Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
8786d8b32eecc82f5b9e7e9017d492aa_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8786d8b32eecc82f5b9e7e9017d492aa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8786d8b32eecc82f5b9e7e9017d492aa_JaffaCakes118.html
-
Size
30KB
-
MD5
8786d8b32eecc82f5b9e7e9017d492aa
-
SHA1
928021c32e8030e752285c3a22cd1170217555ef
-
SHA256
aac304b8239cb986566e71f857ddd4a7b13480108818391715d7a74e29044e1d
-
SHA512
247322f2a2787a7c380c7222898a228e2ff5569efc148fde12d18178778b2aa6a3210aec4cb7550353f3316e68c44701c3f8d0090e9d8413fb23d37f17bc2940
-
SSDEEP
384:SNd/mscacHcicTc6c+fSrHx84JNliFz907CnUK2yPk2dU7+2U:Sjpmr0xSrO4JniV9NUK27Z7i
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6406DC1-1F64-11EF-85B1-6A83D32C515E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423332210" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2044 iexplore.exe 2044 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2504 2044 iexplore.exe 28 PID 2044 wrote to memory of 2504 2044 iexplore.exe 28 PID 2044 wrote to memory of 2504 2044 iexplore.exe 28 PID 2044 wrote to memory of 2504 2044 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8786d8b32eecc82f5b9e7e9017d492aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c115d08b3745a962e3e1437e6dcc0f9
SHA1917cb7d0f801f68f44eb2ab08709d49df39ff9d0
SHA2560c329ab0b448645ddad43ca6741a9ea188a2e07a0d0750972b844a4c5de7a8f7
SHA512d72f559df860dd51d978da9a92d40c69fcada6944c717fca44926a9438b5704ce17b1f597dfdc38db2457a68c8d04c5e1c86042a9f5cc0b469c21761b9e9d825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541317a02d843d931def812686111b37f
SHA16bb37b9f13d5d8f5b17575da3f61b33a2832f0cb
SHA256db454ff02316aa9725d0ce0ddf5880696205deb376b7e933af0f1163cc625438
SHA512e7621322abfe300fb0680daaf1f603962e97af1bf0d132f3b19ce2fb972444abe586eff6956dd9eff95e69e029461792916a061c17df748417d91af34a8d0ed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589a4b513863a3db2ec8999622093bec0
SHA19e50dc3ae2e490da206cb669e71e3ef47d5ed0dd
SHA25610c6fb3ef0aea9333136e863949e8ade68c9d950cb2539a384f10d897e16bdaa
SHA512750e98a88b95129c66fd1e62375d9848843113a42fccc07abc0e83ddb9fb8ef18986e1d1006dadc46a0dd2a87690107f241913761ccb6d8e7b3d8fc7ecf54412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566848a9a632484a5831c432d49d07199
SHA1226b232baf360268bb650fca11b7c62915b99000
SHA2566da8291e5c5caa448768adfd0970bae763a3dc716f16d1ded779f82ca63ef30f
SHA5128a7c65ef5e174ebacf54aaa8e1b7593aa32fa1d7544a5cca4973acc3371a2fabe69d0c342e8ec34f3a25e09b062a9fcffffe3d379c7e14dc7285058fcaed6b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b96a9033c5f3b32d6555b71ace7373dc
SHA1bbc245c944013d8c539ae61f484709f6606d6c16
SHA2567068d1f4e5d8251bf6686266bbf0ad0241fa594db4765bbc98bddb54e1269148
SHA512ab50dbdb985ef20d008971b3efc8dd2dc794a24458621a29fab07cd8fa36d09cd85c2f2fc441ea1ce0e0a8c125c5b0c20735f9846d02d3f2801580505c842a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5588c4bd6a42e54b0cff27004159f3125
SHA1f2b323474b547f8c5495635f4c52af314a4b3edf
SHA256ece0b877f7d6ac5a4bdb2cf5d6ea2c59d3b986f96879d88dab88c3a664efbc42
SHA512e14761845f67879cf9532ca099cd15dd3f83630a3c67e9341c3fc2f9b293e250a93f04b4b531208ffeeddc7905a6a92feae7f3c81616a1d52c1627a8fd6facc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b8c435129f64993b61e3fb28c7643b2
SHA1c82f45bc4b9862f842d9e773c2d670ecc52aaa76
SHA256734d14e8151b1c0eeef6f3c775c1bd5e2e068450e59eb2b0c78c15f05b823329
SHA512ca707d81bac68d12af4ce58449245a283d9eb8acb2cced25fb780fe0e136349958b9a1f2cdef1892e2035ced96a7a353a673dd18fa5c76936cd3a4d356aa6cfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eacd6c677426c9542f2d4de1db922313
SHA10a9f52afd857fd07d14985805ab3a50b05ac0080
SHA256cc78e46e3e0828ce74dcdec38970a71ef594c19dccdadfd858d76c91c7a8ca62
SHA512543e7a4101e53909fcffce059a15ec323d33fd1182d69ff3f3bc1e749e43866217194977f11dad585555f518a1d9513bbe23e48921cebc3511d29a62e55eb2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563158e629172a7538efca4a795b73fa5
SHA18760cd033557c10152ea5b34bef93b4873470a83
SHA256058fe5a7218e0c0d0597eb38aff7596be737cc419297205f74c28ba19e2a30ff
SHA512147fc2b2cdcb42d6f610249a39fdf322d071d5af7c7a634c6093ef4635a1c0b2d9df40a3bedeafd39c4423704f35f73d633106809c6ef63415be0be8f3ce7bcc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b