Analysis
- max time kernel
120s - max time network
127s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
82f3cb18bb9c2de37402555889781642_JaffaCakes118.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
82f3cb18bb9c2de37402555889781642_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 82f3cb18bb9c2de37402555889781642_JaffaCakes118.html
- Size 162KB
- Sample240530-edpllaed58
- SHA256 097eeb34a8b9aec75cc7979e7d21a120e7d421bfb41deea0008ec839eb2b72d5
- MD5 82f3cb18bb9c2de37402555889781642
- SHA1 f1e26a4b5d9d6ecc4fa1242e6f5112e6889b66fc
- SHA512 060ecdb9e318d35b4b99bd66a190aa6293a9963575ef4b3c33136dbd1702aa411f4652b020e8d41acb5367e86b9f001b0c0a9bc61f74c8a81e0f454526d837fa
- SSDEEP 3072:SgT6LAR5J/21l4yWoaewgWLRSSxTGIcgF/qaCqLlP+xqvd5yfkMY+BES09JXAny+:SER5J/21l4yWoaewgWLRSSxTGIcgF/qT
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10889c7a44b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5A73501-1E37-11EF-A6AA-4E798A8644E3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a116a7b0155ca446b548bdf3ffb74c1900000000020000000000106600000001000020000000f70a42313a3880b28cd6cfba2bc4f80cbce2ac311b790bd558154a1fcdce45c5000000000e800000000200002000000058ca76198ccdbf61859bb97c9eb313b8ce96bc072a67b7ccb0a36e4c3a105b9720000000c2eb566247295d2372e7a0ca4f5018a1f2db06cd22a0476ad0dd66c6eedaa6f44000000086c361263c3ca8aaa76397fc61da8fa15b986d509e68ddbe2a1168e65093be042c2a3fc25bbf4d4d7ce615e44888e357330b2fd5b797ca9e677805d070e3248c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423202850" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a116a7b0155ca446b548bdf3ffb74c19000000000200000000001066000000010000200000008df87e3a768dc31855e1d5702b74afde4d81c0ebb9852cd07f52a3129145f3bd000000000e80000000020000200000004d451f36349b23f9727850f034cc027d1c433a97230597c6c5fe8a0903569af190000000c505488f070b120b33ea0d01a96361337151b8cc8d30ee6e2376abbedf956f2f9a4681f683ca80ccbbd95496fd8c24cdcf6785fb5a044d324aee350e99e64d21fe18575ccb9315d3fa3972d323db40fbb54cc90f6ab183c146e7ca3fef77079d64301730afc65cffeccda71d1712730552e168aaaa0c9248397cb7d464ce77df114c53b50244995a8f8f01d6e796f77e40000000c5fb2631d3bfa7fc0b391814e63a085b40efd0c4921eb5eba512afa85f930b540e8d32d0a3a5d35d0c394c8389b36e015622bd672426ea5d15e30ce4d97aadec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 844 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 844 iexplore.exe 844 iexplore.exe 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28 PID 844 wrote to memory of 1828 844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82f3cb18bb9c2de37402555889781642_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aad404d88fe3ec86103dbecab0461edfc97e21e52b09188a306dacd2ab0beb87
- MD5 09952870c734cd39360a18f5273cdcf4
- SHA1 f28fb9678a93742124b6f3236d0bac305930d0e5
- SHA512 4cd65d740e2cf731ad573548f9980df6f852fe68828dad9085afa5d0ca9d615238c5d308695b67452d397acf1971b179ee8ac3d5823b4b4b8e8dd619bd3afc25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7561161caf1cf279daf2182d1c8864e5b2d3e4c83b44bad2d7106ef891b56a1d
- MD5 e60fd0a3cc3efdd84643072806888516
- SHA1 94504af7d400c7a2c9ef49b52310fcd23f47448d
- SHA512 15463f2bcbea1891a5d33af4b1613f48ee9c466400087d3284f939e34d83ba7c4d00ebf8b3c1e231e3fac43e662f9a1391597a2a51052572e8023a48f90ab3d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6600e0a950bc4f2197bfc2be5bbae06c641809645e8b89df2ac33f6e2ea133da
- MD5 e65361b7c4b2a3ff62b78c589d7f9556
- SHA1 23ac669ad009027c0b51fb9acc8013556f05337e
- SHA512 3753677b7f3fa5aeda75b315c08e23660e803b57f6380b1236a1f86e07504834cd59ef89842730818c7516f8116877f42a27cef0850339c98705f8435067d846
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 206ad548e33a21778bf18314de61a90868798669d2ff1d5347fc905470a25ef7
- MD5 e84d84cbbc8d431b21aa33efcbc1c80c
- SHA1 3cdd301c477292c52f340760109a93bd84a20a4a
- SHA512 deb0c4f1a362f4806363d9da8129dd449b5c5c6cdde979ad9f86811698390a4b7a29a205a63cb6cafbb692197e53e6719261ce6c5d91d2d4e19787a81ad285a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b72894aa8161b7cab68c229076ec078dd6dd00ce71f4ca6127d71d4e4bd60d6b
- MD5 423bb6d3bdec14fa02e7615ea4d1e3e0
- SHA1 fa68b011694dfa8dfaa0ca4aef68b9470f93d8d9
- SHA512 44fb8b7e73e9295b14afc93e2e5eda266c3b91b87b61a0f3fd33e43ab411c2813c19cf145f421d719c524bdbaa5fd9a3706018e4cd83d23d62a2c94c5b9cdbef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 38cad1851d4093aa7754d0b7ba2efae1cf7aa1857b3e59d282b05db1c45d6efc
- MD5 21b90e7f0f59013c726cf38430ab8991
- SHA1 54b897939a99f01b6bddaf6b0dd2b1452eddb07d
- SHA512 3539ad696528b14b392494f8359d4198ac1d80312c2e2e9856009c5a3eff850f20c43f138e268ea098ebd662f5a378dc463c101a79c3261aed60408c89e492aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bc469deca5e5583feb66cabdb47ea1a4c1963f05bf917529f77081c8902ddfdc
- MD5 4768f12491f9a4effd6a3ae0af1c33a4
- SHA1 98292eda8805ec3c6f640a632cb862a748cb9950
- SHA512 4192666701a3daa34038aa47f3dce482f295469a2e10898b4632257058164f8165ef5dfc87c3db93f225f5366695a538eac08fde5f8914e4016bead827b6247e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d65e4394afe2588366d911247c517d32c74766abf07eae3d0519b68c48960bc7
- MD5 a7b8ebe85049efbd5aa33481ae518927
- SHA1 70a06bbb693a78c6c23ecc704f207e5fe2e2f6e5
- SHA512 a05949cecd15a67530219f793397a2b27046d0b75e62ca8bc78669527fc6309eae25185fce0279688314e5cce30bdc6029e2f869b60bdf18271e9aab54c856a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aee705dea6b51ca64079cfd6460295591766be8cac6a7dd60c499f55f249a8b2
- MD5 0a91c42d328c49131708724305bf29ca
- SHA1 d71b2ec1c01e03104ca810a5269443c56255d73b
- SHA512 ff3fc612e7e5574ef908f0b0c248c63154ff55481fac9ff83b5fa18f21031abdfb35f2020357bed8e606c02cf72605081e2cebf2caabe7e52863a6e7575b67d4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab23F7.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2518.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP