Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
48981fb32af24a7b9c94acedeb11ba1f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48981fb32af24a7b9c94acedeb11ba1f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
48981fb32af24a7b9c94acedeb11ba1f_JaffaCakes118.html
-
Size
86KB
-
MD5
48981fb32af24a7b9c94acedeb11ba1f
-
SHA1
cf0c152def71f364bbe63ed52f120dccc181c024
-
SHA256
92a58b5626ea7b5421be3d6d30f6120a4a9d65fa83f9905dc8608fa41ef8e202
-
SHA512
a1b719cf25f1c36d09a222424dd78a6ecd4cc7247fd6a837b4b07d9ed8e5e310230bfa37d2d6f8d2cfddfe6b71c879d9fc79e48449b97872cef66385b1922143
-
SSDEEP
1536:UbM7wo8OZGUJ23FBAYACexvv82jNfzPe3FlqZ0E+:UbM7wQH1c/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4239991-4272-11EF-845E-D61F2295B977} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427186536" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2792 iexplore.exe 2792 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2692 2792 iexplore.exe 31 PID 2792 wrote to memory of 2692 2792 iexplore.exe 31 PID 2792 wrote to memory of 2692 2792 iexplore.exe 31 PID 2792 wrote to memory of 2692 2792 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48981fb32af24a7b9c94acedeb11ba1f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55343a78ab808b48b6f6bb78aa386556e
SHA18abc3848d69c7a816e172b6e85d891b242d23c2b
SHA2560cd0860437e526aeacf2d7d7238f13ae4aefe740a5e25e9b663306a2d5adf667
SHA5120cd288dc919ba4d347b02f84274a06db3c621155d25cd644fed1368916f0219fe4ece4ef6d56736c776109b54fdb6e21cb6231697996644a63c91a49e390e975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55194b046f6fd0cea169b4ece08590358
SHA1c22f6531b8a8f4276158ee0f456d9c83ae137fe0
SHA2560da213225fc18e735849c3fccd60ef825aed2a4c24431de4bbef4d59e5be5c67
SHA512d5b8cb3141ba53e11a5ff9d2467002ddd7b57c7f77a05e1225f1958452bca1c2ee0e38d2624cd93b389324e9c1937f3a86a9dd779d182b0832f8de7de36d8bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516f29641eb90f41d4df08fbe27693fd4
SHA1cde85eb948ba5d81755405ccc31e61e694dd55b4
SHA256d309bc2bb617cc0ceb84d0921cb7de96a544bd5424f38c1c6ad91b0d70d46e15
SHA5128b1de2ae1d3920c1ae65880e0dcfbb74c71147d16432b00d5146ee28fc0878c1b8aeedb2098e1b45a1b2d605134cf45444c7fb5b98b10ddd47117bff064e2ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fed8b9931e27f4d5750fce8bfb3ea108
SHA183403ca21c1fd8d9f683da5a96aed527e72210fa
SHA25655719386ddfb7b29b3ee91b28ed8aa00377c40cdd1fbe37bf4377091daace51b
SHA512d50106d9d7586dc5c9c766bf661bb6240addf30c882eaefb7f2309f76a9df18c4bf467f9305b1afb9055994e685d8118ac4a9b22017fad9c811cadfd3c2cd4c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557f0284c2739498e3c10479700b072b3
SHA13e3b7020d73f20a77cbf050d34046d2127eac7d2
SHA25610c895fb0b26e0240a7682af269b19dd96f9851ae878d93b561748d5fd5678a0
SHA5124fa3f2ba9bcf07d8d70b40491fc27803a3aeca5ef7e87accc9e1f5bb2687b52dbb188c55e669f1f929a25509f8b427e3f53ed0b04c7dbc45b2cd59a13e6b7ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5842b39050942f1351f9577533f7fa298
SHA18bf548287e0c6d2745442f92b8c9979878ef2fd0
SHA25654861980214f05558e8397a9e7e21775a525e09b2151f06a299485371b20197c
SHA512df3b7cbf4aa09ca6188f8184417dffe4daeb1bc7932ea4a9aa0fb30b884dd70f31271f2925fa3f8b56acb7432b57c861ab57abd6ccab80354617a47dc32d1c5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5541c08a4794d804f04a0c8ea4a3b4a5a
SHA147f1b3188eee7cea6537ad68b039e61da493fafa
SHA2567a81590cc9072f7b93ed03e0a61aae2fd83cfa1bf5f1119a5f895725aec9f256
SHA512476abdbd85e30ddb1bec515c1ccd4a3df1a7ee7ffbfbcfbbe36bdc9689849b50ddc3815adfff5d23fc86f42b63774598c1d8d675051bd8268d21d27da9f2f508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dffc293d45724e48b9e0a3f1c00e319b
SHA1018c27740b2a4bc7bb7bb359c3fff1510deebac3
SHA256786395ff79fbd4b93b76dd3d8717450bf31a87a665d28935e8246361fef8466d
SHA51229169a4a5b6ebe247c62de03da983d3cba9ae1b80a98f8d66329b9934fe556ee94058fd44cf24d2b1dd5f7604bcb6943ae7688e40ab096a2be4a47e057b9225a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b