Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
82dccd3778ae9fae32fcaf935a305970_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82dccd3778ae9fae32fcaf935a305970_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82dccd3778ae9fae32fcaf935a305970_JaffaCakes118.html
- Size 34KB
- Sample240530-dqtkmsdd36
- SHA256 680e38ff86e2d2f4a9b246c37e3ec0265e1900543a55307e88e72da00fe6c401
- MD5 82dccd3778ae9fae32fcaf935a305970
- SHA1 eef25b48e9dd701b0391013266558fb69101469a
- SHA512 1ba353d90c02a56ba82bfa4be1c9d0a131bc35ac275c6c76ef56729b427fe75ab8374fe9dc3bc1cfe882b6ea4d90cff420aa7bcc8cfc8f5d6f486f879bdc6f05
- SSDEEP 192:uwHNb5nz7ynQjxn5Q/anQieRNn+nQOkEntKgnQTbnRnQOgdcwqY2zcwqYxcwqYWa:XbQ/jHfe3mOO8etourk3L7PuVTd
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CE52BD1-1E32-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423200661" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1904 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1904 iexplore.exe 1904 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28 PID 1904 wrote to memory of 2564 1904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82dccd3778ae9fae32fcaf935a305970_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a5a5262c3ca269ffe51d9b99cbd5ec7567cc7150fd1402d1a0040e06d85b7fa2
- MD5 19877c767e9f4ef1f268fd105e22228b
- SHA1 6208eb8aa2c3870315d44513dca9c42b51c07aca
- SHA512 12d987213735e8876360cbbc7ed1616ce4c01cb86fa8ead137d2e81dcadee69a8beab70e941ce65c99104e11013fc5216c34f567f2f959ecde5738fb3c917cf5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c931669bcd6e1843f2ab6e14b9c6fe7f08aff46c7598464012fa773414e85e80
- MD5 0a88371d1bcb155e40eca86bb8b4ffda
- SHA1 0010e09fb9724c877ee1c18689567fcf2101f464
- SHA512 a49f4739d6b7b89ba21d5f84f889fd2154ab3f1d05131b5738a16d171073959f4d674b06f3703c802502a6259edf9d515eefce8e726eb20e59ca4de2c67194ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ceee61ee3566f9422a18640025106d92ae509249e6b13e5f20243c5c5bdd7a80
- MD5 347b564290fdc4ed8c5fb8d783e6bf82
- SHA1 bfb56fab83ef5339de11dd08d14cc929cdd23046
- SHA512 5263b04a55ce69170b55f43082c1ba28b1aef6d8f2849e5ece82c4d31cb3438df25cb8c7aa8ce57f719cac022976cb7376945690fb193a2b0cabac48967da2b1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 38b9e29250bf51823fbc06bd2f5fa60f10314c2289ec239daabe231e96fda9b6
- MD5 da11f2589137bdc0dbd3e4fb961f0683
- SHA1 42365668de832d79cdb1dee4080f1eacb3eb243c
- SHA512 d8cedee4cbdddfb849ae935d4506b97f382d036234a542e83df7ce23640acf702e21e298504faaf3a6664dee151b6f5e9549b0facf88364d9469e86b220808c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 32c73bdb435ba9a74d61888da6c150d51b3e1a75cff3a4269ccb0a0a29aa2144
- MD5 d2f5e486d32f8cbd758e24933957955a
- SHA1 30a03b2c9991adef9586c33fb23807d7d4085099
- SHA512 0012a923d2557afb37b6c43836226816a7dad38284c741f8bc63abfae6133fb666871532bce0cd9bf5d38c814ea9d5ccfab3a75bb56bbbb8f86cb9f734f7eae1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6626186a5a7883822417a2b9185c3c1656b3f508443a3492887673f8b111013c
- MD5 26ff1c14981d93f91815bea2848b85c6
- SHA1 479b28d3444a6c34e0be01b187ee010936a3b310
- SHA512 c44fd15ff20f3ddc215d4a88c580c4318c6526805e5edf0c823c7219aa84f1b23f213a27a15b8351dbbfdf6ab7583c11e3e1b692fca735bd5eee4545fe1fd019
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cbae3ed35e5d677fb3549e7a20dc81cfdadce8b176f4782be41198b7e66e9933
- MD5 d485d2731701a9d0a048431357bb451b
- SHA1 de521c54a1fb354d7ef4644580e3e9b8d9c1b431
- SHA512 6db6d1ea1b9dc2de0c53787b3d713a4885ae02a7e2bd6659336c2cd6c5fd52c7a1be7cc881677ecfe5a30d0217f2e7152412c3ef95f9ac8dd58599fff78c3d93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7fdde6627f0986cfbed4dcb24a3d4b9517e97a6dde33dec73b67d2bdb4ecf88e
- MD5 57e2ecaac20e6d9bf462a199b1fd487d
- SHA1 c2da3e84c87ddb9637fa480a71f1a32ff61ed411
- SHA512 67415b9b7771f49e71f2e2065d357f1bb06fa6a5b8272d4283087921d61b6080b1b3426371422b211a024a367a4c03dc07a5e7dfca68984eecaf2fdca1ffc467
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 54198130eaecabf5efd7e99f40615550eaf1e8cff3afa8770e8dd214a7cebdc8
- MD5 796e54409940c002b8391a30a2175e47
- SHA1 0df1c3063a4d4cc12b17766cf4ce0ba50413fa3e
- SHA512 31140c610af31a6bcdac93db8e0509c00434c786bd898cab8afd65a1eed3bef9fa9cf9ba9c8ae2ebc913651596ccfcad8d62e55ff078b82a9b3bd0a84385da7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1C88.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1D2C.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP