Analysis
- max time kernel
121s - max time network
137s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
a4f4c17843b829c0f757147d5623ac2d_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4f4c17843b829c0f757147d5623ac2d_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a4f4c17843b829c0f757147d5623ac2d_JaffaCakes118.html
- Size 4KB
- Sample240613-lyt55stenb
- SHA256 677cbff19a9edc4cb6be437e6ec06cf733c51dd166b9c3b8da2b0dca08969ad8
- MD5 a4f4c17843b829c0f757147d5623ac2d
- SHA1 2af7a76775ee9cc5ffd84c9b383c3fc0e0860ebd
- SHA512 79c5066c9ffe4d2a5c70b5ca1b837606a0ba1e169fe512342436fc2542855d8c5ca825fa3b4fd12128f130d10f1064da7a9686edf2cba1d82b1cfccfade54259
- SSDEEP 96:ziE8ZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhXQpI:zi9wV4GD8/h/KiZwQn/q6pI
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000001c1e254e7eddede109e38d36872c8893a01b286e89b8425f240d76ef7658a0b0000000000e80000000020000200000005deddd330a5f6e97914254056cfd462ef389a7ad06e583355b037326fa45183590000000c0de1a0a5cdabf58e1162133f2fdb8cea401007e6b5bdd4b14df8c9d2bb8340840f99e21238e585d53446129838bc2fd7e23b130bf8f66ca33e23ca1923d22e82d03653c69639304bcad2099edc2051816a2bd244eccff6ddff1e1c66e2e60095617df09490561782a02e330b7b129a9504cd773246eaab9a497bf6907193234816588d2282ce3d3efba25680f40b74e400000009a12c8eb2c51c1616b5d71e3ed9a1cc4a5868d2bf72d5ae90580f2224cb9514b80be60fd628f71eaa13e008ed7de002af5f714389e3a3f3d0fa5e325d4eb23eb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000053b1bee97cdf34d17943a24fb08b4b3ad151729c804506157211d0f8b6213d66000000000e80000000020000200000008efc077ae3337133379a9f8f8e034f3c41da16a3354f3080752871977dab1e7f20000000d8b75abba6155d54bdf2358a7cdd850748d8c6dfc5bb660d764d01908e46ce56400000009d16ed73478b3e85c0a6ca561768995fef187f26cc1c58ef81a4a40a1a692676e7b1d1e73e5d03a3be634fa10cf07d16ebdc013853e25176fa06813dd7ab6204 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{487E31A1-296B-11EF-AA16-D671A15513D2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424434492" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a027e80b78bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1168 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1168 iexplore.exe 1168 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1168 wrote to memory of 2604 1168 iexplore.exe 28 PID 1168 wrote to memory of 2604 1168 iexplore.exe 28 PID 1168 wrote to memory of 2604 1168 iexplore.exe 28 PID 1168 wrote to memory of 2604 1168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4f4c17843b829c0f757147d5623ac2d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0c00ba0ff9af3c11fef585fad875306a37a730918404ee9c54ed16958a1a064c
- MD5 4b507c6959ede2c95042e7d60621fa29
- SHA1 0589d92568172018fc34a1ece519eeea644363ae
- SHA512 2c8adb56328a9457bf489d35b4f00dd18503e3a941c64d5e5de6e09c876563664fc519c1059734400037893354747b6201e4e4eefbd5ff8dda1008e9c4f9a2a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2f37771c1e3ae63664dca869c5e228836e3a4e1a0c53bdb7480c64d741edd9e0
- MD5 8b66e59f57cbd6f8f5f7e8a253f878e6
- SHA1 f48bc3036fbea19a6d5ab97927d0dc7c93b3101f
- SHA512 4406b1b94cc7d8783de0c908f00d1f0a960046ad2cfd0e701e01d822893616a6886406c9b5f49d393ea82b08910bda6b2fd6bcede7e5fddb2ce782cdb11261d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bea120f7c3abe1ee91dc18f60ae8facf03e3086ce65ff9a1f7b8e921b13312c8
- MD5 a7d65326f25c13581cd15666a4b24abc
- SHA1 719e45fbdcafb919161dd3031c81cf619ca313b1
- SHA512 055ff471f9bbd261f3c4775bb6fbd7f33649c15e5c49c21c0e8935389eff48fab1bfc79522bb91fffd3590dbb0c73b7bdcade6c8c4a78593f6dc02429b93ed93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 04e5bfb5b46b0321f1d50755720715b0fcc560e2cd6fc2e3493b4521dc9bd52d
- MD5 b8d4d0fc720317a0275581a629a9d7a5
- SHA1 a1a99c91ddbff487f71c2cd80f9b0f645d43efc5
- SHA512 5e6286bf343e93a9ab6718064a7e6c33214102f0d956f64aac51694d4789cc30480b84e15cbef45aa1ba981726cf25dbac7dcccbd74fdb9fb3b2c59b0773209f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 14e9afbe361cbc0cea9948cbbf98346adff506f13deb1770e4f1bd9a798da959
- MD5 448da6c4136954a0a7a8dccfdb1b3a50
- SHA1 76478e3cb6ddad17c185fdb92eabd0acbedbb410
- SHA512 1d578f15b18130abb7c6028d588ad5267370369b365155479fd6eaff4d999a0fafd9de94b551d18728fa36caf01e3767cb517227da3dbd6da83d6ea1d3c7350f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 293624c7526b095a9d61d9e094fc0598d3a3232330cc8c95001a65d16c184689
- MD5 085cf15716bb80889ca0a2cde5c3414b
- SHA1 6f9cf9030f8bb55e43b32749d9c38bd8f8ad3b24
- SHA512 b0351a25b8e8e00e4c937ea2719cf6c3a837d4c55a444cf8f218100113f07312a5c81652b8a5422dbfc3ba0aef473596048ceee8a29722b6679581f96415e16b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3ec500c296213400cc0278f42e948ba9e9d511dc0d9b73a9a9d5c0bc090b0320
- MD5 836a348a6c2d43f0acedf6da572eba3c
- SHA1 7c80a1818252f793b45906838f6cbfbe222dd6ab
- SHA512 eecf529c6bbb0ed4d58509805bada3a7da48b651117c1a76aeed6a03c2520c4156d82968a0c2d4dc2493d7e8c9b224cb0e4c852cd6d7bb43aa29d87d556503dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 883cd5be8f2993d2ba5a0aafd99d15f1f2a7ce770254d22679289fe0556b132b
- MD5 f153f3eda5b7ae1c69f03bfde0c26824
- SHA1 4a74eb5e941e82bd436cd63a8922535595791314
- SHA512 a232fe79a991a62840ae7bd54820ecfd3ee5fc4d22add84b1535a5bf56fd675dab95b3315384b0a8ce261f175dfc18315064c9ff75c4083490783f97e7093783
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a6b3596bcbc5f2669da98c224c7291f87efecde92ba7fbc9660ee8dc94eb473f
- MD5 de83583c0b6f52939c9d6fb647d36184
- SHA1 693fd1617beff8651da48da8b03226fcaa992893
- SHA512 ae3e27ba89afb076c19a2b2a736df6094ddece33ab53195063a724870d94930dbdd564e273764a6bb7c1509ed8f6673e42231f81493ce164d592758d91341aef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 76b3c0af4eac3676b47cdb7156fcf8059b7c8b04d8e0a82a109a20473791ca34
- MD5 81d05275f49100822973701826b8bd6d
- SHA1 88c1fde8b1eaced8b83d373a4c88fb2ab594b16d
- SHA512 333c54d20443b8703a520acf29ed721cad1820aa4c96847f4374ff7326cc54192288682e6cc2a99c394456b5d691f926d6993a6c7dc2b7e274697c0ce3f86fcb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 79ec987dd77791fa2f1baf3b3668d7b8851e9ef80981da454b103683e6c76b20
- MD5 89a24d80e17757dc6c2d1a9765c7c2ee
- SHA1 834630725c68f05be3996f3f7878a561b4d77cfa
- SHA512 4d43b3033064eb60cabc3f4b20fff0d5462e3ae5d8094f6e7299d40369d173150b76ea3271c9cda0e2d729ae39d598c3a1c1d781425837ddc810356a0ca7566d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 28a4682703d5a380d838755e98e31c43f8aeb060fc9670ff86a5017b2c1f3ee4
- MD5 c9ed142c6824d0afabf8ed0af92df7f8
- SHA1 10a02d201dc46ba93064d1f8936cb2aeea2d9771
- SHA512 9d8d3ec997c7947df685519077fc658ec7eaf22efed0d7099d900dea05c71d3569e32764f3ec4ba9592f98ffee8e269b97303f76e2a515b67f293003e0bfc71c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab91A7.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar9297.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP