Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
91489a17b2f5ad567c3f3895e5538602_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91489a17b2f5ad567c3f3895e5538602_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91489a17b2f5ad567c3f3895e5538602_JaffaCakes118.html
- Size 37KB
- Sample240603-lfe89sab2x
- SHA256 d3ebb64f481314510ee5d3f9ac6d6e4d969afb661ac4766439307555be0cee0a
- MD5 91489a17b2f5ad567c3f3895e5538602
- SHA1 48cd1221a75db22a1415132a16f7d173420936a0
- SHA512 a9f1ebed1d1ee87a70a6786796f60947624f44d7363906bb192cbf89cad2f83a5a1266a3b4c250cf1f25ee202342b01d3aaf1d43f374c8de5ad61d7800c81fe7
- SSDEEP 768:SbDsYDMyCQCdnAhhmNACuA3n/eF9TLumtB18q:SbDsYDMyCLdAhkNACuA3n/eF9TLumtB9
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423568763" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AD137A1-218B-11EF-A293-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 3008 2156 iexplore.exe 28 PID 2156 wrote to memory of 3008 2156 iexplore.exe 28 PID 2156 wrote to memory of 3008 2156 iexplore.exe 28 PID 2156 wrote to memory of 3008 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91489a17b2f5ad567c3f3895e5538602_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e66845bd3600132c53cb6636284c5b55a062666739f5ca1c70699cb74858df92
- MD5 2d16ae5f7aa4a0ce28ca340e6fb6a3a6
- SHA1 a37a4c9639faad71db9b40840e76a05fe59fc756
- SHA512 003cd5a1d097b1416e3f14bd854eac01eb3df8072f63d02d60b1c13e47b488ee47a774b791f1732a96dda9d9317c4bfc9ab8439591c80f14c802b60a2d7479e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3dfcfba4bc7af0311417d8376867e233d9948fdf881b66ae05fe260a631ff549
- MD5 0700b5dd8a8964bdb6b8ba00a7149622
- SHA1 df223c80b2d85220180b625e51e0bb97317d3d83
- SHA512 a27d39386b28dd19e38af849d6f0862cce4dd0acd09fe41e256bba32b939a361ac6cf19c2fbac0e4c58cff3040a2a58f0303ddda3490ffd7c5eca9fef0c123f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 848ad93d7b639a348c72d39db1504e276cd864b7ad795bfbb3e5e6749a0c501e
- MD5 973745f5b704c617649ff89d697ef949
- SHA1 cacb5c2b570bac035b5431ef455b9030c9d90ca1
- SHA512 963a8af0649a6963ac00946ebaf91df1aa01890926d50e076325c56c89b1cf5eff6b19f812248ad3e18fc1fbe27f4fc34aca36777bc0be7e5c4b3c2168310b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 79346be5515c242192c29a8ce60b46d6c08cd6e045387857c233f542c38b3706
- MD5 f9967471afd9e1c57e98eff751b27c86
- SHA1 f6ab668f7d5587b32cca0a28907fdbce06416821
- SHA512 3f7f669a3a8245dead89285f4667f5874363a41ad5f6fb2e5be41fbf39d9c7276f5d0d3ae4a8c9e88705b5a1d67edd55afb330b10707f281bd37f0cbe5a9b875
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a741cd71059807c83bfdaafd4f154ccbd7b01f20064e6642ff51fc8e3f0542fc
- MD5 3577a9a8293534fb487123e901e870d9
- SHA1 be8eef08d1c071441b709d6cb7b5e11167b5c2b5
- SHA512 e930e314125ddc04b9cf1c832a7576c250171b80205e07dd0709849e4bda160ebb006d049c925ba47c2f5f894045ab0a8fd12d7e546325d6cb960ca521d9b1d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e7919bd13395ee5773fe165522cdfb684e1cdcd8d22c4555b704f41ebafc2cb3
- MD5 34ef6eba7d5d9985f113fb2531c60854
- SHA1 14826e859dda40063ed0119f7f6977146882ae36
- SHA512 a5ebc7e659558a2a808ca79eb6132e922b2a68a25fed9d706f7a8b4685a21b0e13736972ed82bad7bb4506897493c8ac2c3d68336d5b633c5d7cad50251425b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2404b0a01347b05baa6f91a5a6df1ea1e48f8d267c14b6fc2ad9208d1f9e0402
- MD5 ffe36151e36fa53267d78b90e94af3ec
- SHA1 831e37a7ed98dc2e2602b22c45f74ded115f9ee5
- SHA512 a331930531f76b0c76fda3b0daf3eea8063f388bf4630da33a08a81cd24edc4844bb85720f0210226516aee6a1be6390c4d34ac08d42990a5cd3bb97d61a3d59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8fbf728063d3839c23d9f9cf99f5b7b1373ab10b0be8b80a10138a2690eae15c
- MD5 7811c5bc79028a350ee406a5a8b03a79
- SHA1 6f506223c39844e852ff0b7cb53e48961697b480
- SHA512 ccfbfc3b3926bd53e8b0b9115f7c9823546b3aa173ef16f4bca57f1cbed5e9343cd861bd15275013096144eefb8636628a87942286e3aa04df8a2dff70fd61ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6bfc6ed7e6f231368e9d0bc8f5bca7d4728ac80ee286d8a7500b955ae752e40e
- MD5 22b2ed5a04b5a39f2554023cc2cd3d6b
- SHA1 7c8d9cb4eec75d7c2c18282f18c92d749ea68f59
- SHA512 96f5aadb7836cb2f7b4f011f7a7596a434e638bec36e6c5a2cc46d5fc4c760eaa899366b49dfc82fe64a16774ebb95bfa4c392f1c7fc5107a46d40660dc27ba4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab13A0.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1493.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP