Analysis
- max time kernel
149s - max time network
144s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
a3d17cbcea3939598ff5a66ce7098640_JaffaCakes118.html
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3d17cbcea3939598ff5a66ce7098640_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3d17cbcea3939598ff5a66ce7098640_JaffaCakes118.html
- Size 120KB
- Sample240613-e33jraxgmj
- SHA256 58943c23efd427bfb9074c07ed2a265c3ae2b625ba48fdf83248e4698b731283
- MD5 a3d17cbcea3939598ff5a66ce7098640
- SHA1 ddac8b757e25ee1ea700d460ac466955275c2f7e
- SHA512 c895e9c3beaa61d97ccf94ad6b42c9a957d0a0326e14401457b3bc4adb1f3a4ca569b591c85abba69e092eb5e969a392be206ab6c9ad5aa77f86307f307a90c9
- SSDEEP 1536:A8JyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:AuyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D30CF91-293D-11EF-A296-4A24C526E2E4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424414795" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28 PID 2904 wrote to memory of 2100 2904 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3d17cbcea3939598ff5a66ce7098640_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 954ce4e4e478082992d2afff8cd737f31d94f6eca01f1d44f5fef1c9c2c451cf
- MD5 d09919430da26caa7b18b6c6c368f6f7
- SHA1 0f9f5755ca8dd3a5ab7b38ef51e0aabeef810023
- SHA512 29ed92903c49e1c340e1f79f6308e6817b211f438eda336da90db6af36986155c2cbeeda1bdc6430b14977d7a8cd96f2c614eece5696b072202a98a3a84da704
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 267451a7df6f8f89757ffe94fdfec1e1b3404545cc771a163b3ffe719693abc6
- MD5 9a1fc1aed5b3b065d16c46c10eb4e57f
- SHA1 e717540c939cfaf193b71dcbc5cf004a4dad1db4
- SHA512 5eac67495e66a699f6cde08981d9f9efe5c2fb9f0636ea436d3b057341f69888b21bb4365c8aa82ce97c53137bf15474c9fc568f32b5d259ea162c8fcae0b88c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4f77f1e8d8d396713f0161db626906e9c972d8a3a5f1029cb5db855dbaa6646e
- MD5 466e3a7bc8609f11122b5520c03243a2
- SHA1 6d1c4fd79ef1de6a15f4ced53f573c22cc111010
- SHA512 9488515b643fd6c7f444deee4f273be7e7a5291d1ac5f8bc299cd90fc2ee76cc6ca8a21d542933411fb9fdb68d8d04fbe0c8f01fab2822a18493f9d8b6936dc3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a170dc06e0495927de07dd2dd2f4138febca9c4348b2a91ec86df4d07afa9a5f
- MD5 d320aa98b05f7fdbaf96112c40641767
- SHA1 c7d5d7f9131e27f0acc63551fa0ca8dc42d9b420
- SHA512 ddd0e0e33856de2e854ddd5f3f299b853c3229548368e5f28c9e68e01fa8f0e99f4491971a32c8ae3c344a5f9f81e88b576ca7b1af8acb59a73e39baf6b3f385
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4e263f79ea2e1f84b60ede3a738e4c5802c0f80313090f8adffcc45295431df3
- MD5 0f44a39308269b5b8dc88b05c487086a
- SHA1 4df83163e08c8e8387a699b5038b99d1e72a3347
- SHA512 dd5b1e6c1d2d6d45d6e3ee61e485a77c861e6684b08ed35fc51581a29c5c8c62c645217d065dde7879ffd9caa72e458b1b062905ee1e9a64c6c117cf80d9262c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 88b0dcfdb9e401035bc287a5bfd5aba59451f278281eecb653d7ff3941d4a435
- MD5 6f9be324f3e73336831fefa463df3108
- SHA1 81bee725944533591bb06d62df1c9abad478c683
- SHA512 a3a9d0bad42a816c83e44265ab594367229f8531b2c3f1f0bf94476271835e3994f9c411d3b3c2e266595da14aa4312ed5eab5ff4a99a63b2765b4dd6803fea0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a7f5ab450afcb9000ee3ca0daf748eae598a03acdee89f0e917ad60828438d2e
- MD5 7bd42d213c9c2a6aba60aac3fb325287
- SHA1 65b7875a201449d483eda538effe30ca2b8e5fde
- SHA512 23d367e4b52bec7937d59321fce94d9ccf0b36cee912e04383f8d2e45a4ff37294bfcb7809c623bc256975359e392e5df345c95b8bca8e66a660f4054a550689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6108098f7831f7ec8bff933d6d45bc12e2b7300003fed447e1cbbab75ac0c60a
- MD5 9d02eb10bc512c298b1b2ba18183e84f
- SHA1 864cdcf613ec60e1327333c75ce0fb5686fdd4dc
- SHA512 ec4e5dbee4fd3cf8daaa5cc529a9ee0b01bd6308cbd9e2d52294fcf5ac4f0aae98fc3bcd2f190fd6b4444ef4d302188c9e24a12d55016215831132c51bd7b5d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7001bdc65572e21547e52ba3fa6271d0f05dec574989503b6e443c9ef08ca5c8
- MD5 62bed823f19a4ce9b4e3debeae607a5c
- SHA1 bf21d63aa6f2d2be2bdec6df555dab07c5bb750e
- SHA512 595b9b0600687e8f174a02b3d4f05a46be1555c3ba152b1bd20414b13f9b4009d315eef5ff97cb1fd39f5a642d9ef307da3d546bad484ca3fcaf093506b06f29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab16CD.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab17AA.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar17BE.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP