Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
a3d80d63bdd452ceff8de6607dc29aab_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3d80d63bdd452ceff8de6607dc29aab_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3d80d63bdd452ceff8de6607dc29aab_JaffaCakes118.html
- Size 23KB
- Sample240613-e9jp8ayakl
- SHA256 0eac4f522d6566dff524dbfe0b555d0a78bffe836aac95fd31eddf1448908351
- MD5 a3d80d63bdd452ceff8de6607dc29aab
- SHA1 015fc93bdcaf740c1c9a5c28cc9758c3da3f89ef
- SHA512 d42984f6208c654d90337b341670d7a9da41bde28cb1bed3afee9bfa024ecea16d3f4416576f72cc84bf1c31197e55d2fac6f1b63b169f61d743590afed2cb2d
- SSDEEP 192:uWTIb5nQinQjxn5Q/XnQie2Nn2qznQOkEntpVnQTbnVnQoCnQtMwMBWqnYnQ7tn/:JQ/gqtMc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424415369" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C355BD31-293E-11EF-A38F-E61A8C993A67} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2016 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2016 iexplore.exe 2016 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2216 2016 iexplore.exe 28 PID 2016 wrote to memory of 2216 2016 iexplore.exe 28 PID 2016 wrote to memory of 2216 2016 iexplore.exe 28 PID 2016 wrote to memory of 2216 2016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3d80d63bdd452ceff8de6607dc29aab_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 41c4138d5e6640147f90c269df3fa9825c8152a9f7c8df436c88f62ab88002be
- MD5 94f4b16ec959f20e0ebe1a11c0ef0c87
- SHA1 74eb29eef955fb6aa3933a16ce0f0a0c3289baa3
- SHA512 fa56130573a0d0cf510ac40f2320874ea2a09073a42362d1e599572ef48868d8326268ee5b299846a7b9b33508840fdde18e93a3a0fc538cf1c3e2f44a6a2ac7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d5cdc4f91502470d6c64440fddbd188648b5a55e88ace0bed28feea216dc414e
- MD5 a2826b2fd6351967de29fca610f058ba
- SHA1 6a9fa23b7c92a475e4d62255ba377e67eac8ea11
- SHA512 5420a8d596e5b2422c621ac1c17eb1cb1805f5e4cecaa8887b55316e4e501e711fa1be8d786ffc79c9d0bf190cbb9872f212cce73b35d83fda05781bc921f822
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ebfc77888b68313917b8ec31b8acd782dc83bfa626641ca2125d1426053afbe7
- MD5 68d56716a7fe17ca082e438e08de027a
- SHA1 571cb12786e47d6352173f00244d23eedd531ace
- SHA512 4b12c5a54a6c4ad6ebb7cc321030d8389743eeb115d5aa878e0a91283e14febae92c8aa1cc04e5400affbdeb92dafc65903b19e18eda331c8126593872b837b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7fdc3a4d79f3013c29474da18792048308672993debc141118bebbb5d3c1f5a2
- MD5 ae37fe9bcaeac3f25455bcbc30962ef0
- SHA1 36eb83f9cf24ad91b27236099c1f34694dcaa604
- SHA512 a03e0fc00eb9d30f8e497ec49109392bb8c9ad9078a06c627de9700ac8bfc6d98fccb9e79e71e4f9f1739eb2427ff52bbbb06be118c531529561ab2ada15cffb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d74698472e64f1ba2fdc1035a6e1379d46ccb8397c56048e1597fe9fc444e9da
- MD5 4afbf5000560c1315315437c62dbbbc5
- SHA1 73b1bbc4e73b478f777c543745d65ded9e9926b7
- SHA512 f0431619858ea18ac438a279d51fb8aac24c0487d557300d9726fdead6455bf097d69d0ba58cb756476d892db5f11658deb35b3b5651c76965e9788049d9a266
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 39e665dc6f9f2a032b19dc5228130072789310201919f6c90ca88f1d6caf6252
- MD5 d273b854a3623124111ea793e6909e41
- SHA1 4d8c479e2a1ed5fd32dd1b6f8f9a87f1cc37cc28
- SHA512 967a9f2bef208b21574656297d256115611e2ac728f72aabf73f9155afea29eba99e0cd23709654795f14b470923621b5b632f67b56609bbebaf3570db548519
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9e61638e8d31af448f50d677005f08b64962494739d00593bc7b9dda0ae4176f
- MD5 915c1f78dade5b4d1946f9e15bf57e7a
- SHA1 4deb847a244da11b2ef65056866dcd3b367e807e
- SHA512 5684548950c1cec07b2b3ace254f693a2b8961c7a595ba5ffc68907d1dc450578b569f20283cf38d374d6e87ec92e522ef9d0fd4e8bae2fdedaa7841eb6cbd2c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 faf3d3aa2fe5ee07b55b8f1aa114843688df6dc925cf3c377e41a591941b70e4
- MD5 c7c9c502d7d41775cdb87691013844d9
- SHA1 14268bf400895a4bb014413ad6bd15bfe1784bc3
- SHA512 6469913f880128a7073cda2cdd366ed0198499fa627b0ec03dfdf92a4963e0297e230fd5e20e5fef09a925beb1f5dd987d937aad1388e4462bd8538bd96a8bc9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6087ca13632bf59cb34dc2e546257846c1d8419ec8afbcbecc9ae91af5168d3e
- MD5 c376e6f3795872dc903aefa43ef88bda
- SHA1 e7a60f60d9ddf7b064cbac3d74e368fef9276403
- SHA512 6eb0320c8230b6b3b226e69a9bdf3b021ab11bc2bff572c628ce491f03deb7bb6098e34130a8ecc9460d239b75e6d3988728fae1cade6737f26229024ec67eaf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7fe435fabafe8c3fff540646f9fe758b33e51158357220dd8d3319685ee1c956
- MD5 319b1a02dd60c8f80c8978c9d941c640
- SHA1 088f0f807063f10034fee231bd2f300ff2bd0b0c
- SHA512 865000107727be3ad75ab38aeb682447446f18f16441cf06f796020223c8e2380a0fa85152f9d76e32363bff2ecda3c1b20527d892aece71d3885388b1d8bf0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fbf25ba00fb18eea20ceace0b4787c7757bb751427618ba122ff183ab1df263c
- MD5 a1277de3a9343387d2a0754f3c2497b6
- SHA1 d29f1590ad00fd555234d318e116b540191a0717
- SHA512 92c148c7b3b00ae9729a22faa2a021cd139032df20743dd6948f2cc68959b767a514d3df5f4f4610e70c3c7f7b02819692f501c70c07782483ae31db3c6360b1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1FF1.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar20E2.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP