Analysis
- max time kernel
65s - max time network
124s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
10/06/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
9a5ee07a6454ecb81c7b47c73a4e8555_JaffaCakes118.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a5ee07a6454ecb81c7b47c73a4e8555_JaffaCakes118.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9a5ee07a6454ecb81c7b47c73a4e8555_JaffaCakes118.html
- Size 139KB
- Sample240610-ejq2lsbg51
- SHA256 067ee1a94e3f29c608bb5242f99dfaeea913a4af0404158fb4974b8cff420535
- MD5 9a5ee07a6454ecb81c7b47c73a4e8555
- SHA1 0e51fd59c200656e38df257d4d54d400df561641
- SHA512 e1f63fb9b77060002df689d7870c77a55ee38f9344ad8a398445b61801904cabcf483d105f3d649cd99acac24eef8982ccc09c6559529f4f2e64c0603274164b
- SSDEEP 1536:S9PRoAO9lPuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:S9G3vuyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA5CE881-26DD-11EF-A002-FED6C5E8D4AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2424 2552 iexplore.exe 28 PID 2552 wrote to memory of 2424 2552 iexplore.exe 28 PID 2552 wrote to memory of 2424 2552 iexplore.exe 28 PID 2552 wrote to memory of 2424 2552 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a5ee07a6454ecb81c7b47c73a4e8555_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 88240e098a13bdb8f947d7a376d3905b56ba0aa56ac5b754e91c449ebd866495
- MD5 8eea9eaadd765a74dff7c927a01e7268
- SHA1 045f2268b3c4b4b7d820be70690b0fd1c4313c93
- SHA512 403d703bbf033e271e850325ec9dbfba92fff51be4c50642cad503a47c31977866f7bf889e7dfa5c9b96cd34fc29ee6fb691c0c9b4c74b3d2f2b47b781239022
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1a0d1b919f0940d533f4458ca5d27357439ee5a2e2f82b0eed0279bd63a69548
- MD5 707fba3de75c59a6f109b0e571f13afa
- SHA1 08df40fb1cd174ac33d48bf50158a18518774c8d
- SHA512 c70072880d28c181700b0e166eca877be5a174bc91df7d3a1268376ec07674afd0dd21bdf1d1b0cbaa86eb99ae3d65ee14682819f83eb2aff8a52e2c1a9598f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1e35cbbeea6057e57fd8c3fa0cb28615e91855fe9d6adbd28d8c9a5da30e89c5
- MD5 d7eb8f4cc22a9aa48c8acdb7750b5b44
- SHA1 cfd985cee4cb6e7bea80c693bd602b92e404a626
- SHA512 3951b3c601fb8c9403a20b7c153f0dffee2e391511842251243b6467e791d1a775410afe9a53845e9e8845310f93c773fef85407e718401692055ed624d3771a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1a141b3110903050162970a99f2c688934c94d0a6194844046efe256bd5b8817
- MD5 325e5f81af7e81c0b419cf1ce2387053
- SHA1 4b18993f5f120a811793dcce824befef227d46a1
- SHA512 77b931c4d0fe58458690f73af2b4e1af330644ca8a5c9af927550eda071ce537e602fa4723aa51a2ea88ed7c4956a27fa700ff19dafb4bc95a39961307fd9c49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4f03afc138acb829143b0e55a17a9a235d0c504c9882e205273816f4611d9c65
- MD5 116bad42ac59488e4aad3d27f1ecc40d
- SHA1 660cafa59f34d8e5e5832fe2230e7fe09205a74c
- SHA512 bc096ab0722301b1c2e825c24eb4716fb30b4178d90662ffa951fe5d1d38d23786a89653443c09afd33ab1d1a5176c816cff3363826b1526f4c80c1ab2ce85b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 80bee86bf744295a1ca6af51eff2def42eebfcba72aa2b37a38b7e99dfdc2ec1
- MD5 8ef382f19572f1631272c6acf14a7774
- SHA1 95ed26785807c832a6f3033c8ccf64f20e99a481
- SHA512 cfe17078394e9adfb4149d84c1a6fcf014ddcca95677d8777fd0195377b93411d3854d9766c11eb51838163cb883fbcbfedca9adad1bc94e1d0fd24186abf375
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f5feab9306a1b4ab4499c01d34945581c63b47f809453c57f29841d159fbe6e1
- MD5 97cfb49cd1a0d1e8aeb2c0d74422221c
- SHA1 9abe55791b926d8f66bc8d440371d9b1ade26afb
- SHA512 2a616b9b602cec75c82bd0773d1edd1bb842c2868765e14a805d1531a17ea3e522cdd62ec8f9640f3f59d34dcbe9fd4708908b94cc3a082bea9f807f50061ab0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f5a616338d64d365fdfd896e331e1cc68ce82f8832103b0e64356d983ea10780
- MD5 3e27d31321c471d3a4d5bf124c26e8fe
- SHA1 d1c56dcf40798bc6dda727a3ef40b544a3f46792
- SHA512 22b662b4d8a41cdf24adff2aa2366954b9a5dde599266ace1c369de589bdba17de4e31a423322c29e51f8e287058415225815700f178a11b90f6e72cbeb7f844
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cb194e87b0add5807c60ffac8fb2fb4afd8fd8ad9d7ca95976c5dc65113a1310
- MD5 c50e7c62f346f90241fa5224cd8ad3c1
- SHA1 b71c74a5766a24e718955203e22029cc921fb1f7
- SHA512 1c15c201121b1aab1dd0f376578c5db936259d9898ffbbd4bc36d9d5e8a91491069efc04a4a6bebcce6ea8654a92964c8953ad91a1cc4a0b03280fb1648806be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3c4d5ee725547938e323fa8742b8a1ba9d8c8694bbeec0225c64820a79adeb7e
- MD5 96e689c9f628df6fb052c0a8eee2d60b
- SHA1 ae06ecfdfabaf9f7c5c9356bdcc093e48c7e0769
- SHA512 ad570ff31952838b280b81acc6b7f65fa87b5ee1e41e1c82bd4f48812b6ade12f3174e8abec5b980bbaee57ad5c0b3fc5d12c9e0a88629d48f0834495de3eb0f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e9d034d91b222a5ea9a861063673b23a1938a2272cd6ae40c7dd0acd40795a67
- MD5 2a7517bc9c934f0dac711cd5d0eac19d
- SHA1 c440eff784ae080b9abfd8095e0ff881dea1515f
- SHA512 5e2e28f3eff373c2fe399c56586651c195fea2dfef20551a7a9f290315578b3244b6352b623482e141e5085024ac168742e1965f78f449744bc8e92aba91df00
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1750cc6b7cff4f97321629cb34fe9635a0ea5ba9d378589a3da5d18be22b6898
- MD5 990a2024faf8609017f8150ba26a8cef
- SHA1 cd6e04b4e2eb9bdc5c9de7164a5f8a31d772741a
- SHA512 18606e75c3da70bbc0a5d7413049bea2f963028941c48bcdcbd65fd4e41298e41f7661255034fc60d09a23629a398e7bc68ad1cc784ecae2d1711b85070ad2a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2acd20d44713f72ba22a21da97c4d24585a2534bf178d6600b117c67f953c6e6
- MD5 dd20c0b5f4a7da2abc63df4f7015a0e4
- SHA1 faa5b497c96977706c034b420862e7aba7a9dc0c
- SHA512 987aa74e8b4c3b3678acad701792b1641d6a9587db246af069e981a3b4049a65250b4b89457c19587180c3cf7904380c323cdf3176fb8ae7765b553e8c9e4399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 464eef2fce95bcf62e2eb91622f4467c5a55cd4410ec798da7325e732fa045af
- MD5 a682b2f26f43f8c605b038c70bd6c858
- SHA1 0dc64c5821eda501b244b53467998bec6e7dd6ef
- SHA512 3fcec920249617d13cc85b323efbd5883d84c4de3323f048ee9e05a3c33406de4180d4f430cca87ab28ec0f4949d2178ed108b65578e5a7b8dd377f8e489c363
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fdd48cce7cda6c53a2c54b11ec973422c6454b58deb9e7b052041b22bcfa7371
- MD5 90f099f64ddff12200b46f6b5a3f79f0
- SHA1 1d41363e78eb4ec092964490a6e5b64dcc534202
- SHA512 6e580f9cedbc940c4821a31e1af88ee6d74d9e583c4dcc16d03fb78ec882f0f22855119ba8f60d6bc22680784ce9b6afc3cb9848f83d5c80baf1849029586926
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 78d37fdd0e7fda9e81392e28503ff24d20bc4b50f7e42ebcc0384993d017a958
- MD5 883c923c8412d024fe8cba2144cfe777
- SHA1 203a002b2c69284639a6a5833df7e1cd89b5f950
- SHA512 61bb128ebbeb35c4af557a694983076eaf52078c52b65c91aa04e2f9a713e6df610e2b758b3326adcce5a1b76baafd883192396f6745d9942414b3ed3a7de7fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1d5c4176a94f6cd9e0b883705ec0197b737706f0ae44893f3dc8aa9f60a11f11
- MD5 889e49e4f936ab34f5a39367e106aa03
- SHA1 e76d4ae16060451c6da6d114e4839723dfe3d35d
- SHA512 a6e7859829276893327f8631dfd916b8469dc6e0f83797dc9d96cfac60df8c2da8a7f04fe7eed01e3fbb8464141fcefb26d88383d1d88e0b2414f94bf7449288
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8665bf03b2fef94d1267133e0b5f73793485242aba8c5bfbfc06b678a777beca
- MD5 3e322981d011ed1411947b92714a2055
- SHA1 cd8559a71996635ceb49739383198da2db82e6f1
- SHA512 d4fb1c3a31e6fe7bb3b414c64764d9347ce75369baf7aa07361adc5222ded9a1e7a322395168423f7d85dc42df4ec53a4a31598d0545c3c551998eb75c34a5ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a5d5e824a615144c932b73d53d58afa886eca65a1fb646ae7239625af19f227a
- MD5 4fd4e32cd477abad9e706beb4e01d461
- SHA1 a332af9a37dfe709373e1aadf13c8592f5a05f30
- SHA512 851dc064f993f1188ea240995cfcb8d5c30c22829c4754b749a129d120d5476acfad0e3d678914cfadf4c306efe4fde3bda9702c5b9adc5e9c33b000a2f95569
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab2DB7.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab2E16.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2E2B.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP