Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
9139a0ff172308237cef4a8ed8cbb827_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9139a0ff172308237cef4a8ed8cbb827_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9139a0ff172308237cef4a8ed8cbb827_JaffaCakes118.html
- Size 35KB
- Sample240603-k2wbyaba39
- SHA256 1cf8be2a8beddf2a5b3137be4b12c533ee31830fb233cda606e59438c2800883
- MD5 9139a0ff172308237cef4a8ed8cbb827
- SHA1 11fee86295d6dd87c1ddbbc9a0430351f4055ee1
- SHA512 f7e02993a11407cf5d7390a9814f7b763fb76049540d169b90b1c48746caaee67dd8037769a17f345ac9012f76520a965964141759c83f9ed6e68b68794c4893
- SSDEEP 768:EPnCe5cezbzpTLDUtFh3PnFX+w02xcAFzjwa/BgxGXrG6TnPVRx6RgGtcnalSBdj:EPnaOw04Fzjwa/BgxGXrG6TnPVRx6Rg/
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423567447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A62F281-2188-11EF-BBEC-C662D38FA52F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28 PID 2460 wrote to memory of 2148 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9139a0ff172308237cef4a8ed8cbb827_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 80d0db653cf78bbeebfb682e60b2ed4b5a8bb05cc4d1b9cf47d1eeeca51ef1f7
- MD5 858614c44e02a70d68d0f3858d30b9e6
- SHA1 a1f08d9657389cb3451401f32385c821c7d0d4ae
- SHA512 c51dfd1984ac6c810a081ad42174720b858cc4dc93b3a9abf013153e2b4e829c21b80e96f382d16804352b9787b66d831db0f0e8edddb9f2e8ff34d1d81e0db1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cd1868225e03d15719e8677f268dd464143cbf4fc1fef097119fd3160346cec2
- MD5 5ec53e42c8d0b4926a28ad56f9ed99f8
- SHA1 2da27c362422b6c7e930d4ee50ee2b25ae37b3cd
- SHA512 ac21c7ccc98251158281fdbc5dc586a93ed4b8f47e10de44722d4caf9cdd446ecad76902f68e501f5a37c910f2dd8b4a0f4f113c6e1102868b084a70ad2691dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cc0852557505880d69ac8b0595cf56ee8aa8dfd0a4ac483e679ce3e8105e8377
- MD5 46871e1eb773298dd2d9e1152c45acdc
- SHA1 abb52a68a691dd0c0c3f9fff3860df014c5d1585
- SHA512 ba9006e8e3251154bb7770239d0c1830e6d949b976a86d3b437a847ebe46f4995f8b2603c77b342e0c31351e5f59cb592d38d8b498c9d76c25f8671b0bb82938
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 85f81c78ebe5795e22e509fa1ec101b4021df00c93b9ecf31d515ca9033d8dc0
- MD5 8f2c634d00001aff0bf3e4829d60ec48
- SHA1 87f2102dbf0db478c13a8e7951395d9f0313a766
- SHA512 659befd29f5a37375054fc1182e626ec5d437b7b821f512c097b9b8ef1eae296db2239ac48674541ac244add750cf4d06f5f93a66a0f97bc3f6381d78abeee01
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 da611f18aa736a7d57b03edc74949dfdfb1b4b5ec7db2d36e077b630aa293dfb
- MD5 a99b4dfc52c53964dec4227fd1e82958
- SHA1 34d41bf012dbb561a60c5f90501778a208dd5b69
- SHA512 2d32c00e4a249b3ec51e998782a22c47913c0a785357582893c75061d7e7cd2bdc02c7321ddab268f76f746a8d9b5946577f6815a5394f8cb6c8aa330fe47a57
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 dc248ecee4c4c28e294266fb01938ecc79ce8a15dc0bd46c1e83ca4272c1a207
- MD5 cf396ad9c7df7bd858edf22dbeb6f862
- SHA1 1f4ef27ee9dce2b65a64dfd2badff704b8a4bcba
- SHA512 8e2525436ff2667fb626b89de1ee5a7ca9251e1093e93230a64dea3efaee404714caf7b4647f190cbdac8e9f8662fa04e6dca140c2773f1488744686c0a05734
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 57e1bd60593f6822c8a6cac45dc87ba015721dcbaca5312eaa276d0f9a23b028
- MD5 293698b9f8f42bc9c6c0c57eee8f9a5d
- SHA1 3f7234308155eb22b9ede9b1a48df25a1e5c59ca
- SHA512 0c2d174813bd5ffb6e1747c3c7de0853935e2ae7bfc00a8748cf6871b9786eda0caba6521bdd476f8a2aa7f967b7142567b34ec47dd41ea112efc39c4f9e5dcf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5cc6a94e68e9a35a5d10f49f19afa1d181ac3554c2978bf75db28f9660f32c88
- MD5 ff06f7bf92fd5834a849789e95ba41ed
- SHA1 4ece8405c1623364afb7afe04b378de2db878984
- SHA512 96557c7c48afed866674d4b690ec5539b8ddc46a962e53d88ba8d6768bc5a58ae0aae5bb491286ba78dc9ec79a7d0fba805fd83477d98036691c2f22e57350fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ebc2ef0f28f6ceff9d84d26f054b63e84b7c7058001b9edf69a117f363cd114f
- MD5 4ede53ebe580790b96a6c6f790905316
- SHA1 aafaf4bff11318add94a9415a2c7590c618369a0
- SHA512 b8fc200cfb8478f25d85122757cb0d14fcf53b1335c6a4b809a931d91b071ab068b97eaeb9116aa3d98236ead921337fbcc95d6bc9f871911a192a82fc711aa1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1814.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar18A8.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP