Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 23:06
Static task
static1
Behavioral task
behavioral1
Sample
a2d8cd40f9bd137a4129b8f9ab39619c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2d8cd40f9bd137a4129b8f9ab39619c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a2d8cd40f9bd137a4129b8f9ab39619c_JaffaCakes118.html
-
Size
19KB
-
MD5
a2d8cd40f9bd137a4129b8f9ab39619c
-
SHA1
e9644aefd24bbf9fd104ea4778f669f3cdfe87bb
-
SHA256
e21b2d913cc4e762b94a786f2356a65acf2c204da51445f9df14aa9242b81b32
-
SHA512
6c51f783e73c074e526b7adbe036569f3391f42fc4b7313eeb6fc8ad96ee8bddf9d8ba9c9353a099bff4407d5011e749d5c47fcefc20a6161fa7657b212ec1df
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIJ4dzUnjBhH582qDB8:SIMd0I5nO9HFsvHSxDB8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E803211-2910-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424395443" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1420 iexplore.exe 1420 iexplore.exe 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE 2792 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2792 1420 iexplore.exe 28 PID 1420 wrote to memory of 2792 1420 iexplore.exe 28 PID 1420 wrote to memory of 2792 1420 iexplore.exe 28 PID 1420 wrote to memory of 2792 1420 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2d8cd40f9bd137a4129b8f9ab39619c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887cdaa5a3d4f38d328b6cd56753368e
SHA1cbcbf0f9b6ba67d97a5d4070fb71e867a70ee450
SHA256140401f1f5860296ae97c7f8fa0323fbe4d474bb262ac9022b955662e392849c
SHA512b656dda6c3b95453118803d186c88119c25b9714a5b86841a12b7a2356c02c32220ccffe49aa0be6b3da79142df0d1e930c3ff66076a684fc66c62ead526a5d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4025386a6aed8f21a2de4d947d2bcd0
SHA112ba94483306133107434fadc851b5353d44aa50
SHA2566acbf6d52531d5d8e4bcb1e211ca72b493f97dbf91da8bba58f632c17631ad20
SHA512ca93a9300419f1f947153ed525a46dd3fd3285452bb2344b16d5650f624d9bf80bdd0b0f9e230f00b8c9b7fe16984b286aded617e60899a3464045c811a532a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599e0b7128568c5b47bd8f538845189b7
SHA1f409d2770ffd987f4afccf8ea94700431025e83b
SHA256cfa0aa35230b3205573a09a845f0ee63790dc12ac6d0e2fdcdb22b134def07f9
SHA51222a158a4fa9b5a06e83680f6728d36a334fa1184804c023bcb130248401189dbb6e802337e5c00e9bdda182ca059efb0603f89b61d4b21487c3e7b1d8b239c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b353725be548d7fedf82852e87b43bbd
SHA12d9adec2ff0a25af1159593f6d728ced94279fbe
SHA256cb6b695fe0aea2b7f5fb4ef035fe890b4982b1021111cf0147ea553f47f4a4cb
SHA512d874ea7a1a6c850220a4aa4bc51163f11cb6c9fb5a26dae6e26656be5b469b2d692ef856f910d5daa2c34a4ebd14deb00fcc75278f9b977cf753120b4a95508e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2cbffe8c27ece090c05e5904f315774
SHA16ce2d0ff7ae3e757f9736b18cd493836f2dbd18f
SHA256cad1f682cc127cb742a298d99aab9e1a6e5638d0c7157bdf1c2c4a1786cc54a8
SHA5123f4c01609203cd2354613291ebbaccc48def50b64bbdc216a39f1e65bdc1a30ee000eafbb070191620fb08d609558f2254fc50758325c43379db80b619f56627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53899e17fa10c7a908c339f8b8b11065b
SHA1fde33b334d80caaaf0d269ef8e4bdf1ec87afaf6
SHA256ee18618b4cceb4d16e9eb55c4d8f8b076b3563508227357c4914951828fe14c6
SHA51252544c59dd43856d0b44195fe7818e8099067fe9c733c0fbf12967a714c8d0ff27af7837ba1a6a735c42e7af6338303b34d5dd2dd8e3a61fe92f97e2ca48df7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56854e66f30b30f2f021dbd7d251ce005
SHA12c7ae6868af18fa5317c2ffd69fed5b26ddc5ef2
SHA25620fd43c5f5905b5b447b6558fc83ff1d412c6fb7d679e3d2bf3a1f962f41f91a
SHA51249e6fbd3892c03cc35883da56c7ec42a61b7b6e911fda7d613b5fdcef3cb73bf95d2c6de82b2be284ea4a73c89456663099f9807fb669f1a7221eb4a7036a81b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc8d8b65274c18741ff48a4c364346a4
SHA15c2fba7cd3f0701d224241491aae5342d26cafe7
SHA25657242dd62d47d5622e3fdbe1ca6573c7758f43475cb809c6e2cee2005dee81c0
SHA51246044d69b0ab1ba0bbd8768fd8e8df66f623164fd0ebc9d315055d6661307a7d829a011ff1962b975af4e5ee55d28c6189dcf78c6bb46dc5db6e01a00464e02e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e5d4a99826907e9a23e9dd1034f83e6
SHA173176f7d385d1230d4536e55351943e07e2d1bb9
SHA25676b135d940919a093098c4eb8855aa31c9964ee5efc5c9d4e451f9cdbb0bc089
SHA512dc813ce8b454e4c874c39a0c4831f92659241d053147634e959b8239b4fa4d2ad1aec4e84ecff5fea5cf6b597a3bd635e63b0a9462d361af43b0d50d7523138c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b