Analysis
-
max time kernel
117s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
36765596c36b7b2a97c526ab639c4529_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
36765596c36b7b2a97c526ab639c4529_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
36765596c36b7b2a97c526ab639c4529_JaffaCakes118.html
-
Size
12KB
-
MD5
36765596c36b7b2a97c526ab639c4529
-
SHA1
31308702e861fd7fce1703465d74147366052199
-
SHA256
1c205151561750e18287d280f9747b8f010f2299d42cbe3f270403e9e4196f48
-
SHA512
de3beb8ff6daff91a47b0ff9c46eb66d02c86941377e1b4bd14f845f29fca0b1be5b56b49a2a09dd802c8d897931de88fc73f858698c9dcc12f93bce9e806adf
-
SSDEEP
192:2VwlIsr0KXyJxVC4N5+D8k/w1wvqygB/Z3n1wWda01JauBuLbdU8d:swlIc0V/j+V/gcgB/Z3n1wWda0JaguLZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0faab9310d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{924FDD31-3F03-11EF-AB2E-FEF21B3B37D6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426808872" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009c0a313b350f95a1b49edc4b5e6189d995371bd1e63ea82bf06ee98258f53be7000000000e800000000200002000000021e2c210cd8af91291b47f24c9733c7812ef676b98b7c186879ac049d134765220000000ff86d88ad8b5558ea75c89b693d3558dacf0558d5fc4d7c35cf39a21dcb10bcb40000000cfabec184b17671dbabfc09e69a6ec84be8772b9ddc08061aa716fdd5a082648114ef0e61f96fd915024106be9001deb33e9a8449765113df2736984ecd0e4c4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005dcfd421396f2f5973f10c0850162e4e29e19d88abe836a7af563f232793ee3f000000000e800000000200002000000009578c1b316932ab27a7381dd6535a199ef67757562b3baefee15615934b872890000000bb582f3c8d95bf62fb3c774cf82ca73f2e6b64949521ee6bfc2b12dccb261992579951269c60bb7eb4c77c77747700a8adcf760f07c09ab933a83b6e9f700a94633382765ba16d3d87610abeabc0b9704188077502c95505e77bc4382e3af77c2b28f15dc8ee45ed625ceaf59f99fb559b85878696bae0439185c76d0ff627019c63c4892bec8d6cfad7a6d4261418e940000000f62cade582d0b0e61ea4cf4504ec91bb0b401e267c2c790c55daba7b6eb86a2b2a5dec80419eabbc00a16ee6c7f730563e17984ea8c8323a79bc7ff7cedcc19d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 iexplore.exe 2492 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2492 wrote to memory of 1716 2492 iexplore.exe 30 PID 2492 wrote to memory of 1716 2492 iexplore.exe 30 PID 2492 wrote to memory of 1716 2492 iexplore.exe 30 PID 2492 wrote to memory of 1716 2492 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36765596c36b7b2a97c526ab639c4529_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568fad4e4a07dd1bf9d7a14633949410e
SHA12955da52f70079ccdb6a2467e2ba853e13fd8ff2
SHA2566f4c8d341d9f45d8f8d7f1a7a4a624388493b2bdb5739152a38dde3f7967ce36
SHA512d74cb99b3484905ea658b41fbab7ce4cceb40ed1f0f069318e8415af2fc43820218b15aa447f8698031bad5d5cc15dd1b084a5b7cc150f909e9de76c1d3df95c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8061471deb69aec030d9510ee748995
SHA1f3dfbb6499d1de6112d84b237f848c6e626a25a5
SHA256433cf3eaad04951aa049c1b7eaec1b05d6296bb18e6009288d53c72703e68f46
SHA512f1f18df8db75867b7972935b5ad28aff47845d6dc36cb9672c575e085d6c6e37297d492dca05af20835d31fa2e90488431c2ddeab896e74eca2630e02461f7c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51186866746beb3968da717b17ebde6ae
SHA1063486af3a4f9dbb42f84b88c546d509eb172b5d
SHA256a741dee8b531cda74cbcc526ba099afb44186c5b5d7cbf35565114554d3d3142
SHA51207c4b564d1a77cf68b55108abc51378901c401fb959d4f401fde7bf940f8dbd2cda5197b2ed015e60d453fd7d71fa508c773f6f151b00725c41221ee5b400e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a474511065ccfc1a5abdbcf824061c6
SHA1818f82e85262bdbf16063361e7205ce435552251
SHA2569d3f1e519fc79c449547d4664a92def461612cdea1206fcab29fb7ba34279db2
SHA512d2194d2b6232652a4c8fec15271c27758b1fe655aec2c2949f4ed5dce8f2fae0ca79da309db1dca7b04c6d4b4302c49394282aa3f807c750a072005b1ed879d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb9d9aa63b45c46f5931109501605ae3
SHA1977d18814c67f4242c40245a3657a45a2c490713
SHA25698310eb5479b450fa6656be0425c07164c1fbb0c6ac82584d3905c9bec3e3e82
SHA5121305c3e0e710304812a9ac908953975a037d74c267044edeafc6a04f64dc6181033b2cad950dc6711994c15438a8fae5b9ae5dcac69af47f869137d2b009bead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d69de9b8219e00bb271186d482e93d
SHA1bf457c4218cd3a36af3ccd5a27cf041cfa4afbdc
SHA25612550283fef7479f9f78d7f052596428720b45dbe6c7240a72c45d450279e642
SHA51299b2d460d544995dd669bae948646531a0ed07bca687adfe965c48492583f7158cbc0e4e5d4b2d0be3b2e6a481f00295969073797db72158616393a5ebe26604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2863b9955cb30fc5e7e0264be60a41a
SHA1bb86114c25317a9f85e908c8132c50b46bf2dbcb
SHA256062ac378cfc1de6138185f36b655a969d2c7f9bac012712d62a2af09d4d37ad0
SHA512e805735f8db182d4dd5fc7554b040f07730f9edce47c5bc6c7280f1016e31bb15b0b5685513139d88c0abf1b1a35d855ccfef59385d602829e2882e9044e3305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555f987723cc6b90ffa11ee65fb52f02f
SHA1f7d7315c1cb53ceb2666ca3b32b42cb79079859e
SHA256d8ca03210dff1c895d27ccaad737905cc0adddc4671ef6d70e7da93e8b8c463a
SHA512d8c3967191d7b8161e6320fc6ece42d9254956923ceda209f1cb413037d1fe45bbe7548c59cb241296aba6cc3f38060796d81ea2c8db1d8892218638704e06cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535c35d2cffb697443e78406be8eac12f
SHA1606aa4db7bb8d40b1d1966b73477914652dfbb03
SHA256ab947833a243f4f73cc45587495c990130ff7f9ce8c4344f2386b74fd41e6b8e
SHA512feabae7ee02a7f61a6f5cf542908b3c4f771040b05355a84961428a89bbccd61bbdb65024f90c3fa1b77934de70a66f0b8a57d64808b0ffee9ff694ed5442c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a812048693f566dd5db1d09b48e3f59
SHA1725eae9d2bd854d7e72ff40a73618600e235de8c
SHA25605372e107010f443102733b839c155d335c0993fb973be55c149b0832606c2c9
SHA512fcfe0a40f77e85f495ceb5da7f1da16596d72f23b45024f65c40571022adcceae20ef2b11b00f59470530cf51d7e35ff346ff087353989b3421155eb46e2311c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9e7b000cc536c743378e2042f62c0e3
SHA1068a8366745dd4f678c1f432432f0b321e2cfb19
SHA256eccf52f0ee92b24cf0ff915506f4d1c95e0ac7dff714c5c879f142f87b75fd00
SHA51262824e5412d8eec22d4656dd5c97a2aabac214c9b7abf179e9c9cb4959fd865c49451b1b8c880de93f8d5c1fafb0e2af0193002eb5aa637d94ebf73e849e2d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4a36da774e40f9508e0fca16a0cefb6
SHA1cbfa4f6bb737685df9f16f8afd9bef246cdbd11a
SHA256326b4f4b201ae110344e0d94cbd2be394675ea5b162d50549c4549b0af1dadd0
SHA512473d9e1d9b1bbd0c60d3a8320570fbc60d8048d240b792f2b9d6a6978f3e38efefa072fad6cf0ce0cc92e32fdb4f561da6e9763ee1a4f6ac746de58e922f1bfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5881fe0995aa5080175e75a260c8d8b9e
SHA198b47f9d84c2c074b7760ea4058917fc25b812ba
SHA256e5121f17c59c3b2e8e85da6a533cf3fe84eecba8d251f41957783f7f56750b0a
SHA512414d0b52961b92db835959e056da47ffc7438489e0443f6ef6446b35b7081fec7367ca9c2cb1175d60e0ea5882ae07174d20eb51de7c08b3008b537c01834fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf9538cb84ac87c3b2523f1b492965ce
SHA191dc97dddb0f61c2a0c12a0844a0bd021f42b306
SHA25652511a359f3da0d455393f2965e108d83d29c8b6ad007147937080a5d2b4e750
SHA51271c8cf73d0c09d24bf217c96f5b397c0b66ef2267da0dd9c583be0f9a52a126963ec6682e961ad9174e09a1efe9fe6b6acbdde70ed0377622d77c14356538e03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52884d84fe9ba3c6796c2d193441d73df
SHA1bcb18b87de11d907645e6a27c6c8374f40e38672
SHA256bf50aacd5a3f68b1afc475b21293c7bba5ba3a397e0ee0d97937dbb3c59cafc4
SHA512ee00104eddc7bd857d232f63648664e8b5b0b6de55794a020b91d9d9233121f6f009d1007bab677dd8b67bc8b9971bd1aeee3572849ee2759d3d39d9e809fdec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da1db00fd9ae53199dc3a6a6eac6a3d7
SHA13769e72ba55235b58bb6f63cf3a7b1b4af233238
SHA2569f3982cdc9f46a8aad25dc28efdc2cc342c5c8ef64ade40deab24baa58ee1a7b
SHA512e0fa27fba10de4c744cc495aba06662bb1da81324eabbb63544c42d9b08b0e4001cc6a6903268d593e6c0823bf51ac18f1b792fca41690f4c26f99c919cdb9c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570b36da28d098fd5fe7631f9d83a3585
SHA12fa447666d2bdbc194c1a1aa5455caaae02b40f2
SHA256db2ac2d31680cb587fe725ac30d14e748d019de8a74cf07256f29a7b6d526c76
SHA512d8f862418563505b913c2cade605a9fa4f2a6c3f5e6d67052a14cab70455762e02a4eec366b1c997b9237ab2c6702a4251c3dd0fc04f62a13deb9933a1dcde93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5454609551792d121008201e3cdc188f2
SHA1f20f3857206382bda1335a55d60714f7cd1e8154
SHA25607c71b5763c4d245fbdd50c18dbd4079fc13df2bef103a823d95fa249e921604
SHA512deecdd36b9758c7259cad1f941b3a72a38742f35ae92363bc96413e4d340eb97bc8ce11dd22a888deaaa889e9d5e840584b200638b5f064aaee99f42a0b45a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f01264871ae41cf390f68325f1f7e3c
SHA13db106b5d259abcaa20109b03da25685472f3ef2
SHA256f461d4598187125a748e984aca8b97f87286a654052933191971ea50ce5ab053
SHA5127d61b280d8fb3ada68a9592c99d28f8de5405605681d18313dde327086f284b5aea0e987b1945e86b98376c0bb852e1f5ea2a2d6deda9a06b6547bd89e2848df
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b