Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html
-
Size
59KB
-
MD5
b2cf1e0b82510cd2ca34f622cab12693
-
SHA1
1997b44fee7c26f73dc636b9c312cdfc642afba6
-
SHA256
6354678e10a6456dff7f6e48e7f680a82fefc88e0ff5075707b5d043f3277978
-
SHA512
bb2b964d2a69672bbeddfe4e940922488a816468679f549e408978a4626ab314560433c676e592314dbdb53fabb0d82cc20d04c2138c37d7fa942065c00bd411
-
SSDEEP
1536:8IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZH+5:fH+mFkiZEwAF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C258B51-2BC3-11EF-AC4C-424EC277AA72} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ffaa73d0bfda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000006fe62266972adc3bad39b89b5d19143a2b96f51306641723114b13269ef8d02000000000e8000000002000020000000e40f336689a81f9f21c6f223cdea75b5e705fff5e510dae3a79f17bf05e604429000000001e768101872d3640dd570c56d7b73cc7918cce5271eac22ba65545d7651f51998a2ba83891b411efbfb367b5b2e41ba51fa62687369a9ffdc94d33f869b0da0c324021d6805d19316cf1671b7414fa929a95212594cfcb006277236bde9af773d6379b681de405ac5fa99cc4187108ed9cf433623cf08e6202942ba10f99da5b934c4ccb02349da63bb5d47fdec6d014000000043c51992162b5d5f16874cff38ab7834622bac4a6d980ae5472dff840a97d7d1bfc01d04bb9a6d1f4add3cada9a56c9c68072c91cbe276bc8c7c7abcb0cd876e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000051a75655e12c6ef5abc6457601e4a909b11ec7e5d5c919ac3ebcf41efbc41e70000000000e800000000200002000000022d21518106cded64150f333c92228999d8eb1bc1037a2fc990dbe50f8eed5e9200000009d60ca3854258facc6e70313359e5427e4d762e2cd41ea522451ff5f50a6c55840000000efc3ad1bf29286f6b8787ac7fd10eae81c47d03068042a3e7f98d81492e18ee8cec378ffbbae43ebeab6ae1d0590be9ca62f92efc5e7a071953f93efe004a1ef iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424692330" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3056 2852 iexplore.exe 28 PID 2852 wrote to memory of 3056 2852 iexplore.exe 28 PID 2852 wrote to memory of 3056 2852 iexplore.exe 28 PID 2852 wrote to memory of 3056 2852 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5017971b78fe9431a14fc77fb35de973d
SHA1016125be0616230816ee78f6298bc49ae78d5b96
SHA256249bf5c43d45446a6b736991b0c91c6aed0ab678575caad98e9b3b198b035efb
SHA5125dda106b78dce46e057eac3f41f751fb58a7c7d890727227c4d59ddd7982a7006eedf2f4900f371d4e22206d7e018480d29b86d41811de456a4985523ab9a1b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0bcf6da2ac0bb18d7cbe94018dd821a
SHA1f58d18617fb2c69d3c8feff4454880f04ddce909
SHA256e269644ea998f9173a7454a271f9c0026613a08d43fe0807bb219958d700940c
SHA512df0219f63119dd0dcd4fef895bbb7670a02e2f7b636b848c46cc4c2f87357d90e877e0ed5480cca86e66efbf6a8c745557d23baed2f0c8b19525a520da732aab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dea3037867e99978dc5306f6d1932494
SHA1ebf2886f1b20603b117c5a1fda228ab0d120b608
SHA2569c16d5ec547bc7487799f8d0c9f2b26593c1e26a991a752ccddced4a021fef5e
SHA512d25e6457809f7defc3670e78c08ef49f6e56ef668b41929d9b176ab9f8f36967e3b28903cb145011ad28e9f23c3b8130f79f93317352bdf758eb8034fc199eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efa2738ca238e2983d7248365ea8644b
SHA1622ec269c09c7a3db1e5550df8e3583c7d285b0b
SHA256c13d7a8287d8935edd078c643414c0372d005c4aa9f8b7330c9523f88d34387b
SHA512b7e86af34ba8160186368305854a75dd647d4bc0df70c726130e27dacf009c1960a8fb907a9d3593c629ae5887094dfd8e2558f303ff236c2b56c740f248a86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afb25b7202b2e017b7c22af37631991c
SHA1649fb76d038ea286e9c552997b319708568d3b04
SHA25681cfc518e0604bef656e4fadb72f019c4d21b92055eeff07ad3ae06656e94f36
SHA51282e91b4ea81e26dd8fb3cd9aed1582ab7be068c2df698ff754b1be6e38b2a699dbf24b8d8f5510b1a1869f881ff5d7f0460f52dc14ca096650fc2a16a716600a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f2cabf44f3f4cf55467da2fcc87d9d1
SHA14e9de5c29a79769773609418d54091e3a4c6c41b
SHA256c1ed3a4e1fa5116489e9eb2996e15a8d9965d622adda5f1b39d6fbe98c5b8cf9
SHA51280aebdc344f69a32fe032c53e9373f775fd47e9d8f1f5ed97200c269255b1fdd5eab04e4fc2baf3483a6b177e416787f085e45355f4ea5770c38ba360ec52c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59daf2b00891a14efb791747b3e11db55
SHA1756fa9884d58bbb31e61aa61c44b52756e998e1f
SHA2566fce63827bc3cf3fc7fc83ceb6834e02c35bd5d8ac37edcb29283ecd4c09aa3b
SHA512dfeed133b18259810f038167a850111a28e02cd21d5c1205985c57e486c9ebf226624c1777e3f65ffd03aaa2c52c1c8cc3259e24ae22027a8d8d593649705e40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5366c47f9e630e9d555a9c1f3b7c99e6f
SHA125d93b7bbf2ebd5439b66c594faf18ee6afd4445
SHA256c029965f7216c91dc1ff9b3c2700cab18050bd585f16707a06b435e913c23bdd
SHA5128a86756ede381b10b9bb38277b2b6d5fae0d6f86b0644b6dad9554e79772563bcaa69af2bba038b3e85c7800c81c82a90404551990f75ffa019d5706862641d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1375c1573cf64b5ff3963a28102619a
SHA1241515f6de8bd2583952116acaff89158af9b04b
SHA256db6c8c80eac1cfb6d42472697bd4bb1b6c42596fc900e88d3171141b7f57e06e
SHA51212789f63b61934fd90d646340bb016eb7492a18b9dfc3b503e0bfb3ab7695edce1a984a13a5a49a51e90aa8b66fb46779cd35e76a527e01f7fb8e9ad42e71dd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566f56a3b627bb30a2dcd17674ab02569
SHA1b83c41cebe58c3345a7f8bb72183e17d9616ae6d
SHA256f791919e8f2347c20ef82cdeb5930fea08f504832d6e02c47d63db8c2eaf0ba8
SHA51217e1ed70df2a159e6ee61d56b271f2785c211ce30afa7bb359ae35d968f5592ae74ac6cde8480591cbff86d93973585827164942c46779602ee7cca18fcb7447
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b