Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html
-
Size
23KB
-
MD5
928cd9f47be407298d57eb5ffd768062
-
SHA1
88b08fb75f3c799762caf9d3a8b38425c89fd6fd
-
SHA256
c00e0a9ddf55ed4769592c02d58ac83c40fb52dc24ce6f7fcf3879c7effbd4fe
-
SHA512
65aaa57e9f2e22e433a16614aef8ce25eb1349c4d90dd2a6b92c74b1f152ce9e17ce420fc198933c49dd6300b8d48b33a6cfaea5280573e72f5350d492f1bedd
-
SSDEEP
192:uwvjb5nJCnQjxn5Q/8nQieXNnGnQOkEntMPunQTbnNnQtBXvvMB3qnYnQ7tnEYqH:/Q/yUdB
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423596363" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDB6DFD1-21CB-11EF-910D-CE7E212FECBD} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2000 2220 iexplore.exe 28 PID 2220 wrote to memory of 2000 2220 iexplore.exe 28 PID 2220 wrote to memory of 2000 2220 iexplore.exe 28 PID 2220 wrote to memory of 2000 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f0b486c1788708486da081fae3cfbea7
SHA147b6ab4f67aa377ba7d745a3ad98dd8b7181a7f6
SHA2560f9740052c32f0020771788bdde410ec56b4cafcd597feeb068aa6f2d90ddfad
SHA512d5980356304de713ce549ee16811cfa979a562f809d5931d5e29f872ab2d3bde0b2a1c2f7a3502c2f6a89ec5ca3005ebcdcb6e95da4bf8f768a7406b797cfd37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa63bf7b8bd52828da30f02938f9546d
SHA194d84008ca5693a89b91d73054d0d45fdb32e516
SHA256a2cf62eb44c42072d6941a181f32ccdfcc667057c3ca0b3ca07d4dd0a85d841c
SHA51275aff076e5f9fe2e2e239704165638dd57a32b11bac62dfc5d145c93323d620dc0eebd83d4a807b2f7eeea991fbb0e11f07082b858b3ec840ee5d5df28160d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578c563d64c757485d286675c82493d1c
SHA1ff1911094b54e9e8c1d0caa05aa7a391ecd6138b
SHA256f199cdabbadb2fce1f4790429489af56072aa5ee091bd710abcd0de5ab3308a2
SHA5120ef5ddbdb8dac733df507301f9862b52910146edf8a6522ce6d0d542e01f417f41c4194cdf7cd54e684485217ce6c33069a516096bf0850cdd48cc86572314dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59965a5ebd7adb55f19e19aa519861789
SHA1f12592e6d362a42c5bdde4e4954f2a916104986d
SHA2565b657340996aef0f81f195249bab4cb77ecf6ed59bddc489d422dec20aa20c4b
SHA512e924aebdbf861ee3e9e1ea6cf1a0c292473625001d9a1f453a1cb7e70895d15a22b1855b893d8edb09743d4949d2b2a3a1313f09bcc5cc437b2dd6a27eb5699b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50657cd58301bd5625434b759adaaab88
SHA1add003c3b1db1a720ccf92283717b46e93c62e36
SHA256a57d41e5072c00cc8d1b45f45196d3a0903da32faff638d92b5830edfc95ae17
SHA512ec6922035563dce65a04beace622e31d0a31feed6a77ce3f6b2e886ffb42bf13448e2113c07bf972d5a5b793ce135ee15f774346816fa98ece951eb482c798c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d301f57df41810f881acf63438aa6c1a
SHA1f8b73d66470c9df16f5fa5f82fb8881cb7ff3dbf
SHA256b991efd7cc2e85b87c9ef4d20724da5075454474437d0fa31ac0aababed3b86c
SHA512e114f5c0e41ceec4490b67bf197c2526b2e6e5ac8a90a4f82f464b430a2038815a825229233de798063aefff40b59fc8c5ce85a0877a6612933c1f4efea05715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e872370d530ab08befb698e6183daa6
SHA1472d41a9c6aa9ea449a22c8c7246d8d0704e1b3f
SHA256cd63a9bf246628d1a4f1b07e1a7a15fd13bcc9ce4933e164e8bb3149c35adb94
SHA512dd2eb8eacafe7df1e5e8fb93b196ef9fda335d531e40f5e25488cc41156787851c64eee9774f6b7de070f2f01fb5e97e278bf95d87df5f66dbc8d032715d26fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c646a02928098d99ead726e4bf022ad
SHA17f221dcf46c210fc69b01427e735bd6a69a2b15c
SHA256f214b6678ea9fddb3fd65ac84031fcc5a22fd67cd059fb2d858832329d2073a7
SHA5126c1285e3f98d1e33a55641c5390e4a0ed58928e19a5148f40d32647bf0247e1e93d3a73fb846e1d89a2b924060b56172f28cd9b51e29b1e2adbf11dca8061830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3976075668e880ed561f7ff7c11536b
SHA1d96b4d37a7b5662bde91020f43b5b876350a8d5a
SHA2562197d6565800f3c2755aa073847e5b5348a903f85cec684613830209cfcb86ac
SHA512469fd38694289e421cd876f002e0fc25eab84add2f52c0585039b6d9593dcc11ce5be453684d8aa864fb8660bc2c86b8523e2f37a843f66fab4114b2169df42f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a12b2fbd6d4e2e1494d8a214cc331658
SHA10b0913a8830a012b13584a756fd5bad7b691170e
SHA256ac64140f2663a0c232683354e632c776f1a05e82a947c19997ff2874df81ab23
SHA5123b5ddbf416e9f8533d36ca0a7c6f7c34fd012cc78664a90034fe06e1a272c0e3d793ae1119ab646ea073d966a8c08f1175007ce2f929d6d2b3a9c83a629a0690
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b