Analysis

  • max time kernel
    117s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 20:16

General

  • Target

    687c62498d836280c183e5d0db9ab2c6_JaffaCakes118.html

  • Size

    34KB

  • MD5

    687c62498d836280c183e5d0db9ab2c6

  • SHA1

    f6431825ef3efcb281e937fc5afb75dc0381cf57

  • SHA256

    65829bd92e1efd88c63bbf036157fb996cb66a7b88caa752d5a25bcbe2f5f648

  • SHA512

    443cef58099a7e959427902f771cd95cc4b89db5a1efd873560f151c507035824bdecdbc4e6edbc5b548dfbf9aa8e96aa5ca336d834a655dd206258854bace83

  • SSDEEP

    192:uw7ub5nVSvEnQjxn5Q/xnQie8NnbnQOkEntzXnQTbnxnQOgrcwqY+cwqY9cwqYQ8:zQ/uJ675A5Ywyejd9rG/W

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687c62498d836280c183e5d0db9ab2c6_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    88b381d310ac76acf468c6bc66ff6699

    SHA1

    53d5d0642557440c7a7f2f471407e5f191ea5034

    SHA256

    98a271deb9e20d795a53ffe4cfd14ed4210fc247efd0d1936fe8c001054abd95

    SHA512

    d5e7b74666e5db774ac901295724a6c554204c4c884abde774bdc92946e5d1997c51dc611270078fa4ac132d0aeac87861037f910e63b031fb2410fcf4f94052

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a583bf7fe32549b3ad1af1be7540111

    SHA1

    6683e221696332edc8e5f86ccb283b6a8508a47c

    SHA256

    8bbb00b3365f7cccfcde78e56146ac71bcd6250caf2b0552dfa9df50962f7b3e

    SHA512

    a7105bcd0e780986406d46bef72499aac019b8622f7e4bd2b08c8f9389a4680744817f6f41292cec23922dd1730513dc4e1b0b409289183485efb1656d0fa33f

  • C:\Users\Admin\AppData\Local\Temp\Cab4740.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar481E.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a