Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html
-
Size
40KB
-
MD5
a6ee461dfb167c9d2cf39ab4431ba510
-
SHA1
1ce889c13a010c13786149d1d8a9430ae5506b97
-
SHA256
ea35598fe308f20526280e88f48ed817469ca6dbc9c48d6889950fba4acc744c
-
SHA512
39ae1c5ecd5972709bcb3807ea487e1b72665b3a4a156599c29b374b801f7a7dbe798623dd2abebce9e3dffeee07726ecfbe9547929669979037f882fb502f33
-
SSDEEP
384:EWGtj3MBNM5OiaeNE07mJlzQ/z9w63RTcb8pxhzEKfNuzV7a0MHRBfkswj6cWiCf:hQUFdU5f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC2D4901-29D5-11EF-8A46-EA263619F6CB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424480211" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2836 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2836 iexplore.exe 2836 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2184 2836 iexplore.exe 28 PID 2836 wrote to memory of 2184 2836 iexplore.exe 28 PID 2836 wrote to memory of 2184 2836 iexplore.exe 28 PID 2836 wrote to memory of 2184 2836 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6ee461dfb167c9d2cf39ab4431ba510_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52809cbefcab380d14ae8d8bcfebab0b8
SHA1c3a85541620c2d1fe41ee00baf7bb2741a8a4f4d
SHA2568cd944b386f6a92de91b42be6a03108106460bd192067a12e5cb7fd3f421fb96
SHA512cf6db9f5fda5cf6a5b394d05829bf6bbe13bf12a4d5c7f51df6c672e9b8ddf5def399501e02cc5c28a1de3c62bbbea9a51ebe67d57b9506d88ddde559f811c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54443568a5265ade5a522ba11861f6f13
SHA1529427d70a7117b8b4e324455138163ca6befe61
SHA2568d6cc18ac37cc15bb3e13cbab378c66dda20c4dfe3a2af892a77061b56f47e44
SHA51201e31f438d360e5b0fe01502a3e7c2613b15a1f72031c1c28c215a001ca28ad068c461cb59f4d0412daf8a6a61ceed4a004b3c7e2ca7423de48c6237794f37ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bd4c85350487e12f48ec2555ae7dfb3
SHA17c435c56ad81a4baa5ec3145a12bdf35c7c64bd4
SHA2562fb6cd280328d37be2bd1ed590dd26e331add1788499169eb2b3b7898b0c304f
SHA51259ee88c368c52420f08f5fa19cae37c9eae96d9a70ab862785a5133087e5f786e07de9b8422595230fe8c0776f64c06f598b3fd62122318b43da221ccf8230e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2188abc10437625c0a383f748344c80
SHA13bb2e45e84464b22dc9d1b559209cf19fd411a04
SHA25689d03e8b14ba601ff6d311d1938bdb325535009eee383afc599078f36ee5307e
SHA512cce78d6cc521ddd675f7c28cc62a65df0d10eaedc3c6284a3744595f366f387033b67868d2296821326ec2b88b04036dd89d15b37b752b25ad677d92c11792cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5654ac47679b7c9287c4c3484444cbf0a
SHA11bc856f307a28f6b849bc10f8483ba3099fcebc7
SHA25603ef7511c98e2c0b87b296e10c1c941a11127e0aabc1244101cfa5a82fbf0cd0
SHA512424d07c606984ca6f5827748e7dc00f367fed845a0dbef43bc3006127565982f23e5e04b6a60b31af2343432a7e80eec5604db09323f66b9ca0461ea0c87a3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fea0016b594453e607668f1b1b9bea1
SHA12075ccdbb4e90855bb739cbca8caaba752373d9b
SHA256a5bad709551d35f056b6a149e0d503ed3c2e12463ec82024755b68b73f13588e
SHA51204acbaf7533dd8c4eabddfbfa8cb795401c15079c8912efde4a928ba5e8fecd8bf0a8b41c91488fab33776ef58fc9ab10afceb50f138438f6ffa628bf8595ecf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5722cb19ac28699a514e209aa6bd511c1
SHA18e967355196aa85be8dc81aa1504cb8c58de80a8
SHA2565361e26b485d2e9d8d1cb169e072704fc188fbf86bfe3d27c414502b2e85f2a1
SHA512960b9b930e7d8446423e4dbd002f622b96323bf22ee17175083479633ac67c065144e0878eb9e43fb5d9128e65d02a470be0ec719d1f1fa6794493e250fcdfde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595df5b04c157aeaefa42e6a3f7116d31
SHA1c41da63b63c87b9c7944e9f15d3ab57ebee476bf
SHA25698469ddb73e26f8c5e272702348ab48b3cf7eaba1538ab1ba993b98db131ed4a
SHA512df2eb36ce18323b20ef7c3015e8983ee53039e4f999341df338f8902e9d9e8774850ff484a989ac654b2cd80059cee2ce55575cd2d4258efc76d19c6d488b821
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e51d049ee8a10f63553ac2445695bdd
SHA1eff69be9ad92693a76a7052c048a854772550289
SHA2566c1d10523a157a36c2f98e5e9449ddf80d88a63db5c0532a262a7b26e40263ee
SHA51258a06e7ac8b17f5dea1269709c6549f7f5349f55a04dac6dc41fda3c5d19091ef9c1a2da16468b6016d5f949601a53058edab791080d8cf3b506b9317053bcc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57acd93d33678d76f693496080e5382b6
SHA19a172030dcde895276fbe7086ae2261b68675755
SHA2564b6700d63cc0c073fe9f233a67cfe17cf6cc89d38f52c6cc96b60aafacc4e495
SHA5127c62c586a6625d0cbc56b0ee3c5f4d483047731a9ba5ed0c2ddda65e77a96b5c920bf91cc3f84ecaafdb61b811dc58976f211bd64cf92f9a96d6d8fb2d8f2da6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba0d795b9e1ee03c2f60610337acc35c
SHA175d109a0ef13d6a3176a463a94e4147410dfa931
SHA256e4474ce89b6ca765e172b8ac51e7e45d6cc971684808b458aa3a15d0b66fc59b
SHA5125e7096f1fed83366173d301da712a54bfddd81029c0b2cbe5182a578cf76c3b5f191488225924e09e96b283624c7382f113a35efcbc32f3815b90572fe3a288a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b