Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
a2d6aca82f5ce45fe5d70c0caaa6d339_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2d6aca82f5ce45fe5d70c0caaa6d339_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a2d6aca82f5ce45fe5d70c0caaa6d339_JaffaCakes118.html
- Size 23KB
- Sample240612-22dkkathpg
- SHA256 796c441d29bc64e7a1487d25bf2fda7a59c60a32975e4fe6de1e5b83269e1801
- MD5 a2d6aca82f5ce45fe5d70c0caaa6d339
- SHA1 347e3fa56d25da576acb2b24287d35ac3ca90c55
- SHA512 456dcc5f4c9ca7259cfe494c2d7671628a2a4c055a66870ff8ffc0a68e90104faf0a14309030278b54f8b968abe2576aa70358737e9fea0339c5670e83695e7f
- SSDEEP 192:uwvPTSUpPoa6Qb5nkkc/tTDrzZbIIv534nQjxn5Q/KcnQieOjNn2rorjnQOkEntI:yQ/gEov06ko
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B062DA1-2910-11EF-B3FC-D2ACEE0A983D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424395331" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1876 iexplore.exe 1876 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2548 1876 iexplore.exe 28 PID 1876 wrote to memory of 2548 1876 iexplore.exe 28 PID 1876 wrote to memory of 2548 1876 iexplore.exe 28 PID 1876 wrote to memory of 2548 1876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2d6aca82f5ce45fe5d70c0caaa6d339_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6869f91d8ac031faa15391ff5f9b4c33057cc11927173af08d419e35873d2c9f
- MD5 a9e06eb525d0534c8ff0bad2bd8b86be
- SHA1 a1c43a9e827681223d769aad52b1547218f3d061
- SHA512 41144149c8f3947b134a0031b24e9f1705377db9451c28d0de6ab1b2481c4c2c5882a3aa763a3987afbf7eece1515c3e35602d97928b8572cc272747037d6ea1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4617d85201c06fd49c27bda6f58893efe7ef5c3cde8565fd303473c5a34d3a04
- MD5 1b10e462ef23775136ba8eef75d87d86
- SHA1 ca4050c29aca0ffed3a47dd7bcbf98e54e70ca3f
- SHA512 7dc9c39651d3847fbc4e4b27fc151b454c165e07b8852f3884bbae519d5399e129ccbc41ab805134b4e373fb6d98dbdda1112840b49a74031d81fad4c634e9f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b2d86196ac189603bafe02ee859bb5e2817887b9aef53cca36f5e893db855c6b
- MD5 1ef2532022339a92275d29b7d6589e18
- SHA1 71b0d3d201cce2bedbe6d15d4b5a44350d8a415f
- SHA512 e74b986274e7e375cd562f86ad7b4e7aab47682a9f084a89c7cf651e3baf7323f13f8a5635adfb4572ba0948cbed32a33509a0196d226e0e20b6533b59b0d1c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 03b7d0a856167f522d9849eca30d2e99b3f62d6d60cee90e3339ce9c8dc6f49b
- MD5 510ec710b8927d653c1c247f574b53c3
- SHA1 0022e2a336b792083b3cfc2ae4fa74fa3bda8eab
- SHA512 ee8806935cd15898a336511d0e4aa34c68b6f8aadc415a82f7b1fbed8719eccb5704f27d3330e0616ac6ce4260ea49ca1c41f432b25a889b5b153ad29cc198b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6e2d768df8c586fb7fc55b91b0027872f5caac959d0880ea0873751d6ad6c022
- MD5 2eeea39d56f5fefa992dafce29d3df55
- SHA1 669431e5e544509a22f93abd5c83602507a0db29
- SHA512 2dc237a93650e1419d003468146e7d9c1a4c7e1f0ba40fbbd861298344a71f2042d260fa06afbe8029ad91d7caa7457e5aec7ebcfa01bb9480f37c64a469593d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f639146c214f197f59c9a607cfbc2708760f327eee1817a7ef4b77b150040cdc
- MD5 81b2ab024882105727f3d34e20b1197f
- SHA1 f9ac8557464e03872e9ece9883523cdb448788fa
- SHA512 84426972e13be532f285ae5ed3679fd6750ddc2b0a13890ab12c2db7e18b2be7300ce68cb1487876da49e06a6a34c425dac2be3a45d1a9b82444b833c6d038c4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4fd3c51f1a63e693c7b2159aa978ed1a839a9a7fcef81aa21f0016df3fb54a95
- MD5 ac2ccb1dea558cc0325e66f13dddd7fe
- SHA1 c0d853584788016d5e3d8186877224d39144ab98
- SHA512 78d24a074c03a36b9b750cfe98d06591bed43462ce5cd19ce6dc9b951a5a9c831e76f5c119cdcd65398bc8027ec4bdfb81985ddacdc347c329db5fec1447b8c4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e5bbaabd405d46bb1216a5eb7e316212680d0e6d6f948ae119900417437cb154
- MD5 e22fa241d0b216375d3407953acd5839
- SHA1 86bb1712153bfff94f48877f741f885f44e905d9
- SHA512 8326441f9f96f567695f612685f65b49b6353e07680f53ac3006185321d809594abdbb24663a42d0bacbc03ced6cac988ef83776454c9a09c4f5d010ed34b244
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b5d3a68f082d1951d49335c20ab12c602af20ac2d0c6c98c5124d2470b4d5ac7
- MD5 83525262bf543896e71bcf2f7eebcce4
- SHA1 a4cb12edbb299616b9d85bbab61773b213763c85
- SHA512 d4d929cce62609df68b92366339d8070b74bc690a1411f4368d64f65f63af0801fae0716ca0e788fc296fab1d89de519098794dc05f278720bb90a9b5d793713
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab5B1D.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar5BDB.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP