Analysis
- max time kernel
137s - max time network
143s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
a60e2de5b3840deaf209c43187fa2a3a_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a60e2de5b3840deaf209c43187fa2a3a_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target a60e2de5b3840deaf209c43187fa2a3a_JaffaCakes118.html
- Size 79KB
- Sample240613-ryq2dashle
- SHA256 71ac2c044fa8230540462dd648d5f808678984746827e94213087362e2f867e9
- MD5 a60e2de5b3840deaf209c43187fa2a3a
- SHA1 7b588df8d46266be6a11febc17c0a042140dfe5f
- SHA512 9d29c44f95720f111f22fcccb2a61b0804c7ec69283af9ad27954c36934d92825053d1ddb760534599cc75549a0c40de1b92f19a4b1c1a12e8371c3535274ac6
- SSDEEP 768:Ji7gcMiR3sI2PDDnX0g6sy68MuEcb86AvbAIzXoTyS1wCZkoTyMdtbBnfBgN8/lQ:J3Lc1TzNen0tbrga94hcuNnQC
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d2f9259fbdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424451256" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50EE3071-2992-11EF-8156-CE03E2754020} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000633257a692e59ba725fc090916ebd86003b334256f871922f11983211671dc97000000000e8000000002000020000000fb126eb36baa060742891a391cf60836b268475fad8653c91af057534e8948e5900000002c57dac7dedd37832a4c8ba0962bf39b74369e595331083cc5f32d442a382cdd9c9cda07a2ba9b8cc757d4a04236234180959d3d1cc529232797cab51b85a09304d4f82ae65aa80de7b1171db62dafcd0f9b7e86f5e5e29358dd27031b81ee569b9176c2bfd40fe91b94f22044b8874d55e237fe0732704060e553b128a871b3eff809781f1efe35eef53b94f585df6240000000db58c5da3cc58a89842dee48f9bcbf2815b9908e241f91b17bda71631f1a3892907dde0469cd6b1e035eb987aca83ad06888168d25b982699ba2e3e3bd8ddbc6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e35f4390de5d329ca0df0f6bd7b1e1899aee0501af664310b42ce44f3c435692000000000e8000000002000020000000b185e0145f2b17f9e26d25ab9d7a9d03a948016b1fc501208c6a1d6d228e450920000000d354c694ebb44960d7054812a677e6c007513d77fd70ac96b02bedf51f35b0f6400000002a91aff0c310181ad14dca1cfcabe396e651505052f5bab87b7f0a57836f1adedee09a958786592166774f525ee3b571c579cdc6545783b87333aa6ee715ace1 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2384 2236 iexplore.exe 28 PID 2236 wrote to memory of 2384 2236 iexplore.exe 28 PID 2236 wrote to memory of 2384 2236 iexplore.exe 28 PID 2236 wrote to memory of 2384 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a60e2de5b3840deaf209c43187fa2a3a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a2ecc74a6187fcf69afcfc16dcb4c867b024c9c8b06ef69f1f2531be96017618
- MD5 f9d915a96ada60dd1b8ee6aec2d95da4
- SHA1 78df4a04dd0ec40c124075c6fdab071c1b1fdba7
- SHA512 388dd220a0323e8bbfe4bf9ba138c27699082eeb62d7964cb219a4e53f78e629695b8891e1e9e517a8a7ec5986505964e3b20c9f98a069acc90efc135540617a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 21956f60a7652f6d0e9b7cbd4c51f9eab740d7c9b869693f7df46cc62c70488d
- MD5 ace04ee338c78ae37cfbd0f659a85cfa
- SHA1 6cf06640198ef76ebe515a5443dc320956fbd833
- SHA512 ca01d415334ae0728c54cbe2f8cb8678284481c8501970a34fa5e1240b610e2c2dded9729e00918c8aa92cd071e5ea408b4167b9544d2b82cf5acdffc7da24ba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4694e536d8940e10ee561621922c2bbeea46aae73282b27f8368239b82fb145e
- MD5 5a2031f79555c808e6152ca06d9ce00d
- SHA1 bd29563e7367fa6376252ad12e9deec95624d40c
- SHA512 7a6473d7b43bd6e674cf6e75f7d19309fd618a03c747f180c03bc72eea61431bc1e3cb2644af11fc8e32fdf0dc06bfc8d1df16078606c2c2c767fd7fe89c9a74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 4b8e92181105eff7f6e37901bdeb3e25c63910c4a8525f778f95f6a9a6cf128f
- MD5 f43753253aec8d461a4b957c657a0901
- SHA1 29ed83c54401eb9f574845132d84383bbd455fa7
- SHA512 f98726e87da7f4d994d131abce5777f136430668b26fb250cfca05a99d0b982fa7b071334fad046a84639199a96bad9760ef3ff8b7e6b3a0fdb74fcbf8a3e0e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 77a1deed3a556709414efc4f16c2f77a3192bccaafcc9bf21cc7410fe9735132
- MD5 c0ae7254a6bea5d5031db0bddc8690ff
- SHA1 0a7c4dfd240ea70a3407dd5baa1cfeab1ac1c1ec
- SHA512 2670e5e6bead28941fd17a0ada4b04225db10e4af8ef2b56a97a78c39182ac0ff32b3e511e425af33e5e090000539ed6bb23f43ae4c8ea1eb077a827d28a1485
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 86888fc3292ad55c328522a915db88869a817d2fe4c251c5d014b7b4c8dcf31f
- MD5 fd5cf125f74bf026ac1626949f38114b
- SHA1 dca21e0e38f33561084e3dbd2e85551758b42dcb
- SHA512 597d0a453be40fb3fc439fd94112cd267b2d2af13c1703293e52385b9fcc0c6ca975fa89babf4de4dd1e01dbe2fcc4c53f48c0048fad5ceee065e6583f06b713
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a7435878018598a78bfbc38cdee1178712483ab8c2a01e0dd41b4924173de5d2
- MD5 4a0f11f7e3bd464dab891d8a9f235e6a
- SHA1 2edbd3725bf6f89782212df5bf43b59895a6e2cd
- SHA512 b93a82fad4645ead8f1142ff5e582e5892c27106afa9578ec05be5d59c35bde94cc5a35b5adde7ad7c423b90de13acf45a5dfe24ee4a93f4bd0f00a69143f8f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a5fe064b319dd35b1ae9104e5345123cd1ae6a23e3a385b08ae742036ef62d7c
- MD5 ae97add526d635c96c288fc70f8a0754
- SHA1 8d31a0da641c9e6d30d786a53146e9692f2b590f
- SHA512 63efe91745f3f79167243ce160d1489697ae51199e2e42003de29bd163bda3e0dce64472ede3715308f55ab578445f575b0d0a9ad3f2b6d1a49dc8d8c1ba7281
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 310a36fb4bf0a0bdb947c5ba34f07845a69f4a94e08380810350f2555a74a6e2
- MD5 2cdc9f7a39005ef35b98b95c7cc48b10
- SHA1 b0d74157d0b6405b7cad0fd0f018a5c8023e1723
- SHA512 defd5e3140545c681360e73891bd3aa8861b5b6110f20a74abe099225a31a8f48e8ffdc8e8c8026579e1201aae67977c3a8c0f78d5702901e9ac5582fbf4bf5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b92bd516a6d9f0b0ee47e0011baecfa73116c78719476e43f576d09b1dc03591
- MD5 f952ae23ac2a16d49c08689630b33506
- SHA1 5dbee59eb6c50f3c02e62b329ad75b1b7c18aacf
- SHA512 fd2a18eeec8b91b86df46cce81464622657158f62e905bbd5d96b5990cb66f705966eee472f326a37969c2aa6875b72211840208dd5df5c078e2aae5d675d689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3dda52e8fc63dfa162bbd0a68077a60476dba36a66363815403524cc093bada3
- MD5 91cad010f64d96e7572f98462f194daa
- SHA1 3ea8d188054ab040c9aa224357595d712f90fd23
- SHA512 0eca6908e1fb2d1a495bfb9293f5ec041b37589c3579a59611a38be718fe6b512e02388e0471b895030056738ce0ab46d2c5ff9c3066fedfe779765815e8527e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 70df8a70887566bc14b1451045e5a53dc5b366535511bd0888c4e5b39f8ddb10
- MD5 f1991c76f917ebcda68c449ae0c0d41b
- SHA1 aa8e5decf641d7a302dd552e7152735424797e9c
- SHA512 5fedc676f19190b0f63180cf0ef144a4db14ded648f95a49bbd5f7b90bed86d472ac23c74d68b94161b4934a9e5f85edbc3cd2c4ab0d4425dcec9b2292272c1f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 76465d2d97f1c29719ba7f9a940fd1a46b58414bd829073b75423a43af09255f
- MD5 38b50946f7b50daf5f73b0f1f5530093
- SHA1 53e2bef5cd6ea98f566ec63e49f931b795990316
- SHA512 0814a28b7c046a2da4d42bd89a9dcb979974c112978bf8991da4621141238054825ce7cc9f644f89c9ed04362360e54fa4fb38069b35c5b32685d09605a09050
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 3d30779311587a0cf2e84d3f976e7ec40825598c5e9e6bbc6b98abb5dc2b7f52
- MD5 fe7d34d3c1afbbecbea780da19695f98
- SHA1 9ecc08558e39ad83a7537bbf671bce33a8b36d0b
- SHA512 aba72891930210b649163cf1d734a01683921b80824d492cafc8af266336628e5488690545e02ff505371029d73445bf60d20c4a892a510f8b9738ff752ee475
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e74f38fef64832840c51fd9828fd11340949305a32b4cf46ffeedb49b98fd23f
- MD5 f4955bdc6ac40a29cdd601f2317dd165
- SHA1 94454374228f6bab655da98e07a49ff33c5811b0
- SHA512 9f0be58aa2633b1d5470620771b3ce286b3daede21fa8ad793cfd0fd56bcac51fc62d5ebfb6834c77c2a646d154d88904d11339529d24024bd65003bc6ddb511
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 6e7be8ac56f3db921dfd78547496892b6fa0070e6b624d43a440b96e64a07bd9
- MD5 fe0a519eeac96da4d205e1b45a855355
- SHA1 52d392290e03c0d908338ff96bfd8f4af9396e50
- SHA512 dce4875e31bfe1d566f3b29cf0f139dc8d69c8230fe372efd8ca706aee678a52149eaeaef6634860c26a0353e4df9b7cfb5adf365d5063db5ff2793778565586
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabB127.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarB1C8.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP