Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
41a7c161a010e71e5e243784650b793e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
41a7c161a010e71e5e243784650b793e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
41a7c161a010e71e5e243784650b793e_JaffaCakes118.html
-
Size
11KB
-
MD5
41a7c161a010e71e5e243784650b793e
-
SHA1
9fbcff5a319fcd2c44207839129d50536e17bbbc
-
SHA256
416ec3e77cb9c79352201c754a4902726a2be76c940a63faddb0fd45a80bf2bb
-
SHA512
afeb51cf8be651df1a2b74074a771821aa62e5ea6e555548da4aeb03298b8c26dde086448acc484f680b9d9b2aad972a31894e519acdddb85e8370ff9f997307
-
SSDEEP
192:csz7yOAYS/yC6eqJ1erQTeM1erQMeLeeSSCPHb76f:cVOAY8yCNHS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cfe3f91fd5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009f0d5e79dea155cb008bc180d95abf0354c45207f24244c590550ef9b2940856000000000e8000000002000020000000280ba28e87c2b2b8fe625421e2c608b8b782b108ce692ee2b24e6c1d9174537e200000002b53cb47774fe79605d912447fef47028061e67ae8d9ca48e546923c8f8339104000000075086d585b084e3b3718e5e4b3339dc24ded30a601b3b76c84bc3c7b6e54caaa1d134c153bc2416928a29b13ec2effb47bebf56ef9bbafb171d8cf07efb4315e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000d1de9e49d7cd0ff14d138c36fa43fc19133c772a01963ca3c1ff1e9620a96598000000000e80000000020000200000003ba728daa668a2df1a9898e07efab2195fbc53b285c38365c93f2ea5ff2e710b9000000028ff647a5264071c1abb1212c98a8619b7b289005473d7805b9c350d452d458dbb79faa38b26e635f0ae034663583715ec36b2b2aaede80d6eebef24aad48648ede17ce5cf1d2bc1c9104927863509ee0fe0db0e3549fb3235309e7a5d8c7a4bfab51ce557b2526d9c6a871a396912c557a61cc51a7ab3d59dca07eec93abcd72c3a78b319e1438815731a295454425c40000000bec8138d91fd442bb23b3c92ad63a3f5db6bb6bb8ba69f50a79f7d8abf810af8846a4c43a5ca58e23726dfc52fd34c7e3b2b70d551bc2ddce4e6d11fb1214e6c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427035460" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2342C851-4113-11EF-9D6F-6AF53BBB81F8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3064 2460 iexplore.exe 30 PID 2460 wrote to memory of 3064 2460 iexplore.exe 30 PID 2460 wrote to memory of 3064 2460 iexplore.exe 30 PID 2460 wrote to memory of 3064 2460 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41a7c161a010e71e5e243784650b793e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5806420f9ce7cc5ca1020483a1f1469d7
SHA1a92ee6fc1e1bbd240d18447134409ce0b014afb3
SHA256ab7ef6528b3a2ef417b08df6e4adbc6646d812b8147fa92df232cb966793c9d5
SHA51245d58439e2244c1bb446f6c4f78d114b86a00c5d0ff5c80fbdfa8521c16166022ae83db0a4eb97fc3575b0a108bb73eb1eb4451fa31f1fb6fe299e8d0eab2b83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eca9617588867ae7099798013e777c96
SHA1ec8389287059a47aed5af3c07a07d3e59dd256c8
SHA25618674f68e0b129461b2950a29d695e45b078bbe711efa5a3ec4c3923cd075ad5
SHA51211dcc65d62af5f5efa5a71408b7c1fac6b4f747f9a37511efc22f782c3f0c06d01577f5cfc9fcecacc2da99871d7274e3c93f9fc337b5120840b29498cc640fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538bda349589fb6ce94e1a7e36e31862f
SHA127b94b4d885c3b74329e641537232c7ea055993b
SHA256c1adf3875efb5b1550d1a0c23ac61121f9963168e1369dc71fb5dae4f01edf79
SHA512f3e13f91569c72faed8d4b0f1c8552ed9240cabc68b260e55b906bd90264ba003f1555fbedee40302aa0f1a9f5ca1436437cf2cd846c0461f33017183b2b089c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5185c09cd95729e11cdff6d02b2647848
SHA1ef08867b15646c5a8f208b257684db5f501846b8
SHA25614099da06439c49cccf7ad0d6188f31f42b6a3edc0ab9b3530ee6faa6a34cb8c
SHA512f5ffea0e744aff292c34ce1eba9fa5d22d106ec3dc2e27a58cceee2469fd58a19748e0d5aeb21d0cbb52b2215cfd81b3de8b3bf6b3f6b1a5939ec4644b9eb495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f624648a6e806e0bd79a3f1f2519471
SHA160b19e55ce247fbe6ee2154ccdfea1ddcc0731a2
SHA256c76422a798050b0ad957380923bba380700a1a2c27cbe90dcb399f8c703d8b64
SHA512545f60c04b4872d4e54b3689fd19e7a85404e32e8eea4ce0c771490d76fb58c33a2d3146e4deb78b6dc53c9d99551c9a0943654553fa0c000d1d50b6366355df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d245e95ee43133dcb60e1c02e2a3eac1
SHA15f2b9a52ded19d1320b935e1804bb58b43268a94
SHA2569570f6fd884fdb49179971aa450b4b6b44902a34890770a999eef214ea5e032c
SHA5121de8aa97c1cb93fbb2459cee2588da73a605fc71ef7aaca98bfdba223aca26b76c0e8ebc3633de20d26cae28c88eb145e75b3bed914a3fffa0efe5b0228e4bde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acb89afe8a76198a578eeceb13d974c2
SHA17e2e1e30ea48c55644de5c70600cbd749f534153
SHA2568ee678236fc91e7382a4886d3068c20bc1f1bce7f9a204abffeade8876461b51
SHA5125475c9f688e2834c6e3e4cb339238d6149b227d7d828bb16c6753bd47ac9befadc17c0620d7c6498ed93918fff27737682586eba70301a7c905019ae401d2c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e700dfdc588ba0a3bb34a0c1a4a908b
SHA10f4a6280af079f479335d4ccb614cb2b459a53c0
SHA2569cffcab39aae84312afceea0e8dd33da0492b64900477b42bd87f1cc5ead4fae
SHA5125ecb12273ca545c31dfe56084b2f542e66b6076023de8a68ee6ca3d895e79561f74c73fcdd78ca181d695820d2755630b30baf23fbd89e4fdbf5049cc7ef251e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d6fa9b0ddbc019bb17d5768913517ea
SHA1a698d7e63eab7fced58e0086074a03b0654bc676
SHA256837b68429e1d7da141b155a4f07e208243164edf73a669f1f06a7a50f833212a
SHA51217769dbc37d5eef78c7850bf59c20dbf3af22c55f646df9698deda3d1b25721e55990d7cd118565f7ef8bd79077fac050d04f8712f74ef6ff834d8636a48038c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a780950fe95f286809349024bdea794
SHA1a17396dba6a1ac4c2b96fd76ca20912e4879b070
SHA256da96a6ff72208ef9d0ec901bff0dda41b2c698d4dc3c9b0671ce5f4bf15312e1
SHA512e91be1a81a8e5860417fa9a4dae8930098949ecd24b1d9daaf6e53ff5b7acc5055c22f6a125e20543b02c5e0ccb0d953be6d55e5849eedb2803d749b9e5ea807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a45ee1d178b0d7a39f81f2c07c16c1b1
SHA10cb3cfd2411a614703b2fef4ed54be106effabcc
SHA2561cab329fec83f9d265720b4b1ba108ff6507b6e5bc5d52ae604b74b28ab2d7f6
SHA5128fd9b8cf0456c1f99ffacab71c79ae43ed277c00c46339ddd6d58e08b7e968a08e35b1fefa21415c57e63cef109568347bd22fbf2bc3e77c9915fea0ea48d62d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5750af5117c476bc51ccf7792a0b5a603
SHA1faef2637c8249c9d6dc58efffef718ed7fe79fc1
SHA256f8d8989156cd98d440d97b152fafcfe2324aa72639e4fa1b0aa9590e52181c07
SHA5120b65811a69719a7c114dd9484d40d816f8f37c0a54952f22d8ad82066c18561bc76b2718d64dc8cd71917342c159e642627f071e80b5c94c2fb931665addcf71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c97fbfc113be8aed54494fea4caa1ab
SHA19517c5338ae17ecc5337ca92a8b60bf404dad099
SHA256228a0cbff8698715a5073646577e1b98eb29c18bebe33660faa72f056448edc9
SHA512a1f0da726352aed01ce640a68b841064e38f3770b2573303adfed4a70c6deec16ef794658e518b386fb302786556ed765635944488506e7e5ade6c085229a7c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1a5d1b10e52f93368557e454702d6f8
SHA129b7a363017ccb6a52b6b85fc6babf3ff22caed0
SHA256da11f6b557700799c5d759f3970dbed3421fa187754fda5fe75b011ddc4a949c
SHA51262f8507635a4ac9ba34b196a84b7375628444b4129eb7e138b1fb24ad15f40b8cef9c5a8bfa89ae4aea6c1cbe3a3fba188af319c19682a8b67a9fb83d42c835f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538bef29920b8a7b395375699c8141bf9
SHA13bfd9851d6050e35c017817899af873086a0f6ce
SHA256fb9f230fc30919db2a8d8c33f67a360563393541ed4d5fbac432c74a0c49ee6e
SHA512854f73e3d9946732bd08f035d7332d9169b31d467125f364d516df114585332d7f695ea2aec9e459de2a68fd04714bc13fa7b6c3ce352115857b3f363bd4252f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5317bed13a8aa0bcaf8c62643bb15140e
SHA1763a5245d899710cc46f56ad57865505661bff03
SHA2560a2297ab009e90412dfa4e8ae7e55fa853721d77b8b5d0567685ec311f339c58
SHA51289e5b9943ddb83b3f32e8d8010caca0eb433399bd212d0089b53d9e8f0a77f91a65af4a3b1c2317aff4423547a73da279dec98599d27a156a65659b775e76e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5964ea2c0ddad6792c6741e260a3c0952
SHA1b8ae0b7d210e3ee408adecb5a2a985c6f3466ce6
SHA25615f0bcb30f84d29cdcfaab588345362113730f0ea4eef6594b395caa0ff47029
SHA5123500edb5b793570d771220c330f8922137d77eec1a03b7c8db2579e21bb9cce6e95aca6e01a482235d9db0ed4c5db3f2ec1fc3301e368017d4e806581f538018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58895ccacd5467d692268371e6aacbb31
SHA189d259f3d01d743ec30c01e25c84e1206b3508da
SHA2565e763d11cda90d0e24db077b461c7edfe07521c0dc271076f043598654a636aa
SHA5121ec271e45a7f0a0eca19724015ea3e22015f661658c0caf64f912cc2acac159fe9363289b1be0081e412044ff657a387928391c6ba198c4b8bd03a0d1948b000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554d7f27c61c4323fefd812dc1388877a
SHA13f6878d6264fb583be2eca020b8907f28a3c6597
SHA256db48cfd7296c10a99eebc8e22a900b15e58302743af3d43270d3d18e7e2b7982
SHA5127318f6c8b01ce72467dcd433b70d87d130d28567ef5ffd75c496c28c97e65799ef1e451f6618eafe2769979910fe544e80a57b4fe5e2b7a7bd89059cb4a7ea19
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b