Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
9c5dd36f1718a931470ec4fd50811b03_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c5dd36f1718a931470ec4fd50811b03_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9c5dd36f1718a931470ec4fd50811b03_JaffaCakes118.html
-
Size
15KB
-
MD5
9c5dd36f1718a931470ec4fd50811b03
-
SHA1
b7c4db7303943b1ed42cec482634223bad6ef809
-
SHA256
46ae9c87a4dfe6be1964a617f919790223b7e2c77cb131a424210e2ff368e8e7
-
SHA512
825832aac4d979089c703ac646ec02fc9abd67d9db75b61eaf6bbd4b9697f8f0492e559e99c946b38f9f4d67fb1f46beca6acd59df1fb6b94439be302cfe6fd5
-
SSDEEP
192:6/oKyBEGSliZRjI5YmsabNnhXiNXL4yGYo1J+w7OAkq:unyWBeRcfb1kNNCkw7p
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD2C0051-2784-11EF-B804-569FD5A164C1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e090b3a291bbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ef2c9bf77bdaf541a490feac4f02c5f20000000002000000000010660000000100002000000022dd84fbe1341669f891272b31813971b0e4f19cce696eeebb0c41be5c2d34c9000000000e800000000200002000000018f339af1c7bc1cbb0d9a98c4382271e0a3ff9d53244fa24f257f0e802a64c3320000000f3721f292bfb1c9d37b3f1ee834fd1e870cceada0deba4b8942431f2fab99dcc4000000065bfed8852b50f9b5e0fc1ac64c1e73cf0dc6abd2b9396680d8acaa46087aa01e7e73e523c058d717ed8c4834a7ed69d941b50960fd52bbd9dbf8d8ea66614ae iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424225549" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ef2c9bf77bdaf541a490feac4f02c5f200000000020000000000106600000001000020000000a610ffa145a947cce41ea7eee312f9266a18092510abe9426b5cc2fe6213c274000000000e80000000020000200000007afea82bc96d032ddbad607dce7b763c3e355b97ee0006b4e5ca9e8cc089b7a0900000005f093385b723ec6545288bf6e7dd22ef1f9d58976aa65671ef7b4b31669dbd4a19bd53276d1fc2ac2c4f3a6aa77b04e3a48469b0087b4cf7317f245c2f645a8bb5c9e230473347be15bafa71ebbc7d068799b173ebc89e9e21ec22578d8134e105167caa066ee39599120ca58d619a4ae0fd85ca5b412ba7cc5217b724dd1a5455907e73de1fb07a18379a26cf50213c40000000da1fa2f3641255a91d7bc4446df42fa01d97ad4cac5cf92232b9bcbb6547a6bdce6cbfc0f53f8cc4d484ac4fa4c4a035532e733bd3afc8989582cd3651c4d048 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2136 2972 iexplore.exe 28 PID 2972 wrote to memory of 2136 2972 iexplore.exe 28 PID 2972 wrote to memory of 2136 2972 iexplore.exe 28 PID 2972 wrote to memory of 2136 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c5dd36f1718a931470ec4fd50811b03_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB
Filesize512B
MD577b562a2a470f4777424af84f37d68ce
SHA1485952633bb1c11dd34d1a53ab8c29faa136b2ac
SHA2565336577edc925b16d595365fcd9a55ef1df7aa75113960d21e62d77a96be73ef
SHA512c13a580e063f24452611530522d251b2f0cb77babf13179733bffac66dc6068cf26cebd507391a135a5d169a5492f8ffb3910da9f68fe9dbae4ff49677d1fdc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51c403243f0e633cc418262cc819edeba
SHA1e252c9625a01f82e8346bd86217f80b9e47e2f91
SHA25644ad1ce312b64bb47941ab03db51a7b2eee2dd4db0405b1dcee8871bd4a250ca
SHA512d353ae0f69fd5e468041a5c6f06dd523c6b3d08760a78b354ca12fe4ecb6c4a976588c92d880102c4371eab04a9dcdf417f2602fe51d3665334c9d6faaf54a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7a5df52dbec65febf4a748016d519e
SHA1fd1f92ba2ea874c1e9819c121d1ab0f62ac4d193
SHA2562bdb254dbed0aa5902b3c3452a5ce06b70487ddb15006477d1c00302430fffee
SHA51286e7bad601b045e1bcdbc82a439708f991a4217d7c6858d476c5ab0a4f473ebaf75dd08545aee89e7349151fd2734aeae40e18db79a0a3ea6cd8052f3fa9d7ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b55bb2ec7e6dbd7b34270a5d9df5d9f2
SHA1f7181468b0108f32260afbda884aa378614298e4
SHA256f649cbe59b14bf9f776cc1c1f64bff9dd5594da3480fa6b26d0a8a005c79b64f
SHA512c2b2022a6dedfc9585b60de732e30617156b1b9555063dce14dea0e54cee793c0754fbaaacbd8a3c3b27bd5d336dcd6eb4573ff75cf3326af7a813105fe7146c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff11b7b82d30fe5626aa8f3706f660b5
SHA19758ff3675a0b829f23188bfbeb8ddf7ec7c6338
SHA2568d054930275cf148c69bb74186f21f0d2e9d6853041f3b8a75649d2794cc441f
SHA51228e08cc0f6d7d19f17599578d263e6eb4d88d007ff1a927b565a1f939503e7c8cf1c6db278f7b0a2bce6bdc02b3cc4ce0af274b1c82275de0908d4b4305464bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f7dcc3754b3efcdf7b531e00da0b18
SHA16fcf0481e6c8049530f2cecbf95a1ede065db832
SHA256c0598109d7076b032b36790e56afefd4d50e7d79e249d3be0ce54934b73658e4
SHA512b99aa3aebb67411b0dc7a420a03257ee6bcc9fc26f77f1e8338548c6911908c7eca74524f4bd0df04a8ac324e6ab16e47d5e0987b34f33d6edc39b21f653ddd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD574b54ba51bbeeb1986e8beafdc5d7c80
SHA172933178fa3901b1fc5077abfd8d908b168ba6cf
SHA25672554c8ed03dfc3731fc03cb9d21551e338845293a06220ea861ad0898fbbb0d
SHA512876d6af5ca80f20c8ce43d97c6f962ff0bb927a687fdea90ebd9a390221607cf12a70eb6a0e4928645757a02a256e2eb71f2b004570e520eb6505908251cf18d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b