Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html
- Size 32KB
- Sample240526-ea546sed87
- SHA256 3ae934d3811eae2b114f2a097fbbf6cf647be99e793b66a7fc0756b453167b58
- MD5 743be36bb6b805f2b9784f7843bf142e
- SHA1 1ff5c6080cd288dc1176f39dafcb19f83d2954ac
- SHA512 0d6db4637bb727dec5233bbb53c8506d482ae35725852bb5666a39ee45adfec8e9add9290fd5f234ddbc207af0fec57d67738a3b181059a5f7af624174e72922
- SSDEEP 192:uW7Jb5nAn1nQjxn5Q/TnQieaNngnQOkEntxVnQTbnBnQAMC3AzYLWPY6NJoky9tq:oeQ/pxf6P9NQt3j2Oh6
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422856981" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C4231D1-1B12-11EF-B195-DEECE6B0C1A4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1608 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1608 iexplore.exe 1608 iexplore.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2568 1608 iexplore.exe 28 PID 1608 wrote to memory of 2568 1608 iexplore.exe 28 PID 1608 wrote to memory of 2568 1608 iexplore.exe 28 PID 1608 wrote to memory of 2568 1608 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\743be36bb6b805f2b9784f7843bf142e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5d06940aebdb8578f1ea453f9ce973910dbf28fe39a73895b559fb0893961677
- MD5 ba83646cded413f06e9e5f536bb8158e
- SHA1 e957858126223ca030bd3d1408852a6b4968b392
- SHA512 7fa6575776432da9b03dda716a1760f68ad3e7d9f054a42b2f613bd72430b047fa8e9d61ea5eee36e1d03bcb4e84baf01a3f3d8a6d785effb3c52eab14adf1d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 244f4816b8050deabc483726898b4cb40d7ce3758db1c55f09b103cf1a808c42
- MD5 759a130e745da2451638fb184ce4fbcc
- SHA1 29a7c167a9b4ba18bd0b5cb90980915a1fb3e1eb
- SHA512 514c3ca2331bc6c6a84f2d7445df25eca7cc51a8b7e1bf832bd5288b9b6437835bfa73cbf13b44d0a8594be81a7f4dd5200036bcf668cb3d4d1d3b14226a5897
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 351e687871f68e5abc360f95142a8d16e285cab83b82a0f6a0c6ada5a267dda1
- MD5 ef9cf8314054cbcf45bedf88499c9a7d
- SHA1 738435dfbefb86db558606f75bba3419ce6051ec
- SHA512 cbffdc1da644ebe8d675e558795a142510c813eb22c7ad95c5d8fcbe9e8362984799da1b47bd66919475950ca037759362c51e3ef55ff0447ec8c84cf04d3019
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 595d12c0a18fc58d6f9bbd53ddccd8ac0aa487da4f96288e158e8646f9ad53c4
- MD5 0802687a84d1e44f5bafe8b12a856174
- SHA1 014a433997e8c47346859d7e9f4b3ece703c2f9a
- SHA512 92c218de0ff2695f115712c0530da1de3e707e571e8091ba37ea8e5aabe2cbd7b4a68fab42e3147f4281fff9e06e4c3311d0de667ca7a20b8ae51a9b1b9c33a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0fe2a31d227fcb88c47aaacde6b8cd57220193d4968eba2301b5c0b9daaf9b12
- MD5 c523a5b1da380658afeee5e4ae9fe4c7
- SHA1 c203639b337e4e906981a5ad6aa4abcd37c2c076
- SHA512 bc466d3e9475260028a2c82d52e375165eb841ad2c88c134b4713ea0f0edc11f4f1c8004acab08c4f8b91f44c8fbdc2d2d1f528e0602087d0a0f38dbd20e2c6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 61c8e3b2a6a1c6ec3bace8cd60e303dfeee633b93f32c7489a90393ef226b2ba
- MD5 44262fc88072fe2ea79aedc7b6ac1c68
- SHA1 b28b0f2acd36625330e17b29433fcb9d587d96ca
- SHA512 460497aa0dcf20ce6cf08b03b33a34161ad06b9919721e21dc0cc2bba3e8c2a09a2bbf13da340dc41596ddc557a3bb948e2bc368eba8ba66f25934e97b7eb8c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ede9c6721aed4ef81b70de6d920a7b24277160e2b4dc9c75644add5d0ccf65b4
- MD5 83b53b98519ccee255007148b550fb78
- SHA1 f8745d773d3a7d0642d0413b47368183124591c3
- SHA512 d972b662dba274e2d2492fb60d16c7e123ae8aba72f92d1cd5f80df513d826df853c7b155a277fe3ab36179701fc911ee5f6f75c1a4d5cbd587805a7ea4e8c8d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 89ca98c9c99e562a8072870503e2efda511d5b86e75c640585f69886ac76bb95
- MD5 85ba167d47c94a2b8068221f91c6c1e6
- SHA1 d96d0bce7ea8195ddcfdcee411de14c375516e84
- SHA512 bb8a94609c398e334179897c67533aeb342969e7ec5ed535bcdc6e0a246ffb0f4a6b9546327426852b635d31844e11a1c04e0adaf0682b92c6b79a763ec470af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8f65e2ad3fd578263ab47dc71e09d4be55b7244589e4c20fabd46adc6ce47fcd
- MD5 388dc7ef792f4e82471ce9d4785d2ff9
- SHA1 fd73bb738b67f2c8354082ecb47f122bc1e25102
- SHA512 792bef193a63d80dc356c0b60b66b77310cb3b43dcf28d4f73f8c1a88015e6ebba52858ce0315e0c55a72217dfed13f20a5440ff8d0f689dd558f8a44a22e5c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 94117199abcd534f1187399a83f30758ba965d6b77a639ce17bdb5932b3c042c
- MD5 3931380627472db02c204dc5fd4ebc6b
- SHA1 1842cff05af16c49751e25c661df9706bff2093d
- SHA512 830cee6d92ac6172fecfcbe31cab250b5663a8ef1f1159a091ffdb185462b602a5db1d0a92679940f640ed5dd7330155821506db7bde293ff2170cee024c9912
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 1b9fd0c7905eea071eb43528f942eddaac5cb7081ef415d4e58311ef0b9a57c2
- MD5 526c1d7d0699ca533fb71480f98eef1e
- SHA1 db44fc3b6c6757f25e01b83110427228bf19bc0e
- SHA512 9e3a084f38975d79f0de155e3b6bb42f1f595ff071ac0a91fea9a7fb7f80e107f94fa463f886fd2f0be911cd842840111c8647de49767408b13030f53cf58b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2949e9c8e70a4edc8101e3463f05eb0f038d0ad801a68d89310b2550e3ad2750
- MD5 8815114eb87850358e567c790bb45090
- SHA1 40181017275de726f19e9aebf6b12160c7761b8a
- SHA512 2877f87d692d2044839a322e6dba46ba297ad1d7333637493b2344ce48f48fdbd7e75a0fada8a9452a5fbcba4ca17b6084140a5aab73edffc81f154811c6d16f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab229E.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2300.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP