Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
a38d9fc6d15969102db582c815beeb33_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a38d9fc6d15969102db582c815beeb33_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a38d9fc6d15969102db582c815beeb33_JaffaCakes118.html
- Size 27KB
- Sample240613-c4f12a1fqa
- SHA256 1b679660ae0d461c26675d76f9c628eb88a9a164985c0479fda35375dc96b359
- MD5 a38d9fc6d15969102db582c815beeb33
- SHA1 acf73d5ea1848e9abd15bb602077a95a81aa35e5
- SHA512 4fd8adbd07a45f7acd3e6aa7e72c88ac7fd3985484a5a5104154d3cb46a345562aaa655603e8ed1df50cdb7f1833a0f23bc4a636c56655eb6d705fd3e98f4ac7
- SSDEEP 192:uwfob5nCBy+nQjxn5Q/+NnQie/Nn3nQOkEnts6nQTbnJnQ9eLHm6u/VfQl7MBfqB:0Q/fC5WVeSxyz
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E58DB031-292D-11EF-9DC0-D20227E6D795} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424408125" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2380 1888 iexplore.exe 28 PID 1888 wrote to memory of 2380 1888 iexplore.exe 28 PID 1888 wrote to memory of 2380 1888 iexplore.exe 28 PID 1888 wrote to memory of 2380 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a38d9fc6d15969102db582c815beeb33_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 2b08fe33bfc5d81363201e7e4af215c21bcacea914d6b1f620a983e65b793b9f
- MD5 15ab22298969265622bca24cfd5bdd75
- SHA1 4e1726e8bf359768f738a2d4efea0845447d2831
- SHA512 a27ba19fdc4cdb54764ac1f5fcd0fa69630971078c843f9b343c5b45ba4d23c231c5118e7e50b877cba16954bc79651755b1a71e7f3bd8e09a2c5d0763490d97
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 c16ffb04789b5bcdf02b871e3accae9587b5f3bc267646e5859fb70254d4c2ee
- MD5 f06f3e505bcd180aae3a9ba12700f697
- SHA1 212c184b78acce59635b62ace9ddd6b4499a4d2a
- SHA512 52ae620751ef55b71ba689871354bfd6baf781551cb0c252583147c3c492e5506b850f3381bf9995e6881895ece75fda89a6d2727b5aefa34d39800e2c5794b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 675d86657f808018a33d5be1072a32fdbdcbc14c032342647d6e7a141d604c31
- MD5 e06f0db14fcd0b0c54bd138c8930e695
- SHA1 b2fff1620d3c2f35ae3d12218e715436fe505a01
- SHA512 36143005f8dfbe81c152f4ae27ece6b1285f4f6084a3af451d88bb38efbfc586cad23fcb69a9883c5e8d116c9f3de50d35b15bd147c8892fff98f2dc20655b2d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 84102d1c93d2ea514fac9a132336549cb00431e77618559c69580f1a63d25ba5
- MD5 88cb1c8bc1a3d303c3bf079c0a17ed57
- SHA1 d6797c38ccfb541ef27b5fd62504cbb5397c7c1a
- SHA512 6af066d5f2b842b6ccfd9e5fe80c6f4939b928353e4d882c9384a000f37116f2e8e3fd86d3d02b3290409cdebe5a41897e0bd752aec1ce15857f424873bcc0a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 db8c328308448c2dd8f48a4838c7032e195be79a3a686de7a51709dc793a877c
- MD5 6fa8b8e3ebff5fcf2e425fa5ddfb3a52
- SHA1 e54e1384a574f5a016910319ae63b408930b3aca
- SHA512 15b1f2b0f4995a07bf91348c8d7c7600a740088971cbf21be5acc72012dd7ac617094c83179a30e013c6d7b4da6b71b0249dbf10b59a2ef9d89a78a5141ebbf9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 e0d501fea49c627278bd11cf11bad631983a86d8046c508e96dfb1ebbafa0d65
- MD5 d95b8612b254c463934a5bab1bf87edb
- SHA1 dd6b11a2f8a1ad656fb84d806c7ef130c8a9a9ad
- SHA512 b393f78a5609087a915b793e91a7e7e23ffbacf1ee84f05877465275ae1c490ca123fd07388d30511feb1be694f547084c2166af197e5bf59de568a7f2dd5ff9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 f48418a820eed0c0f0478887441585d585580f238a0d0d227a83ac100d23a7b5
- MD5 5d509cbad28c4786dff78a9c1cdc75fd
- SHA1 1cbe11b0dbe5dd3a7e049e797c71f7c4928026ac
- SHA512 f36b110c207e3a15b5c9621182f79e5e91ca560678d1871fbc3fdcbab1d3cf84b08ed5171d239669ba576bc3efa2f0d836dc0bc5eb3254281a0fe26774f6027e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 304B
- SHA256 79dee0298688c0ae3dea80afcf5b5c565cbb41901f67b688d1dd9b6effc22fec
- MD5 f07143219b2b3f7065f8d827887142ed
- SHA1 eb0e6603dc3937c87ff39e7c9a43c174b195298c
- SHA512 5b9dba191f6d08162ae2be49f29860f3985a235621b5aa000fdd0e40d914236e77dde0f5b2293d1cf5193e8b160fb43e88daac0914906cdea96df75352f806da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab2FE8.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab30B5.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar30CA.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP