Analysis
- max time kernel
148s - max time network
152s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
29/04/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html
- Size 19KB
- Sample240429-e6fjdsag2w
- SHA256 f41c66cfa86421546ff194e76e623d127b1d5840cd20a2a025450a71932fe40c
- MD5 06d3328d3352d9388a6bb711a2795087
- SHA1 46d948a8c4c2f608b925be16ccd001d6c55ce00a
- SHA512 5a16bc7007c245f0689b3aac646ebcdb0f193ef89b18c7ab68d3616d9b042e38816415ea900e55f572ebe7239d2c1453f1f03c7e1ebb5fc63d323e6408114b59
- SSDEEP 192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIE4azUnjBhGY82qDB8:SIMd0I5nO9HjsvGrxDB8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420527049" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9000B281-05E1-11EF-8A7C-66DD11CD6629} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 iexplore.exe 1912 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2504 1912 iexplore.exe 28 PID 1912 wrote to memory of 2504 1912 iexplore.exe 28 PID 1912 wrote to memory of 2504 1912 iexplore.exe 28 PID 1912 wrote to memory of 2504 1912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06d3328d3352d9388a6bb711a2795087_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c064a62d55d0590278d3c5ac8c293e5671a724f80a8b339e652739e22c9362f5
- MD5 455b4d47bde0f03efc16a59f429e22e4
- SHA1 6ccddadcd6c3d03b0d82c253ba31937fc8106488
- SHA512 644b0a58d04d0bcc54c2ea6adc6d56b124a948e5f8cba262ecbf67f944c16f428541b2eab2dca606c90da28a6a6944d6357413dcadfe82af05a977a6431a1867
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4ce7bd18c6b164fa03e44a7f5a30ebb8beb0dd0adbeab241b40445e072230c24
- MD5 dfa8ca68121ae82ef66fbedb0e1a7e4b
- SHA1 8e58c52bde72ece46bfbb3dce5444717d4e48f8e
- SHA512 e5ee36815ec22b82aa73d4cc30e2e3e4dbdab3b15c0053d1ebacba4b95a83ebff0ae3d2614ba6549e204a756a3aa8fbb649f7584d988836a4c504b501ca7b0dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 fa46198efda0035cc33ad2152d85359028e07b79c710ad460889a944c8cf31b9
- MD5 992bb548dbdcaacf1089f61e7c3a3a77
- SHA1 5a14cbfa38f08547dc0a3ecacae6b57c838d1f99
- SHA512 7db4a79c54288f604fd0083ee2312818aac7384101cf7078ddbf2a583470fc7cbafdc114e3fb0ab27ca39356301efee3f2e8fe7c46559919923ee4ae6dbbbc54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ef7f4ee7c4f75e15a3e0e73f071dcd033fda4d682f15cd700d4c645c8c2719e6
- MD5 08b7d59ad01d2578bb3757aadbee8d4c
- SHA1 29d20d0b276dc1f459c00146ffbb98d7a7379b74
- SHA512 fd5274ae66e80cc0838ca798d59e05169e946c665ac612f9b8ff186a8b7142de4af0adc77bb54416016acb00f41a51fb15241e1c6c6cbadd38584f2e1028d89f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2a629d8adecdc2ceb21f3938a73c2a75b05a28f66d83153fa5a194d4245ff785
- MD5 84749197dd3e84c5cb2d7f6294a84a27
- SHA1 2f4fe59c1aa4e3d88464bd573ad4c15623bdd40f
- SHA512 7eda5507fd95c5f855c497e52e4aba97db3c7a37ed6dc337712702305f8db16c4f2bfc131c8dfc3ee7796bcbe2fd8f0007ec8cea3d6421efc18bbd27297eb6a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5711178ce7cc38eb01ad76fbe2520592bd5e8efbcd944e82330c536826dcaa6c
- MD5 0014671baaf369bd73b83fa7c25516cb
- SHA1 370ed47ea4ba37a5c2d3f46eb041ad8bf1623e5e
- SHA512 4ecbb4d87b07ecba34a904236b3571ad6be03565466c0c2d9d5c491efc8f4aaf8fd02d029fadae0a3e9a3381eaa82c34840a47a3c73f5528d0ae6dafd921718d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 76c974201be09befff28d9348ee27edf14bd323a3bcb65cbcca9a7dfb12fab35
- MD5 495ada36697234ccecae10edae7cea33
- SHA1 b9bc1987aea97afcfe074ecaa4562fe0bc1db591
- SHA512 386767027710f1fd5008393d471db153b8f9ece35d2dbe39db9601c7bdf563f75087df77c1f176f19ca27571cd5ea1a85ae7ca9e7d1732f66b66de689be62e13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ab1239e219d2f3b41c949fb52c7e2cb665f9e10454e30ef12ec4d534bfee64e6
- MD5 d8ec8d627796e698b4403c0e9eae1758
- SHA1 b4758f6ff06264e8b0e942c6256de0f3e293e583
- SHA512 6c1874e4aa18b2fed0f2716c973ac832a424415ea96de291dd5ddf77362b843cd40de6bd3ea7f6d8d7b1fb16f897d9ae2cf35c8ad088393451f0305492f28a4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 56d4fd1099e71dda26942fd3e6b16f730049c1320c2b7973fa1e0af254a29154
- MD5 4557a4923d2196c3677e70d24b2ded66
- SHA1 c5fd595216007d0af27a47b66138c9ccd21317a9
- SHA512 69e32918054cc9341c6e65393f622f716062f27ce03263972e72980a91224f542fabe8f93d10e199c912061991e2cd63abe093dd8f75392376293cc40e0039d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabB28.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarC0B.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP