Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:09
Static task
static1
Behavioral task
behavioral1
Sample
91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
-
Size
43KB
-
MD5
91e65cbc13b3750291fd890a1c3a91f0
-
SHA1
c0feea47b6e48a1e90e5f6e63491b0770147132e
-
SHA256
6d5b8b75dcea05b80172c24cdca0e254d7d7b668a8e21facbe0d9f538b0fd983
-
SHA512
75ab61a76dfb054578667959002e1a3485652c60211299b983ecdd7c16cc7a103e4a024bfeaf2df41dbb7b374fac1c4f9fc26b69840bed19b800c7ba72de5b2d
-
SSDEEP
768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslst3FOs/wOena:K+vt+0U+v5ikH/iOgOTFnYOv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582065" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94017881-21AA-11EF-B6D8-6A387CD8C53E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517d8525358aefddbfc32ebdc7e4ade7e
SHA1217f5e274495684270fcec274cfb2dbe9e1deb6d
SHA256cfce6f448422edfb27542efc1b7d78e5c483d2422696061e3fc0c7bb1ebee5ea
SHA5129cb0baac7112c85dee367c0ed552532896b3da707492d5cb217f4d3b14c6663ff67a4e2a083b1d5747a9c26c294c14570e14d7884804e8107ea694bcb163371e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f02f00074341178129ecdbdaf3d4fc3
SHA1c5a45bfc16e125869a68480d0a4a0da5c4ce16ab
SHA256f177225da8078272771b7d3a77b328ef105a977c617fefeb31618f1364cb22a9
SHA512261874ecfe938c362fd7ea8c164acdbe62c8230791703891f9d3195c01a9e5441d0e2d0b8901d02384a4c2fa863b1f3c5cbf85981b0bb627e92dc3f70d0e66f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4657228ed2b40035be235ac46f38c5f
SHA1941d80d2fd676ee17eeee5715e4070ca3a4766ff
SHA256fe1f9ae8b26f58fa6f50b82f88ad1fb8b3b2024c892f279566dcfa6ec800a996
SHA5125f6753c8aa3c90bc3267e35663847358a5ed696af4e666e0682ffe4590d0f7067f0077b9b89e2502b5ec636723ba1d6a2f4cab6f0971c15a1438c3ab45fb6d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52664302d898826ad76b105da518b5da9
SHA12532a939c951807f49cd80cec9767f2dad02ec1e
SHA25690cf59769bc0c5533a88a120229a9df4962733ae0469054a948ce69f8ed12eef
SHA512baf87ed87dfc239c398610f662260262b351130f295437664923b2beb3db1e2b98c087e85cd5f522cad7343bbdcc4f461a28f372ab83329a07911457e4f2ab03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f6e40b119b9a06c42db2d849886a401
SHA107d05c777d51e104a201c62cebf7ceacbaf2a4ba
SHA25676e681167d6a6bf8872d8753987c556fc1297587f06f5d16bc1c7d418d76e63e
SHA512725887654335bb773aa71be64eca7e5f16e4666cb831410905a35f04eed93f34ebaa92662a6846e9f0d8f19678b3026fd1d43949326b176672817410a252fed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c13013aaf95e9f60481f4ae4b2cee6f
SHA1b42d8ed3067c4e98df29ffcd7e78f872d0101447
SHA256b74a557f3ed3f1e445ee19f82143617e20a08966392f5296f5e891a414854ccc
SHA512699160660efedeb22cd8fadf983c9eb54c4bee5057ead16c40aa922f8de9e70c84a764fabc5b7ec9a741270a06753747372a10af7595b4e7ef84faebe05e3868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a17b4a43c4f92c76796f4238b118fe9
SHA141e2f7bee2ae968212d0f01f2a9b668b756822cd
SHA25617c6f50e96563b57e528f2342257ce033987ade94ca72aa23b1b99c90900dedf
SHA51244f810e333c11b830521d4a9c5ea3b512b5946c37933888cb03991806481ecf62345e32e37a03c4b99ef9839b4b9021aa213edd84c9e561bbe79481793eaa40c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5d8352a3b736634a393c282e765048d
SHA1d6f8a62ddf51349f90e73015782374965fcc011e
SHA256e4aec8b03f3d5903df6c6eb2b9e1540b223e609cf412505d05ff5002780dd70c
SHA5128daafb5a5e72e6521f8a8cbc1db557b71f390d3faf74aedd47c3376e7a1a420ae1968ecf7e6a81667e951420f32e12f3862ea0ab894807155713cbc782414667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d91e1f546bc3fd8d1c1f98eca3d92302
SHA17d6d8c6419945d312ffb3ba3ead729b34feefb5f
SHA256865c7cf1a1fada48efee6eb2c227832bca6add352f742ac129e346424c9e0d15
SHA5127fe4a6691a31ab777028b0fb57f89fd91a667d727bbb509116e5e183bd4312d52e4b7bf914adda99efb40e9c6a9b0800a3faad5655cd2cd0c0dac25f5125d05a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b