Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
36e33e1bdf1ac5a8948a079f07e9a0cb_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36e33e1bdf1ac5a8948a079f07e9a0cb_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
36e33e1bdf1ac5a8948a079f07e9a0cb_JaffaCakes118.html
-
Size
4KB
-
MD5
36e33e1bdf1ac5a8948a079f07e9a0cb
-
SHA1
2afb53447530291be9df037d2f65c2c6b83e9d7a
-
SHA256
0b43b4f1a941873f5c615e6a55b7522dfe3d46acf44ee29a44a11ae13c0958f6
-
SHA512
2700d4171ba93f978119d80d0a9ba190fd825e255296f9a05f28aa14b513d02e4ed0378ba8735594939891d5a42d624aaf45b2af8958885bb724af426cb3ec9f
-
SSDEEP
96:O1QLv/mb9Wd619mqv61CmVZKnhpX98eV4v61CmLkJoQ9Wdf9Xy1K6pfXrl9dY6C:nLv/uWd6HmzCiShpt8eHC8mWdxyU8bW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000006c185935aa1cb85cdd8f0c28d31ab1d3e39e9435ecaf974ca7152692611bc893000000000e80000000020000200000007302239babfc74e5237f406a9e5b56efab76493f479055378406427d45bc37cb900000008c6dcf1f86513daf4a60b66811d26fb4dd47cc3799dc8449e1a6c945475e3e3c46f2a5105136552f76f8da58b9e9c909e27f33f6d4f357aa0525765336ea1e51132a880ccc4f1b4e3d6e203e6f079531decb077a5a9ab1a631f6044a2a26f17f3e6a7372dcef8018c3b35b6bd1b5f016bc6c347c43ca0d34028b2178a36b66df1024cf2c939cf93ba2a9356e5bf78307400000008df17695d7596d1ae1c12dfabcdf025adfeb393d9b149eda433e985dab334f9ce83fe46865780e5179c585ceb06ad76450fb4be661d1119fd347cc543e28f480 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426817232" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009bfedd2fdc5afa60bf20cff5fadcbc2168f1e2e33606309fb95955318b171276000000000e800000000200002000000095859f70510b42469c18882efb16b2d7cb4a412210a4490aa462c05d699ea50d200000007c5225b1b9214a9b380e16f4d05f6c435575c5c669609d5f3b16efbe8d3862fd400000009189f14dff5fc290c0e3fbd81c74d74ce7886db07b4946b6516a3603f6adc5dc3c91c4eef0673e4637fb9ccc54446ddbb0c0306859ecb5b39c1db5493bbaf595 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0951C431-3F17-11EF-987A-EE88FE214989} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407be3dd23d3da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2064 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2064 iexplore.exe 2064 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2816 2064 iexplore.exe 30 PID 2064 wrote to memory of 2816 2064 iexplore.exe 30 PID 2064 wrote to memory of 2816 2064 iexplore.exe 30 PID 2064 wrote to memory of 2816 2064 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e33e1bdf1ac5a8948a079f07e9a0cb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1fac45f4285cc6a0be1878ded2c6b2a
SHA1e1bce289f8ab5bd1be2ca111c0e51c670ab5b662
SHA256d1f3b917b9e646e31a4c0c4572aeded3b995c5b9c29632b809031480b537afd8
SHA5129745cd49eb5d6b4e38fdf05690bcf9b19998d07efb3857295075b470ae20210caca0561f81c64f227df70371908dd29bb0664241161d8729b678cd7e0432e47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3d3dc047d4a95691f1b62f3d49a3eb2
SHA12dbc896ff4e0db9565fc59dcf3e0be152d2438d6
SHA256420a23bd0f9a8d7453a78e0aaca5e07d26465a080a20488b38b8d33e9ae3c721
SHA512fdbb260f07384b3a2d1a42160eecfe8f74a09c1a0f009d4f539d1900593d32a1ce0193feb5e79ca8481c47e87d9612e110c85195105cfc3d65ac65dc5f41b78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53af82495acafe9f761304c91bd1c9753
SHA1d7bd6d5627051be6d634397eaf3a1e73b1a704f4
SHA2569eb094bcb05101b31329594e67420cacab01b9fb03a845e18777406294cba2e0
SHA5125ffba28887b1aa30e9fa154e74fc3d7c9efcc39fec09bc9f61ad27c8127352b09dc68988185013960c472dce0919b8b11fd25803ecbcc958ae51b104316e62a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e75d9c20c284643d815844654336c658
SHA129d3c8e64f1f7c8ee77f0c15c27a97f00a0438ba
SHA256a389c90270f4fb03254b39dd1efcf60f8880af2da0e85e9e1b234174b0d1180c
SHA512f2533eee133a942747c7c39a10a1ac431adc03bdc21333e052c47f3dd285cac7ab91196bded07ef336d22f30850b30bdf750fb38c26c4548e9a2b56f0ceda082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a52fd316f1667ec42ebffe65eca6d6e3
SHA1b074c6afafe34cf9970192cdcf76d1a5e616e6ae
SHA2565137e22570f859d1b37597e215811a16a20826cffeaafd8a048414920a03ac5b
SHA5122916f7c30f2cd486df223f135f48afdcb16b70b88af25e8345f6e2a65094b5675771835467a225ae25b94b872a6ed06c21909300d217813d467466986e746a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e557c69c9340bce1e3f3226e5bbad482
SHA1bac18f4c236141a6b25da757f0b46da11f9ce6a9
SHA256fc963a455cea30f744c8a5e4d725664dc5d8aa194e3b256649287d7c5f1e1c87
SHA512e7fa6acdd6ff930417311629c8a87f414b8e51d4f9dcab263cf5cc370bbb3b44f27d811459f33a9ebaf6d25de12c78ad9614206cc37c17ecded4f6bf2c4caa40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fa646a59c25c8bd761ab3fb838e1b3b
SHA1f657ca027dae8249463d29d98463cababa4a21ee
SHA256bf96bc447f025f5835ec4c3e481174b4fe6ee3728c7028204f49c859c996f01b
SHA5126cee183fb3aedfe882818960a43f655b4280f2ef72ddf7b1544acf46b53a055e744ba35559601a1c965260764dbff4425576343ddffa5af11540ccfa80c17c43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f544814b5351cfd0265e684223b9f62
SHA1804e25819b70b5bf4a04a2432bb664fb03893db4
SHA256e62040fc8cea037e6caf188172670c04a6290a055ca12c9d7ff14ca5407bfafe
SHA512506a60426667abd925620e05654e264cd3de119a681b894c636213f93f653ba43fa00e2f3bdca1283c78e5a45a5768df2542348d91f34907170b04ace835f641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527bc55c6610913dfeae8abb439b97730
SHA13d1329dafcdd9e2dbb0363b112833fd980a223a7
SHA256d4bf191731fea1ffa16a823fdeebe7aefcce62bcc094bec40a06c47c1ba4f21f
SHA5123e191dfa2add4712ac24cce97e12f5570e142d8378cbf6aa0f53c521b23ed66e079ae7d68b7d1ef133df649ecd5e76e7ab9e5c893f916abba653cc6e484b2e61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598ef6675a889341a1f2682d49c04fe3a
SHA1bdbb62bd2304faa54d66d6a7242cfe6677925f9f
SHA256a8337037a3773ca2bddac5c9010ceda5a6cb22683905fa5f86e9e5913b8f06a1
SHA512f9db93c649e69830ada4af32a7fb73924ce36acb1d3037b078dcd412f7ca78051b532779ad9d9a28780a01af87e1fc64f493f0ae8278baf90052b7d553694fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dce2b4aa66daa906e22bdea09f2ac15
SHA1f493d12bd39ab70f86ca95e68204a5171849771c
SHA25620e275e47469b50e83be104c8b157a1eb7574b8299f3ab9369fd2f04a3bbae42
SHA512938d775127496f21f1dff00729df25e7a6b4adb08243e46d44323712578e27d7c2d0fffdb17ddd2f330e066becb6f347f94a8f39afd5006196218724d32210ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a194ce480d0bd3ec12696b789bcb94b6
SHA114da4cbe9e7d62a82385d51ddab6ed102e07c031
SHA2563518e77abc1d2792ffadabc6acae8310c16d0547b1c3f4a7274ac0666a0d0692
SHA512110e483d877e65d1a0938a6bc624cf5bd0372b27b973a17bf2bfc14d3821aa9b6d057da585452637390e336885a909ab5453b9e6fc2a2247e642f00c01fab71e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f92534579ad521d424e80a2de075d03c
SHA1396b0dd1fd6a538f8d4ae39ea6e233dbb41983d9
SHA2560a0adecef9b4a110a0abad407f02426a5e9d2cc762e04616978f5ece84cce7e2
SHA5126334ec93d41b300ea3900ed7e9559164ba11e5d96262ca34e44fb1ff2c295b633bdc659c3586bc29f628db806f4727a7f8c7547dd442d7b13351b0a4b5cb4575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50acd8e25be533dabef06914c52ec76ee
SHA176d5f729c352b09312953e7eb7727e1de1bc01c0
SHA256961e7c58bbe1c4e8d1dbb5b80997aa3c87cb54580e1cec50e94eae9b6b12bce0
SHA512431d67cd8d6563839610fbc96007a8643a8d9b5f4f8b684ef86fc9e82a5eb6c7853c38fae7ac9c79aad7318367bdae0d86cc382b3e577cebbbe32213e84061ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb69c7bd880b17046fad9c897ef67859
SHA135e50e5b3e318acd68a2270e3dee742635bbce69
SHA2568dea258daabac18fa2138b5f38c2f6c3698b831fa27a37d8c57cff571f084a66
SHA51236ca3c09d7116a02159a05e4b4fb6c05e01e762420919d09645fe6b3896982fab6edff338f4ebbf985f148fc48ebfd03419fcda979a2ab858a6f839e9bee0b8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6e591a25ec7438de3ecd4767808868f
SHA1928aac1e08196582a36838d2856865eafc0c4ce0
SHA256946e8d998fd5fbbc540b1689988b6ad12d572ff7aacc21918dc2309b6af9bb3d
SHA51267e7262493adbcdaba8831384d812592859c7ac74742047b9be6f2de2d2be3aef55c7899dbd7b2d8d0d6e78b6f7a487ba3580a6030bed395431a7426f6195ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f117310df447c855751742664a222210
SHA1af45db37fd0930d160ef11b93a89d8423ec193dc
SHA256b292ce53a5c064607777c22b23d354119b5563751c60960b2de93b8cd61c467a
SHA512e946f78cf18da5c0dd29f000bddf7d20f911d94dae902acf19c5750e7ccff0232ca687854004b39f233038557d844a6d2d792c1e109fdbc75e9125684005d036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b259f82607853a1c24401fd06410dccf
SHA1a91d911f93a65722aba1015748007af43baecf2d
SHA256069d80f3f34a5e7268ff0c4f69b319ea98a92a5639df2a668ac8202929e03c4e
SHA51215afccc2550251dd8bc82c9270f46f15f2b046d9cae43ee1d944b8bf105026ec442fcfd0dfa9ec762acfaed915008273205494c6552850c87712f21c2fac1c3a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b