Analysis
- max time kernel
137s - max time network
130s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
743bac471f158a6453da4df26fe4f191_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
743bac471f158a6453da4df26fe4f191_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 743bac471f158a6453da4df26fe4f191_JaffaCakes118.html
- Size 24KB
- Sample240526-ea23hsdf8w
- SHA256 6b4f315bddc2f3200c4980c6c730b6f776a9c4562b4f4284b68c47c7ccced90f
- MD5 743bac471f158a6453da4df26fe4f191
- SHA1 5015372bc94fb810fa5cf07a7182f8a12d74128b
- SHA512 62cc5a98f2e61161de8822c9a9a505250f0a9df45339d43c457ee303ef8d604d3e03605159725f7016a5df9eee4c956e3ca1a687d6e39cc92fa22737b23eefab
- SSDEEP 384:XySpUK+1kRhxJ6tV9nPPjOmqORrYRS/AdxvXGJZEu85HQF4IMMHL9w5K4EdBnrmh:iSpUfw6L9PKqj/bJtT/MMrMaNmfMpMTV
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56F04191-1B12-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405b892b1fafda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001d811dfec364d6c305ff23de7adb74e74d0e5a14555359b1fad1c81167d8fca0000000000e800000000200002000000003bffb3ca0c53d96bd675e7a8ba2580e3ffe330ac5bc71f3de5efc4c595fea2690000000153d3813a95528ff97fc13a1d9782791280aeebefd6756f94001acbb869061a6c8ffd0cfb34491bf7466c54dd4d74416770d1e3268847126735ce558271dec18359565acdb284444ffa19739f4310107ebd060ed49ebc2689164f507f8df0a90f4076e228c7d8ac3d724192a86c9ad9337eeb02659626ebccb029b9c1ccdd8828d43a28cd94fdea2b9fd30ca6b8b220a40000000aacba842b10dfaae180ffef62bbc823d64e71ce0d67887d1025752ea2e74a3c497e414c6104449a961ab909aba07b450dd58409e27794ae7eb6279902ca7be02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422856976" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d2ad30c151421bd56c7427243a616c3d2d4f4533e8cac0a5bc90a0ea38b3dbb5000000000e8000000002000020000000a5687c441bd13180ecf4d7f9fed93036518c7b7212a33d864d8ee169d19f788820000000f41fe3afe91892a8a267712337e7ab6b72f49efc2d55348d9fbcdd73a3b76c34400000009de37778ad65075068f222f7f17907a1adadbea782f2295ca68b374d2c29b920389180d83e93277259839c46cb81cd4504911373c2dd59dde868dc9ae780cb30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1284 2972 iexplore.exe 28 PID 2972 wrote to memory of 1284 2972 iexplore.exe 28 PID 2972 wrote to memory of 1284 2972 iexplore.exe 28 PID 2972 wrote to memory of 1284 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\743bac471f158a6453da4df26fe4f191_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 79f0036105da15954bf64f1c5c2354111355d030903ef0b7af26740e6db0135b
- MD5 f792396291bbd462e5e077c217f0d033
- SHA1 e27a38934d2666369db9d3aa829816f38624ec07
- SHA512 6980718b54cc1cd2e1f078271146ff1103d84a4c768ec72fbdcef6c6c28e621be70e1c55bd40d237c58d1d323b21a3c6222763b2f169368e53d8a169ec47bcef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 58b33471970b6c0ad00507bc581cb25319d8d39f01f2552cfadfbbb414b80160
- MD5 17c3ce0bdcf65eb4b442bb0e18a7dade
- SHA1 3bf923c2f0646f5da5239095ea26e12af4d8389a
- SHA512 080b22917cfb6c684e73c6646b61fd666ac71f79bd5c181593e5cdefb08cbf743d1c9676e1c470be705d8c2c5ec50aac0dc0366606f2f87a5b461764f8a3d523
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3d362ebf95636669cab8bc1b29c413002e7c806ee9095a6e85d177629a6dec73
- MD5 15eb5633ca86eed04aaa94d129147648
- SHA1 76d4658ae284d2feca0fb9558f9387fdae057bf7
- SHA512 48ff05d1a293c820b09b957e5fbcf343b9b8bcc9254e0407c7e86f27691f841efa2f5a9bf3bcee29af6f6fc5fbc615c9dd596f614659967d9897dce2f1181468
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c9b07616ee6e600488970344387073847de3b648f66a93e2ac280337a1091201
- MD5 5d3402e52171c3ec7082f18c978f2c05
- SHA1 7b5255fe3b74084fa4123ed7c5d1d268a76d90d1
- SHA512 71098ff17e891041651758bc43769ac8210893c79f29870c9f3fed19cc18821d53fd507a21925d0638bab7534560dd673cf434521e5fee1383fb4c0c39344d73
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5d54b3164edaaa56ab1b900548eff2da2fc322d6ab09123b5117bcfe50d83c22
- MD5 fc6f5c0fae46e4a277ca8c6ac25f56ae
- SHA1 38ce5b34be98252c0f649cec405133f62b9befcb
- SHA512 850b247f1e5006b9c0b51529f9ad71145ab355bba1dfaff6fc313261add0d803294a633decdf878cc711537526fafef164a43d5c2765d67f6dd2e1a15dcce052
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 24c62a894299ac06de624b7b7b80ecb26280850ce84c783c717cabafb913ae52
- MD5 af67ddc6d4beb019f5825dde4e0f6fdc
- SHA1 fa281a3f892f351293f0349050b1959059c1d2d0
- SHA512 ae50176eb1ed1ee4e4084733e88d79801ec0e090dab4de7442ac902889f4d177d8c18b2ec918ead9a98dd3e0705570951861c78791884a804b1eb5436c8a1e59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 30b9e98ed44893c87aa98f00a197d727122e3ea141d65b416baa80e132f9aaa2
- MD5 50f56847c936883b4667e61d90ce2407
- SHA1 35c8ff9ec0a1a15648db89b8fe49fda328c009eb
- SHA512 c9f1c0588c99b9e10bb93c43210104295e2668d50c46e60f51c471fb81e5f264ef582e78606810c8a0c71615a7f0358c515d570dab76dab1354c04310504f8e8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2070ed7254536c354bced577d33240bd4bfff2217a832aa2be01cca5a18eb433
- MD5 9dfdb04d200a279bc549b5109a6dee64
- SHA1 9049c3eb048856bf7dd1a318ccbea458aa140d8b
- SHA512 b2deadf0e9cb12cd7f4d5274c03972093f6c728543dc55c534ee063a900ee5889416e63d6a772ffc593795f709c9cc35e3108026a35427eda4c3f6030ac74f5f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d0f4811104b501842bbc3fd52de76b3743ca1e15eee36b16d43dea45b27d0fb6
- MD5 d70202280515db8aa0682167b261bc7f
- SHA1 24f9a75ab397e1407236fa8df29bba3fd176f8c3
- SHA512 0c1aca891a93cf2ca51e692e6e1790d5c6f2d1de3b5cdda6e05a468a156bee2a8bee889a319da5178be84976c3bb23af2b092ab8be7118f924635751067f4099
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab2A0F.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2A61.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP