Analysis
- max time kernel
150s - max time network
144s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
a4d80a5a0465ca49cc7d5ebe81b6bded_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4d80a5a0465ca49cc7d5ebe81b6bded_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a4d80a5a0465ca49cc7d5ebe81b6bded_JaffaCakes118.html
- Size 30KB
- Sample240613-lemlyssgkd
- SHA256 c0d8fdbf5a643a6392f41a6a1c2c396af85bbed0772553248ab2e88c1fc7b375
- MD5 a4d80a5a0465ca49cc7d5ebe81b6bded
- SHA1 e00d8e4ccdaeace074578801851ab437d8a47199
- SHA512 2a742fb4aac4c5ead07849ca833c4d076a11bac730891496b8a6ed069d532dd8a80edd4ae4a6a32748f5d5a9964ff47100f142ae5d3002d6679738953cd97146
- SSDEEP 192:uW/1b5nFXnQjxn5Q/YnQiejNnetnQOkEntcanQTbnVnQEMC7Au6K+iibI3serwxc:aQ/cCBTOcca5zARvfUO7i
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14640421-2967-11EF-9E55-E6415F422194} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424432686" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 3004 2176 iexplore.exe 28 PID 2176 wrote to memory of 3004 2176 iexplore.exe 28 PID 2176 wrote to memory of 3004 2176 iexplore.exe 28 PID 2176 wrote to memory of 3004 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4d80a5a0465ca49cc7d5ebe81b6bded_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6efcf83c1bfc20e618bb2ff1a6cde8d82d89019c2c324706765fbf123b7bb6b8
- MD5 7c59c0e655422b3af3b18c3c2d8c27f9
- SHA1 f768076457862842995962c6f08a6a6a182b0054
- SHA512 86b719866b67e7bc82d526601e2a587ff59dc0f288e1c452ca1b8f50a8644dfafd214e2c216dba9427e7388e20a33167bd0c5ebc0dac6a74776559e92e2b0efa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 09c96b7c8c5cacdc19eaa57caccbe9e00d0c2aeecc3e6beb5d869f05cf7cd911
- MD5 54fc5f3b16ebe063837f157723ff565e
- SHA1 e583b78a4933ac5a27995f6c75e6c657a84117f3
- SHA512 07c15d789055d5646709e6b3692063be4e1e2b3bb7657668c305e6513cca3970c668f8fa1c6b19ed5ddc4b7392330338169c228cb96640fe1ef4c8ddcdb77665
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fee682aae50982583d6500bed54e9ebd7187c45548e7c32e709276e3b61427f2
- MD5 353436e738bf49e839f120300c277363
- SHA1 5fa6494e4cdaac74b8b0ffdd35c17f7ebb957b02
- SHA512 925ea0f19695726a350162166ba084597527f1fde2f7df40b59ab26dc58b9258b2a7c036991e62d384fde01b9bbb173ee3780269906972ef1ac15237172b7aa7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 18c48c79f3993eb007aa4cd0caa21c2545289486014e1084bea6cf01be0b53ae
- MD5 309eb544c69d605b408f8e7f4b77848d
- SHA1 8f9bef3637e949d2395cb2dee53be91321bb9064
- SHA512 3ef9b4fe181d349a425a5d08962cbb4cc1a36c39703bf04e5a92de1c99c70ddc8e1366f6be1db1538ec76a226183b828e9cc260d1faa41dfb65799db95ebaeb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b4d29c0553b89bc3d14ce8d4878f471aa858abb549c96ceaee8efb3727835ebf
- MD5 9305b85c4bf8d4f7dcfd608256d1cf12
- SHA1 04e3e6b6c67483d6ef3011cc7bac5d991c51231d
- SHA512 5d0129d86697c4b1df3736456a8c46a26fb99267e3c8e0399ff1fd36125f293438b19bc902ef2a8ba286739f91fdb43858a690e6b1ba5d3b1800188f4def6d07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7679144d91f6b9de8580c4f2db08ee481fcb5f8f46a97e8274adff7847c579c2
- MD5 7ebaa5e5b3b10596aeecc175b7fe415d
- SHA1 e03260076b65f910e560e8b851a8220a479d52bc
- SHA512 801114d6891045a9b73bfd5ed1305e158417d651e7d667f878a353a958857e224fb749444b85eee084df2dbacebb2aaa74014e197c919d0b9960da4e2dcd0fd6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 01d2ca487a7cd62179c9edcd409635d92d5cd079d7f5608a998467bbb794edc7
- MD5 178eeb9c29862cf6004c055e47861ef6
- SHA1 3e15148d284217fbe904d59a70940ec1a38aa7ef
- SHA512 aa551bce34811cbdcc1799f3866b70dc125cb54ce19dc1b5bc97f2cc12adf70d649f525842b46f3878c07bcefae1d6e1b229a5678635f34d2d4250fb47e3c6f9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 91d161ef9f4cf635e6e477e618b1bb90a380e7668969983c74e7ab7ab1ee9e9f
- MD5 e7862173ab76181d7c463bfb735a5147
- SHA1 d40bb9e0cdf2d5223c6fa34d3ee0bc5bd49d13cd
- SHA512 b4221d8c93e92b6234ce0903517d1dda7d1097744fbd4b94190b487665900b466282214f4a9178b86551604b73201299bd192f6052f9ce91100fc13c0b62c591
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab6CC8.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar6DA6.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP