Analysis

  • max time kernel
    141s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 20:04

General

  • Target

    8b9d63590fb6353026721b6270186864_JaffaCakes118.html

  • Size

    139KB

  • MD5

    8b9d63590fb6353026721b6270186864

  • SHA1

    e8f96985f7af602c101be9963d3ae5b47db71532

  • SHA256

    df70c34ed1d8d36317eb9e0dffc8dce89546f4d2fca4f47b4de8f268bd19ab5f

  • SHA512

    9bade9c90286157e01062c685c48ef32a0cda6f9cbd7fb576341717eb41303fb9e9702cfbb266d0f4ff49d00393defb6430043bb2e1af29fa2747539c88c7ce3

  • SSDEEP

    1536:SuNdnkEwiTldJyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SuFFyfkMY+BES09JXAnyrZalI+YQ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b9d63590fb6353026721b6270186864_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3028

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          a2e1690ae721805f89a09af9bbde35e2

          SHA1

          70584a0e9dabb818bb6e067a8c4928912b48e65c

          SHA256

          1fa8d5b9dcee4a63e1668972f23c810aa383edede030622214bfcba2e3972e9f

          SHA512

          f4901eb6cd79ed6c5bbd127e860b2589b6a5ae7c83d55f809f94f6c01456592aa3ed13583ed87f636c4886f6fe5018e196adfe23221a2cb82ae95f40c56a1b6c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e09813a855d47501e53a93b42c0b950c

          SHA1

          0c2f9aad553defcb445d9cf28498d2193cade647

          SHA256

          56c74413004a67c6b9c77af16b92bb45547c14732b7f93810869d6921fee6cb7

          SHA512

          f3270de08b6b0d15114b1fbf94da3353a2d92df78df6b8009a612308981fc912ecab2c1770cd1c8af8027036c1813d727b9bc99eed576784c325143cb615fdd9

        • C:\Users\Admin\AppData\Local\Temp\CabE36.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\Tar133C.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b