Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
36112e980639fa76ece55f67ba9d980c_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
36112e980639fa76ece55f67ba9d980c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
36112e980639fa76ece55f67ba9d980c_JaffaCakes118.html
-
Size
18KB
-
MD5
36112e980639fa76ece55f67ba9d980c
-
SHA1
921d68ee849e245a6ce68f2d631cd86c6f7c658a
-
SHA256
fa41d45f54c39a8e6974e0b2dcd3413570d06801bd13c20c7530afce0f6ed2bf
-
SHA512
8ec1cc050750682d56f2d55e3d5daff101d2ebbab9ba001ac266573c0ac21784f087da26b3e373d8d2d90e54955d5712f20f2a3e9353a9bd2af914bcc9a5f84f
-
SSDEEP
384:nf6lRNHFSXI8VSrLVnVRlkysngiQPE4AJO5jl9at9pzMfa9LXcr+kuo:nORNHFSXXVSrZnVMysn1QPErJO5k+yIr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000014ddb949d5c763eb7639690b43bc583051ef5b09898ae01c12ed974f6aadfdb6000000000e8000000002000020000000cfd8f764b951f2bd3595f5f2923256a9332a01de580fe272ade192ecfcdcfe6a900000003c4bc17f38038fe95eaea181879685e324e61768c5dd9fbf03e0102261d7c643875088d7c929c5f7a0a78263b551e2eca3af9a981dffe16e9e4c4888355bb43f2004e2d6e6ecec0248efd9486960078c9dc915a590425529d305ede5b70031a23fee1fd782af477fa788cfe8168f8eec418a4ed01c8c0d9d0ee949103041c48be02fbdf3938d6b2f9da1228a8777018940000000e832b7ebecc3152e1e5a052f6da55a516ba1fb7d15184ce237179aaa6a4dce32001e02d41d1b465a305c772ba873d2936fa314fa9109819f8606c2725107ffe3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5005136fd5a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000096c4c68bad0971dfe9685066f96026dc0e74816db3bb08bd73d62e3f310ee9cb000000000e8000000002000020000000332cf5c4685ff2227883d35a2e7fdcd27ad2a18db230519dc28944ce2ab522b320000000a80d630624580e45b83773b8dbbcfe8b3b514b597ee7101f0f26eb42558c320e4000000069c2896d44ceb91b7042e1903591ee04be463bb9e01c241529cb8cc0e994d07007a745461e2392cf391b63c5296c8710f6cdeaeb19d07accee7d3c86e3b4ed30 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421615841" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A916B41-0FC8-11EF-9CF3-F62AD7DF13FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1432 iexplore.exe 1432 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1432 wrote to memory of 1060 1432 iexplore.exe 28 PID 1432 wrote to memory of 1060 1432 iexplore.exe 28 PID 1432 wrote to memory of 1060 1432 iexplore.exe 28 PID 1432 wrote to memory of 1060 1432 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36112e980639fa76ece55f67ba9d980c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f24b7d17b4f0831768820ca95fd12913
SHA107106b45e9ffab3dc5dfb477a97950435b75a475
SHA25646e3a1471cfc45524da4eab6f08f36e30dbd3d820775ec1264136e8fdd82a1a9
SHA5122433f93f475ee383c916d264d8bd9259acfe2ac492b0e9a91c579e3884f382501cf2f88d58b7c96b6ab062b8bc56e1024df3417e535cb9528a1672d5b34043a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634215dc14f69f5e5942dc6ecccad025
SHA1d8be8b87c3ce97eee06261262683a0268cfe6ab0
SHA2560b9bdf238f175e47eb3fa3980457543a5b079389199cf2527a0e18763f97e3a2
SHA51237e2abaf2ea95df61a985252c8b9cc4233b99d01a99dae118f234ef16d28b6c1ba822ddbcae953d35deaba5d03ca1be5e5da49f8f0f18642273cf56caaa6a241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515e5e9c77517527bc376192f646e5f8c
SHA10eebca34f707703c754fd39a447349046e7adced
SHA256161af7fb30367e39377ee58d06ab133824f50f73d4d42a0e9f2445694d7ab43c
SHA512b8fdea032b635f6fdc8ed6d20d55fc775cfa423df600c19795e0b6ea88685b1c76650db7951b1088d5a7d898a99b10ff9d16a309f6aaab5617f8d2d69be9bc92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f23ddf557b46c7f7a6575aae511f35c9
SHA13d5780a143a2bb29ac4315dd7aeaa0cd28c5808f
SHA256803485d41edb09e799f4a9f4a4cd0323c1276002f685aa9a14a5b36a28faa567
SHA5128d861cf1a9b807105a141432fa99e6a5adf6e45b287832ee2b045e446f77dbf1bb569b73788e0a8b15045b1a7adcafcffe5054f9d5463029c325edfed6d72713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e834233c81339f55c6b8ffa15aba5818
SHA13fed8477700e51c99199cb8328665e1aebb6bb06
SHA256d55dfdce43467760c2b826dfc4d62f8136b6b626693a391b7038971673a53f0f
SHA512d95d93e11613516cbf3e3b89a90ffa424907b555d258c3c25c7d577adc3a613723da9f5a9fa493311e0d8bcd9d2cf75f14434f7216cf4891886e80c1882d4456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51db13dcf385dd743705c904a59f8a249
SHA175d4425e70dfd6c5f2e9d45920a5aaf58011476e
SHA25609f03597fc9650a475898f007ecbe78dbd5227bd393a7a1f3735513d6a7f0116
SHA51285e9134e3b90f44c183aebd5c84872110c511e47ed2e0daf9d986e53e2fe29232659dfc6da1b0af5a044b67f08706c0fb3e6b53abdd1fef83761577ed82dabb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58193466c64835ab1671391331162a7cb
SHA1a468f0a6b6fb80d7bf2a2ef8baed24dc460d0021
SHA25685f3fd956c1110b9d697eb245250bdf8068ea399f75b3301e1d95531a7281a49
SHA51217ff8fb39ed2b6bc471c99efb1fa09b529b4a2e264c45b7b9d31ce62b928370ac5593ae2f34611275a4273030fcab4bb806a01731de1a17768f75868b060bf8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c766d98b6a9d11e053df8a0e0f38872
SHA1e4eb57c582c9968987e081c6bab6e309275adac9
SHA256f12840554e1f4e482c5b1a6d29870bca034604208fc7fca61968175947b0e257
SHA5121f2fb50a5d5f57f3a9076c0ffcdec1c24654b5ce77130d2adc794a8bc09260ad122510ef0e2e31fdbe5c0d05cc80da148991405c2574908f3f1c664f8c7c621a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee0b96d88e2a6cf4b5e3dc8059a63ffa
SHA176df23c75e5b0db3273932c4e8e7eaeb8c8f66b8
SHA2562b4de76c407c79421e9bd7ab5331dd28d7a0b2b370792d10f83687b254c6097b
SHA51272c7f35f085dd213c3fc4a1dfb711348248517b33128d9d6b47ee3eece9b63cb42649efe0f4aebd9b238111e383355e7bca4cacdc60882113e3eca4fcf3d6ad8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c9a81f7bfc0e944a68877f3cceb5453
SHA15097c9e7f4c998d77fd718a6effd9836099cd880
SHA256dc742f5c9556f57e96dfb79df7990a772a8fef9e6f485b73ff5be8fcfe378927
SHA5122fcfa48864333f7dba7b012f8be828f82f9c1f474032c4d373f3f3b31cfcea7f6d12b5220285de6337ba9e62f4f823d016a65baa9281e5cca039cd1d02355e9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8427e21e2dd4d66e6d70467d190c11
SHA16d781b8d0c9ba33cbeab5dc704fea585b9566f0c
SHA2564b67d5f42bdb9caff2f81e455c2eeff20aa12e7e5de486332849be7e6c9adce8
SHA512fa69e3f6dc6ef697c41b9628ac2e9fdeba0a5f25649b26da072ce2f94bc89b40d3fe057dcb626d62154a797338e9c57370b1b4a9755501788fc40b136ab8cabd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5184460fa235536e3d092ed53957d3028
SHA1d8da0a4ee13318f1e7c025188d3eae2c157a5d73
SHA25621e184a449fa3b24613e433d5aac39244e1a5c13fd883c1012c10c625502719f
SHA512a73579ca921c7d53f283631a11e383423749ec06be8cbc5a6cdf79b2d543d9f8337bedf8b50d2ec06194009d76e828842ef51fc170be64f813e39342942a6e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdf54443ecc8b9d815cb4e2602c0ce77
SHA1a05ad88db123a421d39af3681e1f7849bc1cd73f
SHA256d8d718249c5f1fe374f585ad9784a582e7baf4ff216cb4c884e6f54a0dd19c03
SHA51297622dfe669eeb58f326c58b22ce2a3ebe0ebd62385ad948de44740d9023e16b3bd5cc3a363b902168c2927d514dbc2cdc2da9a2920a770451f45ba5c36e264c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551543e34dca044fdb49ac7b1a5684453
SHA16b08234cc6d198da77fcbbb1ee447863412c30fa
SHA256ff08d3a7e8de3217185128556c06b82370dbb4a9c64d97897c41f62080e5f883
SHA5128cd2bbb1934256ac7f0acf369774b06d8135f2919c9b2d1a8eea78d78a702939f244fc7a874906eea7c7f52f86cc54f94b4f5594f12f82c6b523e65619ca8679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5969861b6710e41b64176872de632ce46
SHA1d14e8737588f5800f9b6c07fc7deefbaf5e22234
SHA25604ddc3d7bafb4797434beaf0e5a7ca21408ef97a5d46a2690a69cf36d7a4deb7
SHA51223be119d8031f95e5138730b6677ca20efd9c9b10bfae5d10f4c05fdc9e29c34dd722289f4a748273e29f57ec43c0a6fb1edd983b29ba8d5ac5a581093075203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5232e448c5d8182ace378c9747aa74389
SHA1e937f355d856a3ab466469767b30e0ed516e9e49
SHA2564dd434c982645f7115b2e616d09b8f2e04a3c4ca8268a3b2cb6972fff72d4f98
SHA5128633b8d41a78598261240b19a5515dcb0f989d985b211edccf57944940af320b98df491b4d206e85c3ef263c34193f2057522831c78ca79ce4fb37022566638c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bbb39b7e24a00f9b66bcac5399c2b92
SHA16f73c31d812b9bd0d03ba6621034cdd9f311d0e9
SHA2563b53eb7b33844027d8e46fab7a831bbb0636b6ac31af7c4617b556a9373e3ecb
SHA5120fe882f0d3f3b65a919b8394dd46832edada922fdb2122a6b30c46a96bd48f85be792520043ae593a3e771126fb6b7f57ca50fc146a178c23195307a5aaaefd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7321b3311b2f32816d81fb52d63e4b7
SHA14f37bc3ace1a6befb7e167096c9bef3ad9122c35
SHA256997f86a964e73da7896474d5541a17b12e53f1041f4d7c81a5edf9aa57e35c0c
SHA51286799134506f98c3ebdd7fd869b38dd068291ff075c23f0c02e67ba2fa292987391988684d202387eeb162b370cdb07c61167a71eb3b3c2cb8ec16e9467c8e52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559e75ba37fdec0d508d15f2cc2760079
SHA11c7d0d7c5313add235e7687f85abfeccd584bedf
SHA2560d47e7333d13e8788512725c8dcbdbea3d9e059c0163e176b720748c3292ae36
SHA512b7674693fcd76ace70f8676af02438f8b5534ec37d515a487cb10a3ce3ba9fab8c1cf497ed9f12eee92093e864aff5104345e8a11af86e01913303900dca3423
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a