b6cc01dbe107b15a4b277144ebf938fcfd5ff12f2ccf640ed64301d42d8b9a4
SHA512599a4427a49892ec531850df68616d89f318c3d4e502f51e091061fdaf34c94871784c8fa0190fe26e9d1ef94972893950cc5c2fbed762169ddc7b787d055fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c2abdf08188d2f55a4c267a4e9bfd07
SHA1b613209ca611400abfd9d2a4dac171b1fe9e7b92
SHA25618dd2fe7b57a27f8b323b2429f97de5324797c977b3039efc36852f72caf3e19
SHA512bd2b03508e85e3c268e7d349ff9b7634144db72a02ec47a8cd3c148db5a6a34f8496a8445680bb16d11e8d813a0c5a470e5942573690f4b5ba50c6a7e0818549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3c1e25ab4a9938debb143e396384491
SHA1869764faf0a4e4a077165db6a5a9d8b267056c49
SHA25668f993168ff6273676edc30caea0e9f2686c1023460225b18e303f4a8b48da37
SHA51253b8ced723b2b5142bbb80ae4bf605ee73cbb4291db6681048e2e7eae95470ae3607cc81fafb16674380cf6f3eda73fde85440c2096ca879717bd3c11e70e6ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edb202c751303072cc9c97290c69c2e6
SHA1d5149fbaa2416f06f8ce52e14d5d71f702b984b6
SHA25673cfbd01d6ad8d0f9af9fb66c2c467f84e06d38d7bee62ca689723d931520fd6
SHA512ca428a000f8e6a672ac2a19dd6c40e578de91329b51c9e8750b5578d6977bcfd1ecb48f9ee88f7446ed48e00745bcae97653f8d84a1c60be0633eabc47f7388d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5502c6e1f86f083e526608f321f59cc2b
SHA196411ab621ebab099b148d311792fd243f9e30b4
SHA2565cbd05fb1296883b7b6f616e7da8f01ed4e6b05ba854d14c5c5d1adef1f169e9
SHA5120df0f0b4b068c9eebf869c4ea328805120d3281168273c4fc0db6624c42b0d8078d4a2a0d26fced5577d2625edac34d3a6540f4760f337ad01914ac7fbc65d4b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b