Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
84730b26a4cb34cd581281d681f8aef3_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
84730b26a4cb34cd581281d681f8aef3_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 84730b26a4cb34cd581281d681f8aef3_JaffaCakes118.html
- Size 27KB
- Sample240530-rnp2bsce59
- SHA256 2df5a4f8b1bec6ea7faa4602bc3db523f8aa401d8cad0bdeab68102ea7802feb
- MD5 84730b26a4cb34cd581281d681f8aef3
- SHA1 1a1d216975b6b296283f35b651fdf5d977a5c92a
- SHA512 2d24fdf536f96ae1ba01afc15cd4525d3e7a0586346d7104afc1b5f05ba2cb388de1e26cf774403a3da98a1019d4a0bab304242e2227aeae335a9a48d7a6a329
- SSDEEP 192:uwL0b5noenQjxn5Q/rnQieSNnonQOkEntplnQTbnpnQ9eAKm6uZOgQl7MByqnYnK:NQ/wpioODSUvc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423240704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8FF0701-1E8F-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE 1200 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1200 2980 iexplore.exe 28 PID 2980 wrote to memory of 1200 2980 iexplore.exe 28 PID 2980 wrote to memory of 1200 2980 iexplore.exe 28 PID 2980 wrote to memory of 1200 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84730b26a4cb34cd581281d681f8aef3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c6c44658aa4338b67deddbe9b4b93d6b46f93b64f2746de9036273d276d5a922
- MD5 667e0886a579c382b055bb7fce823373
- SHA1 dade644563abc31575ee9528f14eb9353145bcfd
- SHA512 ead187593aaf18a301c1a89944573d21c51235ed6e2de00b6efed7d4c257f9d57c7cc49da620f700ae7a9d5d30810ace97d128ddfbd8490a3f202f298ea6f348
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b7e15da6a85dfecf13f35b5c1ed32c12d37a5dda372a5a61a36003b95ce543a9
- MD5 706023f7d6a8b69f4d26d54b90379343
- SHA1 ed6af9cba178f9cce260ee0801dacc962bf37f4a
- SHA512 f8d61bc6d403b5d767cfeb4dea2cf7915bfbc134d4309d18177eb24616d9305e8d0af86ae620d7489817f31221fc1d6164f2992ed5d773105702d9a755c866e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b9b4690bf6988921f63bce98930092afed13f2b61d9adad27957b208b5846c23
- MD5 a27fb636c6cf57e98cd5763fde0a8457
- SHA1 512f7e52e80a1bf5915f3c97abd25ddab7fbc331
- SHA512 25d2cf7640af067750b68b2381524c78a1de50a53769002ca3a3dcd52dc3676fa583f750673c3bae4497ea1cab3958205e843b9b118557c211323a5e887d88fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 91da20fbe8baa36d53db2d8ea3daa86de6009db6a65e4c4b33f29f1e9c87fd6f
- MD5 2568e1c4d9e6bf41bf25a96ecd5890cb
- SHA1 31f3caad5a58c854b11d70881f42baf1d178a607
- SHA512 f26181053c5d4592940d9693581e899799f422783ee7a21481b380a1dc799852ffd8b895b681ae6da563fdaf21d4fc0387782fb246d574f7302f8d04efbebc07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2c559cf137905e91737aea4cca43d059e90fc78a2b46c8157b7036fc45c20b32
- MD5 7ff3b4e8cf2d2bc26fc5250432f551c0
- SHA1 c95633c2e26d64ab942be4b12710e94c0a625531
- SHA512 6ee60c7e5a415123a885014a97ae72c3ce8f042e1a508210c9fcffbaf922cda8b325ad4be3d42fa89ca3ec15dedb54f183b18b9ff6b61570e5ec1840209b6891
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 36d33a01675adc33d46d962829b3ca041ae471d4f7fb5228223be95334c97b0d
- MD5 b6757a81591f8288fcaf13448f101e0b
- SHA1 78e5ed103c792f0e534849f89f2dbec7bc322521
- SHA512 0a77d91b5c2b9e4db8b0185285ce6755dcab3cd6385c2706b4dff0fdeed8af4f9750a261187f59b0077fcc245ec92c23c0a6c273e30c526abdefe37597057b90
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aa347222376ed62f2fcf41cd64f0869624a00d1c53ebef3c2938f0869b1ae166
- MD5 1bf8ed3ed90333dff08b14f8b29743f1
- SHA1 17655a24f1bc78a179305ef63b9214c6140c069a
- SHA512 680953a84dc3d994f77ec5d06b325bd1a6ca43873878489d4b7daf00f1b9ee930d57c7426690dbc5716c41cfdea128232948d6a8e0739b834e540c861be35125
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4c15edfbb6326bab4780cad740fd138975b09246b6c8d6d791d219d3f6008a3b
- MD5 204c533517c2d8f2190b17191596ce3c
- SHA1 e1552d60fb2368ce3df49b5c638ca7ee434ee296
- SHA512 4020d93ea7cf422d2322eba8854f9e37f7fd927e11b0456812b1ac60b99ab877c8b00f6f2db52cbab28928cab9e81e8a0ee8ca74b17f8bf70919aac75ea87030
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0d4d18bfec765c41ced9403b6a13bda056fbdb249c823da53772718ce48bffe8
- MD5 9f204e7e9d02169b9571700a1b8e1654
- SHA1 2d76dbec173828e397d570e086daba28f4b9f1a5
- SHA512 22e450312dd8991d02609a09190288d533665c24e3fb1985842b135ad403f909f72165db4391128c85d8c0bfc45ac2c4b919ee8b897975b309ad9e5f935b5637
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab24B0.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2555.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP