Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html
- Size 43KB
- Sample240603-qeadvafe3x
- SHA256 6d5b8b75dcea05b80172c24cdca0e254d7d7b668a8e21facbe0d9f538b0fd983
- MD5 91e65cbc13b3750291fd890a1c3a91f0
- SHA1 c0feea47b6e48a1e90e5f6e63491b0770147132e
- SHA512 75ab61a76dfb054578667959002e1a3485652c60211299b983ecdd7c16cc7a103e4a024bfeaf2df41dbb7b374fac1c4f9fc26b69840bed19b800c7ba72de5b2d
- SSDEEP 768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslst3FOs/wOena:K+vt+0U+v5ikH/iOgOTFnYOv
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582065" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94017881-21AA-11EF-B6D8-6A387CD8C53E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28 PID 2236 wrote to memory of 1236 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91e65cbc13b3750291fd890a1c3a91f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cfce6f448422edfb27542efc1b7d78e5c483d2422696061e3fc0c7bb1ebee5ea
- MD5 17d8525358aefddbfc32ebdc7e4ade7e
- SHA1 217f5e274495684270fcec274cfb2dbe9e1deb6d
- SHA512 9cb0baac7112c85dee367c0ed552532896b3da707492d5cb217f4d3b14c6663ff67a4e2a083b1d5747a9c26c294c14570e14d7884804e8107ea694bcb163371e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f177225da8078272771b7d3a77b328ef105a977c617fefeb31618f1364cb22a9
- MD5 4f02f00074341178129ecdbdaf3d4fc3
- SHA1 c5a45bfc16e125869a68480d0a4a0da5c4ce16ab
- SHA512 261874ecfe938c362fd7ea8c164acdbe62c8230791703891f9d3195c01a9e5441d0e2d0b8901d02384a4c2fa863b1f3c5cbf85981b0bb627e92dc3f70d0e66f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fe1f9ae8b26f58fa6f50b82f88ad1fb8b3b2024c892f279566dcfa6ec800a996
- MD5 d4657228ed2b40035be235ac46f38c5f
- SHA1 941d80d2fd676ee17eeee5715e4070ca3a4766ff
- SHA512 5f6753c8aa3c90bc3267e35663847358a5ed696af4e666e0682ffe4590d0f7067f0077b9b89e2502b5ec636723ba1d6a2f4cab6f0971c15a1438c3ab45fb6d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 90cf59769bc0c5533a88a120229a9df4962733ae0469054a948ce69f8ed12eef
- MD5 2664302d898826ad76b105da518b5da9
- SHA1 2532a939c951807f49cd80cec9767f2dad02ec1e
- SHA512 baf87ed87dfc239c398610f662260262b351130f295437664923b2beb3db1e2b98c087e85cd5f522cad7343bbdcc4f461a28f372ab83329a07911457e4f2ab03
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 76e681167d6a6bf8872d8753987c556fc1297587f06f5d16bc1c7d418d76e63e
- MD5 9f6e40b119b9a06c42db2d849886a401
- SHA1 07d05c777d51e104a201c62cebf7ceacbaf2a4ba
- SHA512 725887654335bb773aa71be64eca7e5f16e4666cb831410905a35f04eed93f34ebaa92662a6846e9f0d8f19678b3026fd1d43949326b176672817410a252fed1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b74a557f3ed3f1e445ee19f82143617e20a08966392f5296f5e891a414854ccc
- MD5 4c13013aaf95e9f60481f4ae4b2cee6f
- SHA1 b42d8ed3067c4e98df29ffcd7e78f872d0101447
- SHA512 699160660efedeb22cd8fadf983c9eb54c4bee5057ead16c40aa922f8de9e70c84a764fabc5b7ec9a741270a06753747372a10af7595b4e7ef84faebe05e3868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 17c6f50e96563b57e528f2342257ce033987ade94ca72aa23b1b99c90900dedf
- MD5 3a17b4a43c4f92c76796f4238b118fe9
- SHA1 41e2f7bee2ae968212d0f01f2a9b668b756822cd
- SHA512 44f810e333c11b830521d4a9c5ea3b512b5946c37933888cb03991806481ecf62345e32e37a03c4b99ef9839b4b9021aa213edd84c9e561bbe79481793eaa40c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e4aec8b03f3d5903df6c6eb2b9e1540b223e609cf412505d05ff5002780dd70c
- MD5 e5d8352a3b736634a393c282e765048d
- SHA1 d6f8a62ddf51349f90e73015782374965fcc011e
- SHA512 8daafb5a5e72e6521f8a8cbc1db557b71f390d3faf74aedd47c3376e7a1a420ae1968ecf7e6a81667e951420f32e12f3862ea0ab894807155713cbc782414667
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 865c7cf1a1fada48efee6eb2c227832bca6add352f742ac129e346424c9e0d15
- MD5 d91e1f546bc3fd8d1c1f98eca3d92302
- SHA1 7d6d8c6419945d312ffb3ba3ead729b34feefb5f
- SHA512 7fe4a6691a31ab777028b0fb57f89fd91a667d727bbb509116e5e183bd4312d52e4b7bf914adda99efb40e9c6a9b0800a3faad5655cd2cd0c0dac25f5125d05a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1892.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1925.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP