Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
02/06/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
8fc4d158666307bd5e88fd71a189cdde_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fc4d158666307bd5e88fd71a189cdde_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8fc4d158666307bd5e88fd71a189cdde_JaffaCakes118.html
- Size 34KB
- Sample240602-271bhsaf2y
- SHA256 fafbb2e3bc0431c31cc48d8ecd29e265c7c7f6497b2ac7d7da7f90163a6d9587
- MD5 8fc4d158666307bd5e88fd71a189cdde
- SHA1 8b31ddb9366d2231c923b0475c1602bd65e66b64
- SHA512 a67086bb5644d624289e933d2b89aee99bc338551018844096b0fa4ebd6d978ad22c41ea7a9edd9f419adf318f00bd7b2711c5242a40bc557c66c7910537a636
- SSDEEP 192:uwf0b5n/o+nQjxn5Q/fnQiemNncnQOkEnt9lnQTbnxnQOgLcwqYOcwqYacwqYQUO:9Q/f72c5UCalmQ5nbnoJ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423531919" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D218B2C1-2135-11EF-88AC-F2AB90EC9A26} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1824 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1824 iexplore.exe 1824 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28 PID 1824 wrote to memory of 2772 1824 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fc4d158666307bd5e88fd71a189cdde_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f7b3af023864c814e369f4c7afc98d6a188f36c3313b7676db147980f50a18af
- MD5 62c42f4e5196448dfb7504d029a02cee
- SHA1 5cac506ef6249fec872fe80e914c6e0802218ce5
- SHA512 30a25ccabc73664ff51b26df2ce881deefe059002e9a63717b976ac58dc4841d2e9db2daf23e7ba94bcadc991ba78455d6f65a5db9ba3857f89a8c39899803b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 586265cd6c32da6d8e8bedaea89a14efde8a5580eaecec18aa1646ada259b033
- MD5 d1539e75ffef8b9b9a40f42a67b41f8e
- SHA1 ebe6b859b5aeb65add076c335d3d10a86fc14e83
- SHA512 a65b78f2ce7ef4257d5ffab5464f76e269fd0bdc5ccf3e5e33633b5197a0091865db9bfcb3e152e71eb0c38ee907010302495983877e5e45267c852d35c32a34
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 20e25903b91d7f40beab886015c1292591a6c4904c95093bded481114ba47918
- MD5 ba4d2631e463d2ab0df00a0829c2a88e
- SHA1 11c60d63c1467c099c96dccfa4f3aa1ca14b462d
- SHA512 96d40cbc52886df5c9410011757846aedc9329aa1dad40aed17d8be16ba28099996c0e4567d77d7ed7f90920fadf95d13d98c8011f48244897ea65bdf900f0b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 69034a8bcd084c293ccfa94f830b7173216c1ddcb97242584833373ddb992249
- MD5 17c80e57c3a58adebb3b61d561611c96
- SHA1 1c8ed4e494e95befede1ba6a2598af3f6346456e
- SHA512 d581a1133488cb56c966dc3a0b89231fa955dd5332ddca1333fb9c6cad2bf9251388bc55a22c5d93a0dc9044439eb968bef74b16ef59835085274fc898566351
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bf73ddfc8a4b4ae18c849c1f58e98f3b20cb7b0ba95d768f6beeba6f6e3e7d96
- MD5 aff8090de50ed7ee6b6b0a82f4330da5
- SHA1 dcac06bfc5234790e7d995b6044d3fbec0485d22
- SHA512 c871f9ff9c92c4c74423e8b2f545f746c8140141c44797dc09fa6ce0146fd317a28608c528459f06d9493f2b1f6ed5c8165ba6e495ece73b5f958ca298926fca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c86bed0546fe6c9c694b98db8a7cc492534064e16f51e4a1455cbeb806b5d9ae
- MD5 7ad1e3e275daa20a4b5bf81edebc7c5d
- SHA1 5872d25bbf159e18a4baf7a62bcb088149c68ce0
- SHA512 cab8537e7eaf1bba5f86e92551a57b162c8fd6e2fa13107fc8e767b4ddfb6ee32405233a0ba07651b840d89bb13eba6c5a13a0986d1bb90de7205fae9dd7c246
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 405f5ab86704271ab48f0ebd1099088ce3c26bd2dc938ad4bc320e1de9baf243
- MD5 b28fd7d2e631e587573b94bc7557f6ca
- SHA1 33b2e99151a4affc50475fb220a3c7a0e008f156
- SHA512 cb2b57127d37d747dfd4b89cdc8c73b6611eb4aa523de5237d6a10fb48cb2dea988e0b6145cc405d5637dedc405e9ca62c8be3ab8836b6b43c5c9a45173e11f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e10d7d1e1a4ad0e001d4dc34733ff3b593475c2b8bbd477d068584002a7b31cb
- MD5 00f53a443bb9d1fd6ca1654216fb319f
- SHA1 be5d2e1328f6fc28b9a990682c3ff7571d722643
- SHA512 87c1a722aafd228aeb9175d39bd24fe41de0db1156a272e66484c0cc3669bb92735933b79689d6360695633b56d4b86439a7978e647c5d3a732fb5b9eec4570e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a06e7d5f5a5442756943a537d6a3b8d06bbad764a63b5647328693bf8119a0f1
- MD5 71e53c2373320aaee32eb70c08353f12
- SHA1 c89e6cb0be5eda2ba7502aa71fc6613e5a96a23d
- SHA512 67effc4627d5d44798859ee9b5cfe8875733317d59f3fecac5df453b2291a2b726986223c6b181c50a1c4e6f8ac3e991057d19e567142f86965a800fcfd35ce1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab485.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab514.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar528.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP