Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
a3d9d2997098211428765d6e3094c38d_JaffaCakes118.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3d9d2997098211428765d6e3094c38d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a3d9d2997098211428765d6e3094c38d_JaffaCakes118.html
- Size 25KB
- Sample240613-fargfsvbmd
- SHA256 8d0115608abed81b1156dafa536a18d01a6aa4d365d746b2ad1cf3459a21dbf6
- MD5 a3d9d2997098211428765d6e3094c38d
- SHA1 ba8d6f98f45b4ade68d768934d9298a3013e2fef
- SHA512 8710a4803bc370aeec3e5d38b45957480373606bf407dabcec5ebb0bc1be9f4455929afc5287638112d47717e4e648d3689e882a174d93175ede057389577723
- SSDEEP 192:uWzA+b5nN6nQjxn5Q/0nQienNnXnQOkEntU+nQTbnNnQeYqCLAWpdEe4cwqHXMBO:lQ/j/rLOO
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EFAA341-293F-11EF-87B3-6E1D43634CD3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424415496" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 3032 2060 iexplore.exe 28 PID 2060 wrote to memory of 3032 2060 iexplore.exe 28 PID 2060 wrote to memory of 3032 2060 iexplore.exe 28 PID 2060 wrote to memory of 3032 2060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3d9d2997098211428765d6e3094c38d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 0fc3ada8991fb43345fc53174e2e46a4a04efda7cb0105bfb3ab32ad2429a028
- MD5 17a159bcf73d800e9720796a213c052a
- SHA1 92ae005e6c7497f90c55b8a694777d890de02d8d
- SHA512 f624f0d279cc9dabd981f86724af7d3c11e6cb7a9089ad1ca7eee3e3a8b2f9175df6ad2848f4b2e39092b30927703aadf11ceaffd8b100aa9fa64fe5b12987b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 924f6e013d5369e4c5dfbb1aed7852fcbdb8f074febdcb59fce6e70ca48ac9c4
- MD5 106f1841bf4ea6934e489e60c98e2fda
- SHA1 0697e72c6448721e1324259f461356b2166aeb52
- SHA512 fd60a9a592e5a8be031ce9bfc64e04c7c3e29e61333d6c3b987aa14591cbe77954df46ff3e5ce0c967860f5a4d4de0614a49e576f14637581c0dcb627facdf4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f7e7471b23036969d1365101589cfa43f90932774900bc7ed884364dbb6d97ff
- MD5 d5c20dcdb4d6a7704d1383a406967935
- SHA1 850151de15984e6b53082703c36860d586a0dea6
- SHA512 cf2a218560725f3f18bc4f3f19dd47c2fa417286d5be4c6debc52822aeeba6f6bf8cb03f5f8b198d518b8a4b0a7f8856ab7224d62e743ef6661b1585958ed583
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a44663807f322f3981adfed41f3307464baf2502bdb763d08c70afd5941e0115
- MD5 583f6bdcbb77de1d367aafddecff74ba
- SHA1 f93b2bc7585c2687e22a443f146c8ea7fb7946af
- SHA512 222c1aae3d17e2f412aade4613ee00b6d0326de76ec7feb6ed3de20fe5bfc11d2410117a7e0de0245a753b4ea568eb6137b1afb672861d1846ac0cd984f1f445
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1964a87ba6e12137cf94f88bfb9c8e88ad6b1f224d6290618056fb38b087a030
- MD5 2fc9118d70471971cc756a22435026b8
- SHA1 65d27fa48a52d1c38057b9861e249e3d487f9dc7
- SHA512 d5033ecbd5c899d3a42f05a997e3ae9bbbc87a59a38c38fcd5a43e6e55b4a55ad174d47e89599b1bcbd65c1207ffc3fa8334a1437ccefc966aac716d9e4ebd5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7d8baaa9da01aff8ee93423578baa5b0dec9b9f938668c9954efa5226b64a2ca
- MD5 8f408b866f49fcf869c1d94238d41904
- SHA1 85a168e2202b1257da07f864837a2a894bd2629b
- SHA512 099f07be997d014967689ead17c8f52ad766a97b26f5089f95ef04a058226040eac857bd98b3496ce2e48bb7ee45a0c2ee8c9244b4f75227a444adebd165305a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8223c04e9a21a4cba38e28e260faf876c532ba42a87dfe9d21fecb6d75986cc4
- MD5 94c1c9621b2495ace3f74ea89d609eef
- SHA1 f94fd3abfb20a6635a964711320c24207184e385
- SHA512 9a087096f7b134443b2a3b604546344290f1ac9f8f52ae43d7b822cc2407a9566884dbf576ba8519024334c0ecd2aed6c0198273cfca26ebf5c7b5d423fbf165
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 754b4db7eaff48507bb5c30e5b56afd7e62fa727133a622642053a93d2ee6051
- MD5 16af0d1732b755c5b2ff056616e09460
- SHA1 e60f60e09765ab1bab90635ca10e39006b5a1fa4
- SHA512 118668a99b2cb9af4b6dafd1149af6634f5755ddfb2d38d4cd10278661810b71160760d60ecd99366feb9eb3939482f9a31f4bdc79067f47cdd6589a60b02a71
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e0a5801a8f5a46783f0b9d9b3c141f4f54af31b460d84b13add994c20bfdc982
- MD5 b33a01024f2b8a39bf2ebf548d2cb129
- SHA1 adfbd1e5d1f1a211eb380a4cd0b45c4efd0a6a52
- SHA512 ff97328c4b025d78479c7d8c7b7fec1732e393bb6c6de4b575076bdb86f8bd38022a8e20e306f9bc3f8b3d77c50f0c8463fee811d795834521d1a2cf827a82e0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 48b5259c736c23a9f100debb3b86cbf3762fb3cc893eba07aed5f46e5535e57e
- MD5 a4e38b0fff6a6d90244ed207c6484898
- SHA1 108e84d93ebe93c85e4bc41e84d3bb49ef579327
- SHA512 fadbfa6c5fdcad3e9b5503da448db7c95bbd8eb9ba9e33df8720243f562f3b7c70648873c971d4ad530e2aeaaa663a03b5958151e154e603d5e215ea376797c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 999c10dbf31bd60f911ebd3d18f5d280cfb5a6be4df0fb7c8a5ec0ee504d5987
- MD5 1bb8c8b71b0bbbe81b61cf23da2b682c
- SHA1 dfb55c14e4553d605fe6745ffc549db3f2cfeeff
- SHA512 7fae8209526bdc087973c0259c92bbb4cad4ae19744fce7a2e8145997a763103105a059b42d26b1010dd84ebc1038ffc4431b792b5ed8ca73fb2a2b4c859fb54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Tar1902.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP