Analysis
- max time kernel
117s - max time network
133s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
9255cf6a5691668c778c21e647147db4_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9255cf6a5691668c778c21e647147db4_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9255cf6a5691668c778c21e647147db4_JaffaCakes118.html
- Size 448B
- Sample240603-tap6aabd6x
- SHA256 fd224d4f952cad091bbdf40876b34d769a472c2aa3eb7a79d80edebd8bb6b985
- MD5 9255cf6a5691668c778c21e647147db4
- SHA1 5fc5871b481d511fb3ed36fbdc21117e2956350d
- SHA512 58cbb402565d363b9eeaf45d62b1d24634a469ac02de90c823f5cce89b11cc73ddb195a2e2c06e632edfe066928de8252a3c5e8938135149b5d70f12c97df92d
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c30eb3d5a8cba243b92aa2d38f9c738a000000000200000000001066000000010000200000009b64cdc25798d00d0f4a3a48c438329573f41df4fe879cc18d460300c7ad69e0000000000e800000000200002000000033f122062a929c6fe01e30216287e73b396a7652e9357b666ef5e1cd4c3100b19000000048322a7f118b70fa782d24ade752f7190270ac7cd6c19cb2bba1c7579771024ad0decae365f986bf666f8dbebf62f10ff790f23cd92da0d811c6842f8fb553bd47574b6a1ab7c41713e82934056f0f8e3cf5dd1dc04074fe9316f5c11318ad0ae19b5d9b11d6442f5df65e0805538fad6870b5def5efc68f96acf6256f6599f2d15f0716a7067f805899c5c95de5a6854000000034992d10d08fa4c720610fa8e75c5f43615a21702b56b3621737f047a61eee64a6096a19691c329483951683608396850db3763a768ec848c09ec2da1580565c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c30eb3d5a8cba243b92aa2d38f9c738a00000000020000000000106600000001000020000000d404e4c7ca2f5c040c03b625ae9ba7c6181fea0bfea9dd3f61bdab690e050268000000000e80000000020000200000002ee5ee11aaeed576ce886a32b6b448c1553901fce8055b2a2a3b00b917d08c802000000066e9f5f72e9d4735f861a917a0b385b19c9c08e6dd3fd12874fcea8a5a92ca0d40000000a3c1726fc532c10046d75b15c982d32ac15c4ff59551d010ed5adfbfbd60559619c8bfafc0099f7ef51ca6176bcc8cfe1fe8a07d48ca421ebf94fed30ffafb63 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1048fee9cdb5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423591763" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{269DB081-21C1-11EF-9F3E-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3024 2212 iexplore.exe 28 PID 2212 wrote to memory of 3024 2212 iexplore.exe 28 PID 2212 wrote to memory of 3024 2212 iexplore.exe 28 PID 2212 wrote to memory of 3024 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9255cf6a5691668c778c21e647147db4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4375909daaffe657b255848faab2f95a9ed0b5eb60085b1609027616327da4e8
- MD5 125efb798e49bf2462920d493de8446f
- SHA1 ae35167484ef27ed89adb3eb5a65e6997754320c
- SHA512 4b994b54429b2e96842bb34a54173b3ad2c34591e2c182b0d7b9efdd89260f46cdc627093803532bcef8533d94181cab6d57507587ce5fdf81803dd9fc37e913
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1a866c1c656e66a3f43133bbbcfe6200c9b3da0eab92c15b70e09ae09c226b61
- MD5 3e35045a8acc6c0e06555c49dc1ee9b0
- SHA1 82fcce4854eea89fc78d89777435178912a4bda4
- SHA512 2708066dae84614f2f0d4c3792dbd71915521f4de78d201c72fb1550adbb3212ced8daec84da4f3fd4f43b3db718426da2d6937fd1fce05ebdf1db2f954b8167
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2850b43bb8f6ae1f368f453742e806b5e82317d9162eee9ec1099f6674e9476c
- MD5 a05c6eb8a2fd6d11da074dfc3849d4b5
- SHA1 8fd8fca70b0acd15c9d878516430bd0d4cc541b7
- SHA512 06e7b61373870c136879495c3447d588f78a5ef02d970b3368d25e618d6be3e20ae215a7db1d579276068febb0beb7271b8a45e0554216d9036089af6c7b25e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e42709ea41c42460f8e6de246c5a9c626a775f8a6b6e16772691722ee46f5dcd
- MD5 25d819d3d625e35d55977fcac3287d4f
- SHA1 5b52e561654b27c705555a8c64dca2f38113c3fd
- SHA512 171abce29ac48a73206b6541f2c11cd8c09a4e03a587e19423c375ba2fc3ac87fa3ffdb97200d3553513858fc3a0d80ebbbd60db5c95018f63fa80ffc0a2e508
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3aa63a07c81ac6f82d5ba058c320918aa26dc95c6ff64c352189e42461791101
- MD5 aba5a8df3a400d576ebbb3ab6f7170ba
- SHA1 cf675f661ca74652d1d021cc5489728cef21b192
- SHA512 34c922ee21eb477b9e8c62e9cce27247ddac868bc6aea7cedcd4564fe4a8d2fb4777b33ee813331a4000e4aab291285005bcdf98c5217a7e4561babf3cf46e8b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 07411fae3ad3f62997130ba22a0c1078e01be28ca7a66a5983d3b002b88990ed
- MD5 2052afaed22f72f8e2eec8a0ba2deabc
- SHA1 1ca39ed6b4c4581dfa27aaab4695c2a85572c61f
- SHA512 43f96a3222d9e3de66981b8a6da5208926bf4bd85b5436ed241838b5b1daa4a54c112129f0ed4758543c8798470b5aee1da4874e9dc02f3be962a7ab62a3975e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 49b7cd5f8db610aa57fe577bc8de143e37d1e5d13ce59c6ee66abd33ab008653
- MD5 d1ac9d3e51db06485639ca73bef59103
- SHA1 46f5b792861962d13ae0050b4abdb8ee3e13d0ca
- SHA512 f5bfd6497781d370139d86172dd9a56143b590257c3d55e37f180ffa879d9dba84a75dcbe959b25a14c9563d3c1a4497e69474cb5ab276e48b764a6a3be426f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9da4db2906ebd81af0f0aaded6e18c3d314cc4fc4cede9895e7ecf91f2525659
- MD5 2bce5b0bef9b3b1a26da3b36f563f0c7
- SHA1 9024608f2d000614d935e23f211aeefb1454f910
- SHA512 2fc2379c776c94fcf61a12f8aad6fd2f8880e824d7aad368f5d22fd4675911fcf8feaa420c6acd5bfc1a866491da3b95bdb8d1a34235d0c62499655dbd5e4f4a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a94dc099dc1a4e5254b6457f2538143b4359f6b6c721f2c61cebd9f928d807b3
- MD5 6916f70cb618846af6ee9106e33811dd
- SHA1 2abf633863ce4b20549d1494c9a61cdf127efc8a
- SHA512 c73e87717b34c6de30e38c32d9b8a0ce30d1c0bfd2b868107050bc406b248a35b7fdfe8fc13e0c2964ba13b12f2be363c4d09be1a6394c9f6d9437d9e753f558
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5f8d24c6dab669886dddca7b1735b1d3a4a851934491b683c04c99c785bffb0d
- MD5 d0dd1d00e069c17f161379e552ed48e4
- SHA1 744eae6c4bac3f2a2107eaa6be571376c4bb2f9a
- SHA512 869f232c80f5c0414db33942d536d834b4a4e1fe406ed9e5ad386901860f2c8b95e0baa6b4d466c29e227d85ec5ccb156602ee2b4be485dfa20427f20635e572
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2ec5a9f3146605070f1451d908e08dd6ecaa2326faceb43beb894d284433b398
- MD5 b4269d6041bf1da1b4ffd2009b0b8df2
- SHA1 0f102bb324f0a86585611d26dd8087f2e1d6497b
- SHA512 bae7b747548071b029fa877f60242cecbfbfef71f2a3cd5bd28f374c49210afda95d0bea9a5e4b3d80e73546832f751b6cbf7b17ac574be203dbfb4217cbb5ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 17fa6a8bae1dffcd99ba93192e5c2e0fd469bb261f52de1b65725c8bad90c9ab
- MD5 bf4f6a58db8c7f0b74fb7451070bec7e
- SHA1 1b8c33cc922cc882e1d92ed46366c22e62b4e22a
- SHA512 7355cd031afc3c4dd562d67b0d57a24ccb0388d32f7ccf302e867a2fb920928cb75a33186ed7629c667a931011b00fcfa8e5d161fe7ef9c6ac9c244d7d6e09a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9570d4d9c813f0a40c44efa06f299b81e5dc3bd76b676ea7e354dd50b6a310d4
- MD5 9ce3b4f5be236aee7b2355289a6db6e2
- SHA1 f960adf0c9859dae71675db2cf1ee2412e6b35d0
- SHA512 f9c26e3bb2e479a71484f23c4c6af6d8a61c08e9cb7b633283d97c9b1975f9bc19f0c071acd07404a622bb9c4befc2a7e79ecdc40309d9a9b423a12e902328a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cd20983e06f531d1774f0eaeb272a13c676cf70b9069c5a5a2dbb1cd9357ed15
- MD5 8ae99cf2ad5f62527497f63a89736fd6
- SHA1 6132d1d957a2e9b2f57cdee520fa014ca2ef5fde
- SHA512 0c01bd25ca8057e156a86b4356407756e0ac705ddb46fdbbeb40e2c11a80dc8eb05d54e5bfdede73303015ea992533802842ad0e022d5a21dba8a6bfd5fa21fc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c2521825905cb9dddc01eb1cd22f031ceed388490a5830496bdbbf8b9148181c
- MD5 4b3237cb54d232ba2529caaf81385fce
- SHA1 83416ee98feaa09e23b4840fa3d5290fd8c128e9
- SHA512 12d5ceaac37e6d015ce614799e5909dd9c6ba355b01de7445c59caa4bb23fbfe8109abdb1192a2a591aa58fb4e75dc8cd5a583f7601509b4f8a51491913f5957
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabA19E.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarA741.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP