Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
a572653d303bee5defbaab5684e334ce_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a572653d303bee5defbaab5684e334ce_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a572653d303bee5defbaab5684e334ce_JaffaCakes118.html
- Size 35KB
- Sample240613-n9hycssblj
- SHA256 f494222b39c0d2f45130bbb022b24d0f8c827f3e65df71823994bb0f22e56365
- MD5 a572653d303bee5defbaab5684e334ce
- SHA1 418c06d1488d83fc4c96ac19f72a3ef199c34ac8
- SHA512 0847330fbf9b3f1133295c2c06a50d7e29dbaea9293d598ec744add726ffa0ad2d6fb4a20d02e07cb37635add2460819a9db203fe0adfd0bc558b9f44c831a6c
- SSDEEP 192:uwLfb5nxrKnQjxn5Q/InQiebNnTnQOkEnt4SnQTbndnQOgazcwqYCmcwqYu2cwqr:zQ/YwlX5LbtKHxW0Uvpf
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424442211" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{425F37D1-297D-11EF-97AC-52C7B7C5B073} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2748 2032 iexplore.exe 28 PID 2032 wrote to memory of 2748 2032 iexplore.exe 28 PID 2032 wrote to memory of 2748 2032 iexplore.exe 28 PID 2032 wrote to memory of 2748 2032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a572653d303bee5defbaab5684e334ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 448746fcef490c0753cf85596565108d413958ebd317c36ec034fbc64b1de994
- MD5 b45fb7a0122665f7b8ffb344a73923da
- SHA1 1b20c2b3c95986828b3deca39837824a16715f23
- SHA512 ad6c25e3d403400cbef15bbe85b67267401186fbd50d0dbbe8e8bba421e2ea830a23114712c84dc89339b78ffb5bcbca7e1e10aec0adb014c6b229b3107f6c8e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f390429afef6b7b098d55db5d9518c9f3e8853213f35e51a71153c7daf65eded
- MD5 69f2ef3276a5742cb1015c9d8e0c81ca
- SHA1 3cc234e53bb69d19669717bea091fd44a0be6a66
- SHA512 909a3bf1d00bda542bd352ab1e4b8b12f74bb34f341d8d885fb0116c54fa5fa8ffdd9afaa930215ecc37f3a647156087da1a31b01c19739f12ce989f7f7baf0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3f6fe9de71d60c6247e13f3af26ad724df52410eeebc1c2e2b6a472e34cd3d3e
- MD5 ab0d5e0edfcb73fb7a0fa1b816179212
- SHA1 2771875f2cdd5d13f57495eeed5074ac409cf85b
- SHA512 116833fb5c551925c012c349459e2260106699e90276a8fc9ee0bdcf0c2f832bdbcaaf84b291acb0230c91c92116a4277aa4acfc0cda15598825711a96754573
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fab9c8ba57a8b4da1a8665da9eb9063c7b0c18d4ad7f13468034d7d746223519
- MD5 e0551c7fe1255814ff5655d2afdf4398
- SHA1 ec00555cd900f689ea2cc86034064adfc509d0fa
- SHA512 5fd839c46eef81fa3186955b79efb3f1e2071b3f4bfae512eeb6f6c25a45e67bbf81e48bc702189f3cc3236744868868929efeae18459cfc3876d63561ac4ec8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3615dd6e1d9fadce7e9d524858cd087cb37d89173d87f4983e25817ab9ec19c9
- MD5 9cc5eea6f73339124ec37ab0955f9e25
- SHA1 aac3df1440f0bc00785c21145bf704278f1c0423
- SHA512 f935d730303cd7991d9b702d446921cba981b7a04d26b7ca9e21ab03c74f8446d056ef323a1c99fa9d584a5fddad4b79ac923d1fd2737935280f33f58afe2246
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 cc81776cfc44dedce0b6fc9b56bfde11a93e867d8db290730b7567d64f21839a
- MD5 08d9588e044fcdbe63a4c3d04c97a5bb
- SHA1 34a5c583460ce0dbc2155d37628f7bbce8fedfc7
- SHA512 50ae2b49e53b3262068eae78e6c3025d70e9614b2fae63d0ba522060f229315929aaaf913d7f534c3833a5ffa341f51cff99b379d354732ba27d117c3cdb460c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 c7ac10ec6f4f2695538948acbb4b9e175f0212f337c2388bba30b341db80eaf2
- MD5 af0d9a229f74c367d93a447cce1c1c6a
- SHA1 d57cca9817bd383da576e4fdcdcb440efaf2e99f
- SHA512 5e6f54d2ffbb38ed6b73211210dc0d0fa6c8e2cb48d8d0ccc2e2a73d1153234092c4af32401f48ed0468d5d1fc8ba9a0d4b6a14de818d8ad4df8ec47c048bd7e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 012ea366d7600b20e795abca13e5120d7873a96327d3894e187914164f36d227
- MD5 0ae5b98b7e0b485b30af54a5990124a9
- SHA1 b7f04fefaa7b68c787d98db7350a06642ad67fad
- SHA512 f78988250a68bd60b2c6dc5d08a1ee167466811cb4d384b21cf3e4e3dd025253f119a326191920855de81d412d55aa07b8d594fd2b8b8fa518a7ed3234fd746e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 06bbee18e76652965244403098ac660440eba844339584a97e7c60bfec733f72
- MD5 19f2d6f3476f67dd5c52b86006b6f889
- SHA1 f8f3dc60db307606d32ad14b7bf0021acbcf9b89
- SHA512 392278c593db2d349cd876a13335886587119d5d9e21ef08db77d43e07bdd6c0b0a294138e8b3cd029f6b8f2b8c797cc48f17decdeb457e457045c80ef3c650b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab121C.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab12E9.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar131F.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP