Analysis
- max time kernel
139s - max time network
151s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
a38224809094ec39590bec97ad1387ee_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a38224809094ec39590bec97ad1387ee_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a38224809094ec39590bec97ad1387ee_JaffaCakes118.html
- Size 52KB
- Sample240613-cp3lgsvbml
- SHA256 fa2da44f74b9d9385adb074aab581b5695514fc8780196bd448ae7c7da94d006
- MD5 a38224809094ec39590bec97ad1387ee
- SHA1 af9f50f1379568716c34e2d12255b354de5e136f
- SHA512 521646d49edfd4ed94b4f2cd6c5c7f84bbddc953ac7b3bee1a232fc208623dfa04d871a606a13039e0f9bfbc7e586755d0480ec7f08051e6d0b8924624a5cc3f
- SSDEEP 1536:VAQSnjcWQmIIx9zFblIJfbNqQ9KcKvZCoqbPKijIMiv6ymMML4:GQRUz0JM3RCoqbPKijIMiv6ymMME
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01bdfce37bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0D4F241-292A-11EF-AF9B-7E1039193522} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000bc6f946d6417d5f39bd559a7a4e5d5fac4d46adba59e62976d434c7a22ac67ff000000000e80000000020000200000002168829d1d0446972c64ad45572c70e26d9348c5e71e05bc5ff48b52f98c945b9000000051dbdb1f49d1e1840f0dbe4fd4be738289aec53d49e5a522630dd9dac81e671eea39041c3d18b6097fa33ae713622cb5871678056dfdd4c0ee7c2173ae9ba63124c6c313a717e4f76a647b9337a76ab4e90f5ceac39e8f5e3a4cfc81b28f9d3ba174ac2485a5efb69cfa0dde74333e236f6c627425e394a6af9d3651186b1bcaedffd7c4b831636eec7d6d33dbfb3d9440000000cad228348084b2db3edd39afc2cd10ab9708ad61bf84df1ecd2eb7ddd1ab5cbb746e9984ec9ad55b5089bc2f59dae24645514c4c277f14300aa550e03826a133 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000827aa157551ca1d0634c5372f99108f1b4e17f816abe12a2fe9847c1cf30f6ed000000000e8000000002000020000000134d9540d018e1f4917643685337200d9e520195c30fed0467b564d13cca2e29200000008cbae0a53b5773bb9b2f01df5ad4524c86d787764f1a4f3d46848cda0cb809e340000000560c91a9e3da085538b47a6db92df953e0f44ed9b83e76edb41e799aaefeff7f65d4b0647d1417e5c5c7daa3ccaccb3a8bc28d80b5ba74c2f82a881a462f06eb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424406863" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1904 1672 iexplore.exe 28 PID 1672 wrote to memory of 1904 1672 iexplore.exe 28 PID 1672 wrote to memory of 1904 1672 iexplore.exe 28 PID 1672 wrote to memory of 1904 1672 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a38224809094ec39590bec97ad1387ee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7c3bbdea8cedbf9e9faf9fba2c60fac7256cd177c72d72d8915cbe097e47f3b5
- MD5 89cca78fbfdc4c5498f8f067d8f9c480
- SHA1 b5e043d34b2b686afacc649a4b827ba2013df2a5
- SHA512 162786f1e983660cfdb416d0404151922b8b1983ad3a2da949c0fe2e8c4c3eb8a14bc48643d86623e15d28b27eab9f87caa1a5ea81f7b75e938ebbaf65364602
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1d4f17ef0aa920280a5c40bd84d0250b396812c10ecacfe88f3cc007c9f999a5
- MD5 0fa23789ec0e5598ac2fc8aa5c8c58c1
- SHA1 3b31e31f3283525f3902584df418caa2d6f5e7fc
- SHA512 1c35310fcf9003fe090dabecc9239f30e482d6aedb5a5f2f4b5d5651d56765d415f013ce0682f6cdded68d3676ca73fdb6ddf89e8eb4df50d899fd6df1bf4c1c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 59c56b1b634be934a04adbec10230da1624818b90441624c43cd6cf183f118f9
- MD5 b27410525a9cf00dbeb125264f3f9280
- SHA1 5debdbf4368efab29aa35359ba79596c502f45fe
- SHA512 b0a462c1d734cd405a369c120650fff1feec262b067efe3e138346997e0fea18ee184fb632627d96a1e1f2e9ae5dbaa92bd5c4c1bec244fc758117f428cad545
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5a1e1a7746842c5d06e6519231f10b1ffab68ca3ff7671cf459d4f77557b1188
- MD5 bee46ad8a0a390f891b5a1195bcdb25a
- SHA1 ca71dde0169e83dcf309208b9034e83bb32e4a14
- SHA512 10673da131923478d05d554b84e596125188d6b81faaf08edc3fc516ab1cdefae1be091ef04f052307519a0980942e8c6317235258feedbe62dc226fdf7b9333
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 19a88d5ac62dc14d36069fa58013562f857eea599b2562e34cd4cd87693c0466
- MD5 588df297937df2ee07d2badc4ab48d01
- SHA1 fcddf68022dbf01b8f9e3d945edb9cf6d079bcfe
- SHA512 d1702381d3ba255a49e09e5210a9e728a75a2cda7ed748ae7f4329d63417c67df9c8d30a368c1337a498b863a34afc6db0a45c89859e7580ba4c2f1478a4e6ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\cb=gapi[2].js
- Size 66KB
- SHA256 d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683
- MD5 0fe383a7ddb9bbaefc3105b3297f5583
- SHA1 f80c9d789f251909c7560bd91a9e1b9a10c26362
- SHA512 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4
- SSDEEP 1536:GV/LeDvGcyvAjTbF9wDebPlEbujOPTpdjL:fGcyvoTFjOHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\3604799710-postmessagerelay[1].js
- Size 11KB
- SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
- MD5 40aaadf2a7451d276b940cddefb2d0ed
- SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
- SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50
- SSDEEP 192:+MvFGmjVGhFkC7s7zpRnhK1deZ+ZzirR+j3IexCAC59RKBUq5hL+XloH:+M0mhG3kC7s7zpRM1Vz8+j3IePyYBUoj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\rpc_shindig_random[1].js
- Size 14KB
- SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
- MD5 6a90a8e611705b6e5953757cc549ce8c
- SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
- SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd
- SSDEEP 384:IXocJuaAiggOKU7nFahfaF++5SYOelHO91KIuW:IXoUAiM7FKCROGa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab56E8.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar9208.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP