Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
a39139acfd9acec60734785fc6ca3ad2_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a39139acfd9acec60734785fc6ca3ad2_JaffaCakes118.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target a39139acfd9acec60734785fc6ca3ad2_JaffaCakes118.html
- Size 23KB
- Sample240613-c6rwbavfpn
- SHA256 4c9c835b185b8f0070bee3bcea1f03144e0df233baa4ca3569a14246296ef90a
- MD5 a39139acfd9acec60734785fc6ca3ad2
- SHA1 d1ac86e046af8e9e537adb4e36bca1970cbddfce
- SHA512 bf9ffeeda35d8936a888e0d3388d61e4c53937b3def5366ce8bfc6bdd7b5b20f0bd68a270915c0fac88891f6333d1dfaa17c21d2cf96cda6c4958b46fbba0c98
- SSDEEP 192:uWvUb5n5SnQjxn5Q/snQiePNnPnQOkEntwGnQTbntnQRCnQt/wMBvqnYnQ7tnkYB:EQ/R9di
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424408367" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75D718C1-292E-11EF-B1CF-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2128 2164 iexplore.exe 28 PID 2164 wrote to memory of 2128 2164 iexplore.exe 28 PID 2164 wrote to memory of 2128 2164 iexplore.exe 28 PID 2164 wrote to memory of 2128 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a39139acfd9acec60734785fc6ca3ad2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 12da892a3c5b9fd5838384d3ecc36e3d688930a2ccaa7c9d31586df59675bb79
- MD5 6df62e9bc97ad11c3520dbbafe2d46ce
- SHA1 4ec7a3d85e7998987aa33baa0791c434a4e9ee0c
- SHA512 72afded86c4587358ed355c95b5b74aad006579b377ef974368ef4f71435a9321aa1a6f5afe6914a77a88e6ecac5f42fea51e61badd2b55cdc1d764b9e0ff256
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2e9a6698740d8dbadfef2a13155338ca900fc62fc2e296d68254becad7e600cc
- MD5 eff770943c8819d76933a3d0c3a6812f
- SHA1 df9942129ed0b076698c292e6f0fe5c4d22c2bff
- SHA512 574e8b827ceae80ea1b79e7a934be210fc132d924b2d842290b67ada1564d044eb66c13a4d9c2a1139c62d0b531442ec2d3e4d3f4613e817fcd13cfd26921881
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3a95f0a5f8a001f36cd11e7e6cd8e6424d760e49c6b589c214caf762837dc340
- MD5 716e6707631527d0546ce2e866d17a94
- SHA1 426f35e373fa42a6b3f29014856b872b88bcecc6
- SHA512 aee451e48dfd9e25d311b845fe7c4f08e3f8dc4e6e901db2658a0b243b4f0c6ad2a89f289f5fe04d5055297d090433924570a7de3919a5032a750d33eebfe75e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 122a27fd0deb1788be79ab348bba7fda6f3440e6fc991912948b986e44f1672f
- MD5 99eecde817a7679ba0b1c96fbee59449
- SHA1 ef7cd516afe4b80013e8fd274d158c4bbd17dbab
- SHA512 837876dc8b1168988085c626a5d0574da8c6d77d878b42411e12f515831e12334fdd01ae05a54bb6554585f07a492dd142ec4365d614b6cb1f4adf359a2c3de3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8445b48caf8b5fef61f40c94c6d44230fa3032dd8e24e727a83385d161d7e0f2
- MD5 3c2d034bb7af45b3970e2f06c4169d7d
- SHA1 025d54423337734300123f2cdc5c65629d60d96d
- SHA512 773d2ebec8abf2a004db87c521a9fdd3a458eed46c960e01049bf9b048991bac1e6661a6888ec34ec2eb2159df768a12a4669021fb2fbca6a75e777d5e5a0cb2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ab3ee0e3cfd02af3332a8c78866f6cba0cf3fad7273b93e6adc555b3a7f52296
- MD5 5924238069da4de716ae4ef21698baaf
- SHA1 4a7ba384f92b9adeeb3c2a29800c425901c889b1
- SHA512 5c0bcc5f242c8058ad1f319070aa4cac62ae2c9935946eebb72b39605ab63b96d6c912fcedc01d902f1325125c23f3a9e2eefc3532632aab39fc91e21d7df8d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 41272109c6bad68d774dc0c5ab4ebc8b6057ee440cdc92916195abe92fed77f2
- MD5 e24f96103e421fc0af97517c36ec048c
- SHA1 1c57b2158c0d4ffe0d50ec4021ba2065b8038ba2
- SHA512 bc1efa56faf3dafc2983b473c45169e1550ae8944e22e9e0eabf431741b816642d0baf73bd5c72d5d4a5eaf2e4a97c0d8d15e14b7b6eda71a1a22585389c3d39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 03499064d6bddf801f6e61483c6a61ef845b7d97b701cefe52e8a06a917ec634
- MD5 687441d0280aaa9212ca2288ba01f234
- SHA1 2f596b9d7441e3591042eb851defac038d51af17
- SHA512 adc1198138520e616402153faf8ec6dbceb16615537862e810ce42b232c52148f0c33df4ce2b366d1336c2ae1c5d9d69e065aedc6e59b5f39d04f12b2ee15be9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0bb3bb84bdfceae4fb0edf8ba2bfee458bab13a58661c66967371f04ad1f0a78
- MD5 2800549856d93702828ceb1e18477d08
- SHA1 f8513b779659a0fad0ab7d74363eab6b45a4c039
- SHA512 c18614abea59222b164b4f75f20b69b2bf5d4814783913b550cb55d5240d03ca158e228c4165f0ec0b8c053c14af746dd6212c75178b36d234d1af4cfd02e24a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1CC5.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1DD6.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP