Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
40419b236ed777f58eff52c59946653d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40419b236ed777f58eff52c59946653d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
40419b236ed777f58eff52c59946653d_JaffaCakes118.html
-
Size
11KB
-
MD5
40419b236ed777f58eff52c59946653d
-
SHA1
a0ec5a3d54dec5bbe1776cdc782e40ecd63ddb0b
-
SHA256
28612871e3a22731cd35412349768f66c4bc08f50c8a0468976c7eac63b8009c
-
SHA512
17bcf08876d5ea502c58aeeab09f95efc042dd667d30d01c46a0532510dca713def45695533f67d3c746cebe6e27ebc3a3326c61c3424f953711c474528c9efe
-
SSDEEP
192:bJPliPyRSUW62Osg1PzfePYNMiz9HFQdBG+t4c:bl7WffgShCHFQdB3Cc
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805f7ec5dfd4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000851e34ad166c5f107e74bd3a63eabb759a2c6e08b5de9d167437f2030ffcf54c000000000e800000000200002000000066e5239c2889cc6fc5926f67f66a3a365518801359a62694f021db1d2918a62190000000cde2c5b73615e4695b537e853b4a21713f6f0204c771b92106d08856b7a2b6949461c984f709b9c5c60fd5b2885d03cb0b3dcfabb56754e585befd668a2161a57b168f4b464c471f50e8d9097e647cd8f4b8dff7866649b659a547af3aa0582e2cc2ea6586b3c92bbf1aeda756bc4b6ad5383953b414493cc118abe918b07e633a51127b4258f5d57b8bad508b27800040000000ddf35b50630c431b4c04f0b110d5105161775b2560080edfe4ae5238a23935fe09da2b815e103d2af2619dd1e8b46c2134fe234ef3d09f6dd645020f30d03ecf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1064AF1-40D2-11EF-98E6-E649859EC46C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000482c0bec1abe06ce194905607e04214ae9affe13b87d940d5cec6724977e6e1e000000000e800000000200002000000020fea9ffabbdcf24e23a65ff7d52dc1fe4177425d2c91defff0ef9b68cc542d5200000003ef1547bbd63b9c3c2e941d143bf159d98516de9920a2b59eb6dfe335610e16740000000bb78a36406c7744529716374c1c12fb1cb65debfbb79e28f857618a6ba83d20a8c9433756a208cdfcfc26046f01ff30f15a0147b45c532916bac7e63f62dc040 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427007887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2584 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2584 iexplore.exe 2584 iexplore.exe 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE 2344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2344 2584 iexplore.exe 30 PID 2584 wrote to memory of 2344 2584 iexplore.exe 30 PID 2584 wrote to memory of 2344 2584 iexplore.exe 30 PID 2584 wrote to memory of 2344 2584 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40419b236ed777f58eff52c59946653d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7a0dedd97391a26d920a1b634fcf491
SHA1a862325766d1bccba5655f80541674e60db538bd
SHA25677422dbd079beee258f694e128bc91cd25fba51247a6660ef3671a01b0eb613c
SHA512902e92050abd521ed490b0f2fe46d452d511ae03a625db3b35c8441fba6b788a054474313d98b3d9908766e23b726c86b13723dda9793785c8b6667cd00e7fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584780126f3dfa30725b7c6c9264887d8
SHA1604e713aaa83575aca3d55803c6cfa1a1c3e02db
SHA256a6da510a02d9caa81a3e3653b6e8ce8e9e41e5d89f8ea9e228f51b8ad410af5a
SHA5126084a391a301a63ea8512a9b543f2cea7d008562956d1c82bfcc47d22d5d1faa1888d91d19f2fa7622b5dfa3e946408817e4bd9de0f26336ff42848b45d24160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5566deb270d7abe2b4d25a3e757c8e8e0
SHA189e28ae4484a51811cf06b1d1cd80cf57e1bc56c
SHA2565a97c9e1cb561071a0e90f7b406914e6a11cdfbbdaa6e5480edf7db4a9df36f6
SHA51294f4aa0b03b02cc84f2cfabdb04a040bcd65e4bf1efc1a001ca1cad3592208ed52d9e61719f170775357001f6fc352a03b63be4b80e24e53c3fcea28dec0b257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a0ad6d0f9ef4a95eeddf0e605544aff
SHA11b5b0d80e9b692c2a8fa34992b4d25d366508e7b
SHA256a0370a3d6963de19d9fb1cabbb92b42a45df03da1efa90760a2bfa2bb7d2cb36
SHA512359b16601376d875a1f1a9dcfd2d3d283a853c9141a88f8d77f3ada3cf5641202e19ba310c89aeacf000a9ecb635f69f89ad309971eae787d2a9147ee7e91e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffce42152ec7b762c8686108bf59b209
SHA1cce57e7070f26764816207590b14fb197e867106
SHA2560cedd38fe6f2d587e1490cb9432d32cf472f2bd7d0852086f51a1f126c896c5a
SHA5124d4ad0f5d42a7ea4ad4c1e2ff06f20afb9255e683bc7ab443d181cc334c99f5541f42f2e2b6dd06d6d0c546c2fb5ddae8a74f38a430de53dd312130593943c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5941d3acc289d6ea497edffb1b227dec7
SHA1dac0ad961ccd067898a07b0f2d37dd9b4a93142a
SHA2564a370869a07e1ecf9d391d91f865f5f535072454fdf693c4e530c34cf11e6ea3
SHA512898338a44414fb6ecd06b6f810d27503c71c4b4f019cd8281e0fed4f1def67972f1856095e413a49cbe4db838f93a9c39ef756e39e4d0beb844270787404fab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e6726e44b2c3f17cf4542486226ba98
SHA169f48c32f5fddd6c2725f96319b179ebebf5a307
SHA25688506a7cc674ac1b94311f7135a509fb61406671e3c621a4365aa8f0bf1d79e1
SHA5129a1625db67682210bbcf813004516e66322dad2e150988d3b89de36e51d5443b815998298994a6c0a4a8bf82b45a7fc185c924cfb9bc33d85fb382720992b0e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c12bc27e403f27f3ecc175194bab766d
SHA1a09157cf7ba05e26f0228c350a6d39da4066ff9c
SHA256eba1cadf65b96e384b7b6e31de249a9b2bbe44ac51a6956750c4a7853f80b4f5
SHA512d558325f113e9575ae107757d0fd4a04aa15bfb8c567b0c234a34a45bfe21ed6929244c247fe59282ca616e6a3b39b41de2d13a1ab01da8b9de879fe20766b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50acf2d1fadf94237f13c03f2dba7af27
SHA15e2056fab97a00616b11bae0996ddde79e6761ad
SHA256784b43728addb1a59f601ce4c6620bc89f5edf13ea2384b2755123915591a944
SHA5124e286dd4897c31c7eea8f65d1c4e2ff91ce8b6bbc9fbd012202aa170bee4b24a86ca86956ffbfbc98e6aa6ec82fefcc1414643abce9a255142c7243a3e5353b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52705907736674ab726a4d52c6891c00e
SHA1b1cbdd1b280b6e29c869743a402c0306888a49a3
SHA25643c653cd5b4e3cd961d4e4786b0df73d0c29b24869c11f281b28c4bc03f3d05b
SHA512e236b4d668fcb83ea22556bb252c725163962b01b4908c05b13ce5b1a250da35a6e22192c98f7609ebd26554b4f5385e7b9f57e0fb03db0568a74ec0ad01295e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7ef9aa6669447b401861b20d6c9b2a9
SHA1a66605d02fd6894d50fd34618c3dafe8c5d6c80f
SHA256ae225d3b2665768a0dd5eccbdf6c51ed0c2c38e394f43c659218c9ebd25b81cd
SHA51259364dce3e83e019e0b435a7d535247ec1267c73c2bfffd3267679bc05bf54e7d312349c5515ba18c51f1a03a3a9737b77a32c82db0ed7cc14d1cc5fdfc81758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afded760ecb62805aba396801f16d199
SHA10cae19d029fedecb0f634662e802c21c81f75bb9
SHA2564f3e9ed927a1ee10043739ec6daf1542a2a58376a34711922de1334fa3ba3767
SHA512e5d173686574943c1896e77091ddbea7eb64159b56ce28d046b62591de446c93f482f6f31d09e55e088b9bb8df884c89a6d44588a59818058d616713bf925150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b50233243d735bc7e4124627ccaddcc6
SHA131481d0ec225600060c2c51380295dbf55f1f2e1
SHA2560c7527269b7e616d58d38c15df99b60c9026d24b6d7607935cb54461c954295f
SHA512a23dca2421219e4707ed6c99c24e5065496d149e58983bbbe612fa9b76fd0b25c71fb87c8208b680839369747813250bd6fac33c4da64e6bcdd1e9d5b98a8a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad06d83d9a394752ce29e98633624004
SHA1b58325f2e58c53f5baa655c93ac8b2db85ef940d
SHA25650104900b252106e5f4989b6a0a9a60e31e48627ca393c18ef4ae8b888d77183
SHA51292f439940aa3f33914a80bede9c8ce2e099de2b2efb148cc2724413c172d5b24605727f5f2f631468e19122abf60539b06d2c384814bf8054d3c52f123e20cba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574d96ce46e1f456c1a6056b1f094bb3b
SHA1ba84bcf5df4462e5fafafefa217e954a34c86293
SHA2568525df9716096febac74990795b346c898eca9fb0329014caf34aff2a7d0eb2a
SHA51274e9a7ada177d42f5b54fba1f2dcf303f61e309b537363827a18062c4bf72c94736b957e37b7bae1ad94c8f0c12d57e6d24c2ca942ec932a3d014effd34086a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5999bcef1723257c60d521ae2fb1693f1
SHA1083cb220a6180bf6ee43ffdb7e6b8e89f2663988
SHA256a3d74d376ad21813fb337e9aac83e6abeac2f65d25e11783a907efb82ab30b12
SHA51291d99c8ca568ee8e2fbac96cd2b6ea0d2eaa988d79255dcaf19ef13df5cdf8536a6a001d4f60214838d744cd3bc2d955c34ec0423e3d8d5c59859bdcdb515292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d00887d9bd0b61d4f57339283599235
SHA15d97172e0e12c429aef90f13fb123a27aa1d81a5
SHA2568a4eef0c68fa5636c115d5898e8c4580f363e04b83656f6a5010cd8680ba1bc8
SHA5121df0d2e374d15467cf05f1466c60cdd0ec8996b4a982cd556ca938bc11ed259fe6c4a292acd5b728b8177f70394084b4684614a83b8b28c6dda1222f5f577e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ba75c0074058682d6871d9a3e757568
SHA1f079b1562cf35c30e5d484843fef690f6c20fc02
SHA2564d7f6f3bf3dd525333abed25f995d354084e6cebb2159168bf8e3655dd6f5afe
SHA512c49f38b1ae507c23f7d53c7cb00c6214c6528644d7da6dae2ee9d4a027a4a2d8998fac08176ce51127043fc99e4a4b0d0c56979fcb41440738d6bcf56a4d1562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c142d052a8be88fb20d7c7d36b4dc0b
SHA196866eff3542da138f4ae72177d11835cb4bf356
SHA25683d41a28babd5b70cdeff44e59289df73f001cf7a0825ee693ff5a1e83946ef8
SHA512334994578e0bcc935854ed46ee3cc6342b1008c7fdcda4e6595e1e3b05fcb6e16172554a07ccad83ca288840ae89c0f771f36b2cabb04e53d038fdd1be1ce6c2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b