Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
846d680242d3a217f06b0875aea135bc_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
846d680242d3a217f06b0875aea135bc_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 846d680242d3a217f06b0875aea135bc_JaffaCakes118.html
- Size 32KB
- Sample240530-rjbcdabc4x
- SHA256 16eddf0919706d919d5366b1f5c991191a8dbb7757df45c2a106a91520de17f2
- MD5 846d680242d3a217f06b0875aea135bc
- SHA1 59996afb529114f84554c667573289dfb40a3c24
- SHA512 d797bdcf80e7dc1d7a457751f37d1a0d6e3db22fbe9d02bc5001aa990ead4dddc80ec7cf11ee5b87e695335e1a32162bc2a6da00fc3a41156520a4818aa91e9a
- SSDEEP 192:uWrSb5n76nQjxn5Q/bnQieKNnEnQOkEntVpnQTbndnQzuMC3AlStO+N2RjIt6+XI:CQ/WupttOe2RUt6+XOoqPqnjo1+ID5ws
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423240243" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B59FD961-1E8E-11EF-9066-F6F8CE09FCD4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE 2172 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2172 2316 iexplore.exe 28 PID 2316 wrote to memory of 2172 2316 iexplore.exe 28 PID 2316 wrote to memory of 2172 2316 iexplore.exe 28 PID 2316 wrote to memory of 2172 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\846d680242d3a217f06b0875aea135bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 897a5afc6647ec5b06200bb342382b2a509ef25741cabae9fb2c15f41550bbcc
- MD5 92229f3fead7bbe86eb743bf3c8656b6
- SHA1 abe2ce31418eb8081b0f180b8d871613804b88f5
- SHA512 27c36a5d39604ad81a6e008964f347cd3641649f934cc13583e92b876a7699e86cf553ad93646852182e11bad4aeeaba7c83bf4297751f6654874e2c18acc9ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f17ea757c7c942d2ea05da8898ada52dcc8575bad69350d8ef9ebd23e7c6102b
- MD5 ad128724bde426b9710828804982b8ce
- SHA1 5653f860d6f2e705d332e5ab3b38da240b0e556a
- SHA512 a13905a3b5c6a4ace39d5738ef6da689c45a51e0ece7ed9155cf693e71c02e73cab9eb4ba0c3b7e52bca151cecc6c7104d5e569e3556279c4501ff86c58c754e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7c3bf3220bc865fecc50ce0eac30a3805ae972c083940c3aa0866301aaaa423e
- MD5 ca7a9deada55697d60ba68406eaafcf6
- SHA1 8f71539c9fabd3cb543ed07fab0d594b1da8740d
- SHA512 e1de8dd893bf4d9098de1bf3fd0e2ce69e158b8d75e82a73e6ed6320b0aca2588039896a6aa6cb31e2d6e1eb9c4ad3528449c0d1eb2c41e60f78b34fb04baa1d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3ed17b4d2f2688955c05a5ce2c6aa6039f5f7c5db486487b1634fb6efb3b8563
- MD5 dd8d3ba159748ffba64494ba7042f784
- SHA1 e2a1119ed1b2294e6934f76026166ba663f1401d
- SHA512 cb79b47b05fcb144220412584e760b48a1974b1b195025d6e8078cf5c211b12c27c2358a801a4ea40afc63c150bd71a67d14a16c05e78b6e6054f76c540659c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0450aa4dd573f13f90628146a74e9f64f8e370288c0491af9cb2b2b7910930b4
- MD5 dd8510df4e2ff5fe4146a9e0631e6c61
- SHA1 c45bee4aecf025141bc1e9061051c330fc0c669d
- SHA512 9aada29dfa9f4305e7a7191320b7133a8ef7bd4a16f864da75681eea040cbc1ade25fb588ab4f108480b4becc2b35d1ac126fd0dabf680b87c5c267ce6e17a36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 05abbf10f2e99331c230bbb841d96d6ac75012fe02d9595ac09220f2593aafe9
- MD5 3a929dfe1bad0ad398dd4a82376b39df
- SHA1 62bc5b6423c619976df4cc7ce3b36427a43bf6f9
- SHA512 2d8250ec65d93356589ef5c4945d59e7f93dc1b50c01deaa6e218ac9548e64c0a9a6083eb5724ec8c963d4463148a78947ce2ea9c64ea4d24e3ba58fafc2a75b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f93f0e12a5332c0509deeb993e6e20179193e61d5517b38e6caaf7785a50bb17
- MD5 ad3799bd4399710bb0c03f1606db74ac
- SHA1 70ff9630c5d283d252a495d3c404052d392b39f3
- SHA512 6bd33e743df9c3a24f28612db00931544436938b53da37670fcbb333c3b57a88b697cee10bd9709a45794423be59a099ea9cfb22e2d0761488e4bc9e97a6061e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b262fa425684e83dc5258e87169cc19d5b4e9f2f692ba15a42600e6175ff28f2
- MD5 a063d5eb2c9168372e4d3424f6a04765
- SHA1 6d9c07b74d0f0a69f82fd3fc77a38a5c98251b79
- SHA512 83734b08498c979bbaeea5ab5c1d7a1f57fe6ddda767a6452248edd36db0f92874216d93d3abf121bbb7c28c9fcf0e34cc23f7a370d923a079c585352f4491b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a540b52445210d20a9b8393a2c934bdffcc2d6efac51c05b94507999d9cfeed4
- MD5 d2eb3cd5d36428c7dd608685986e737c
- SHA1 69db7dc5e310b940e41efc0334887ff9d953291e
- SHA512 fcd2c8614098e108a31864fa66ff6ba9ef6ad9f3085cdd1f4e0d6296a68e05bd5c3bbac2a6d354489ada81f2ab7b9659035c4c5b723c5f7c09e4cfa9a2192fac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cfe04534160b0bace7fbf782f72c471c2e90375c995515d89ed2bfb8777912a7
- MD5 8502381d248bb82fb3517f50134925e2
- SHA1 67e12ed19fb9dd179981df621d8cdb75abef53f1
- SHA512 eda8637d6329518da72ae39113cbe9d0a3c9f7c259f87853d925cec910899c411a8dcf71c21719efa8825f6b64addafbf39d35f87d664976596d5f505a5879fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 bba5dee0c5007c27aea1f35ed8806224d51f1c9845ceac6a130cefe9840d44ce
- MD5 92d7b2862c2e4b84be2e015574718893
- SHA1 5008f75071026f5fc3a754e14b786cdd16e8faf4
- SHA512 21f87af424313d1b3957da3369d6a4b205636403b0b51fbe2a937e9653bae60ad3aa61dd5c3f5331f67418c42a0ba2bd6dd24b5351d83e643c31ec8fadfa6dcb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Tar102C.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP