Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
9142e7e6f7d6f433669efb42ea7a314d_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9142e7e6f7d6f433669efb42ea7a314d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 9142e7e6f7d6f433669efb42ea7a314d_JaffaCakes118.html
- Size 106KB
- Sample240603-la1b9aaa2x
- SHA256 5fc9584fea963baa0f3577607957c8b24071a13ba873618c7cf9765f020f7069
- MD5 9142e7e6f7d6f433669efb42ea7a314d
- SHA1 51dcdaf81fceb448fbe375f3ffc9c7b43f9f55d9
- SHA512 1204722ab3477e1a5b02d38e4cb856d62a010e2a73a401009aff9123b4f9e2ebf354633923b3a56628947cffb714a87716795bc7b5b7320d6d7f01ff5819d4b8
- SSDEEP 1536:nR0gTSmLLAzQu9oYYx5CJ/ez+SRExN7VXBtpKnCZSzDkTilj6UeV8H/Ec:3TFvBgJmyGnFeu/V
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423568303" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88059771-218A-11EF-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1368 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1368 iexplore.exe 1368 iexplore.exe 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE 2744 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28 PID 1368 wrote to memory of 2744 1368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9142e7e6f7d6f433669efb42ea7a314d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8504a998ffa52aaaf2d7f309b2961c5697332b0a3e43dcad2971701ce07f5913
- MD5 f80817d0c72d697794560ba9c0f1508f
- SHA1 35e6eee7a3c781ac00678ecbf682ee747bd2ec92
- SHA512 ce49160dc66404dad59e10d31ef408f38840c59cba6a9520b35c10c1cdb5341148fc8151f13b047585ae215e2490cf15f73d217895f38008da0fe932077b16f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f3ac103e809aed2dfcff376880501b936c892ccc449f07b8a5aa6f5981aa9e3a
- MD5 9fa48fa537856a2108733abb73b049c3
- SHA1 7eaa1a9121985dd29ed9f5ff50fd2a0bec43fe74
- SHA512 ba7f3a8aa44ff1d54452b33864e51bfb99f3ca6f0c03d746e07684a7fe149c3d3450e205d0a45f417a6a5d173b41c371bb88900ace7ea44401c3424df68cf049
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c96e27df1d0d679f1dd4c613b213cc80ac4cbb171d535f4ddf5260913ada238d
- MD5 375f3f23b91cab1c289174b1bb8dc8c8
- SHA1 92dd94e62880197146bdd6da8d79057e96b45237
- SHA512 aa2737ac8d1f2703e098090b60c94bfd95f5912d3124fef3fde9d0e14baa922df1f011f3499db54a6fc069d512daa0e550a7297a46d59c309a417aca7d24484c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b48eaadb0f19e0a4388b4c3554c1153a5d6e72cd532b18c58d82e82b19ac90a8
- MD5 034990809e8ac0d539b43dccde2b94f1
- SHA1 d46723d10bd9981ecdd9e95308a14d76d0482c85
- SHA512 387173903db9bd1e8857e779f7b8a39b794bfaa26a23e1fffcf7f651a54bf9b6c9bf0c8df66e081e06b66bfa6915e8ce33763f6f9c8d366c3d355b3a6ff15b6c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3b12b31bf8011edfcc5efdbf27d3af16d3689c08fcaf8e4fd1cc3faea88e19e8
- MD5 2e1027abd8c585513ebb60514c5f2091
- SHA1 86b31ff4596f2d970522dac4f9e4e0816e02b9ff
- SHA512 f27a7bff3110c3728c1a4a3ec4dd48152b02afd85edeb2c34db15c301266787fa7d87334ac11d4dc82a2ea18abb88541d7799178d54d519ca2e87b004f3c34b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e437ad87207baef6d5326572d68b885102cc4fca11971e7e88ea2ccc69f94ad7
- MD5 df107fb5b986961a080e1371a7c27d98
- SHA1 056405406b078182621d8d20c9185481592c78ce
- SHA512 b57ceecf688554b214080355a49eeef63688cd0835178b9c499f721351cb82f11f315475f429808f3bc4152d5c64240a72ec7635362d125b72e13c679092bea8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9ecbdb201f63c65d163f0fba51ffa727da5e7a12e45c2bbf0cd0e65184076fb4
- MD5 0c1fb6f205d8f952a79235d22485b26a
- SHA1 fd24952884bea091b33d8b344f6171e6a95439fc
- SHA512 1131cbe20116347d65a3b84dce02ae7395c7f761d13b0f50b3250f0806d948192606741fb3a7457c6fd4c67f5017760c18704cea93981b67fa6d8aa6f20d6bb4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 329b9611ae2878641422f5204ab54c0551df3d9a4594640f9968eef82d61287e
- MD5 27234efc0484cb187aa29cf8a8db7b2f
- SHA1 f667bc4c9c226ca283d6047900e266c1888702c6
- SHA512 5d99d08853abc2a81fcefef70007aa5d51e192809ca706b9912f4b52a3ce6659aa9a297a55a732f54f5fbe20bf43b815abf5c7d8a9d1a24cb252f07967fd1861
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2ef1f5b4cdf804651ee1fa81476b7106df535d3b023e356f52cac8d9b3226ffc
- MD5 7f51c8fb002342f4464af983baa9a3bb
- SHA1 84fbdb7054c05f451833c315665801698973a040
- SHA512 b754237fc03d19b35d19c0f5a3132e21ba2277deea6f17e841a133c5b41d93154c8cb18cdf3d76de51fb6dfbee22fd14da3c01131243a0c7dee4e717c4fa6d5a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aaaf65fa85dbc8243db0b2706d5ec4478bc600f79fc5502b7918439339d4f6b6
- MD5 ad350c4eea22ef50099f946d713f1023
- SHA1 c4f3bf2ab025f6f82d04a7cd7060a423986858cb
- SHA512 f807d5be1cdbf2d4eb1a135d6b269e2e10252fb1c03fdac8637b2cd8ad0b9b1d6bba7ec61018db89d1d0c2925b1ec7c20917734f6de38da7f4b0c255619fb3c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab8641.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar8790.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP