Analysis
- max time kernel
151s - max time network
157s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
926841ca0e64969eb6c01f407a8e5320_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
926841ca0e64969eb6c01f407a8e5320_JaffaCakes118.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 926841ca0e64969eb6c01f407a8e5320_JaffaCakes118.html
- Size 23KB
- Sample240603-tp8aeaca6x
- SHA256 50a0fcde1eb8a102a887058c1737419ecd4a98ccfe49eec5cee3d8fbc62176b3
- MD5 926841ca0e64969eb6c01f407a8e5320
- SHA1 49175634135189d1872834cc3f9b460e8d7f3caf
- SHA512 86ba7732c1c8edb46c2c6d1ebb47c9ce2430cd32aa121b9920006618aabe07da7fa7f6333252a37391fab8e5e97170cc0b0052eecaa6403b8ea8da283aef41ea
- SSDEEP 384:TphIOw9cAfEJFNxwHEmBUQfQ/ygZXLUOXtMEOcj6kgGgs3wu/2kyqS:C
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423593181" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74B36051-21C4-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28 PID 2312 wrote to memory of 2252 2312 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\926841ca0e64969eb6c01f407a8e5320_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b78c828a23013629ff0045eece35228221736e6d16e21185b303c2c0d3415faf
- MD5 d3d2d78fd2ff701e52ba72efbe8756b5
- SHA1 c5678e5b0ab5050a4d185cecdafd9cf707c3ae4c
- SHA512 d75458e08b57f4b7769cf9dc39d2480b56a5d4009c377fd9921c64059d744974d359633abae0aa6f019165151d8a71e09ac54172933f3e309b4277e7c981edaa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c79a471d01d80dfe6cb310383931ac9193da8275e016b294284528b581a83cce
- MD5 12b708adea794db7bc3f98f35419b98a
- SHA1 e5a57cbf38db17cd54bcd940af68d8ec4ec030aa
- SHA512 1e8c42c8a933d45cb851e2465f2e8c865e5134fc2346394afe6fbe2d02a7a487f71d3ded3b8f6d1befb4521033a1687cca941d116e23b215179c7d6167761e74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 668397580869429a72f93f73af78eda0f927553f267c01d3bbe9a03f35f66127
- MD5 a99aebe5756c7d013e748f0b6f41949c
- SHA1 7853af43dcc7cb906a1edb3086ae37176094516e
- SHA512 08bdf6443fde112840533b34b4dfdf12b34af3699da6543d2a8102f70bae25a16612d0ccef223d58d34c804bfc03be3b1fa6bb4afe9d92d2b33da3b5aa72e790
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fcc3c374d6d7cce87d76685847c3e66b042e3bf57f77ba7ca6c8d18f53a27221
- MD5 759af444478ef55a20ad97b8e5c8cb10
- SHA1 be9b6ac18390b7444bed386c299e8e5469133ece
- SHA512 cad0c5e644d6a007c341ac2609737eeab4d39841a961c3d80258ff480245157e785e94dcefbefec2b3829ad0a722921633b58141d56efb2e8475433ad9420d19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 178cac4a55187d3d32dcfa96d5018e634f7eadec6da6515ecad7a49cbc3fe774
- MD5 65314d1318f1c64d9ab6ee78adbbc02c
- SHA1 78f80ebcc7c246e6c1a0ff316ae8acd56f16e6bb
- SHA512 a75b18c845ef0d7876e38a5a8dac9f4e181af65db8cbe7cc1ad4961552489b5449aefe5291e3cd919a8a73edcc8ed37c5aa8fa2374096b7ab6aa5f828a7cfc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 899a2a8549fcfceffaa59206b7c7d5713180065f97cfaafd2457f6fe0a539662
- MD5 993847633112cd00b81e1d836b85dd5c
- SHA1 0f85a0e7e6b466a1c5a5ea0076b7f3002f4957af
- SHA512 5447aebc1af4beaf356c7482ff76a2e8aece112e3acc7a264ab5732c75e5d280e55c26416c751c635982521a15b44b2feaf6a9f294ead55068d450df465d3b35
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5855ea8aec96433915b96ded1b4d35f5575337485af7713edc471bccc24d7108
- MD5 09de9dd67f186223faa776de3ac0c022
- SHA1 216e754b69bef2eaee2079cdf04c468b4eff212b
- SHA512 e69dfbf58cb54b97e4ebc6e30ee6a412ba953d1c53840d1d3a4b620279d86f4f979f2ef40bd2383a0b67e990962bde93f10d8da65f4a58f788c7cd1fe2adbc63
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8e78350924666ebe045e18a477e9cccc662056a31b941d380ea1e73c7bc90878
- MD5 798a4207697c60d7e5d1ff90fe49d15d
- SHA1 b6e05121bdede92cfb9bf6e25191490bc80d2cec
- SHA512 5c37316b8a267a1fa4a7639ab3105cdc5e0719fafcb626b99f689b32012bb0a908595bbd44f65511b9e6a02a016f1e788f93c177567523ae4b935e9a003caea2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1df290d906b739fe89257fa92c88a471e92787c14619c67f653eaa5b76d1abe9
- MD5 4d0cd1bc851de4614cb6efe3373d1860
- SHA1 d84e81334bb5cbcb8776b084ac8f46ec358dc3ed
- SHA512 b692ad610397b1ccef342480da0cb613cdf527e0ee96b1485632d09e87dd98e31d3d170687fec5126f6304f112373d9a3817c4f3e7e447574b6061723210e541
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 24f3d9faefca1a9c3df9d1f2da2b633993834403723f3a7765e487eabb1d1020
- MD5 75e7648c0d3b3a60e4965b79a27aad83
- SHA1 fc8e88f2a8be674bf189a760f2da5611c39caa5c
- SHA512 75ba34406db8ed58ce86e0b2e3bc0ee94b6b8b89e48e0bece596adcb874f9fc1cc36a2d482dcc7825d088b745fb02cab66e77c05fdd5e72e0f2121ce29850ab4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab899C.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab8A7A.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar8ACC.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP