Analysis
- max time kernel
150s - max time network
144s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
91748d657b3ac55ea696929dcd0be255_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91748d657b3ac55ea696929dcd0be255_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 91748d657b3ac55ea696929dcd0be255_JaffaCakes118.html
- Size 30KB
- Sample240603-mkj9fsbd4v
- SHA256 18f5ec70d3ed5afb7c96ab8c2c941e8935eddb6871dc0ae6a59c0b6f1a475ad3
- MD5 91748d657b3ac55ea696929dcd0be255
- SHA1 d31320edfe6d3cf603de03c614170b0477ec5c04
- SHA512 cf887c2ba575ac20b74bf600552f643a3d6060318d563de35d89dabd7524854c72b07e178d1e4094e43f8f91d4bf7287e3f5bc63a2add5f9e21858b93fbc06d3
- SSDEEP 192:uWO6m7Y4Z/g7rUb5n5fuqeuLZeAxSL3MnQjxn5Q/4nQiejPNn6vGnQOkEnts0Pn4:ZQ/qXGQ9xYpyQ3ZbDpOH
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F7DA3A1-2194-11EF-9201-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423572556" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1524 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1524 iexplore.exe 1524 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1524 wrote to memory of 3064 1524 iexplore.exe 28 PID 1524 wrote to memory of 3064 1524 iexplore.exe 28 PID 1524 wrote to memory of 3064 1524 iexplore.exe 28 PID 1524 wrote to memory of 3064 1524 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91748d657b3ac55ea696929dcd0be255_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4224fd8185c82f8f5c13709e8c4dab9871636016202eabb3b019dd89e8e34658
- MD5 521dc594595b8a17b30d450de662b0fe
- SHA1 ee10fc4fe406b4e15d32744e17156030a7dee99c
- SHA512 aaf9d397a5335fd23b91c466a169c36d4ef228bc4219e31f215ba417af9ad0c1a3832f8ac4303d589d04c7bc55fd0ff5d8084f629eab25302cf90750d2acee18
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9c23e26658b4030f936f6ee0b2b8ae16c1c8e317138df65ff71680fdc44f061c
- MD5 3c3500657441991e76ef6d302dac6c08
- SHA1 cc54bf069cca4d9f8c9f5691063a4268c2c93d2a
- SHA512 1b06766a6748c2cb4a123f8f5141b380879bf6d69a425f451cc6c26bdb90a4db75ad5845eb3b22bb1e119a96efd25a5bc776ff400c4be59ce039fb9b12bf18e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e9a6191915836efc108bc2ea842cfa62454c500e55ccc097dc75141f9d66c229
- MD5 02589c318b50a8c9054d700e752fee8c
- SHA1 870c090329818dd6c99afce0131b5396e0a4850b
- SHA512 a40e87d7b4beb724cf44c34b40c29e969f59933605c69e621d2e7ab6bc7fd96a2e196694fc2de263af47f10994e5536113dccf589a7b83c17dca6d4a1f991583
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 02e73c9e537e14461f0d1924232fe6cb6136b7345fa0f0afe80ae7b9d4ecf5b0
- MD5 7f348c3a271308c854adff7d560a60b3
- SHA1 f91b580ce5f6bcd11fd462baf8e933efd7316f4f
- SHA512 74606fb3135fd552826f06716e1c782312bb45ce43d6d8fd6723d22cf2f34713f83e30f0d6d1d28eb911d1d6bf197f4eeda8e96afa6ee68e55119c10bb44607b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bac441c80a21df398b6394cb61346be5b830bbc577491d6341fcd84976bf602d
- MD5 ff79ef35465dc0b88585df2b26638ee8
- SHA1 baeb7415fc30338de5ac9a163d136274c09ba1f5
- SHA512 6f7a9cc61fa65eec47e06c8b9f62df9eeb78de32f6d81c1209ad0bf959a365291398c923d53082a61483073b6175c9254b3cb633f09ae3c482522dbd58ae93d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1310c3ed5b9baa27d721d17429cc9ffb6539da66aa2ced00b2a0bfce9ecf379a
- MD5 eff7e6f6c803deb460f0a41dc52db58d
- SHA1 6191db33770cc132a5f9003f468c5e6a800a980f
- SHA512 7aa6988a94621cc03c4e700e4e44657100ab56fe4597bcadc14f6e3ca798c5dce1781abfbc3605f751688d79d40d7cf4c09fb62bc9e721011488ea2b03ea759e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 665c34e1646f692c7c55c47b1b760d4045d5ecf07543747938201af6be383351
- MD5 ea7ab8a708f2fbec6b50892a9b7e6714
- SHA1 32efe0392113937858f10327d184a0d7a4c7908a
- SHA512 8e45140063418bb7c76a91b1a7bdf40bb7e10f85ad0265dacbc82e091f1f7e9cd00274de5fa043da9bd3426d617ec5e57eb0102f016af29c13d377ab1fe264d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 89c07adcf0005f4150fdf1c0601feda92403054772a390aa8546efd5bd93e2ea
- MD5 8f9518abe9d649ac38d7ba9193d2d0d5
- SHA1 e2d5b887695dfbaaca23f20247ce7a4eb01c85b4
- SHA512 1e4ae61f169e4526b2611dec1b9a3798d649e7ff538e9c4d97d18071fe48b898ec06a9751c27d5755162e2a064a5415cfbb1431cbaf31715a83b1448e3a00e6a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bf1b282fce756b01244f23f47d6224554f455773eb7af8c364c169963cc09e80
- MD5 e206ed635ed7776cd7cf6adc06ca6fa9
- SHA1 6779a78448d190ad72faab6c08eac8bd1bd8c7b9
- SHA512 73ab30711cdb13a2e72689801009f690bddd630b1e6253b7c068235d30599cb8c3b53337f688e9322a92d41b6eafe4813bdb0ee3bc365bd8bb42eba981e5a80f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab6A2A.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab6B16.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar6B4A.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP