Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 12:45
Static task
static1
Behavioral task
behavioral1
Sample
41b8b7dd73b64e038a5fdbc653f257ba_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
41b8b7dd73b64e038a5fdbc653f257ba_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
41b8b7dd73b64e038a5fdbc653f257ba_JaffaCakes118.html
-
Size
1KB
-
MD5
41b8b7dd73b64e038a5fdbc653f257ba
-
SHA1
b2306d0081558c8e8d55a0308151a827d2d6a353
-
SHA256
6c76e5587c5b1e1e523ebc590531f7e1048a11eae85f9368b7f6bd2d516d613f
-
SHA512
ff436377a49cdde197bcbd7702588e527ec56038a7bc31e61370159a685bc8571b8e39d636ec89140b2e4843cda7a24786ef0d3cbe461c8c58de91008adda164
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106f33ab22d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427036615" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D44A9901-4115-11EF-B580-F235D470040A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000000da0b4f2bb876ca954876c67054f5ff1f173bca2f2d2cb68de1126d9e5091d33000000000e8000000002000020000000437bd1b8b8d10a12b5c3ea721137772b2a722eba602e09ae8e0d841320d4904120000000f7e5db83426b2117440f128230148beabd87ebe6ea4eb7137df500b8d3712c3140000000d4d740a1473e49ec0041b6231bef1bf7d8c714f4fdce112673e8335500cacfe0568c0ca4eca1d8e191148965aea587a71e0dc98f2cc258d2aac01ce1b8be098e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001e63edc3d6e3b552fc4e7b965f514a284ae41631863fd656a657107d10ada7e5000000000e8000000002000020000000afced01882cf272aeaa4672a2e1528bea65c6de4b1ec8a56b38a97f8fdc93e55900000004a89de1a88fe06172516b7a5565ddbf75a0b8e9d6c2b86ddcdd3071abaa0989583b3d94fd5e5d63801ec3555a5740cff68edba55d6b5794af245ce18a02d43fd5c8680b33d86d2b61e6b025bce9689f77bdde789f01f93dfaac56aa45272f7af1de18d6e2acb6f39db94bad1d728f1006246f87dc6b1477352805ebd9f18325db1d41137a7513e5ea4d2260b247ba75740000000073754aad926e4bbd6dd2db2c62846a1640b28cc28892920cc82246fe5a2043cd56dfdb3a825fbe1b3e2c603c7199bcd9d47ae948d24e65003cf1ba5e4091bb3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2116 2336 iexplore.exe 30 PID 2336 wrote to memory of 2116 2336 iexplore.exe 30 PID 2336 wrote to memory of 2116 2336 iexplore.exe 30 PID 2336 wrote to memory of 2116 2336 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41b8b7dd73b64e038a5fdbc653f257ba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f362a13a577e4f7ea509bf110d23c11
SHA1ebb8f2fc47815f9dacfc6a54b3091c36fb3f5f61
SHA2560c0b7820d046b75ff51351452d8d4e0b056d79f5fc07e874d628551f0b7070ec
SHA512a9058355ac4820a96715d3a0304335cf8fcae5cfa6744b02b8e80e7ba91f15cf63a40dbbb2943d23be28d574d0140bba951ad9f64a3b2a598fe7697db574da74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5515133028e7a457fb0521f4174a7b816
SHA12f69e4144249168eced5016aaa59ba013be324f7
SHA256ae4cfb93c724aae13f181f972cdcf123a10e8830cd7b0196901410762878e77e
SHA51290b712b10dec82b3ce2e42d9df07036ba96b118ac0f819b3ebbffae4fb49e92dc4286f3300215b1462e0ce8a2b2d43c0bb4b989eba167edd20996e66f4d8a9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55224b0dde247ad37cfb60dda58f7db66
SHA16a7a7cc3b97a22fc347857f5f2b2528799874185
SHA256c1f8d87c8bbfcb11d778130cb510568bffaf043a5516e4aff278b8bdd4e786a6
SHA5120abe312c835cd455cbfcf9fe5daad01a7d442e515153cc37f04376722bba55d2ea92bb2e2e52c19521f894cd13312e3927016e3e4904d1367f0eb9e1a4f4b238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5490335808e4af88c8f612557b58b747e
SHA17282b59bedc2a336382fa83cfafbe8f5c2abcb09
SHA256334db195306c9d2ca75ec478206980e15d799137965649febc75d95c70697d19
SHA5126f80d897cb86eed0617c01d09c7f20e8828ffe564b3a5a94dcc650c67d19d9b9cb80b2abca6df2d2c298caacdc52fc4fe2b8c00b691fe5af019518c0c361a9e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa234de50640fee2d11a975d657596d1
SHA18e6499b6559528ac011c6492f272120ec3a1f447
SHA25602fad2428050abf4033a571f9f75d12016632d8989522548785e9eb8fc230be8
SHA512b303733614d8579183d2629a3dd45c080945e58f7bbc0f9965bdb48fb143613beb7f5f27725518e7ba0280bc40c21ab81abf04ac68e65e9ac0363492fc6336b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e796b326238988ad987fac4b6a50e876
SHA19ae10dfcc62abb8582c4c65ac0a9cebb96e892f1
SHA2567a56140518016c8655cecbb13b24f5098fea6324694cfc5156ab87058a799e3c
SHA5123459364faa6ae15af0adb0c10020d0ecd43e04c3a780f79e3f3ec598dacdb6a1793d5fcacd3d58a04a2f1917b553ec342dbaa24c86e64e99ab6c8b1474bb4d22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec457f03a176780435d04d3e85175185
SHA19c8cdee461b8783822ff00901499f242fe98fdb6
SHA25686876b1288e231d48e2868eefdc78a2363cb6ce2f747addefece271d233333b9
SHA5125a204ef4b08659ff6c4a5157246a40406dd613301e47a235e344f2b77a46ea949d79e89ffba050c76ec7797153c270ee2b8471423aaa15a9b18f26fa0b0c0e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf2a9380d3b43e9c4ab910b45d6ed5c0
SHA18fd4b0f18cf32a3e822941cf628e322f7754cb8a
SHA256cd608f843eae0dec11388ae31f93698f2796556f53981d978db6e80ad635f86d
SHA512c0cbf9199b84b8992bfebe5e0c543f68abb794e33bed1aa239eb0eebf1e54f5acff3cf46c8788a28caee4a94d1322298b0b654234bf43cf342686abfd98faf9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9406b348255bf9460eedb38900028f6
SHA12d727425780b14f177622f2ea209bc2f922c337c
SHA25618b117af0435fba09d8ef39edfe9f72a9009d1e18ae7998ecf76fdc8f77daa05
SHA512f211e44af2cdf488df6e2df4b478d0c44589aaa485cdcddffc5302b3c24119a1277284a0a345739021cc8e7a9db2a3018ae59b88db4fe6efc84bb52f12b24f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9ecd0624312ebb30357b76f1e0202f1
SHA136b7856553f6a4c7f7e56eab4e9e7adc7663e817
SHA256404c5cb8cdde3eeaf0d5ee3ceeda1e3ab57a935d6e41da40ed84f93a7b12ec5a
SHA51255f0126c678ad283e2138c881bad14b339bcd28ec6c8cd0c54b3ebea20e8cb6ad9753b6d8164617426cc14fa56e742148fc6f97fd4d3f4535604ba945e9797d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5504d027140b56649007626a0a8ef42ed
SHA12b60351a61739534ca5b41074459a4f746ce138f
SHA256a958fe7542f9660f592e847fe9457b353ff5246b907ce192e34d676ae9a696fe
SHA51249a4c18acb6107ff25ee36e6530f9464286ea6b149bc3c9df8d83702922c74c6b532c271e408c79e51fd7df479791abde0172e4ca5e4e2e38a537360c284cbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e7ce59d73560fcc1adc3b9de63c24dd
SHA146e1a24fc00100c72f3d166a79fe0edc3867ffac
SHA256225b392c2b515ff8c58ca1882a46e0bf99099e7661f8efa83ab25f5b77672197
SHA512b10c7027b0d4218d043e90135332d000a9b3c0c5ff48bb058f5def8f1aebab22275281d2aac49371e48c9413bbb238503c938fb97f2b02d474505eb4651b4ed5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5719285e8f0fec9b516bf9f2ac02f9c81
SHA1c06cb03a11e064c41c9b9a9776961273ab435bd3
SHA2564851d4dd51ed3d265de5e1920e41e5feb7752b7054e2de68355a9aaa44ed1b52
SHA512e87e8626ddcb0c22c59c6034a600f08d0913c8393028ac5af0cf86936cdc557dda5b9328fef1c2a43b93f10f4ae5c4c03fddc54a83a238a8ecbc5884d2efb2e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54975fb652003c0348642d5ea95027e6c
SHA1432af7ce1ae050a8ffacfa9b6cfe30079f3d36cf
SHA25619d7f71055192adca4b0a03ed33750d1639232d411099cdc34325fc31fc45a78
SHA5121d74ac088abe7f032e296c9eb947e07e4e005962b160c74262e36e8670d99bc6f5d0fe95052957bb5febe9c528c97933c9c874ce439a4c9b2b303087572f0750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56557b1d48c6d24b3b329dc89224f069d
SHA10a197f9d3dbe17e9d05b92a5e51ce3874799619a
SHA256aae0454a88c0514bd3bf7afbc8707a5b50def8a10e6a15c18d3f7dd3f3f516b7
SHA512810fc5e909cf2df38ba7f01cc93c4360ac778f56e3f651104b93fa899875f3aecb95d165296522703ff3a3cc7198c231728d583d34626085e0f9845754b18806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7e42ebb1413b901c673119b09f36804
SHA1c4ad29cca977850cb2c72110ce97a1750dcd62d8
SHA25693067f7f78102bf52d8114c57ccd6f1fcd04cd766c5a074c77caa74e3af4714d
SHA512453919c8a222bb93d44c5b320bd8e37715e749ef5a2d06c69c6acfca823d4eb8e7ef0915bc2d753fe13b828c59a1ebfb47139322540973e939193ef1046f0716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2b8f1eaf241be4b554bb3f8cb164ad4
SHA1ae1c7ef303d01bddd791df104c850ce69752ef63
SHA2562a25ed40520fe587b781b206ed6787517a03fe10b5907347b5206cbb3285ac61
SHA512d752eb67bace5cafe8cf2ae29ed46eee35aba5954bd54f9684a137072651edbbf8e2ad8457f146bb3b19dd8bce0857da2c4741230845e71b434e672f8d1d22da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b10cbafc20378cb018e66fa8a164f19
SHA15cd2f4903af14fd7a2eff60d7cf34493652c2ae1
SHA256dd61dc2efee0ec8b92fb11b1529cc5296c5333f27ea1340bcac41cb51e6929c2
SHA512ebbe829fb8da34cad61da5c2b57d5d69458ce53a2bee7f79a86d0f45af5c2f82170a1c586d61f91550ec5a59e0ec75b93966748b0699bc5186af727b3a7ee4b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb3be4d7b456ddf29df459166efeccf4
SHA1a292d36582af2d0bacd4d21471ae4e13046b10c6
SHA25611615809b6527dde1197251205bc95c63778c3a613428aee4131dfd2d14692e1
SHA51239405e947ce65b79487cec33adcea2de1eb7d5a4efb8d6871f7a83b4d4c3de96da8370d0eda09ea20bed57789641570b01801dd8981d70c8d57b9658c711a6f7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b