Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
41ec26c456dd34debcb1925b89ea6912_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
41ec26c456dd34debcb1925b89ea6912_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
41ec26c456dd34debcb1925b89ea6912_JaffaCakes118.html
-
Size
3KB
-
MD5
41ec26c456dd34debcb1925b89ea6912
-
SHA1
f6a2f68edcefc747e9a5c10ee312948862c30c4e
-
SHA256
23bfa82ce74b338861bd7b0664e5b64951e067ec79369a0ce6edc7ec4a69d1f3
-
SHA512
7f3512af89567724c26e14145d81eb9f3fbcbb0d20353d217c5e2ec473de7b9429b0f1ce8f57594e567d766cf0e44a7e3b9e9be63d82c6e8cdd5abc36235e739
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000006e9218e2b5bb08db695036c20d1a8013d785a1eb08d4fde399fb45c022d1c8a000000000e80000000020000200000004bcdae63e2f2570cfb306fd696246afd86c3055ca6b308f4894b616c1c086349200000009748a7b68f14a1c04a44a91edf9de4661635850e31a39063d3631f9a9239d3f34000000039cb331b94ac9412b67f3100a64d5d496ff531751a4072f2f9fe2b689b60a39c824c29ade68160ad166d9b58b56da75eb1b4990ae7923b6bafd01a9fb066a30a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AB935A1-411E-11EF-AFFE-C20DC8CB8E9E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000001185fe457c018692f7ae0e669bef929dd6a42abe0d4b376ff948955519d18908000000000e8000000002000020000000c256968319236977979a137119f7c85c146d3cbf36cdb420b987228769e4061490000000fc96726b4c433c8bafdd5975e5078c67b080efed76e8effce3ea22c6f03157b5c160b1db92f8e81948f5a08a1c03cb7088ef0c923227e633d05761a96c053c0e9541e51d3067a2584578928ceccb2e22946c8e97ed4a20e6ad583470a2456973d11801b02557c4fcdbde7b3d3bd6741d8420e7d9c54b193cf1f767b6d4f11ef0565fa962ff8f2250836bc5f9adad2cba400000009ff8c1190d0fc411c331aa3074d1e8c669a5bf71e9b2d0fdfd0d44bc0ee1d77e0e1126f045fe812808e33751f9c1ecff70ae4f9b0f724dc2c32184b16faa812d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e76aed2ad5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427040196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2984 iexplore.exe 2984 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2068 2984 iexplore.exe 31 PID 2984 wrote to memory of 2068 2984 iexplore.exe 31 PID 2984 wrote to memory of 2068 2984 iexplore.exe 31 PID 2984 wrote to memory of 2068 2984 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41ec26c456dd34debcb1925b89ea6912_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6f25f0303f08a36516dd67c2325badc
SHA1fc2f539b86075691033651bdf1aab1bc286090ba
SHA2566cc6a20a78b6664c5dc599104964e7956c5260628e3622cd4f75377141f2a53b
SHA512961351ee5b2004d4d66d5714e91fceaef5b38f136f92efcf16466a39b73fd46e91ac3a96c576adcd2f0563a63142c5cadaef8a683325968944ddec5864514a9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5739cd46b9807836b6a9c3ae85b8a01bc
SHA179ec551d22f06fcab73e61ec8c384cd2b4bc1558
SHA2560de2782932809a55088cf177d9f4a94e33e1ac59e33b183a224e97ce153d14fe
SHA512eb5ae3e470773995b1929452df7b13be189ac429810f95d0ad05462c1732b9aef50a1c473e82c8946c18e92d5651808b0194fc41a491223b9fccc26740cbc57c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a97d562f4ac8d7f9d1049cbcb2d0a829
SHA1d4f72cf7e7cc45c5440f631d7fd8ab1e6050fb30
SHA256bdc45175a318b961723659d39be06785a874c7f7fc8db3e2f95fa70ecfa7a681
SHA512880e8da023d5015f3c120f7bf1404c20f272220a09a65971ed1f82c3a6b18e7afb51c17fba8bd0f15c6f8acf7efc4942ee2eb58c48b2df52117f908fc241b609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9f939dfb93e706638d9c297ef81452f
SHA163c48c2919bac64553ddabd0e42de4a0e65b40aa
SHA256971d4d1df7862e9a1ef0f66e39446d3e647485408f5906cab4b42f9f578dd997
SHA512dc427bfcdf47b738679d1ef13e0caa6e70388d0788f4251585d4612218aaf60d7e2cbb7d153189ec468ce9246737e98d4bff1c732ac52dfe4454f259d8bde18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53587223abb56b440be98d172a40a2ee0
SHA16312174c149e9b4cc53f642814ff1d8b5766f00a
SHA2567d8f5f5f8572a0ddfbd44daaead8fa783ff2f07cee0d06aeb746bcc73922d64d
SHA512de9009e435d2f49110668f4840118003ab41055977404107ec2b61d4abdeae479c58c8c4cbfed34026209fea83d27512f33217897611f6175db987fc6c7a9318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cabe83949992f3d6b7c2e9e4b8748ff
SHA11f9d4ad7ec5f162b6c4e77f2bf34f3adf3971b8f
SHA256af8ecf99139a22985c0b808d57538759d85da55fb3e83d5aacca27988391cfb6
SHA5125f62d0493f6094a79d35acfe64eb0da351874fe8d61d7d5875e942d586795e26f82bf80f0c96f028ae0209d3a514582ef6234398d98b015f7cd4a9622c1d7a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d282ba66255e963436bdf3da872faa55
SHA119482f47b1c4ff8fa6f202526ccdd1b404ec38f0
SHA256e03d83539f71b91abd1a078186f67a843746f0fd4f4b60a6c4509c8ace274935
SHA5127ad1f99758ea62cb8182648d595ec31226d980baf9771cd479a4256d972a34c01e946c5ec56e8b6edbbbeb5c4399ef83bf2c724296d71335ae4a2b993a969113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563b4aa028dca3d07d3f2a6cfc1fa5d58
SHA165a25576f6290558ce70b6afc5cec4a2ec0ed25a
SHA256f7ab14ee05b5e36ebd84e60d4c8c8a8d184b420161cb8cae7a1b610720b4d613
SHA5129ba79783b20f59022039eed7e3cd3dc9038ed155943970c4dad1a0710c702656e013c490863016a903bf28781010b322092d28ee81bcce6c8b85069586b07b51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6085e2753d897cf2b27e583ebdcec24
SHA130ffe4933b637dde048b123721d66d01e64fcab9
SHA256be5454ef68317bcd11e20353fe0ad340aad4c22ce91ad8a7515c293627b1f82c
SHA5124a6d081083b4ccda8e9dd086597296a3119ffa304872e1a4cac5bc234cb707eae8218ee6ad746003bcecae9014162f6eae92376c727b66039fd49d4205b915c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3052efd9acd31d3abd64f88668ee958
SHA12c4285f3d71833e39c483a8909a21518a162b393
SHA25625877e9b20c401146dd902087dc8c53abb9555c402b407d7fc8ee93786961b1a
SHA512cd4623a9f386f76250c275f1cd19b50238061793fbc32856e2fbc612bd76120bac3d690dc84a760de1315bb17e1c92159e7918166ca8d04a06842c547989f919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5694d18a66e2481809a6f2b14dd5cd9e9
SHA1611a6ed0bbc02e963ec4136c0530c2442567818d
SHA256012969612e7ad578ac281575a3f9d757637a9703d768c7afb991bb2f84977866
SHA512e118666c17b92370c8d187f791874d6b178269e382402db2673fc1aa48141ab36cd78b8d5f9f00d9123f915717fca2c03d857f3c34776c4a5137e5f698411ddc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533ba6266db1b8a185bf2e222dc1ae17e
SHA1dc893d47bede43a824f7b0ecc14eec41c5a9c43e
SHA256efe49a384a21efe2a674bafb1d70408b7e854b72de9927752a1581bb21deca46
SHA512bd51b64cab5ca64c6af99b2413dbb1382848f153ba21eb60a88e7ed44c003e97cec9eac1332ad65d5737ec8fec348475de747a944e78d5b00ff30b134bb439a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b367648873e6bea4142ff2ee1b3e2db5
SHA1283cfbca8f59251d6f0face4c5582f0cd50fdd5f
SHA256a15905e7ea9f192a754ebdc613b75fce5e58eaa8cf82270f58cc048bbb293e3e
SHA5122b41210d43a106601df4ef7d784510002bd8a95ccefde2e89ff1e1330baaf62aaf0e6b4ce3097bd9958360604c8a046f975e72b0e32fe56193bee798f83c900c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a689717402ce286ba63664ade04606f
SHA137af898866f29129e24964b4c5290d5c925f5ade
SHA256da621d9e90f93c98efd0bc45091e69c0363aeef884cef87e608879371f58eb96
SHA512c18c9b812aa5f7d6487156e1de4fcdd4076997fd6cbb237a4880c57e4e9429eb5585948538cc2e16eb5368b1d513d8dbdb3aa1d7fddb4f8d4848d6baa94653e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dfdc8b26ea683f22e94196b39af2326
SHA1bae7330b6132ffce18871dee7c6d4144bc351e7d
SHA256d1e0bec9a11605d5cf4b713a4ac85da14dce9596ddf0fc54bcc98e5a0da25415
SHA51279f580f558118a92c4b4eae29f0b061b8549b326ab95ef8c0e64ebd6dd74272ec20626c17b35d30be82a99fd984c1aa36d04d092f194b0fe93589ab645ed43cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5766cd0db034b51abf3423ac6dc48ac12
SHA15dbd9b1d905346cdac396ace8aac07c90b5ff92c
SHA256c8f8385c4c7441e68490589a1f42cd3038682fdf225e2158ab771076feae8d70
SHA5122453bfda5e9086c686c744b4a0b1586a5650e15bbf5a5aa7c37ceecc710d4ce5819ce2012b47e0af8104d107bcfe039a180d3bf488fe3907d26d1a0a9f099a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d754e8d4b289c9ddab3b2d2f96b8bee
SHA114a59b68b186a84ae35ac1937081801f2982dd18
SHA256c23a65e4302a26bceb76adcbd7f031902375127d4e5794bf5090e58b695a9da9
SHA5120d523917a72212c162423e7f13cb4750b3c7bfe8a82c814bc6b7c4553af8f8fa284dd3f91e55e9e5f169614a2951afd16cae1b02d035f71e44e0cd679911c69b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6c2dd7cebdfe1ad85c8529f4e1bc16
SHA192a6d13afc66916a97ddec56ec56152bacb296ac
SHA25658b568eb939ad524cb61ccf97fb2e559f3a58ad168ad25c565f98beceaaff2ed
SHA512407d1f420b83cd87c76f38773a476a126c1ac19e6ccba589faf11427f637ce3eef7800f6614cb34c7f377275732007ab7badf98da386503c16c1db1da65ffec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58619e8d422060e8b74d13292a0f3952f
SHA178bed522aba7fbab4ff4c4649bd29fd83ae6cfc0
SHA256ccd22082311837875b75828f6f9e1aa4ba97a5114c49cbf407190622b3660569
SHA512cb10f1ba62d4c72f4a207d160158707a4ffa2861eee63954f51cf0dae25f70d4be9c684d690784942cbbf38ad630afcd142d7a93760655d6b6ae1b1b845b6642
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b