Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
82dd9827999104b8bdfd770c9c7d4770_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82dd9827999104b8bdfd770c9c7d4770_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82dd9827999104b8bdfd770c9c7d4770_JaffaCakes118.html
- Size 32KB
- Sample240530-dr3vpscd8v
- SHA256 543c121ba1017677ca52c683cda5f2e16abb4ca0c041c90aa640e87f18006bd3
- MD5 82dd9827999104b8bdfd770c9c7d4770
- SHA1 a906d041fb387c7b4092e6b897902aa4b90c4049
- SHA512 3963ad89e65d47ddf37c305dfe2720571867de97d555c0acb87df4351fff7a1b0bb1e9dbdb759ef2226382fd09f9dde5ce488fbbe1fd30c71b165588d53b6f7a
- SSDEEP 192:uw7yBb5nLJB4nQjxn5Q/vnQiemNn4nQOkEntRtnQTbnVnQmS1xhGHJvfb3jxyrK4:gQ/RyxczjxyWok0Qs
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423200793" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBA47141-1E32-11EF-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2620 1628 iexplore.exe 28 PID 1628 wrote to memory of 2620 1628 iexplore.exe 28 PID 1628 wrote to memory of 2620 1628 iexplore.exe 28 PID 1628 wrote to memory of 2620 1628 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82dd9827999104b8bdfd770c9c7d4770_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1eeaacc1f42d536cdfc0512070822befad12f77098e6a38bad20e74660ebf8df
- MD5 070b9b09813fa2fe9a0c06fe0dd99844
- SHA1 8cb3f3b4064a40eb5aa261e6a3dc6a679dd73f05
- SHA512 712fc6b297c4346557736a4d241c65638905df8ce53c3eba516c083a8521649f3b4d2d4c271c1abbe7e4759b359ecd24be5cd839946975ad34b11fbdf5bcc526
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 63f5b2084da5b263bcbced354c9bf4cdb4f58d77eb8414b652001755d1bb4925
- MD5 475033e0a5f6650680af4a07e027893b
- SHA1 3fe772eb11b1bfb2153a7e51659f8ca60aaddfe5
- SHA512 c3d08c057ed24787aadf056acab58a54e2eb551c0b8d1f7d5e9c08fa3b9aeb81e09a99c031e0a73d59322be604e970c0d4e97e9e61680e45141d96e68c62c2e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d626cf1a9e639cca370a228c2f9f7fb0998dab4b93e68033b95fcadf33c352fa
- MD5 992274d1e8ef6461760db239c1f58015
- SHA1 4087f7ce79bb95f3877ac20942c14c3e8c3c4ffa
- SHA512 505a5d63dc3f61025f8fb44fb567c7a330a494eb01f8c6b2b187ff0dbba175cebd2a28f13eadb3090769ec57d15c6a01cee7649811defd8670cc27b614f996b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6ef9be95c6036700c7f24f5616349b0ee7ac2a212bce68aa8875a0d940abb602
- MD5 4279598ffa49d383af327a035dfc1aa1
- SHA1 0040ceafd1bfbe2d4cae45c138c743ef8f8bbb1c
- SHA512 a0408f3bd2575161b195c9f11eb2a37d4f6b1940bf7dcdc5528055eea531e593ce7726b77ae1655763f29255fdd8b0a78e43f8ee5c5f6b017a4c3012f95662f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 854589e8516a9266bfcd014d8f3608d9ae598be9aff846135150dd32ca388935
- MD5 ad14bfcf215a978fa835e719eb73efe9
- SHA1 15b2190e3e0555c465a0f969d667a4cce032ce81
- SHA512 7f4f6648d99d495ff4fb677a258c7ff43f31647c1e10bb7d64c3abde7866b37e803481c5e09f778955eaf5ae90d89c1e2a5dee64386050c48e2ef790d9ebb568
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f8dc9366f4725f7885e684e9372e90bf0f92b7ccccf112a3162694752e4ee23f
- MD5 847ee0265589e52b0c62142ae1d4269d
- SHA1 56f9114440de7c2b9074066b910377bfb5646639
- SHA512 239aababa244ace932905417a35f3701b99190cc3498437fdf93b8be6d813f38dd4ec605d8f8d8d38337bc6ddb570f92f9201a25d0fc794a9abf1b8f14991fa6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 30ef964be294bbd0b5cae13ea09e1864e500cabe6a70ce8bd70ce8614d4be8cb
- MD5 6db52b53b9855bf850254a7cb65071ac
- SHA1 93d7c247e4728ee4ffe765f2c52c04b87abffc66
- SHA512 55f7da0096e7c27dd6c8a80e943316295ff0e8c6bf9956cbff98ff523a3712d2a6798c936df8d6d6e293ac13fce6646cb0ee5fb4e76e658aef5002d984a8273b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 927387f286c45acc6c398eaea420765a11060a129eb326e10dfd806d955a4e4d
- MD5 82ed123c7b34b4c15e73f3a23e70753c
- SHA1 c3ad5a1e03317d316e4e206d44475a7f859c9dc0
- SHA512 34a51cdb59906bfc32db4ec17201bf7130d617ad0376837d5a8455d703cce34cd4852de1506fcd1035c13ccee08fb632852fbb522ed5c27df94da8693c22f7b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 47781f85dacd51034c700b05bd74329cc2f03692ca4aa0f24cb883e1a9e4c8a9
- MD5 98eeac466ca653cdd7fd4e1b133ba46f
- SHA1 f4b30830c0f4ff9089c050adf835c954556c2c97
- SHA512 4f608e5987b994c68a04aec2cddc32c74f6849c35755756eb082416877a24b53719ba76a608b095b80e16618ab4ed8898ae2a272f016b79183acfaa2289488ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1E1D.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1EFF.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP