Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
28/05/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
7c05c34e7ae038a8a2f2b2ac5b084c2b_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c05c34e7ae038a8a2f2b2ac5b084c2b_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7c05c34e7ae038a8a2f2b2ac5b084c2b_JaffaCakes118.html
- Size 27KB
- Sample240528-haffashd5x
- SHA256 61a0abfe5fc4f7448ec3323f9649d9c75da81f87c70970e3be283a7fc49e17aa
- MD5 7c05c34e7ae038a8a2f2b2ac5b084c2b
- SHA1 6aa1b0f42baff7e851de5be80ac281e4dfa84810
- SHA512 430dc59102d15eb6beb98f4f7c9fb331b6dbfcdce6ff6ce383fb9c964e536cd217e2d6e0e8a5a272ab6119727e7732539c18de60b2aae40b87b84c616030b7c3
- SSDEEP 192:uw/Qb5nYunQjxn5Q/3nQieONn5nQOkEntFtnQTbnRnQ9eIqm609ukQl7MBuqnYnA:hQ/P1CyuPSgu
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F568C181-1CBB-11EF-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423039775" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 764 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 764 iexplore.exe 764 iexplore.exe 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 764 wrote to memory of 1708 764 iexplore.exe 28 PID 764 wrote to memory of 1708 764 iexplore.exe 28 PID 764 wrote to memory of 1708 764 iexplore.exe 28 PID 764 wrote to memory of 1708 764 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c05c34e7ae038a8a2f2b2ac5b084c2b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4fe9f3a690953615cae49a9b9962d9661f23234e1d0be1659a99661464366a89
- MD5 26b2f34c9d4febcc56c79ad7f02b8013
- SHA1 191d63af7966c93bd989c4c3875699c283b62216
- SHA512 eb4efdc8912153043e5ef5ec9c6389779623775bbf8729c5f6bf58bce901fcd7074ac63ca481e70cd09a0e1001f9e158ffe30cf20fac97b77010d70ac66963c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 da5dcf6ff29f5b80793bb867e6817ec1d3405768cdac8fb4b7503bbce59be14e
- MD5 6edf9bc7ecbfed88abce5281c7ccdacc
- SHA1 f7ff39a7084018f55db340adc4a41ddd2c3a2fed
- SHA512 1e9a043191078fc011c3e16ae067d0fa909e2157f966d1b4471407d6706849b95ee858be55b774d51294cc812cd3028771fb8f51f8a74ce636962f7366c857b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5aeb8cce2224aed986a7acf85803f26e2f21182d4be426adbbb46fd61a989e18
- MD5 bce0ac57d1a9a88630d80bedcb089333
- SHA1 72b38151df0e0e9654cbbb4f470a10182a193983
- SHA512 a94dae10cc33cd35617e343d9b93bbe3cdf8fc4033c82d077d5424df3ba07d03c17ec0993f50ff07403badfd35f83fcf35e5e8fdc3181be8001d5e28ec9a6ea6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 641fbeb2c86885e27688a9582b1e8011b530fdbfd4138f298cfa34b0fea13fea
- MD5 5130ce200a5d59c79aacc66b0ec3da5b
- SHA1 1be08b3da1da5b9e1f1b09b7ec93c3a67190c47b
- SHA512 942e9f664e03051531ee8e05e122dd5a569d59263929119c5ce33ec47276017673c8c6f8e9b56333ff036da7bc3bb9d0e105ff4e5932775f1e2ec1f1e923af0e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 f9ef6a6091cfe07d27e06354234278cab53dd8a4265a1a9591088641940fad92
- MD5 e28bdfcf62864cfddad84075ce14f6d4
- SHA1 2c9027a088fb2a754a201c4bd74d771b9988074e
- SHA512 87ab24cd18ed5ac1c4e5473e892ba7a4f6c4534936b83f272f62a0153ee16d41575ce77fe4fc8eea2def1967931110e3707ae5dc2e91be8daad9f6ecdd158f8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3b90cbb13a1065bfe05ba8d3edffc1ac1963ab66bf58599b4bacea0911ae9365
- MD5 eaad41db4907af384c78f354f0f90f0b
- SHA1 1b4ff9d95e765803a22e24493a626af0206e3a89
- SHA512 dda09f9e408ee396cb8251d07849a567bf676f4433ffaa715cc5256462e01be719fe953ea2f9bf7c3b1e027f592d29e9b842be3416ea98034c628cf8485bcb22
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 842690513a77251fd03c502f772def6823086f09cfa4707d5291406275bdfb5c
- MD5 3d7e3333077ac3363b0caffa95d82551
- SHA1 4a63e3673232d41e08726a5483baea9ce78723b4
- SHA512 fefd4843079373a73eced3d923b79808efb0868045c5a14c0347154bd130c0ff3a7d4390ec8b9076750fda42a72b9b3fd227c33ffa73b21760d28425f9633b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8822400d01e64e6ea8e16adfa4ba97ddf5aca6a6568d26b311c45f35d53fa35c
- MD5 cbc83530e046ef8292a1b8976246910d
- SHA1 d131166ed0f2d4232f61411480487402cabe20e9
- SHA512 314b47817a1eee13fc04c076f8bddf8a79032daf983e6c8172a21171cc3ab7b2167f8e18ca6792f7501f0242e84268a385ab2f9463602fedcdee300629035ec1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 727d0fe884436edc801972f4009d9c3a8c8c3f8f5e99746de0c88329e62a39c7
- MD5 16e284655b40eac185015f31ec201214
- SHA1 f783fa1ae9c32a5087c013ec6b0a7f79ac1e9ff1
- SHA512 067c39264f20d0c6338a684adc389b42d8661afa68eb6c677fba1d6ef52e834fe33aad0957ed2f2857277e18aad38874e9b820a9dabf794fe03961eea8f51eb3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab15F2.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1705.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP