Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html
- Size 23KB
- Sample240613-1dfvca1bjd
- SHA256 daee4fd7803de191b70f9a105fb366e7c0730b07201739d4e5801ccf2c547a07
- MD5 a6a8dc526727aeee9f4ff4d127804051
- SHA1 2ec17446ea1e92ae3c2e286f2de75c56a7df1670
- SHA512 8d36300f463d3318f33956fbc10192385502b21d73d38d213480fb78121c983f13833ec11eb3a7231c5accb88595e26af078dca0dd7fd53a8db995cb3268a4a6
- SSDEEP 192:uWDMb5nUWnQjxn5Q/fnQie+Nn+nQOkEntdJnQTbnxnQUCnQtkwMBeqnYnQ7tnyYB:9Q/sAo
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424476176" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57B75AA1-29CC-11EF-B9DB-4A2B752F9250} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2828 2020 iexplore.exe 28 PID 2020 wrote to memory of 2828 2020 iexplore.exe 28 PID 2020 wrote to memory of 2828 2020 iexplore.exe 28 PID 2020 wrote to memory of 2828 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a8dc526727aeee9f4ff4d127804051_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 32014ea45ffd73d1f042dbfcf46aaa6499c58c231446528d894d19754a6ec1c5
- MD5 7e06ff07f25c4b8aef53190fc5ef1836
- SHA1 1b571c54d33782c89c16a8f797f1c8f105d612a3
- SHA512 ce4e4f43c840a9928ce9282944e52891dfcb285e9861793a716db66361a939e433fdde66a2170e0f03897bc8af69b4f212db03127b5af04d0c35356f27cad4f5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4b96687bd98a6718f332547a43f60387bc9751f5ffcc30c8383506a970e31f3b
- MD5 9e1b408f13a9857511cc4bc3ee047732
- SHA1 582bc02fcc4ebccbbb9a4c466f6f1fa102fb03e3
- SHA512 1a7316e56bc54e331929cefd210704ab3ffb65ee9fa8aaed9b0754de1fa073235c3ea0eddcdcb273369267e2bab66acedf9c3d71a2d54153533536f4c46ac8c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 33605481b48a89c48db81756fb3776934c4b1f2b7bc9668ae4b626cac0236194
- MD5 af839950f90edd1aa2f03fd32f57c936
- SHA1 653ad7c3283af9d87ede5a58cc20be874c466a07
- SHA512 144a54c6c5bb8132e1f30b29bdbe5a98743099ca059c484d96438fd1089439d1cd9b383308d4b5d39aa5021365a0a4b174934124a69b8c669f2522e31821ebd3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 01807a167e44e21fdf61a3ea2d6457884b705b5bb443546f1a763a5a3c2af8a6
- MD5 2ee6a59b2751acb0a4f739046c59c7a9
- SHA1 b976223e7f585370d9abd68d547e882a5ae54241
- SHA512 00eeb3157ca2bb385c3212d59e1a3ac1bee1b8e9a205217c3b9e49572c64c1735d63904aeca0bdd2235a389d091e09ef5c24e4dcbabe828776490ae5887bdb8e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 119e11456a0813d13567d56dee12ac95a94f24cd54da34cfeabfd5a3a0545347
- MD5 347a3af03e83ea1cf2763b47a548bf53
- SHA1 a0da37864e79ab9b0e09c0c45b790df3859c28d1
- SHA512 4321cf512678848df621f9a07973fe6975887987cbe9cc796f1c6f2648b895419236559e33ad091a05923174602b6b2aaa34fb0d537379a8ac9f7aeb077c0123
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2e911867b0bab6b2a723171a73029326e0b4a1524ca0de219cf6a41192e6197b
- MD5 1a290f6bf8d5fa977f91e0e1de8c51eb
- SHA1 a1a31ca6e6d8057f5c06355c472473b8eb2cd517
- SHA512 b55453d3092afc8b7a0008fb221b42f4fb2bc038a9d7011c15d1b9f166c4bac0a5f4d3b5186b19f36e951c82b3569b172593d4bfe3b649c0e4f21796c8934566
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f2827819ca75417dacd064ee8e78745266dc98c6054037d25d4823044518012d
- MD5 b57606dd9ae7ab03db4b448897c6e815
- SHA1 3e943b91772d3f4fc742b9cf00f6f78e3a987f95
- SHA512 fb3fe06d96e8a014f7f42666467020e9ad54e45164480f42449f4b56a299b7e0d53b08eac6494b46190d93cfadab2d95c6f17bd84a403bde7c3e1722dba3dc35
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 aac75da352784a172f47cd0e7c029c774828bdcc5e9c5182a34faaada205d1dd
- MD5 11c7e029be94bb1b9c61f6e04aada5d0
- SHA1 9a757dd7d413b92829e4d6927c858e12f3587dc3
- SHA512 17cfdf3f9a456c84b6f17aeda5cdb1bb953aedfb15f7c0bdc011ea0f5a2983052392199ac8b0b36bca897f957e33decab7b49ce1fc991a15b5bf6d6d9c4b9bf4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 20fa177f9ab9fca4396c0e31e22fec26e69d19989881559ff5dc31a4c9f6ac68
- MD5 173e9a8c5eadf4ea4a2fde064fb2a2a9
- SHA1 f4b1f7ec7b43c9d31b76604d5e8c4ba9af13b2cd
- SHA512 4a32a25ea12d3d7c6852689d8bf5d5a1009dd7b3db5ad7e13ce4c7c37a1476ce092ecf334e8f88280127d27def51e519cacf23ef3ff58a57ab51eed4fe711f43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabD9A.tmp
- Size 67KB
- SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
- MD5 2d3dcf90f6c99f47e7593ea250c9e749
- SHA1 51be82be4a272669983313565b4940d4b1385237
- SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAmU:gp2ld5jPqW8LgeulxB3fgcE1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarE3D.tmp
- Size 160KB
- SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
- MD5 7186ad693b8ad9444401bd9bcd2217c2
- SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
- SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt60:as2J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP