Analysis
- max time kernel
137s - max time network
140s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/06/2024, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
8fa90c81a991b53b176e94e5513148e9_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fa90c81a991b53b176e94e5513148e9_JaffaCakes118.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 8fa90c81a991b53b176e94e5513148e9_JaffaCakes118.html
- Size 24KB
- Sample240602-2fe69shd51
- SHA256 d4e54d96c62b2f3ec54a1b46e0ae7c73d3d1f50543f47777c73ad1e97897b5d4
- MD5 8fa90c81a991b53b176e94e5513148e9
- SHA1 b9da49675eeb6c029d27fed1a4bc62a2951cfaf7
- SHA512 066295dfe820ede61d2082fe760e90c78345249f37fa0d0e72c5fd63519174d11997f977f6dd908b8929dc355d6fb87ba61c59dbcc4812b230da3d1ba9b0495c
- SSDEEP 192:SIJteeN7ulOOZ2knmOaV5vStBFRoPQRTnUrmRuVx7mSs8UPoQ/CZJDS5YnT9aniQ:SARqlEOi5vGKQpUiRmMSs8UtqZudiQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2131461-212F-11EF-805C-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205cb9b53cb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423529349" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002eb7aa87a5f6c249a15032eb7424bdc200000000020000000000106600000001000020000000c7ea8535180e2bd2db2744b15ed5235c9f0df41a36e23021886dad5692adf1d9000000000e80000000020000200000002e8782b29f91d094e4e91effe87dd2ca08b0a2a82afeab125dfd73bbe09aa2ef900000000ba554650513b45337183c6d8e57ef6099ca26d6b54a7b035501edc2b4b744362d417e7df2dd6a03402afb1db8ff609b4210950fbc01bab4c62644207fc3c49eacf71366efcf282ae24270ccd646c3817709ad7b1d8bfdf7547abbfeb44e9f897088a94ae98e6494c31ff736d6d23d9c80d3813f168b829afc4320210dd5c41b6daa098f922fd6d7d02ee5dd56ce3c484000000057795cc2f47c2a44cc5986d1bc8aa472c0f9f5d64e09b22507eb7feb0ba50f3e52f8ae23ae665cae9fae1b83a86864d97c3693a2954a8342ba84df30917be192 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002eb7aa87a5f6c249a15032eb7424bdc2000000000200000000001066000000010000200000002a89152a7ba97ccf57512a8dc5ae1865bb756c0cdf3eed323ca0a10e3e30131b000000000e800000000200002000000075f14ff664afe09c90c7b574e2e0d343b15d5258ddba3820c720cc31bb8b28c720000000fcc1c599f6e409a52cf545854203d67f8e00f692e438d8f76eda13e8d1b77cde40000000ea6b8dde8c8f589be080ff5e5bf8b2b6bc43b43307c16cc1ce5942b1cdf15b1e14e1e19f8bd6ca039ca0b184ee39b6ef42f67d937e60ae13d0e7321018144053 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2804 2084 iexplore.exe 28 PID 2084 wrote to memory of 2804 2084 iexplore.exe 28 PID 2084 wrote to memory of 2804 2084 iexplore.exe 28 PID 2084 wrote to memory of 2804 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fa90c81a991b53b176e94e5513148e9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2C718E81AD5369394646EEC5A2FCC7FE
- Size 503B
- SHA256 33ba8acf280c36b435b8ef01961e5cf623eab37aaafeccd7c2ed7e6b42f1df95
- MD5 34409f6f5c59ecf44a8424cbb8d5860d
- SHA1 c92ae48cfb5b13a3cd76425f36c29145ea16e840
- SHA512 32074478dd20bd9267c795ebc492df1d64ab904950608d3fa67987edfac625949057f06236514fb1147103e74aed177df5603d0e9d9a0e35a852a2e0afbf7cbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 baab0226f1ce735768962d463bf90661ade5577bf6874247368ef33de3fb5349
- MD5 dcd15820b63341bc1731487c14435214
- SHA1 dc31ad53126fa3b32cc0dfffe3d969b9d7d0728b
- SHA512 853576da2c5ec168d399299679a84bec878c1daa5fcff68b1885144a005919d4072bf7c152157a1e1ba61644ae9a98272ab77f08d7ab7fbf57240dd9130fe218
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 35a66e5367bff0162f2bae925cd07e7836b1e30602f0e1c7c52c7746c838396b
- MD5 e824d66003bd281c1fdcedcab4cf1e1f
- SHA1 cf1ae6b71e7eeafaf8082653828cc357989e4c16
- SHA512 a5ca21c23eedfdf316785889fa98647bf89c4ff95145dd70d798fbca52f12ae1d81de608cf0a69fb55cabcc7979d9a4f5984081c8e43f583693ad2095258f6c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 59e37a540d1772af3c310d1aad95be0e4d94ad944e7f127d789e7827aff81c10
- MD5 57243c7545ebc8cd3d08e86d919080b3
- SHA1 afd7c14cd328a29f19c890f6a146194216b0be67
- SHA512 5fd4690865350d2fcb5eba258d337dbe8842280823b0485c6afeb03a26343f553703983127c12468f1612cab947ec84f56bd5ac5089db5bfb011fbc3c436aabd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 989dfd9564fb2d24a76fa451c7ecc28e29f249460e6bf04e24489e30260e4630
- MD5 404f5aec4a7341f0da963b3a22efd5e6
- SHA1 2568628468ec09714e975766d96fe4395acb844e
- SHA512 cff655c4db3b1292aab58b9ae8e03c88c4631b9d79ad90ff5af5d0479d9a0148b75900b1f6db59b049946a8d434fc1dfe9047e6c67440efbeb8d99a355f768b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5c591754cf273830fe5778cecf7f41bb3c10ed4b0e32be480144923e648bee3d
- MD5 efb0abb730b630a51def892597c37f57
- SHA1 d8377e9b193784e3c82b71735e1f230c839e7ce4
- SHA512 0735ecc7c34e049fd0c9808460b29d1c51187b2ae4272a1560b3c24a436ee39aac37d2aa0b97f34a6fad33ad95d92bfce3ea1dde451039f223fd20980b3a5d1d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 af4c84383964bab58074127687dcbb3303d0b35686810b9aeef67ad879784ef3
- MD5 128ac83812ee1865c963f3ddf513cc37
- SHA1 fee86b8c24f8589fd3861cc4882e04b4f450037e
- SHA512 c2754b8ca7bb855a17ca7e057e342207503b3fbe4cb63ecde4d4d84ec7e0ec502839533b7c76e0f190eb9c52263c2247a7c96f01b596bedc8597cda6615dea2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6889b9c2f3103c81745596bc7e392251e7d3d364e41936d6f057e0f9cbae60de
- MD5 410ea03c6b3be21f3ea7d8f07b7e5b5b
- SHA1 69d1ab609dfd33d5369051cc242b0543a25ae679
- SHA512 e733d41ae78c2bc2fdfe1765004c6c961f72b21d0ea8d625a84639b8b5bb9469d86341bd9fe6166411a6f795a890d0131498a9ae1f3952c550ee8f0d77540a9f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 388d917496aab876614b886e5ce73960a126249e0d6339261dad766d32eb6369
- MD5 fd0effa974eeed92ff2f32b634f7f75d
- SHA1 3596c45441887e17f757766e6482c3b077868d64
- SHA512 2ee4b817ccfd32d59c9ce173dd731f48d46ffc24e9dcc94ab86b3ae3e57707f3a4849b668078d9162bd239855be4c6cb66609b6c26ad1ec21722539313b56862
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8b8b2022b69a458201f9c3873866d34d07418ed960e20bd970f2894c3f172f0b
- MD5 3c7542810ea214595c579ee338e0cefe
- SHA1 6fc4342420cf360a1ddea06818a8a4d429eff54f
- SHA512 db87222d16669c1d0ab17f18c5859442fd475eb9af527aef5fe4409cb2caa391b0f890d24d29b72c4370e7d364dd8a36ee3fe03f9208b38e05243e4a63bd1d4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 80d73eb8d1a28586290ef936732badce8589b1552a8c592dfaf015b0a0f9cb7f
- MD5 f2094c0d5efb8bd6876d590eca56c371
- SHA1 bae3dd42f4947fe41dacaa4c536f7403b0fb39b1
- SHA512 0dacc9f77cff6424696bcf8ca54c8f747891023eb60cc8bf76882c961ac4e215b485e0a2352e955a1b11947402d0ddda8adff22fb941295a0ea563aa19c8673f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1191fb201ef3ebcdd0e48a6d6709c139020aac71c336a659c66780ba22473813
- MD5 a68ef4717f352a40ba41471f4d513471
- SHA1 5353026a0f2728ee732bb06939294448a418263c
- SHA512 848598a260e977ed8464881c7db6405f0c972bca60d191e092c11bdc602e396b49d129b182a7ff2483f68009f848b502e00bd180d7631e156c6467f8693d0c33
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 effaaf8fe80a014aebdeb8f28beb9d066918c080aeb77c61274dd69b2f1fb6fe
- MD5 f3390aef1b33b9af13454878312fb776
- SHA1 f4ccc14030a66237e747124a3da7ab0cca10ff30
- SHA512 6e1df34489f14b62e67062b50b499caa9d38db8f3801d414ec96e1c58792d1a193f83719305746d172dad33870a3c6de632ebd433bfa59caf62a53fcd0312c02
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Tar9A9.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP