Analysis
- max time kernel
131s - max time network
143s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
28/04/2024, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
0547b6d8eb07c78287d694d0d7921673_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0547b6d8eb07c78287d694d0d7921673_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 0547b6d8eb07c78287d694d0d7921673_JaffaCakes118.html
- Size 19KB
- Sample240428-qlzx3shb21
- SHA256 c55fe5595b327d8a7d13fdac7d31f5d443d0ac4996808f639f149f68df3f2abc
- MD5 0547b6d8eb07c78287d694d0d7921673
- SHA1 8bf13c844d73d2ecc3069306e4be2c1adc119131
- SHA512 1d1a39b4ba159fe7191dcb3d321a904e293dd843ce1b44b4baabfe15c6be15ecc64d1967bd1330a0a2612c3cb304ff36343268967812fc0e2659063f913fffb2
- SSDEEP 192:SIM3t0I5fo9cKivXQWxZxdkVSoAIx4TzUnjBhNn82qDB8:SIMd0I5nvH5svN8xDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41262ED1-0562-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420472373" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28 PID 2236 wrote to memory of 2304 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0547b6d8eb07c78287d694d0d7921673_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 fca2559cbb794b91824ad42ec75f2cd89475dc13c4e521e71a0f2a7a0dad7ac2
- MD5 9333d8566d631c721049d45f2f99fec5
- SHA1 6d085519c1683da26b6997269e8fca33386ecad8
- SHA512 40241b1be4b0618becf747df95fee8df2352ad743a00c4266552869404c287a89e25028dfc5c2e430cc4cdb27378251b5a40e6882ee4191c87fc31a7736ef614
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 587c649398f6608c69ec4a061b4bbeaee8e3d6e2ce9572fe2ab6136020f211c5
- MD5 81ad84b23685a8b7fcc55ca960db2891
- SHA1 bf0c54cca3490983d3d42ffdab051e536f82b242
- SHA512 6713acd0c87aac97b348a96124f5719205fdd86a62f2c7357d255d982598cbfafe78bcb35d1de299fbdea6188a47ef1754be8815c49abd3b7e19c82f73272c3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6537ab0cbc9713d2b6a01f8e30cd739453a54e3fe33868453f31056f5fc7bad0
- MD5 1dda60e3dde8e94c2a3294334946d1cf
- SHA1 063a0efa573483b94c85a2172984bc2a67d55935
- SHA512 7e21a7f22008b48afff5afcce39f04337f3200c8c8b9125b0699126ab3f1c5487a357f4575b9e691ed1273588a7a8f24521de357d477cdf2405a31e063ae9536
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3655e0cb35a5a9686c70722c4c28e7bc584aad403e7a86816c61aa7b401260aa
- MD5 d1e2233cdc8c7fb92046a332cd9e31be
- SHA1 b17fcdd0231643e978eace3f0ad6f60d4cb8497d
- SHA512 84a4bce5588a59dfdfd1fa3338359efbc0efacb075fe8f4464b156603a502265a5becaee4aca03eb1822685c24825a5ea3aff86485736d14f672b72e081ec142
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2deb24cca481448e5eddce374c0e29a2a1c7291ee30740ebe43fa5ba8aec0e16
- MD5 73ffaf15270f2525bc1e32dd75201c55
- SHA1 03c46787a64d5d4379279601d0dae912559ec1ed
- SHA512 26468fb6d30e357288fa4d674326a99f94a442b5afd0113db06477a8008ab33b1d96522e0bc63e8503be25e95960c19c37d5af3919320685b8cb4bb18ce37812
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 090fadc6ca241d06e1424e9f86fda8dd6b2d59907cdd6248c52fd5adc3e82fbb
- MD5 64aaad94e71df9bd85d97d0eb6230bea
- SHA1 8dd9d71478fef9070c741ea01796728f788994f9
- SHA512 153c9e3059cd6f7b69c0e0cd2ee73f8da07d9918821ed0e6dc6d343ed2768c48aeaeed931fd60882ab08814481c8f0ff92c2e66e554040c11f5357ed71f3d0c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 61b281a51e30c69088ff13b56c586cb80a5db9d0aec2663019a36ce1f5b48e31
- MD5 1cb2b0b2ae98d4fc6970423c069bd550
- SHA1 3e488544474bd10de5b2196a2edbe894ba6348ed
- SHA512 792c2a1ef285fd88ad7a4a648d8696b48f00dd72ab8f509a0a24ab9eb9746d1ecbc378fff73804b4bb78abd288e35891c15dfcf8f2e25cbaf70ebc466303e63e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabA738.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarA898.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP