Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
6992b237e711095cea6e6d0584aba299_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6992b237e711095cea6e6d0584aba299_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6992b237e711095cea6e6d0584aba299_JaffaCakes118.html
-
Size
1KB
-
MD5
6992b237e711095cea6e6d0584aba299
-
SHA1
c3ce514dce66f2e9c6aba4966082cfcad23fcee2
-
SHA256
7f7699470d4beb8cdad1352f467aa025185a90aff451abae61dbd703a0da6cd2
-
SHA512
240ea18c05ee2ca699d65f41526139a2b7d4e441556eb812b859361c2c0977da9564c8574aa59531e965685406a1da74b25746021b15d53fd894c5c3ef577420
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d9fac960ddda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000820b9f6bcc2ae260b93b3fbadbefff4295f424cea23de667160fc831b57dde51000000000e80000000020000200000008f64e6465862cbd3a2ec914d3a54181d7334a5fc9c1ba7cded7c70c52b8aef059000000036340b5b236526fe9496c0205e115de86f1c740ca6e890a4cc0a4347752c88a6577285cf6010437840f4a0ca5640853396875730f44d6cea60aab97275f51fd496c52a15a225abeb37a777eb67c122459baaac8ef9016e5e916e5a9eed0600e7af30e019281eeafd1b46861566261291097c7f5719b30b5873e891a132f838277a740f00a60b9e01f7d54e37caf34aa740000000a81c6d48e6dc30c0b62d9c5ba3d7e6a28ed0a90a524216bf5a77460c7362415628549c30a02da26dde3a7fa65734a578c329e0dc5c64b7752b4e5b749304f5bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0D74E11-4953-11EF-AC6D-CE9644F3BBBD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b578b050796d3e28e9733f58ad5feba497bdaca3cb82e396c7261cbb1c3f8bc7000000000e80000000020000200000004063fe2e044c952454d4a9fe3419892d0f4af523622270e15d1ce7676d259a0f200000005f3df5da94d034dbe7ae884b0ccb7dd58b2273f9b4e69a9aa5768fddfe84ca79400000009a32c24f2ff9c9b0a6f2b1c68d0d1d50b862a8dcb75f2a054e8031b95d8be52cd80359cda7b9719bcce0841e23d9a9bc784238c444cf3f3284af3f5780848902 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427942905" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2500 iexplore.exe 2500 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6992b237e711095cea6e6d0584aba299_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512bbdf34812fa0f840e5cc1fa854576d
SHA110bff996e52867e0f4695df4638dd3263a8eeeb8
SHA256c0eb64256d018f0251992bf29ed05fce2343645322943909ee0a51a9a4cf0268
SHA512c8bd58d414e4d6d78662cfece3ed625fd1cb4c57e835dbb1fd1715e59474495d6dca43cbb88a6c072b224fa3b9e0c8b4603c9fba7f1d75614b96359f25767c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dd3a4ed022eb61b80788443b8e04114
SHA169be4de44e55e7cf3a4c9c0728d94eb3d6f119d8
SHA256d4b42c27ccc29428cc7090d32671ea024fce12ca68397f2ec071f3cab802e73b
SHA51217dfe2f8914ee43c0f3b19d6aa74a7451c32769f4d331e752785112fe0da200415ceba872f451ab0df16b4fbced35c2c97e2f3803a0d2555911185c813ffae3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58014075e8e39fca3231401b48ada3f33
SHA12672f6971d85fec3a4948b7733bedc72bd1ebc69
SHA25697c0c29a0b32726d6536719f02bed17fd44c6a26426c4c6643ec0207ae91921c
SHA512bb7fbc4e73291d7ca56d2a9cbdbfbe0f597780236e8420fec646a928605e318c7b509ce0500a7bfb58cbc19d31c2b9e845c8f517725d116796b3681502c1d23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbe47d19e7ce36542cc4972451abddd8
SHA113b40004acec2404db286cde35bc97fd8a485f43
SHA256134e825d6495b3908b545816d6bf7e4d93a4a1ee7c37d93ca591056894ea650c
SHA51266e92b4bc59557c341009eb18bd31a2f0844b6ec43b1188d49945df4fc165a0ed7068e223da709ba968f0ea05daf612247c22c80e3b4458250177968a5a1bd66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbaed345af12ea1cc74cd841b2d7ffdc
SHA10954a66e025ca3b74e533449e229557741a038d9
SHA256e8da29c6a610996cd5a571842fad0767fcf4c2b677714ac1def381cd1fb2697a
SHA5128e5f4e1ce879648cc08d09c7df3c99b2b322c94180a8b71bf9d5d4ed42235ee95669db405bb25484304ba348271cd017e8f370779771ee64b885b4c5b4f82cb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570e3835e71189257cf75bd773eb4aad5
SHA128b50be418466f885c7406c60e1250aefd780d23
SHA2562051ddf8dfe042c91ae8bed75165fea0cb035bf656a2b62bb652d4fb738c7792
SHA512b2abb601aa88e0d3eb5363bcf046644c411703ca2d54508e150ff4ad9143e38f87903139e74b12c80558df92395808d30d164ce9ea5033237ce65cb9968ef256
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fad09f5e18ad8ea1f2289ff90ccae88b
SHA17884846ded52e35adb34bc7c41cf5d8036e47058
SHA2564cdc0300b83fabe6990f2015175a73ded2948df5dcc9c260618db585cabe8bdb
SHA512a33d2456a02ec9f90c76514743372ab9fe7d965dc842ed703b250b4ce36b1703535a7e5c48248163b24b52e2e33b32981664e0f091b1f1bc1d2fbbab90f3b9e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dbcece100fa76efc5e3c0742f99985b
SHA1ee44e7091b17724f6869f1c7879c60829b53492e
SHA256b6f1c10b59ed794e02002b1d05517bd24185839b0da7177d3dd44bbb64264351
SHA512f2a7a298b540e62633d130712149ae341f8c9e46e004e8b9af84d17d42c11db63f9c07390592fa853177452324723c3c8fbc4580fefa0881901f7b4355396a8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58652ba82857cf9aee5a61b4620769677
SHA1ea0699cf3f56e749e9cd342c960c8f98f452d1cb
SHA2562c07cafae7e57911f087da6769f0be90012f6085bd9199f095a7242478676e3f
SHA512aec271925b932225270cd42d99a5e62803f4e2b77bdfbca3411aab845b22b50011a0f8220e39b61f6dd41b45b063a4e05867b02683b7f0c748e3d518b8e95aa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4324d4b1ffaf471c73287c384591d29
SHA17af139c1d177c71bc861aa6965ae7ed0eeeae9f8
SHA25686375e94312f39a073e3a7d223b647420c8b50309a8913abb5207db0c4be9063
SHA512f6d73314c889a862db9119952595b45e39322d87b1ed75d05b447b795591ab540b359afe26333de6ce1a92a730808234d784f0fd07f9514d525c6ebce6e63e62
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b