Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 13:41
Static task
static1
Behavioral task
behavioral1
Sample
41e840a9d9f020c7b4b294459adb3ea9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41e840a9d9f020c7b4b294459adb3ea9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
41e840a9d9f020c7b4b294459adb3ea9_JaffaCakes118.html
-
Size
6KB
-
MD5
41e840a9d9f020c7b4b294459adb3ea9
-
SHA1
46064dd984a1d020facebbb400cab9b5f28c5565
-
SHA256
492c0c351c3052d06f5462a4506e9fd1d2561912d7023eae43e06f91f404b83c
-
SHA512
21e5c4ae82b50172dfed7bd89c76ccf74a4785451c31063617a0d4a275f120354e9a5e9c7e456da3e70a4dfa07def070f1ecaf653e941a513323bcf01c98b982
-
SSDEEP
96:uzVs+ux7XHLLY1k9o84d12ef7CSTUSv/6/NcEZ7ru7f:csz7XHAYS/f4Nb76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004663d4f8c87359184447c4e8b4b15e3937a9115c129c9fd64a3dc8a2c5acffcd000000000e800000000200002000000064f21edfa4053fb368a87b16240c9ef9c9863adc141b307899ddbbac7d9b5b7d90000000d62cdd683c828c47492e607b9e6e7534b29d099569294f62949917870f48425bb3479570419b512bd714e94b54098e9e77a0e51df4f245ef6279d1b97e9bcd81f4049a22ea48bf9270312d704c8320c822438d7bfde08320ad69d078cc8924c2e2f0e1dff49cc805a9596cea4a22037a3f07105818c90d465fdca99de296c4ccdf7b3f18342a0129812d460456a0eac8400000009d317bedc3d5f787b391e65601c235fdfbe8ead63ca78982337a28c276ce9247371e5ef6ad2d66b752e105c56743a7f1756da3f4c944bc9aead1216da0ecf23c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008d3c822ad5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{927CFB01-411D-11EF-AB71-E6140BA5C80C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427039944" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000071b8a516905c1a52cf8ef61cebbc1843e67ff20ed2717658044a6bcefa711e2000000000e80000000020000200000009a906007738298972582871deffe17dee7eddf31270f59da9dffa5e26667a56b20000000d5737cd5d38054cfb51eb0f8a9f394f5433da6484c101c42bf4bac47e6aa779640000000d0553c4f02ffda2f0b5dd6710ca0a1e8b0cc6705eba836a45aefd9fc004049039e3f8caa029c8f364ac66f6bf52fd6aef904bb09af6a1e4b0371128a7aa04f75 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2820 1908 iexplore.exe 31 PID 1908 wrote to memory of 2820 1908 iexplore.exe 31 PID 1908 wrote to memory of 2820 1908 iexplore.exe 31 PID 1908 wrote to memory of 2820 1908 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41e840a9d9f020c7b4b294459adb3ea9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1e8d533cc61c41b05a20e25dea70d76
SHA1a98285cc440c3e915dd2b958b06ccc6284f5253f
SHA2563866a1b9320ee9de896140178c597b1b82f6357cffccebdf00696b4d174b8887
SHA5124aa4ccda7e5c6a767668c0d5d69181ec1a4c373b2cd4f981d153aa50d32082ab0929f6ac6b12afc41dcb2e216ca303e5651e2f3c8e9a553a3edbd16314f6394c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5804b1f79b2fcee2e43ca165c7f9b33a3
SHA1b3ef3f6bc7a4c87f8224b86a7edb1bcdbc3f7ab2
SHA256a7f8e15fc1d872b7c7e8562373a0899207c279476a4a1dd25022199e5eb11442
SHA5129eb2dbcc9aed1dd0a5bb7f642bde4b76750a2140a1367bbfe3818e813eca16f0dd0a7f81fdc7f27c3da43e018c6205043d8a6b77e5ce419e56502bda196de768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512373451c828bc5bf793217104f5e91f
SHA12d60d82e4d40c0ac5b5c6ff9911793791da3abe8
SHA2566b67a6e9f5e4a999823fad4e0ca2014cf41b6df91088da250b9a06f14cd66802
SHA512abe85bcd168b538fbf1fe261a91e6456291c9a50fba7ce06c3665628c29608bf5b70daf16a02bfbf64ff2ede9e1ed23a12164e588f9bc2476ee27e46f5a6aef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575e20bad244e23e8166e1dfcfcf9f12f
SHA198851b8a11ee9262175c62277246a541a54e8857
SHA256d4256b69e702f26f384d62307063779992cc5dc3eaf5cfdc08ae16cc42e50633
SHA512922f473cad2b845926ed82ca40988298cac163734bc2393c8b1071608a1624a46ce621f3004f94b87df5a6c4afa727b0d793248d744655a6231e875dc0e16cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576d276568e0b08fe5d52a1a52d4b95ba
SHA1ce1952bd3a8c8a21b8dbb88b48dafd5af71953b2
SHA256efdb65d3cc5dd14718321b63e144eb5eb85aaf0ab6cd2708f58ab8553ccbb26a
SHA512c465f98c07f8b771978ceed1272b7101b0a54aa6ba48dafa2a18380d5697396f6f973c8835fbf377ae16c7c64029df01dc1f49847552b1852423d43bed0f1414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f18f14b0ead2af06f195ffb801c0331
SHA102b300b71da289e9792c60c9837494f1f2022c46
SHA256e6b68faa936caa5d7e544700e4bf75bbd6aa53beaadf7e69016a13e0dda2b84c
SHA512130bdf9a3ff099dd732381d24ecf7748bbe3edefd600c54672ae123f786e9ceb0bc155d7f01ead00e09bd51fe89bb94b557b650491a9cde77a9a8427e079773d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c51ae014ceb4e5995287c73fcdcee803
SHA15dcdb29306b08d87dac28c0ba556cfab5ea63865
SHA25607cd0ca28cdd3d0bd830c22212567d76f44097dfe8ed18e502b7a3dcfe553509
SHA512e896f69117e797e8925d8fa88c1658825ca18595bb70ae627120f7cfcfa3725a065c753ee74d1bacc1bc976e40114996c90dcb7c58e646bf55a6584828963c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5345ac6c4af0074f86a8b38595397b91d
SHA1bd89306345b480c0c83f350002af2012f871be71
SHA2562f36f583972dd7a2d2221f18c6293b68b69b662d112655cdb11f689ed4f26213
SHA5123e0a9c8081d0ec502476f55bdf4b81c62380fa211bf8b02c4f57f5159d9f995aedfae612cb6cf6c3907dea65e53fc265e9436bc5c598682e6a6a892f66afacac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc86b91adb9d38a9c20d0eb2737f5ea7
SHA11e1ba3871d9f0d915e40b8d6bd6a21fae1c52805
SHA2563f93c5e4ad10b3cecdd119b47faeae87dc099c5b2879fb30019e8a19fa2e7123
SHA512213ead96d603cb2e756412cbd4f76c2baa1d5a2e139088a25effc793276b092cbbcc2e59baf6aca744d1b3cf30db9d09c15789dd799f6077faa5337d5067a978
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584effecf6b35064079b0b1d79b4e6156
SHA116c67ef11c852370c7ba5cf5c15c1f6653b19899
SHA256ae1f925871d78a60df54fcfe4ce575ac49f56836a52d68c431d1b7092632d521
SHA51237ecfa54d5bf2454815b5558a36732aa7c717cd3227ec5e97b89946892201bc92ce63e646a2ea6b587dd283034f16f8b4559f8d89921dc905b7eed562e73712c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e07a5125629869f4ad6fd8986b1bb88
SHA13055573175a7a10b447713eed9313f56428442c6
SHA256e05710a14cce75e97ad83757d625c019d874e5a485f7e4bb0531a5d1fbbe9589
SHA512c9c78505f511561840fc37d7999172ecfb071ab8b6503358e401528a4470d85535e783026b7735c14f03ae1cc4ab17888d8218bac818e8fb6c33625294eff069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df920f76df296fffffa4e32635bf7918
SHA1eb3ee09b6708fbf8d7e861244177d3fff52b4181
SHA2566f859eef5e1e2575f7f4f8bbefe076cf0f49c8338dcf1360af9227f1402712fa
SHA5129ff86b86bb48be5147f341ac56cb114d0131cc637a41b009903cb246959101fadd5b2e8853e6c4af9f52339d9871eda7f60b8ddc4b24343f7f2817495be5571d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8c0787f25dcea6b4e0d7c6323cb34a9
SHA10c1a0d4fa2f83be0f46d1b413459d33623c71ba1
SHA256e1943ad770b0ff8e481636c24cf378e8b9d6638dbb9af08fbe4754a03f058c23
SHA512f0d1a2593a2f11ad0a9e858b17442c4582d4859f81f3fed6e726c8049b68d95cc944827b1af6e7c15c6e2562e0bb1f5b372ff791454b38b1164173e206e6b177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539291dbae6b166c44dd5c622b6e76854
SHA1d127b648b1fd77950876d73636f76d9e87b07223
SHA256ae490e208120d7a04144d96d54a007f6084b099366b79e9d01137365503239ec
SHA51288a4998758a02e07ba8d9b55b605c5b56408f88bc2977650145223155dfeb372f17d521528a19de6eade5cc4fc151444bae03c38e1a7117f200035601d86a7c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59508fdabe05abf5c705a59990cd578e0
SHA16b25f7fe94b4c8d8b140397fbcb8c456f833f979
SHA2563f004dc83c9b6e29703abe196baac56059fb096e2a8c2963165388bc4ad5dba4
SHA51283326e5eaeded344b679ea26dbc3825227872578b2281b3f3e7663cfd7909c3802cc593b82ddca5dcd9fbfa7b1b04c210f913da004cbc37769d4df398decf78d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb37d4d17d1bd6cbb7240dcad47107a7
SHA19c73ef5e33e44b0fbe888a60c32543339359f5f5
SHA256c151786e0179a207311a34da7776cd0fc6217869bb755f4288d11499399995af
SHA5127c3bcc6c47350f4f03b75a8075e3f06c1eb2d179c3e12061a3513fc350bca1ccf882454a4eaab81a351d4fe9f1615eb626e739d30726122802dbb8adb244ed9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e41073790b64eccc8a6e325f6901486
SHA1ca08ba4c3dcb0508485a3c9c7826a0ce5b636e57
SHA2562ef017dfa4c544b114a0c5180e0e957421b4b114096c7322191de794e9733c43
SHA51204a632c5354c9981eef773ca79131d457ddaaa22e97efd8cdcff3ff9ba8b23efc9f72142c42886317d0be9ccfc3deac836fa35ea760d046df02958b8ef771e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8b95914afd1e633da95ec4d486b9aeb
SHA1aae5900ae0b58d4c4bee6fe0b6b2e73eda6b2a16
SHA256f9cf91500e65ffeb38d2ec9ecf61c090dacc3cc271a935973997e2b0f3445091
SHA512ce2485ff5a112d89ce23ff9d51878937849b04ec86ddc6e92c3c12de4612ddd05b190e8745b877485a33acc3c0061450356aa647b8c96b5df1fcdf297a9f71df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e86ea6d8678fc3088eb8fa3b29e9bf6f
SHA158d41e1fda0ff7df807d1b517e8865f3adbfb74f
SHA25648bc389b020a83a32376294b49c5ad9bfc7dd9cbfc1e1bddecfd3801961cc9e9
SHA5122660a40e3dbe45651e25174e37e3d80c365da05f0a5fca3c4107f0a9eb0e43318403fe970e18aa5865a8dc25d77a72e56609bdae707442d970c5a3176ca4a272
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b