Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
29/05/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
8073346ef9ccea1b48218714e792d1de_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8073346ef9ccea1b48218714e792d1de_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8073346ef9ccea1b48218714e792d1de_JaffaCakes118.html
- Size 41KB
- Sample240529-mnnfaace33
- SHA256 f4c3552b6817ee68379caf7f61b802f791b7b253a43756415f01dffaa8c55d8e
- MD5 8073346ef9ccea1b48218714e792d1de
- SHA1 7557ad46c669c2ec5ba46e0b697019bd7e336682
- SHA512 8f3eff460ebcd5865f5fd0e4188c5198dc78d6aa6ac4d0fe2b0e00ddc91c485d227a3a7050bdb7c188e86b3f1ac2e608d260e019f8c923e75d45133e0c85ca72
- SSDEEP 192:uw3vb5nCGnQjxn5Q/2nQieFNnbnQOkEnt+0nQTbnpnQmSgxGQSUs37fG4ynNcqXy:cQ/Mvx461SaVTWVeM
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423140884" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D1BE5A1-1DA7-11EF-8859-DE62917EBCA6} = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2504 iexplore.exe 2504 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28 PID 2504 wrote to memory of 2900 2504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8073346ef9ccea1b48218714e792d1de_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 14f527c07619802c6e5b25f9ad0d7e4e93d3503c044f05fa24fd01ffe8c4ded0
- MD5 d79b24c8dce4be4d0a264340030b71e0
- SHA1 54b0237cdcf05d68f60ce73e01aa8e2f84c9a4da
- SHA512 eff220aa53e48fe78ad1e4fe2cd8322be30ab31a665ab2e45dafdb848a875dfda2a7826ba48413f4c4173b276804ccf0e472f76bb99e3119a0f21e384655d0db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ed5fafe34afe547c42d64600eced172a0fd89e8a520c86c845ed4542a9e8a1fc
- MD5 fb46ee1401d5e213108deccea95e5df8
- SHA1 912a385458a3fa30c056ce8253b79747f6f10f82
- SHA512 e5488bfe6fd969f649c9e1abfbcd622b45316db56b7e11d5ff5baae7c1d326b3a2fbfd870767ff8697e85803d86e057a0eeb019392d1e35dcc6c721578def453
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9dc2e157d732192a3f58ac40d41aadc5af67c62c5e83d673faf5e7c46a3eb7bc
- MD5 d343f751cdd51fdee1567d58c3e58122
- SHA1 62125e0651d30ab219b0df03c8b81101d9973058
- SHA512 64144d86ae52d0895c45ff4d87b7279fe930247f8d68a28ca8713903bee4c97f47877d4cbbfa0a4e0c6881205d806d4e70be7e52843205fc647cca7f2e88446e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ddc286db5cdc5ffa533561b575ae9dac3ea86571324be74a0df08f19b87c36fa
- MD5 17c2b4c91b7dff34e3f86fb757d84331
- SHA1 8ad84629b53b1f6a82197e39c40d8f2b2b9cbd78
- SHA512 ea937acd96276e9fe6aef614ec87e1072b4469fda4668946c060ffb14fa7b2760a16b4665a8d36ae2e157129f9c8d7afb933541beb2b7529da9095a3fd34cefe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 42c57d5d03d9d4d03ee092276dcaf7c4e26467e39374c08ad238963a96ccc022
- MD5 554c4b69c566d2d1c07a9619770d8845
- SHA1 5264ebf0112bce2d4a61a23ce9ada61023cf12fd
- SHA512 fd418256d4c32814b7b97be86f9c15f45c47749d185abe53140583fb35927e3e17466fdb0db1aff0ba09925605d9058cc812dbbc1244acde37c81c9bb588385f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab96D4.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab97C1.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar97F7.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP