Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
8fc26505376eb91f1028ac60cccc0fd5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8fc26505376eb91f1028ac60cccc0fd5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8fc26505376eb91f1028ac60cccc0fd5_JaffaCakes118.html
-
Size
30KB
-
MD5
8fc26505376eb91f1028ac60cccc0fd5
-
SHA1
413d07acd71cc51c71881832c3abc44755b3b6f5
-
SHA256
ec622f24bab8549dcbed0df6cc5f45a38cbed1a6725eefb14e48cb9182fb01b6
-
SHA512
c85c689d7ef49590e718727950b2e96f4ee100d5d38c1f8ee1e6e507d60e7b92efd1ad414aec1c31b9e42a02c8803c9e2469e42b1a59f8a877aafb4eee433fbb
-
SSDEEP
384:SIZVtq9J69n9OATSKZpi5aOlb9LzCje8Mk1iM9M/dRBG9OPk:Sstq9J69n9OFKZp29L2MqlM/dmOPk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F8F08E1-2135-11EF-A30C-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423531700" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2552 1728 iexplore.exe 28 PID 1728 wrote to memory of 2552 1728 iexplore.exe 28 PID 1728 wrote to memory of 2552 1728 iexplore.exe 28 PID 1728 wrote to memory of 2552 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fc26505376eb91f1028ac60cccc0fd5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540ca9aa5dbec6828446baf467b9ffb6d
SHA16013cefc3de2200f9f852d96c52661b39abac162
SHA256027984dda4fa66592cc86c23a2f5aab019187079f6f95316875c8f14e8837cf5
SHA512e8ea84181c5b4c0a0d48184e898f2f09e489fb374b9883d5a8d205c874c5785baca438d6f66170deb3c8224049c3ababe4a110640d37c81984cbe7dce29d443c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be4c83a5d6165b8d8d54db7a4bcc688a
SHA197cbe276b09b1d1e8267ac5aa6b7daffcf66c35e
SHA256e39f84b93ab6204746f50e491091402f559c966301eb9ac6d3704457cf2715cf
SHA51210ad6b93e81bdeaae5b86bbf7425e2a0a0431b69dc158754003ed54b0afd43e6b8c880798ea57734cb73396d958a9102094f529db773151797dea1a410178d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cf97add4806f2874320bd4f7349ef76
SHA15abc083c2a8cf513c57f29895cc57953549dc5b9
SHA2561bc9af0ae3c057dcc163dc51ce2508badcfb286907e6d21d2a9a10d636007786
SHA5123ea047e51221cd943abe36108ef137db28bcc9cb88d70637572359321a8d0f63eaddac38e422dda80b35d44e8a1765805160c1e9acdb9fbda30230b8cf8ce1f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d5b09e3e12f7efa7a0eeeb258b1270f
SHA1344c759f849d5f3ac1f515f0a1bd453ffae1dcd1
SHA2562686c2ccf730d66e29344939c78442f40f7712e0d74d6e7931d6f83c9e2db026
SHA512ccbc5ed678e954007ba22fc3a68c3c5b4893ad182a141eb3b94365e06b8810dc7d0946b1016d4bc9819256fb6adcd332ab472399e9df1a0acfa7900fddbc6871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c10fdf2b30c3b6e0a2c6788e0b641710
SHA1f94e681d0e4d60813e37c9640b88473008646e04
SHA256bbce3133a35d6f0eefe56267a420ffaab525ac20586b548db23546ed8520148a
SHA512f2cad450e677a84b5b21e2404b6216e278b63e31184e99597b9d183908553f7a39a0b253f9eb18b69dca311f1cd730e56fa0cebabc071d1bbac6d30fee09574e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595d37d9fda02da3de379e048aa117ebb
SHA13ca4ba38abfeec76093dfb2a5d702e815748e7d8
SHA256d92a115b465740c22091ed96bfeeb7b07b4ab76ea3d48ab10e27ce52f83baf97
SHA51236b5c6a59f107252b20a93e3d9737266d9c0090df5f6be6b761b42eae7a0fe645f0da26a047a67f83f9362b8131cd5b7a35d1adb96d198d06e96809edf620ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567c17159add1e21fb1e5dc69a68d8c8c
SHA1b00b0d4ccdfc44fc932543d3caeae659cd2cecee
SHA256c485c9325745ea5d57b9635e59f2a0a18b81bc8121fd3a1b8ea2429467fa18cc
SHA512f34ba7f87cdeb0ba82cfd4bc542141d723f05a85b2adcb91baaf48280a7f13e680d01645188de137a2b8db5a475306d1738d10169f6ec110e90aef78cdd602de
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b