Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
91700df889e4a9378cdd2c29632247a7_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91700df889e4a9378cdd2c29632247a7_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91700df889e4a9378cdd2c29632247a7_JaffaCakes118.html
- Size 28KB
- Sample240603-mffepsbb8v
- SHA256 0fe907c8ff637b025d435abed56be9b4ce40bd314d7a0d964172e486032a257e
- MD5 91700df889e4a9378cdd2c29632247a7
- SHA1 c2228091be69cce63af35c62120420c0666b2fed
- SHA512 2f8a8b8a807373172c6d12bd33e199e781cc73c1b615c7756a40ea35144f1e9c5fa5f7400db281e808c988469c1f6035344bed3db844a4e2539aba4059415aa7
- SSDEEP 192:uwDB8Z3bb5nGZwOnQjxn5Q/YnQie7NnTAInQOkEntY6nQTbnVnQ9eDvm6s/XaA5i:h8Z3VQ/pLuReXalSJRKL
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CEEE781-2193-11EF-888E-CA4C2FB69A12} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423572126" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1160 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1160 iexplore.exe 1160 iexplore.exe 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1160 wrote to memory of 852 1160 iexplore.exe 28 PID 1160 wrote to memory of 852 1160 iexplore.exe 28 PID 1160 wrote to memory of 852 1160 iexplore.exe 28 PID 1160 wrote to memory of 852 1160 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91700df889e4a9378cdd2c29632247a7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 85d0818a1284f531dcee8881f9b1aeafba82d0a130f5f032509cc5c56d37dc77
- MD5 f61294cf6f508daee3e84a64e16593c5
- SHA1 cb895b8c0be82e82ce57f4631e56228c06ebb13b
- SHA512 86dbe10869bf38dd9109bd4fe2389c39e4834b3a02a62877c2d002f57775c3a478fd09b28f2a7e4a266e11a623a4848b362ae242a93a8cf22a542cb4a9511fbb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a9d1ffbf9c69cba4c2aa98597aff92459de562f3f27ff6b50a938d218177bc9d
- MD5 f311afba676aa91c32c693615318c627
- SHA1 aa98d3b1577ae93b6b2cf2496d4c04d778cd2b77
- SHA512 c9e41834a7bb132a7601fad5d4f37e84e367b294354964da5f7e6e5d4f71dab13841ce000fe7778058fa92eee0f632d000e69fb8f0801f8b1f0e582d270777dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 076fcb3a22dab65dcd191ebc3002a591dddcfb858b906af93628d4b3d006bacf
- MD5 e8e6efa7d85fd11cd83bba345f2e3705
- SHA1 32533345e33fa39fd814bf99d405de02c1fd7cd0
- SHA512 88c4d22e087bbff9c43f3d0aa7bcf76779fbb037a4697c75f9f8b28e4f6e59c276f54664fe68bc31e67e8f2e157631fd66112ad64a42632226a2932f3ea4d430
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b0bd7bf4a0abaaf16e3ed9a8d7b3d1cb7dade1cc9ab8259189c8375ce636fe23
- MD5 58d3bcfdf8fc65365351ece03cec4321
- SHA1 b1b9e9f88d35b55d68b69c5988145de1befcbf3d
- SHA512 2a439808aa8f44e01975a5f15c82c2deccb49c55d81619b1f0d9c52b51fc0b8fb5375a81b97f0f5b4385404dc0a192488b206e90fbdddf599495d2e2f47a769f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7c2b033ffb31a5383b964f1c28eb20770cfba9df5b6cf15ab0a8780a7168b0e8
- MD5 f5f9b56d0493ba7e01757d14d2efe1ca
- SHA1 6a05fcad18e356590c9b0c14c099f0046a461a63
- SHA512 4083feeca8720615171bb6bb95989351582e104278125e0d24984b8dd7012e1b09fe09aa56941cc6eeeb64213a58b4c1bbf0b4c247d8d0abc42c147eb82e001e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fbe32f67d950d94d156e06ec04f6d48f83c090083f84dcfc2340c7152871ab04
- MD5 fb55dd565231b4af4ef2d24d93a00616
- SHA1 01164e9e5b62176701beae50350b010ce6f61cef
- SHA512 1fd1417882f4d94f06f8056411cd52ec421af8c1742aaf7a9d74efad5fc9c291586c09938a37bb1c8bbc254eedabd4edd2cf3bf8adc6343e9d223725b266fb0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 094fb0fe706b12788f99129a3b7e507a671d829e740c65b3cc2da3fe70fa6c7a
- MD5 780bac057ba3ba21974e3106f688a72f
- SHA1 098a80ae011879f41538b1ef84cd607448178a8d
- SHA512 189979cf9fcb434ac5da56c5c6d35c0b39da9e6222864d610d096bf3eb1e707f56cf3a4c9d946f7d03c25fbbfde40e4c0044749dd1f3cd6421103f70f4951ff8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 307bad9ac1e14130bcd7700fbc9d58a461f81bfd49888a4cfc53c9c218821542
- MD5 a2799a3dbe0478a1a2eb8e3fe7c96af6
- SHA1 56cbce871ff21e7754f0022fb5358be50bf4987c
- SHA512 7b78cafd25a221a5ae663c9c625d126aebce1acaf548b646b115d504219a290217b4e26804218452a39b366e24bdd43b06ffaf5bc51d5f7a44fd7a1ea8c7949d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Tar18D3.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP