Analysis
- max time kernel
148s - max time network
149s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
28/05/2024, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
7e91533bf9b261190cbd46a71ba086cc_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e91533bf9b261190cbd46a71ba086cc_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7e91533bf9b261190cbd46a71ba086cc_JaffaCakes118.html
- Size 138KB
- Sample240528-121vesfe95
- SHA256 043471e01ad79c7c38bee102211c8611aaa893adeeeb09b3bfdb91c3e368536c
- MD5 7e91533bf9b261190cbd46a71ba086cc
- SHA1 966131c1f29f1a123f4531546c611886632a5268
- SHA512 c2feff0f51c808c8fc32717cd6302d97ec0d7ee48fb6f1ae0bf99210ca49f4eb99ead69721afee8e13be52d2e46ba87f26100ae6cf5c68720e04d449dc09edf0
- SSDEEP 3072:SdHfkBsTOWR2K+mudR5brIfkrxetDd0+edA9cf6iV/YK/znS:SpfkhnrgtxNeduciiV/YK/znS
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4C27811-1D3E-11EF-815A-6A55B5C6A64E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423096038" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2252 2184 iexplore.exe 28 PID 2184 wrote to memory of 2252 2184 iexplore.exe 28 PID 2184 wrote to memory of 2252 2184 iexplore.exe 28 PID 2184 wrote to memory of 2252 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e91533bf9b261190cbd46a71ba086cc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6cdb1332abcbc9af7d107e2f0d84fac46e91d4f92720d0932290bf99d7bffa35
- MD5 6fc79bdc1179918233f530b145bdd29a
- SHA1 1c836f25e1d66216de1b6ff642b659e3db72bc90
- SHA512 31b9cb253a20708ce9967f42832309ef72db45bd8111e7006c862321dc15e11bd77a650cf2fe38c8d6bb90a4c9a9d1a01f60a40df92d597b2dcb670f7ed57174
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1190c29783037457294a93a36a4ba905526998646b108ca0d0c3a84a29a1b5a3
- MD5 671a2fb1114141727e7d5188fb27198a
- SHA1 4a414c285393b92eb0d73964142e2dfdcf4afe86
- SHA512 a222e82d4b59c486f46b62002c8d96d81fb38f4573dd01254cc139affe0d06ff4b9a1bbe9682b2c63f30a7ae8514bb01d4fe02113208fae054b3a915809cf145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5463e444dc779c1f60eb79ff387e8d86a329dcf68ab9cfd207732151213258dc
- MD5 3b4d697484427dd47939577e70ce4d8f
- SHA1 b0dad52f78dfb87d7118e9b80e27ba1799d64983
- SHA512 a5a50c2da600ee784a1f0728aede04c14158f54f708fc80801d20ae388ef62d351525e962912a11035d93289f16bdd73ba50ceddec4703f8e1bac70487a3838a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 609626723dfa99533ceb03505e1cc13b366ffc89c12b5020d124986e354a2793
- MD5 3301e0a563917c4a2a56f760fc239cf3
- SHA1 614e52e41e67c334aac23b240f3272f71821d131
- SHA512 069455deef65449b0bf61cf20affbcd1f94229ffb13f09beef6603b2b3c5bc7fb40c834c3c13c837266490da70f96c8047d9a31a0dab5d4219b881b1fceff124
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1f4bf28fe4c878a3d8a91e228055cc50bda3ec62f043fc012f7016b1b72ce227
- MD5 bc9359088e7a5febaaf3698408cca502
- SHA1 264740265c911d17c7bfa3c61800f8bf995a9583
- SHA512 1329e2dc2e308f89131ad80fa47b9e7bd9485eeb3e29111471f49598124ab05ed7b3307fcd39ffd4b6d3f9ed92e2a5b4c7867b26985136ba6c988f5f8b60f12f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 38d53932959e2723046b6a55222576068cffdcdaa1eca1ebc25414c75e55982c
- MD5 03fde4a2edc38a220a187564fd63c449
- SHA1 aa1596ddbce6239dc28ea564cc6a1f401ae20e81
- SHA512 fd573c40da8db3f8a4791a4a4237e1527e861e9426046aa9970ce40e1b1fc346dd54bd0376de4c6e2543baa88f6d0b4d4eba10a4b2e69e8ae5346c79a4fdc4b1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 778667f33ef705cf20b7e853d20e7d0022c4bf9d18d0cf01a2ea6fe783010e0a
- MD5 2011618dc9a78fff50c692c08c82123e
- SHA1 2dd8b618dee4d0698acae1f4270ca3bb34d29ce0
- SHA512 fb329c83c5b1721548d35fd9d159933a686960e7923aa4c772f99c0622be6309a3003fe78041c594b0efa963e40b556119b598a53bb63a77da3e4b10df87619f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 674fa414bb79e7d375cf98114fcf1cce2baa3cd293faa9717ccabaf9fe2a4c64
- MD5 f63521d38379baae8b3f140e06e634cb
- SHA1 2936014ce1fc911b81c747a4b59c55af6a0b01b4
- SHA512 661f1785d481c1bc2b46f4f35b02bc5bee4d815f2cb91adeaf4ed56d627a0e8ae81c4925ddcaaaa92dde8ea313b9365aeb720f1a09bba8abe064a9f234973699
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e5fda59b043acb13ff0b08cd17b6c0431e27e39874814b8ba990dc61f1461453
- MD5 e8dfaf19c559886a4f57dac21d80299b
- SHA1 0717cd67eadb8dcd7f002bb2b88665b08b8d570d
- SHA512 3c102206e3bc11ac236e4115c7b73ec5e4e412a97b2568781becb0a04f370a6aa6fed0df8f4b5873d7307f2ae88f4f7b72491537c8572efcd623cfc60a7f3bb5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fb8c34d410af72580feeedcbd6dfa4f3efd210fef62892cfb4f33baa9c80ba92
- MD5 804f6a99268a676f16c20d7efcf09e13
- SHA1 cfa9a6fab397792fac2de03cb1a943732cc4882c
- SHA512 28c6acf1689f100a8d09bae649698ce4c4aedd80c71e5698b4f2751011db6535485e638e328a6ca8d516e63a46088160b8054cc06099caafe975c54443e118f5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3b012a1d35d60a984bc9b8189d77e100c56ef1772859e811eef5942a75d72abf
- MD5 8b614c11c19a04c0ddf561674c92a657
- SHA1 9631b184804fc83bde6cff5376a1f446d6fbdf3c
- SHA512 4879caee3d3148c4bad33bb77d3273ad88de518655a9f63da314ccd63c4841aca112923cc698079672ad0f20b1d2a29befbc7f40c925049ea04ca2b06ce97e40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\11.0.1[1].js
- Size 106B
- SHA256 c58c444af409b74761d5cb4a86fde4b48ee2d4701252b439834f01868c8cb955
- MD5 fdffada99a6e326385c9d6d22006b6c8
- SHA1 f69101fdeeb5282659ebffa17ec82e89a0cd09f9
- SHA512 a7190172ebb6023d27a69629801b9b71cba77f7f4889aecb129ea8b8e84fef7bd1cc21ca3ee2fe327bd4d97f30bee5ed40927f2a54d45a13c66edca653a60f3d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\ab77b6ea7f3fbf79[1].js
- Size 478B
- SHA256 928131ab2183d971cdbfe2ed1329200212d0021db70574a35c89ae169c0f6e0a
- MD5 5dd27f8f2b042194c3cdabd62fd80110
- SHA1 c035036a939799d4c29b9c0f7229ae1953d03109
- SHA512 95c7b2dba57dd75e6120794c0ff14750258d8ca3c86e6efcf04790d347bda18e246e14d5fd8ce645e46e268f978132407bafa93ca97fa003103b59c6135334ba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1F65.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2085.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP