Analysis
- max time kernel
144s - max time network
145s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
a5fc62a058a7c34f7787e4bc10b0573f_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5fc62a058a7c34f7787e4bc10b0573f_JaffaCakes118.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a5fc62a058a7c34f7787e4bc10b0573f_JaffaCakes118.html
- Size 20KB
- Sample240613-rm2zhasdqa
- SHA256 d202517bfcd1d63efe9720653588bd5c6e0d02790f9bc6a69061c122dfbac780
- MD5 a5fc62a058a7c34f7787e4bc10b0573f
- SHA1 1ab2104b59e2310a8d4a0126e751eb66dab0a9ce
- SHA512 e20929bb092782e37a5df4d06f36ad339fb7bf1e5166db78832b50417202c1cfeb923b106e35413c521c57d651aa629b178b665b72a6ecbb80cbf033188bed97
- SSDEEP 384:ftEcVdpaBhEW/C7EVUZXz63HyKiPwGUiWGzDfAn82l8mU4qynC4xhD3H0i+83GEK:feONA0evPqkvqsAHNtgXeSXRXsc6Nts6
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424450236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1ADAD41-298F-11EF-94DD-CE80800B5EC6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2500 iexplore.exe 2500 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2424 2500 iexplore.exe 28 PID 2500 wrote to memory of 2424 2500 iexplore.exe 28 PID 2500 wrote to memory of 2424 2500 iexplore.exe 28 PID 2500 wrote to memory of 2424 2500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5fc62a058a7c34f7787e4bc10b0573f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e0680f86471b36a3c27b501f622972601c19daabed9c16739eca55964f24dbd7
- MD5 becac335d551dbf83af6e658f2200856
- SHA1 bfa553b458287fd9fe2f1ef1a41658dac3b7c406
- SHA512 e5add0e3651e2bcba503779e57fd7706eb90c2147799836430b915df403716ecbd1e5216ea885444844838c59786b3927097bc7266bd5f866ef4f03974d5ec4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 19c3bc06fe67013dbbec8af060aa01dfa0208cbfd1a7ef1f7f0661489a93c7df
- MD5 a3435c0721cd3d70002ba62c80fbc483
- SHA1 533f17ab6e49232b3ae7b1ef7d6481e90ad3e8e9
- SHA512 8f65f33d8164185fcfdbeba07972d79c49c327ee63a82d75bc3a7aae93aa639bafc759cb992e47d18a6df06bed03bb30c79e3cd7e27f852a64fd4a05b999090c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 38704044d238f17548d7ddf85da12b56cf8a4c57104f514b90e902ce65574b3f
- MD5 85ff7c42dcb21414f55ca172875de936
- SHA1 cb6c8cddef30df8382cd90b674248a90c8dc7206
- SHA512 9db12d723357a551950aca15a2c4e18512f4ad55bf3b0fa46cb8c6e707de1abbfb13bbd5a48ed3fb1e0dc73c9f5857930d2f882b4176bd48a603f399e962fdab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7e703048b2e04cd40b6fbc2f68baf8466e817deebd1e8c2067bb0eeefca67fdc
- MD5 1f0ebb5927cef9ddec1360a52ee21faf
- SHA1 14a37ac1c5c550ff6e22b0ec453b5d4a08a4dcb0
- SHA512 25e3d05ee58fb2b0e6413772f74d692a9e088f1140713d1744e337536b12d6ed883d312fbc8c40b138197a772a08c802645242f7a2ab540ee4e8e5594d276062
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 067b69a16bae298b5bb778b4f1ae36c56430e2542df3bf69eb2665c4b37b8552
- MD5 38edc1c69b93ddf52f23235af80b3c54
- SHA1 82e20520e3eadcb4bdfca2f1903ec0f8b28d7652
- SHA512 212538230b15e25cee32c3bb366c2a5f06161752c379e52fad0eb8d38524e785c3f0cc7f587faa6242e10934100480c7f0ecc3807d4eb519072e455c8fc5016e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6c73ae0c3a93a650c713a76368668579c2ed15b6f374dab3388eda7f4b113652
- MD5 3ef34198530c1acf7963c19a7e0b37c5
- SHA1 efdc9561438a58394b0dfd74348544b85aa81bcb
- SHA512 bc91a5fe7538fefa28190529156692177c26079ef44f835f3305e172263d363432fa94b9b6ce6ad7ec0fa767d496b2c0ff3341f9ca6c88c1394b1971c7a60f80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 462c07add8cddfd4bd03afb49f5137351701b55e8c0037712851ba71ffb9af02
- MD5 62b46169baa5934e5ed5deb8de3e2e62
- SHA1 7be7b7a01df53b2713ec97c34815f688e662b98b
- SHA512 22f2bb10f62e0874db8e3f21dcdc1f0202efec79dabd3c37a15e773d65ebb87e725e3a9515ac5f31957f69e38f5c89114404eac823843bf948a5253c3824de15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7c465f172e3f574f4035819a6598ec40174dcb88df3c7ea4829b3f01685ceb8e
- MD5 fd655dd61d10ac77a546e37519f37962
- SHA1 65e2450fea11ac3d68b95f17e3203c48e851fc83
- SHA512 41a3155f9714a3db028ff1af671fb469a400eeba6b080e2d283f1078d9be71ea713ab0af721206c7f47921cf149affbc7b44df550c4971eeb4695e661cc293ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d6613bd4f2588331ae0296adde4ef9051af729fb99e5f4bddef36e1d785a0abd
- MD5 8f62b2e88f60a9a06e5f6c2502cae437
- SHA1 e6485733e2de72a98c0001b758450102a36007f0
- SHA512 96f2e133dd1a8a1924671333e30754e66d2371589d3273ce5ca13da2bdb707ab7b52b659376d1896fc0798961a4120cd171a71e7833157ffd358d99dc958b951
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1815.tmp
- Size 67KB
- SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
- MD5 2d3dcf90f6c99f47e7593ea250c9e749
- SHA1 51be82be4a272669983313565b4940d4b1385237
- SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAmU:gp2ld5jPqW8LgeulxB3fgcE1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar18D7.tmp
- Size 160KB
- SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
- MD5 7186ad693b8ad9444401bd9bcd2217c2
- SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
- SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt60:as2J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP