Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 08:05
Static task
static1
Behavioral task
behavioral1
Sample
33e86eb40b64655407df44caa78694a7_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
33e86eb40b64655407df44caa78694a7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
33e86eb40b64655407df44caa78694a7_JaffaCakes118.html
-
Size
6KB
-
MD5
33e86eb40b64655407df44caa78694a7
-
SHA1
c8864ba89bfed058906fa5649c34daf6c5d06f3d
-
SHA256
71dffc08d7066eafeb437892b98a7db19d0b352b55ca287d7d6e7ac07173c63a
-
SHA512
b55c141974e7854b8af3852c721361ca826667095f7b462f51bcfb5eef7d702c066a240477adddc2522c93f260b125a6b44fb428d924e37809c9406ae32ef44e
-
SSDEEP
96:uzVs+ux7uOLLY1k9o84d12ef7CSTU3wZcEZ7ru7f:csz7uOAYS/u0b76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000023e56e27f331af3264aebbb4c58606293e57853f6aca5a779fd57db2ff35cce9000000000e8000000002000020000000e11b7dcfa2ca297d84024b863134fdc81cbb0b3a431af0f786772362c2a9bfb920000000605f6e60fc7a0ebdf6aface87fc617a540fc8c12132cac624d83f1a4487dcd5a40000000ec343d76604477d64f50c16be56efe3b9b0adc9e7445f219ac8468062d795d5fa870a633d60a871f2878050e3b578b7ea365eb3a79ac89fcab9fce07cc506174 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30584d12a0d2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426760623" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000000784df43533069903af0c72f8a9d61abcfe0fee2fbb6ad7a0d8039f82232dac1000000000e8000000002000020000000442fbb29bc41e83cec369f929a53ea43e8bdf99c6ce741720e4012461a36dc33900000001d1ebb32572d1c15e1f09c96b63fe1e54e61b096a84da1e349f32bcc2d827d737a629f8edd58d9153e8d877bab9565345350561fd3eeb7a79a5096a2b126d8da30ec5fcc1fc555e1eb1c1ff1ee9f02c41c7d779097f1d292ff168b37468d77af4f5aa311cc085f1ee4bd387ea3116298fd5842557b292e0229fc7d0bcfb809ecc50591acf437ca8263f9a47486d7478940000000d82958251de9ed7c937b4443b89d0a6458f19fa17c5588e5b7bee92cfa99606f925c25ccea23f223b67d9bd1dc8a02bc8d5d764764d3e032a4426d199f7c198a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BB2E871-3E93-11EF-AC89-C644C3EA32BD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 iexplore.exe 2492 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2340 2492 iexplore.exe 30 PID 2492 wrote to memory of 2340 2492 iexplore.exe 30 PID 2492 wrote to memory of 2340 2492 iexplore.exe 30 PID 2492 wrote to memory of 2340 2492 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33e86eb40b64655407df44caa78694a7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b358de973d0b2f9dc550405e62bb66d
SHA15ff31883e9b96c1b4fc3acca1a4f8be35d87d80d
SHA256260f49614f8d788641cd7129b2973413383f9c2d56bd3562fb003a5e3e29acc2
SHA5121196a0fd62a7defdecf0842b73e0b7701d4982de6b179b01904765693239a96c2294303509c9c98571b83b505b5e8e23b1c94ccbbcbaa624b686f4415b738ff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eba67703e3e61f504868e8421e5222ee
SHA1f922963c02dd4d3beb92057028b2ad4c7c9e8e98
SHA256942538486454ccce2e83649df6d910632c9d92a683aa8235181ed98b6eccacd1
SHA512e2a443aa1904a525045b7f97eb4b70a42e73e0a62fd6eba2bf4e2e8756b330ecfd035314dbb29df1413f7a2f04b63f1e3147573afc79b82f6712f16c6a3d3c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c28195581afb5edebe0a489de4c8fe6
SHA1fd9cf819f39c883b6f28761f8599a66db159c1b6
SHA256eeaa356b5e0f3aed32d1deae360daa302be407db783e0f08bc2efa5ab15b6d56
SHA51200ddbc47aacfcb113c651caccc4fdd5bd992cf4fa46ab684476d0a68404b287c22a761868f2529457ae71bdbb60de1d984169846e50faa1e9dbff29b4e7256a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dea8eca8e9462d6f33c517831108007b
SHA1e693a62439c99d7c7d8ff3efd4dcfd772c138d65
SHA2567471759dfd4c3768a60eeadf0387105f26728857965115bb7cf04bec466fb9f5
SHA512facd922f92fa021cb05e66d0da6deacc039a31aca00fe03f888357ee6313eebb946b6e2ed4c85632960f28a6955c51a077d5abdb54e7af4658d99392a35b2d1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d03f1d968c83033ef5e5abd67ecd20
SHA1b3c812590a0f32b5ccab21084c7b9271ed6efbae
SHA256cab927faf94e4a6f36bf9644e0e48036e2cdf718436ef41d1efd14b58fe42335
SHA51257989877295749216ca6bde2c3bd23e325fa9b1d28979a5047d7003864bdc4ba3ed0329f921a17b26a08d535799c745123d596d00c6360b63324abd60412218e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b528879f1f0e45ec4200f5e875c4cbb5
SHA18ab5e571da3deccac317e6584a010df4858ef84e
SHA25657d2e275bf278cfe36abc6781adf7a02c94ae8380b3650c7d97b6861c71b7650
SHA512c75bd2df9b6aa1dd4869a95685bdd3849aeddd786a9171d27aa1f1356d55d9a1da26e8531fe7b60e1631df546d8d8ea10c76f21327e2543d99e20d48bcee6f7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501a8d2db652b6de60a32f72358447a9e
SHA1f183e5a9eb6a63b420e2018ddebdfe264645ab60
SHA256aee1060ad2a8b61a1efe5a0a6aa32903c71adeca2735bfd5443f897479360bb9
SHA512d62118d6cc7bbbb9f3152541d25cd46f398d9d02ff24562676b5ba424ce59ab100ccb60b15095853fd52893aa9e90ed3270e41a2b932f24fc884ae45029f7dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561880074084ec8425b685a48d6ec2cf4
SHA13d70f2f7eb1c6e3b3656a8d4b3b3cd921bd50dc5
SHA256efb56d56d17bc533ae1f4c075732e4a8cb85a65c051534b8a6743ed298d4d70a
SHA5125b4d33da79d63cad6574f6a63210a5da12f3393b2f5a23cfe3d846640fdcc35ba71cc21f0877d88a2bd1fb14d1483d18f3dc26d09a50f4113994dbeff7157991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b93d0d7c92cfb2b8a01c1ccf41d1d2e
SHA11d825122ec25377ced3622315f99103dba5ab706
SHA256f8d46944d3fd0424bb01b2a214be8acad5d1d094862b608294181f12980364ed
SHA512c1365bede2f5d68f782927949860db192af2778eccbb9d1ad47cc3a0774a0044bfefc2a04e62554f769858dadbf22a33ddfdb388e1a98a6a1e8c90a61fd99e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f87039173301f1023749f905dd6eb1b9
SHA1be9f281721a4e2e2b854a2100f261f93e118b29c
SHA2564157e9bb6680fe3285019382e1a675057fbb9d51165cab603025abef36af669e
SHA512ea1ff2921e47471e672daa9a81d63bad017c483139b3fe3fb236ff02b63e441f4d2e06d8492799081cca28f1fcf32ba20d98746d037080ab63de4dcc2ba6eb01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eed797fc860a56461ad3068f48e33de3
SHA11f8609934c4c716735dc4c9b3076184d3b20ce63
SHA25696cce27d02a3f0da3c1fe1783e11ba1713717655f7bada5948bfb0adcf8ea851
SHA512b0b9c24fdf380863a1ecbfc63f92ce5a22a89dc9237ccbbfbe52b2e6f9661bf5aa62784a1c2c9c28851eead4fa3ae5a3b505b0b6171255d1ca93aa9c3e1aaf79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e566ce761ecd974fda5c6e1477671e8d
SHA1f44f29f8cf6e20fe1a8c6093db316c2b2c778867
SHA256fe602d28453592b91b4086d224c25f410a563070457a2dcd341ac9448e830f15
SHA512b9b6d97359e5ce5bcccf1b8c01eeeff00c26aae9044d88da2d57be8851dab086b97d6c517ccad6d7fce91fc8d05b72e8225705fe306e56f6846a325cfc25001b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513bcd158d746227115b349f5e91f0cdb
SHA194a48b34b6f11570fa0490d45d597e2ac2b71404
SHA256f15f3424875941f136e6b11a4e40df12701c30b6a83a0883edaa5b23fec9a5b3
SHA5122b4154a6ecd2c098b80149ef00f2772aec5bb3ad65d5de1aa8ec5425173fbcb2e7917aef32bac3390a5f82d9c3588b69fa1826926931befd236e2e4a9fd81128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580cec12e1c5b92d9bce881784222ddc0
SHA1f8840f91ecb222d365812cb7cb97cdf7faa4cac2
SHA256f0712b7657a89ccf34040d838f0815e33473fcb676814b2c3c56252c1b8d5f57
SHA51239ceb63571fe30b82e67748fae4a7b86fd9807ca53de55918ecd18295af174b273a436b1931b003639e341e07a9a51f0f3e96e2955aebffe184b174eed4f7a13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eda70f108060f73c7594bf4cc2ed9f91
SHA1bb81863306ea73a45ea6fa3a39b5e6eb9a815ec5
SHA25662e2d612d949b3f54a1afc2bc4e76a6d56d30bf5fa92e7e3bee6bcc6af838b8b
SHA512ff1bf842d2c6b96eea31dfa32689b8303bb15e24cbf19b6ade280b38c8b2e3770775a4b79d8faefc081139cdb3a88632523bb9e3eabb5eb9f5028af5b267c448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534f60e7255d61196208dacef81aa62a4
SHA1cd23bf39f71a41a9c573194d2ba611c8a5f5a621
SHA256dd74028101f283b508f7506b2f4017a10266565cb986c44dc94e505e04c3647f
SHA5122b2ece6110794d57f9a95c2d5158e1a62944177e42e1113fc2fdee7886b8535f431728948e80fbb2255639b1d7e33dfc69c75208d218ee003b5276bb8484e8a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52183025be63dfdaa724714e559ec899e
SHA16c22201bae642d5a27257b3b1656a60376fc00a7
SHA2568dfac75875f9203997890c378f38d7bab2ca89192aa50df8f2799327562008b7
SHA512ff2fefcc7f65bde860b10376bed77096399b3f7db2c5d98bb338d4bf6fb2ef09031c618433f81460d7b8decc42007575c77a5b2a4ba36d777f80626bf0881bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d54cea3163e2c484857a77bd7a3289
SHA1719806abc349ec5bab9a5a841cb4e927df0b8b57
SHA256b1c9b960c4b537be08760ccc151374162293c5785970c74b97a6ec724dc131ec
SHA512044526f1e9310bc3775b89c7ed889837b3bddb40d0ba79d31c1e0545a097bf945d4264fd340d99d3dd410d82c0c5333e5ed01aa4a6ce33650c917052ef451b97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597a1416e61ea632f3a781f3084300ffe
SHA1456e4de47e89f840003f9c728beee59a82b95efb
SHA25639e56416e6900dc282e8b58cb3a51634860e233972e02a7cb5007e0859c957c5
SHA512e95e5e363fa331d15d6a950610a274e33fec4a2b85c8a2a4abfb3b32f6ac6a22099fc29a752a9bedcf17d25eb2751c894cffec48ae96130674a71eb16b464789
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b