Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
a2fdf98c899999a84b0e0b27311af59e_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2fdf98c899999a84b0e0b27311af59e_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a2fdf98c899999a84b0e0b27311af59e_JaffaCakes118.html
- Size 17KB
- Sample240612-3r8hmaware
- SHA256 bc4eac9eb994396f0ba4027e45eca5e6105c43148460c311e56e35d96aaa79b2
- MD5 a2fdf98c899999a84b0e0b27311af59e
- SHA1 976053148df7bfe436d89842345ede31618ea3e0
- SHA512 6dfbd4e0e2d73c3ebb6207c1a20d55313681cb6325cb7223a00d9e4946f4a8677401e1ee9743d89d74f57bcbe576635d0e746d1e8df6a035e8e63abaee7c2280
- SSDEEP 192:5Ok6hhdrh7ErUO8lynp41J3PXByl+gnjcgTaigHl0DEKdCoRVwDNBaSX:5Ok6fy2QlZlTaigHlOLEocDNBaSX
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d6e15c981840418ad58a3038a422a32875c8b39f5b4548269547e55c88755be2000000000e800000000200002000000074c57fa0adf3d3e243b8c03d37d7a9410e83aae71ea5e38a85cefa8b880869f0200000004a39b2faed118037b5b78fa44e0214b1d42e4184c1ee8d0638897f7b7e35d1e5400000000607b6cb8dbad1bdc11e9741dd32f73cd2b9231d382aa67cd69cff00819738ad3029695b3082c8f8b0e6ad1fea12f6da30acd18889d4493974cce6101e4f702f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424397833" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e36af7e5a022bb5ef8d8f19c4f7c41bc3bd6ae52d04428167c9d11ff6a3c74c7000000000e8000000002000020000000a89602242e3dd9d5fc84e9813a353a80f0b18de8c8096a5ef87df1b8917818c19000000035f2cde4aebd97dbe47b9672d1be431095b0dbef2be1d0df5c9f1429c260b542dbb62f1cda6da03611192f0eef35d10fce75546e81b946b61d3112ec6ddf99f23fd56ff3adb92609090170930f2fc12032b9bb3153060fe36d167773a5ee851ae839aae427f282597e30ef79843c6f65cfe1df80d8e8331148e379464d4f9862d5482114bff4834f1a9f1472731decb240000000de4d242955c787c6ed9421befd244b17456b7698be85eb3c12de2e9d0e7006ce494674423af306d628ad8a6986cd560298849d0563a6ac46eaa561b816e14d96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE41CB21-2915-11EF-A8D3-D2DB9F9EC2A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d050bdc422bdda01 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2780 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2780 iexplore.exe 2780 iexplore.exe 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE 2064 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2064 2780 iexplore.exe 28 PID 2780 wrote to memory of 2064 2780 iexplore.exe 28 PID 2780 wrote to memory of 2064 2780 iexplore.exe 28 PID 2780 wrote to memory of 2064 2780 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2fdf98c899999a84b0e0b27311af59e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cdd011aa9acb4ad3979e8b636fe6ed79acb4ab3fe4a9d4ca5b56788d1bd9db8e
- MD5 8b78a2b6e4474849559f15ff14632733
- SHA1 31fa70b4ba2e71655f44c4f31dbcee5f0ef8ec48
- SHA512 483d29cf4955aeba6c77e77c9b8a2c88b00b2d6fbf56ece774b9ce58817ce91b633f22a49ef31dbcbed77fac3ec45890136d131007652a3e1b8d1f1e6b05f084
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2d6d7b5554eebd173453ab88af4dfed5f128efd40a0669e8cc06bb72b3af2620
- MD5 f1f7ccf400e6b04cbe348ed146e727fc
- SHA1 d2a0accb2b5cda0c85f1082dac1ab57b2cfdfcb5
- SHA512 769fc4970046b32e8c7165c6f3c3c963741e2a15bbb69e9d00c29b3b39e74bd75f388f796341ab90136ef97f8ac4ec6b619a1851516319ce608a6d9bd882a719
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bcb9f4e59c4f48cbccfcc03e509f54f19849676fa6e4fcde97c747ad46151d0a
- MD5 dfb3e77e71b18297787b101ae99c3476
- SHA1 a8487fa2fc2bf923eee9f62b70db7ca6839f30aa
- SHA512 1d1a18cdc9c389d8240091977fe190d5098ddc7ef580e73e8f745c8c2c43ad4d65a7509a001e58dc4391970ca208f1bfe5cb2cd34d3048b3cbb9daab8269249d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 34ba96da7bae3bc26c56f765d3c01023fd045f6b691423b9ad6bdedebc6b9f12
- MD5 5164b043d551e0185f0c7ec7a652d243
- SHA1 a20342b7fe91f46bd5634b3c5b14b4be5efd6d29
- SHA512 599d1effd9a8e2f3d6465f5768ba5a5899e2486098d2f961f29890b76c63504e841ec91486d2949d7b3017ad47a624fa8683f5d8532f76d73fb267d5cffb9bfd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c74335e4982df0f6d8cc33551cfdd2cc44100a25fa2eb4c1b0cdf6641aaa28e1
- MD5 d146b6c59a905b7d3ca58e997d5cd925
- SHA1 56a7bf488dafc920731b416387463c69ddd1cbed
- SHA512 4c900352dc4c8dc2bab21de328b261c419e6a62c544895bd01242a7c69d673c63cc4e8677cf33fb9aacb58c081030bacb1dee429b8a900dbfb4cb05d4a6e2bd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c15f71c9382ffbe689f60ceb3e4216332ec8cfc24a3e2e1f93060ce1f7f1b78d
- MD5 b77427cca1b4b15600ab79a595f97995
- SHA1 82f7ff94c06a3ddf73aace9362ad593d1ee3b953
- SHA512 de847f1d857f41b932785978bdced9d7b010b3a0522c26eefd1fd2c10ad54998969c493ae3bf9f84ffe3f96e25d53be2fb18a19263831433bd88a429d3d2847b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cbc60e0cea74070c391d1769d8cfb01478265738ffb8e6a276a3e88638b0a814
- MD5 d6fd0ac9d4f1bb41dcfdefa8513d7d33
- SHA1 e566dc877017d1364db3cf63fd30fde18fdaa6c6
- SHA512 3a1961c4ac8dee3ced56a2bcdf62dec949208382790cd667300e06b65805e02481aa5231bc7b77280be7d5eb600e1a5fe81d47177bdbb222257d61ebae127fb4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 96db914e21a38339961e20ffae766c26ddee6ec5cee343c60872e2ac53ac30fa
- MD5 5c31c79f9f5504ebd4a0d76a77673ffa
- SHA1 2bf50d94ca41706521dfefb77736924e03b92382
- SHA512 7a652a094c95d7b9bfbb1ab5057224bb3123a74403776e6ce2f47c26cefe1631c9ae3bb1db8b7230f557e488473e21bc279e880fefe91ab54cbcf99d88f8fd49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 45833226b43309c824fcd052627cd086b990e9b338efd39f6a79d6a76bd3f1e6
- MD5 ff9c9b82fbbdf0440b7f96226922e4a2
- SHA1 039279944a1a5433ea24d8b2f174a606ba1af609
- SHA512 e99bf08a8b2c938852374d4d84821381db4e8dba8f3169c1cb5beb070bf1d882edb1054dcf89053996d48b00111cc0de36203b0a8519b75fd182b48b12e19464
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bd65260be1f190e03a353e925fa7913b59872feae6c324bc9d454ba65960f91c
- MD5 67913d5b51ca86efa84a8b86e866050c
- SHA1 c34fe54f0ba6b84a6a8a1fe798c69121f935b6b2
- SHA512 6e60dc30e947a5404b25d86bbd724ede7c888e08d560b3be20a2177cee744e7cc28389d7835550fe60a85682c1d48db29e94656aac9f9f6295b1b21a78e6d6a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 80099f88d665096282bde586714ac2e52f97ba142c75da7133ef55285b29f6a6
- MD5 4176d76248d7f31fa3e8c7450bce75f0
- SHA1 23d660cc05bba4968736822e379cf639e457c9c7
- SHA512 8fbcd6c1d4f406e5123dcdc060e58eca4ded415e18e6504752eece94b79e5cd01c49054c13989a062f868680e04db26360e4464dcbbb815f7e1174602746ea28
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c81fbfdde664690dd1e46df49301f5b5e0166135955aed18af666e617983dc16
- MD5 47e5fcfb49f27be346c158631f8f8de9
- SHA1 ab751b1838ed9a101eaea2da7b7ec17e232e0f5f
- SHA512 175d72e606fb23eea8b36056ef1451cd2cf158636579bf52f452098ebfc6ced1081f0352e0610d08f712a72a519a8cb67a07c4e6592f1009222688b4b47bfb01
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ed5a023d0f486befd2f4bbb6090486e4a1eefa88690f346c96246f5e4f62923c
- MD5 7d06e63913872bca7cdbd7a9fa62400d
- SHA1 0dd1d26ef05cb6fca50e5b8fee348ff6a0331778
- SHA512 61997a391096a66129436d0e993ba75427d3884f67221b50977e847bb7473b305640e66fdfd15a0133059fef7a2164ca7dcda11ce6bb9e3413dba25470e6912c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab7244.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar7304.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP