Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html
- Size 133KB
- Sample240530-3qd8dsff56
- SHA256 cf6c04f0951cb8dd3e47469f642f43521e66df328ab4ca8b7b91b91ec1925b64
- MD5 855163c1b2c2add75b5419c4c3f027a8
- SHA1 d5a5abc914bf0b153a2522bcc2f31fa267527055
- SHA512 340d53b133068e3f6ac7f4708af1ea75743109d7890d76b4192fe8c11c4c045b4ccfb766d1c7f9a03f0f91492f2ee7ba59ddd4ca5128fae58d481289091ecdb6
- SSDEEP 1536:SKDDyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SKDDyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{537EF181-1EDE-11EF-A0EE-F2EF6E19F123} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0692e28ebb2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe033c9ad3878c4a99ccc44f8f4c27a9000000000200000000001066000000010000200000002dcc1f896ec4ad942008d4bfca9126c5d84554443affc48b2bba49f22c4d6e25000000000e8000000002000020000000771a28a4b8969cb68aa41771f32cea0b57574430565da99ae451e109d7dcfa1720000000e4a37bc367b4c56919d7f5af1e7e73cc7ef8c6c3860028f2c7fa780dcbdb164440000000979945eac98706c25c32f4bf3fe52b77b1f42760234955c13c82ec0b276ced444fbae3fb88a197003bf861da3d23e4968f5d99083a06fcec66320b5a5a68e608 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423274453" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe033c9ad3878c4a99ccc44f8f4c27a900000000020000000000106600000001000020000000a44acff3da79a27c165441bffc16af27642ba33bfaf40f5f4940a49fc578a028000000000e800000000200002000000072d28988a66ad892cde9fc8b482de03977cff0af5e7f5fa0fc4d6e683dbdffde90000000bee635db0495ba92c10cbe21b0c13f22216d6eb785ef3d594b77d6a09cbba52df2fd1f1d3f409705e0c6e3b2202ba11393271b943c806374ba1e52936538c61808d7b90819abcf867ba5757fe1991378e48af09ac7613d3592757345a3624a346c3e2d01636e122ec2dc7afe74cadaf194fd8a1c7dcba2db6591dc574a5b7fdb93be7a20cec4d2ca0f45f0e3cdfd2cb54000000088e6156a9cbe5b9140e379f43dc3ac7f3aaf6366d4c1208195bc65e15fdc58a93143170adcf1a8af3dc78538cdc3856a24a256d509c9aa16bff4f4483cb683e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2928 2876 iexplore.exe 28 PID 2876 wrote to memory of 2928 2876 iexplore.exe 28 PID 2876 wrote to memory of 2928 2876 iexplore.exe 28 PID 2876 wrote to memory of 2928 2876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bc642c17b99cef8b90109128f5387dd48f7d766932255f91d9836e942f42d2d9
- MD5 bf2d8fd722b2f4b53cdd440b648cfcb2
- SHA1 42df0b49731d9cb2fc760f9b9511816112c78e2a
- SHA512 7841e992e13613cbc945c314f34b33f9ca2b5e94510d7fbb0eed596868578315a15985e949a40166dc4b7190bb18f6f9d9a164bd1dca4338750a3acdefcf7739
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9530216c8fcd742397c14a3d2d2e1582715eeac3d9c9d308171b7d1d18043cba
- MD5 2a82156217b4d86bdbcc5809382ec8ab
- SHA1 5a506ed9b955d06570df5dba97476918452db017
- SHA512 a2ae9f1fb0b11cff26f304bbd6e4988a95c1bc77ff6c189c830cad2ff4de5154ba2598e7eaa13c4f5c5d63528f8600e173ccf168ef8dab5ac041b52223da2759
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a73d01944f2b9096166272ea69aa46650e0f96cc5122396143b9ef5c7804c5a2
- MD5 a1d60fd829325abb7f2f427e16ddc49d
- SHA1 3ebe360e959920cfbfd4c9e84c233cee23cedb79
- SHA512 e6c5448de6569d16a5bf76d90b2334a96425067d6ac7b025c76bfcb4538d0ef92c84f6ad427134f56b254089c8ac77768451302f35734db791747425a2f8172e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0c9a8ff0a15a39af0735cdaa826223c35a389c39fe7bcd48f029c788bd5b238f
- MD5 bb068de240e5c6efafda351f72eb7652
- SHA1 747b7ab58c087144bf17296984948d05ba60ac06
- SHA512 bcfe85e6890982e4cf7c532b16bcd9fe132cc75df5a7f928bb45e9902168761d919056a6f67ab00009e64398b2c2c0fb72e2698fe7926e66f3991a47c04b0f90
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 93afca8d2aa999771f8b284e8218d0660367fdd64f2f78bd190ccdfd37b87292
- MD5 cf3edd0fb2ba1a3d09a7417429d5b774
- SHA1 8553ead555f3271cb4ef90d60e15527c7c6cb393
- SHA512 166f0ffaf3a825915e9d0da6d0120049086d1fae7104a33901012618ecf74ac30cc8552fb51ec9790f8861860429b083735dc9fa498299d43cbf1d69e0de8f54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d3ea141b1520e58ca1ac4ecb807b121aeec7f1b4796646fe1950e2f165a7bfa8
- MD5 7e32e063451850c6656d23391f302e59
- SHA1 2d252299afc5436231ce863f35ffe0f6743cfb29
- SHA512 e75237c282c67d348b0be6baf1bf4e98b1fb11918e22154782bd65fd9320aafba55ac741d3a6a8e8962795400968446063b4e7a88f61fd5b6c2b020ab31f3433
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 75cd229eab4350089f61ac15a6a9380b35f1163a81f695985e029a581752ec88
- MD5 f523398f5cc2eb9d39617e875ea610c2
- SHA1 6a4fad0fa867f3ad11908a846245439cedbab4ec
- SHA512 8547649a03afafc2e544ec8eee6561643ed139de46fe27882cb729325709dcac3abf4d85ee667a16e8c5608f89d5add69aa6618761b44cc0dcc8fccd5b8a187f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d40f1fd115eb528faf6e5b28da81efa5553954b504157205c82726fbbfdcafb5
- MD5 248448860cd970a203ecba29909128fd
- SHA1 c7273474c46f80fa54292c2b0a53f4b8a25ce010
- SHA512 b99fc1c25a54f287901ccdf9aa73ff1ed91bc268518c3653a5e44c3d6abe57c09e2c1c92c4ead7e77e80eae324e08a3851360fd024b7c75182d26b101f579fbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c8aeed451cbaca6a0791dd11ddb3e4352313cc4b0dbcf699fc500c832256dcfd
- MD5 753a39b6cd1209ab66a03d12f71f125c
- SHA1 b4f9db2f88ab9d9cd17aba76f5b642d25a99c6a7
- SHA512 b3faca786693cf13df5f19632127cfcd492bd9e00230422e2334a9390b69069cab35dc202fc348abf63e07557c075202958cc932d8492728f4f16585e796dea5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f057301adc48e9a49ac8a1e0f929374989481640c314545eaf6c71a04669e41a
- MD5 1f7157eda9298a234c5a8fbd33ebfb49
- SHA1 295d5637a6063648facc64e86217a4974194ad8a
- SHA512 2835a35aeffe98b8e17994784e2efd3765f8a3b457938a981660d699a0731a1528b13f186cff68a3f99a6b556e2005952cffbddc36310ccf1ead33cfed6959cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e2140e520aa48c253d0487b91b0dc11e738ad492a69dd17c6716d0c52fb6e901
- MD5 288f8d68ff1210f46f36f4a6a6c2275b
- SHA1 fd547cae1ad6e1f0406f1263bb92c2a442eb2e48
- SHA512 bcf963a6b5af81d0aa640d75673fb2a358eb7ae976b3a98b19b947d9c3688650903c0ea6f910eb786c554142bffed726a179615ac203a689c6553f0066d7456c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 635dbdf428f521375e3394020880f176eabc04d00ba075c21b58e06137ce30a7
- MD5 2dab633af9386a4bd20bd214e2f4bc1c
- SHA1 874676cc3e0a1458ebab25941d6e6e2b1d359f1e
- SHA512 a8dca45feeae83536fc6a6d291e1be26f681e87a6c3172a1e61a35f98f4ce43a0c4ba6a5a393740bdc20cd206053b751b6b5beb610d4d3baf9c5e877d293b37b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d229851342ec4a3ac301f5fa7014c6475aef3fe62444812e4760cac79218c0fd
- MD5 6552cefbec53306dd7cd13ca5b736a0a
- SHA1 93d51fa330d6769c1aaed1d38015fc8daae63fef
- SHA512 2e2eecccda60d2700feea5fd4e9a12a1a204c3cb21c17a22337c3a7ed8b5c297e69f802c7a37640af3b53efa3607cbae0f86f3d4ba113fc5adbea7361a88b48b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1650.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar17A0.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP