Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:06
Static task
static1
Behavioral task
behavioral1
Sample
91e3ccc6e2f9174adca98e38261de459_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
91e3ccc6e2f9174adca98e38261de459_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
91e3ccc6e2f9174adca98e38261de459_JaffaCakes118.html
-
Size
21KB
-
MD5
91e3ccc6e2f9174adca98e38261de459
-
SHA1
de38ed1372d664f43b6b7d777780509402cedd70
-
SHA256
65146d01abac46658ea600b1a625f6547363a8e6088d8213846e715383b31536
-
SHA512
e8fabc4a0a36481e8fa357b2283d8799087639bb04b8465e49043f3a70a7358b325efe46d1fef097e563990f81a6175bde358366bbf87feb97467e21ec804a5a
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI3tETPETJmtET8mtETgtETPETJmtET8mtETK:SIMd0I5nO9HpsvlkxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423581860" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{193FFEA1-21AA-11EF-8C71-D684AC6A5058} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2556 2208 iexplore.exe 28 PID 2208 wrote to memory of 2556 2208 iexplore.exe 28 PID 2208 wrote to memory of 2556 2208 iexplore.exe 28 PID 2208 wrote to memory of 2556 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91e3ccc6e2f9174adca98e38261de459_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fc2c57769a2b527b83208d56545e1a3
SHA1d75958beaa5f2ddca24dc28e8b806e3e402ab974
SHA25696bb5c62176c994e4d0ef79eef8f9942071e88cc3aff3ee7741371f999ce233c
SHA512693ec8466c6d614d3c126a1726c761c463895dcbdbfbb5c687753d0a58549177de00246a486f5bc28813848232068536371327efb9232b09c267b2e5ab4e4f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d409c22ac9d75e7bdf6aa0389dc026b9
SHA10d0d63ac9e593b5747c6e04ce0c69ff3c25c2d19
SHA256fc6a50650dfdc3ca6e5690ffea4a3d35bca6160eabf2fc2d2cbde17b8f9a8e51
SHA512449a19da559064414dbe7b37ab6443e876a56d74940576a1e78acaadf2d7f7cbd8d162778a37d428b094bcd4e672a6dfa1f7425e72e48ae76577f6043cef90a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5bc19bebb243234c6aceec2396bd82f
SHA1808b5dd42477c629f059add9f905537cfef71406
SHA256c2ed8612e23e97919164980abafe7bd18c25856f9dd0873f6f314c62a7adb7ee
SHA51292167d62c1c80b2ce12b241a0627a92de457bfddd5a1a8f5e05b46cc2e41744ba5604b085efd5cc4a33bf9335cc8bde87a5642964199f34321c31063306db961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5662c7d0f57f6c8c6de07ea6aec218308
SHA156e45e345ec42851dbc8eb0cd9df5422c23160fe
SHA25689ee60499468ce71fc29b80a4990951bf0eb467d0f469d3471a744ed17df4425
SHA5129c2525bd6f85dbb0813ec9790e39ecc9087cf3dd807ea01b92d46a0eab4fdaa8b034e282f1b3d3dc44f98810f0354fd3aa51730f0052ce590a7752fb6892513a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba04bfcbbc388e41766326d54fed6089
SHA17684a7c0ea950e9c777635149175da9076ccec12
SHA256b2e37504862aeb05c51808f6acb9144f748a29263090448f1f3242a5d5c8dac6
SHA512f3e21d026d849efe2e0c6265dd86abaef299f54fcca7fd476aa511277660720126a12222f46f8ddc6e531be93203b9c05ecb671448aa6bc041d9cc554150daa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a01393ca7f71d6081513cf03681f90d
SHA150f8ea5896677079aa1753acb022847bd2d76bc4
SHA256eb2ff6574634ddd36e89196904e65a59e1fea1fd4aad497184da1ac229835127
SHA5125e8a9eae761bf5cd06669bf724baf54c3c431ecf8e2e713e35a6ff84ca502b7c8981214048c91ac2b9d3af877930230192ec39d40bcc6892705ac9efea0043d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e93cc5a39c1711dc293b0c669e8159c
SHA1235470dcae191d4ee40cf782f3d92a5038c4310a
SHA2565624e1a3190c254f4b895de234c3d3e36039d25bf867b32b0d87ba5a382fc65d
SHA512e9a61098855db94fc7028246ccde59b20f802263ee79c8e336c4356289fcb5f644b7151f30924104da6eaf7587356a8b4c80624775c3d63088efc5a57d2c2f32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3019af9fde0807d24e0679099140fc3
SHA1e45aa565ee4c4585dfcfdaf7bf2d20d3eabc1e15
SHA2561ec23841f6d9faa24b861ac458047ff2644d9ce6a91f276b4aba4ad6bde8c94f
SHA51283e91588236cea71432d07354bdbb891c9dffc97f344bc10ebffde2537621918d447cdb15ae2c8ce89097021e873ceaa95db675436d8e1a143a550b55a338a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd88811919c436798e6c86fa30417a86
SHA1e66734854c818d7df3c83c26c7ec49b9cd52a555
SHA256ab8e122aad73c91e2b7a620c5efdc4bf2a96946fd38030d8053a756be2b151e2
SHA512808a3c322f34242b5a7065e19ef4c7f01a08dc03a5841024ef27e13ff6a9d4b904d5a08c1f863bf3d1d4934bded63bf0730b0d9d235b6713175231f4aee08a5b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b