Analysis
- max time kernel
149s - max time network
149s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
917e9001a8fbc355389c5a99ad3cfea5_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
917e9001a8fbc355389c5a99ad3cfea5_JaffaCakes118.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 917e9001a8fbc355389c5a99ad3cfea5_JaffaCakes118.html
- Size 19KB
- Sample240603-mvrfhsdb36
- SHA256 60fea8a619ce73adfac7e829940b7c8a03b782a3f373f3ff072bdafbc2b9419d
- MD5 917e9001a8fbc355389c5a99ad3cfea5
- SHA1 baaeecf66e0cee3145da63762057ade4a13c7462
- SHA512 6f3e1a0592446cd697452316ba4da9ff25682c2cf44e41ffcec4f090a75dcde2c9bf7cea745ef95dd1f886cfa05c8fb64ad7a871d917479ef44bdc76bbbd28b2
- SSDEEP 192:uwP0b5nN6jPnQjxn5Q/ZnQieUNnVnQOkEntrLnQTbnxnQmSgHMB0qnYnQ5ZNnlnC:oQ/Iq1LK
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423573516" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC6EAC81-2196-11EF-BA8B-4EB079F7C2BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28 PID 2236 wrote to memory of 2264 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\917e9001a8fbc355389c5a99ad3cfea5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9f41aef258dcd6c7ec30ee0666fdf2140bf13c4168d6ad19826f5c30019a04a3
- MD5 a76b63041bac85fc2adc9f4311b1e5fe
- SHA1 931f2b2c5b926dc00eb12dc23d2075fb69b63a47
- SHA512 d2aff7a6de47de3fe25b7188bea3792fa031dfa99de96e662abe21861cb8f9943b4c054721868e1124991638f257b989a75199558fa8152276ff7281a93d65d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 38c4c1ab5cf9d04f00d6333f07260da5d157a46867df4c7259ea8a5c28b01d6d
- MD5 c0b2a544728a7ed9e278f44829fbfba5
- SHA1 fc0efad5bb5e3f8eeee839e43d367d673f035f73
- SHA512 ae61848560c911487c01f6f2cf679206b298a49c15a6710c3da301efb421c17afb89983f74be1f44de8e8f83ab9035421a61e2c7614921f66545b30b82a1e568
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 62a99da7c37b3823d19e95bd4098efcc8fefcea8a3d7c76aa40ee892b07eccc5
- MD5 3d09edb06cfcd2b0e57b5257d6873e08
- SHA1 b02a58da72c842588054f5d3733ec493a1d2f218
- SHA512 4310d919566bfa0f716b03229c3ada032d38e3537c75970fbb880ffeb4bb5e52dcf74ddb17ccc81b71e6c8b6e8a0e4545fe6f3f265f6e69fcb5bedf84f9510de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7e36d0ad3fe9f28450aafa871f4af49061747315ee294681180ad88611a6034e
- MD5 ce3d12a6a96c38f2b803d646cdcb3c38
- SHA1 81465b25bedc4273e7abf09586c5caa3fa8877e3
- SHA512 03318f7e9fb75340220087768cb16e50b160d99a877cff4465511768bd2505238490acae53a0d9198dfa8ed663c8f637d4cae072c1f5564957855e33d80f634a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f94163b27adbdaa0bc45054f64a6b431d5efaebdf5311bc806c77a3b9fd13450
- MD5 641538acf9d9c612cc0dea9008767dd8
- SHA1 6c864f70c0e394d959e9fdab4b3b11b6ce22f4e9
- SHA512 0ab2fe47dca5a18648fb58aa2b8c29d58322e40b8280c5464c6ee2f1969a364677ded540bbc4c5ccfe3c3ae2ea67164524f473516caaca0c8019252593b2e396
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 727b5f463f3997908cee765d81a9adba79c920823a33569f728450f3d11d0848
- MD5 090ed1b9a70e84ba58e56f157046450a
- SHA1 66142a3fac0b0dc08ef103faf4aedd557c23bcf1
- SHA512 60a97b993eefebcdc315d6157ae428e41dcc80d2d36542de94a9d3152c31fc08db88076fbdcd92285b60dbb05a9e7e3b817f8adc447a9d0f0eea641c4ef8a55f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bca8efae36051ce162f05699f8fed3da329ebd74bce075e6b19305d27325cfe0
- MD5 4cde23e3e6fbf28f6dd7313e93541c76
- SHA1 1964ad43886df9af4a0f074bf4507b08f8f63fc4
- SHA512 e41e64135318e2f4e7c3aa3ed03d5442d516cccc43932ace7a6a4cc01f363f8814ac7f59bce53c1dfde867c605ee7661f6a69a63eb8b00dc438e88c96b7f3522
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1715b5ba5444cdc15722c411984cfc5a24f22e337b89a207d64dff6d3cd3c09c
- MD5 e0fd7db5ba033a3751769cca9ca6bf83
- SHA1 84c50624f6cf5ec013ebcaf224dca6d555edaf2a
- SHA512 0a0b7fb1ca4db0cf83ee782f53e8cba4242460d087b322c7e49640755bc3ed18214488f2c9ac6e734ca4842b169a18b085d5a7e963822f8a82ae1527cf7e293e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7265b1bd2565bcb190e3328d9c5d7ed663631522be2efb2081c3fe45ed6257cd
- MD5 bc4b26df69c0a4c832bc70537bbb623a
- SHA1 084da5991bea5fc115cca81215e0707c72648be6
- SHA512 8615b522e80c4b101d254c823f52d9748aa9dbd460e47c3deac3424d648cf126f3e0a9e44747e20363294b7fc0048091d937dc865a02c96dcaf498fef784f890
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1EAA.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1F2D.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP