Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
9d1edd41c90ffea4cf6ae0fcd97f2c32_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d1edd41c90ffea4cf6ae0fcd97f2c32_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9d1edd41c90ffea4cf6ae0fcd97f2c32_JaffaCakes118.html
-
Size
34KB
-
MD5
9d1edd41c90ffea4cf6ae0fcd97f2c32
-
SHA1
397f317bcc13113889bf3d095f2d3bd870827bd2
-
SHA256
d61ed7ca8dae7fb5907c384882552fbfd2a38a2d539fba4c44057b0faf831d36
-
SHA512
4dd75d815c5cb7b2696e07c6c0919ccbc9053c4a8f4792530e089be6474b3dc9e0d337129800ae0d1e78ef0af9a25e26db1ff84ed7590b454526f2f76d7a5077
-
SSDEEP
192:uwHBb5nz7CnQjxn5Q/6nQieZNnVnQOkEntOknQTbnpnQOgycwqY7cwqYncwqYQhV:DrQ/muPB5hNjwlDg+6/rJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{595F74C1-27B3-11EF-917A-EA263619F6CB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424245540" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2908 2884 iexplore.exe 28 PID 2884 wrote to memory of 2908 2884 iexplore.exe 28 PID 2884 wrote to memory of 2908 2884 iexplore.exe 28 PID 2884 wrote to memory of 2908 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9d1edd41c90ffea4cf6ae0fcd97f2c32_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c6ccb99a39099a2ea6919aa7809d431
SHA10ed513c3870e9f4ea87e628fe9a90f6001823250
SHA25628373d4be2bd84de108ccb004444ae0dbb52b95d3ff8c202bbea982d6f32f5ee
SHA512c3abaa4405351e7b32b32252fe059a8f03e5caa20d21637c5af1bfb779189aac1987589c393b542be3f3cde2dbc8d8f776b9ce38e06d10649572f295ef8d6e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df72558af4b3120e057cdb820dde74a2
SHA163b0e4f06ffc601a443ff0e992a81029c12ba618
SHA256aa598d6b5dedda0e7e04c0f2e7ded4b540b6da1aa05a1b976acb124dd0ffa0e8
SHA512262cc799e2f8976b8bf57504cca45486c9c79a471dad92d89d779c48d8626a4554cd695067218eb7786496fc9323b5a8e9b6bdb1f31b5c9e68fc1d388afabd86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f8f7dd3cbf98d33da8a4cf8ea04c7b2
SHA170aad2a8531fd086bf64e0410f9d404fe341db64
SHA256c10040c9b47062a8a8d04a88a32c866e99361fcffd2fe9fd66903c831985776f
SHA5129a39bd4941e35fd2e558cd159866674cce3f4b8427fbf13080d6e0a5121c4fcffe37df3760b95aba7294659183607206565f36911924c543bd0018fcd91a9162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567b68e87d75cbf3bb5182cc970b2bb76
SHA1e21ff563730a153f16cb2d7de457bec6e489bb53
SHA2562f7c6f8da3ec0696639b29e18c93af5a875d0f8201d0f9fec72fb794dfdc0cd9
SHA51260fd0e3694bb0b62c0c683c27881c42331c8a3a7ffbd0f156ea6d58399955ca95ef870dc56faf9091f8e2091a88e8e6ec764f93c05a360b79282742c84a19b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531cd72175de563ce10b776163f387e9e
SHA16bc7aa634fe422ce30204c89b8fad0d39a209fb4
SHA25635a0681c18e121e1d4a4ca021fce315a2f3bc68aaeb5cba1f430d381056866f1
SHA512bc9489db8c8cae27ddb988caea1c8bb0d8b7c13cfc2851acc8162e80715497ce839ec2327949eab5aa58e116839d6d7515d211a9af616d2d492bdce842de29e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f272a3c068b6a990651bdcd0fa7fdbbf
SHA14fd69521178882faa85c84c2c242ed7108f5e9a6
SHA2561ec6e489c1d0efbfc272f7435552aee9f284a67c9860cff69de6f2130e381893
SHA512e0522e2a498d9d761f3a3584325df9efc4e3c5ed0b7035a9c74cdb4ad879374b22a98eda209a38b7f4c7eab541514415d88665f5c5e5b16dce774a2e8774fe2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d27377a5f9b65e987e51a5ad4ae978e
SHA1e62af67a662c1d63984d1c05f180c8739dc7e48e
SHA25666ab18807de1cfee1d93a94da3f30405fd34e778568ec0c9ebfea14aa7133e9b
SHA51266df480ffba2332a1d41b0ecf016e26bcf6e5b7960f8e20089ab48547ff815200b3bec8e3830771686e30dfdb21ec94bc5ca1cedad7a2927f82a83a6e4b741b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544840b5ffb22a43c5a03d36a59aebc6c
SHA1bde95f1bb635e482d548a32f8e89dfa42e99d58b
SHA25690de98e131d731c95d8297d679a1888e04d935fe532304d9885087eef00eaa8b
SHA51234231885d1b417b8ce6258de66085ce7f7e509cadd8843aae0b0ff2f0df69dfa1483e773c16ff80606992875f5062eabd31f1a35097d3f81d1ed7b13eafe1dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a60acb74b610ca082e9e9b8113f4486
SHA1a22c16dd856ff540e18fdeff83fb3ab927634a56
SHA25633366c4dce6e818f673ec1c91bf29ec996aecddf544847be0c325c22d45befae
SHA512c61cbe476e0063e05d82749fcbcdd9334227317f4bb1536a287b48e8a4aef528bdb7d3d2d2645a589a684886818aefde3bbb1d1d553e68b22e6023f5c20e43ed
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b