Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
ab156148864453433939041f0d66eaaa_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab156148864453433939041f0d66eaaa_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ab156148864453433939041f0d66eaaa_JaffaCakes118.html
-
Size
23KB
-
MD5
ab156148864453433939041f0d66eaaa
-
SHA1
a321bdea4f06641e97995727ae3a64ee81f18fba
-
SHA256
8f39e2def36f71e84c17058f662d2d5a96e40ce47dd7a26f3db72b2bdcc5e8b1
-
SHA512
a77cd430a98c20fd034d4deb24f7b71e239dac7965a82b76a95f250fe510289b6d4b8b9789657b01d474d6ec191317cfdcdafc09637e490fe55ac2a116e874c4
-
SSDEEP
192:NuooMrhb5nunQjLntQ/BnQieln5nQOkrntzwnQTbnKnQSanQtCMvnFnQ7XnQnQTJ:0ooghQ/DZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF105E41-2A79-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424550708" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1784 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1784 iexplore.exe 1784 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1784 wrote to memory of 2928 1784 iexplore.exe 28 PID 1784 wrote to memory of 2928 1784 iexplore.exe 28 PID 1784 wrote to memory of 2928 1784 iexplore.exe 28 PID 1784 wrote to memory of 2928 1784 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab156148864453433939041f0d66eaaa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53624324c7db2590aa9a5b3518ee24216
SHA19350c0d41f3694dfea205fea1113825e92c5c564
SHA2561ed63afa463302e8051e5f9fef1343d94548e5ac68f29b71f9d4ebd765441af4
SHA5129df5a9139641e4ed3df942aa8a9719d49fcc50caa0583540120794c58f1938a47b0e828f84b4e6c8ce9bcca7e495cd23a0042629785473f2edee298f942ac7b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc1bdb6291d775a67a7cb54836ea819b
SHA1deb8f150b1e93b2dbe3863201dacfba2d2fc893d
SHA256a4a6980264df17528aeb9af6e06487164bfdf04cd0963ee45791768e4dd6b645
SHA51245a76c378348e58075965ef2d8765e07f91d32d3ce738003f0d5427ef3b0ae92b6d7a56d7fe0f8855c9f7a3ad06e89ead694d5b874dfc19b05beddc3d6f6a2c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5690a0668822a1c110e9c1ded01090e8d
SHA1d1d6e5d6827e632d3ea2e07b823439b3a3a8cc94
SHA2564ef9d85f15a0299aa8f885bcc948e038ea841225709cbed375e27bd7840360a3
SHA512f125788e4656cfa374a9f829528ef1efdd32542873bedbccf9c900cdf617e8ac3ce738e8ddc1a8d886f96bd1a4e3985f12f71615c5656122f77b80b491eca6c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527bddf5ee635a1c440c577e108781384
SHA1a2c6b391359be827bbc11d3fee84cab2ad9b8ebb
SHA256ac4ec9b4eafb6a5fb380836899c3018e8c1305172df7ed1fa449e204b2cdd7de
SHA512619619498d1dc9ac511cfc67c4acf91d1d94e059d3d8257339d7fb510242023be8b43baa8e136f987ddac73656fab61184d01875e905ecc4b87403839d34c707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d702ca350239208a6e8c6e3dda0a9de
SHA191da3768420feec2e89a91b11e494405bc893dc0
SHA2563331304614111df7812193d6c731fef3e64d02663776e3586778969671274806
SHA512472e26399fa30bbba3f10312eeabecba555a0915dea32e15d7f5591675bf0d0bd6ce8e3e305c6faf13dfbdb0e666599071bd46f6e37c1b050fed7ffafbfcc68d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592061d126faebff41ad44c02aeed52b9
SHA16ef2669219f881a465502f7a7e50b0b1e9a3d8ce
SHA2560a7c881937a1d70a15ec777735c1c62b15ae6b5affe5645f3b82d6554ad14784
SHA512007d1996cf1fb8519c669a7428bbe50650b6fc372e32e7771080e3a4c8d1d652295e975e63e9aabf061345f6859736b321be51a1e4aabb2783a9e7a339ca99c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562c9128d95291698c7e24f74964ae924
SHA170a49d952a57442a1af16e2e1411346b74eb5b37
SHA256296220fa90065dc0b8613571680c5e59eac3b47bcfceaa548ea428c091b52686
SHA5127093662cd620a6317a38018297a9cbb1fc55b40f053b04d521f1d928bf05e09afaecca789415cc46302219e7004473bd5dc28f75e964ba0825160de7ba1619f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b864675da1656aeaacbc3c3d9ebed23
SHA1bc4d02f90f6b3de2fded88447a9401c98e5dc264
SHA256363723bbb9f88cbf55c2bab97796dd1e1d86e9ccd2a92f9722bee68649d0fe15
SHA512a75f0461799213413fe9bfafbe9d4d16231597c0ad2e2cd00edfc2f3e0fcdc9227e2ef3d9a4f7fee9aaf388f740d408747a5e525d8347ea3752551e9377261ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b