Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
70877addc4e25c8052b01f95d65f1f76_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70877addc4e25c8052b01f95d65f1f76_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
70877addc4e25c8052b01f95d65f1f76_JaffaCakes118.html
-
Size
10KB
-
MD5
70877addc4e25c8052b01f95d65f1f76
-
SHA1
5d8c24a3017bdf339dbf15886e28bb3c331e4f68
-
SHA256
7dedbf1f0e2ca39c50d79fa9a3b28b1eca23bc87caddc412f4bcd8f29a6e5500
-
SHA512
e9ee35ab18b4a43f09e41099d98216b56f8ba1b60488627169a181886fbc7367bf6a46cd1f6c2a02749a9b8286d84e40162067ef6233162b87a8d6b511b29e9b
-
SSDEEP
96:uzVs+ux7GJLLY1k9o84d12ef7CSTU/GT/krypR5Yj1GMLUdhP0HmJBlVHcEZ7rur:csz7GJAYS/+MROjCtNBPHb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8058f528b7deda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53E55181-4AAA-11EF-B586-DECC44E0FF92} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000076a20d3b5f6a8d4247654dd9d151dda463cb3ea26c3bfaf711df7bd58b73f9e4000000000e80000000020000200000003c796d067a50ba3da1a01d62fd3cfa0b742a9b9ba586f63511b497fca1e3484f20000000b4eb288d1437c81bae499d52274bd2cbaff410657369d5639ae30598b54edf98400000005f261ab9e06a36b39533ebadbda4be748a65d35f698744bbe70f3f72be8f51e4bcaacd41ea1cec07ed4144cba7940f668f328a8f69542e8e2bcaf5eafb5a4438 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ffc2f02ad11f4deb937eef98be3701ee56fec70045570ca51ab59882bdae67f4000000000e800000000200002000000069d57251c6fb7e4fcc27e7544f1e4ad4a3cfb406eff6d227e0b93a5c2f17ec6e9000000085466dd98fe8406397cd61a982ad6dcc1e869af34dfe8cc266739f199cffcf6c3537bb884c9140fa1973e5d42b9132ca8678291a20a67920322c640d89f998531e40892ed896a46024f43e39ff64425b422b4bcd3f3567a689a1a0feac5faf482bb8eff15cc978c5d1ad6376c95b507a1d00bfeb8f2964cf270a0355405eddb7d12a1dda4de9a5d9db980038709dc07040000000285851ace3d0e788f4a4702e3aea8596d8616feb496cc17bbcefc15870cffe57cb285e55c81ee4ad00b00b7efde5eabc8451ad6fe208669dd73dba398579bd86 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428089956" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2716 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2716 iexplore.exe 2716 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2696 2716 iexplore.exe 30 PID 2716 wrote to memory of 2696 2716 iexplore.exe 30 PID 2716 wrote to memory of 2696 2716 iexplore.exe 30 PID 2716 wrote to memory of 2696 2716 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70877addc4e25c8052b01f95d65f1f76_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563f5e66ef3983d37fb9ff85772d69894
SHA196e30b0beae8057b9e30a4bf938ba93f0ec924c5
SHA256242e9cd1ce2bb02ce53acf709d7589df5777bb77ec0d35e590e53f0461f39df6
SHA512c27e13eaeda7806610d665f2f12070b3687aa7850b68786d01d3623e2cde5c57d3ce01a429ac5a934723c96eeb77eedf4c186fdcf3f417840181486c88780f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dd05f57cbf0443fc5a6cc41bbf09917
SHA1d3ed2d97b18920504cf1676c9d4cdb4828b08c2b
SHA256df5c6a3d2ecbc1fb4a1356829571f2966532bf444c4b5b5bbbb7356a2b0910ad
SHA512f2f5bd73caef565c250d861574dc08387bea6dd98bc65d0a564776fd1062bfdb84ebbaed70204894d9208b24649585148671cccd264b5285cb59253dbd232319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9ac51a932b8924c5a387f71e90c6ecb
SHA147e7677310cf6cdb7c8e8a2c9ae142cd2439e06f
SHA2568230b77cfda1e36a47ed594f3326ad6c0b01befb64482e9cdca85ae6bffb22ba
SHA512c1b772ff120efa39973b1176fe4c4a2e15d0f6bdd7913e5605656786dd1a9ac8e65e5909ac4cbce8e391a3f64294cb80843d6484e94986b9cd71cbc1d1357fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f94558dc8a8162e2c7d3a834797912a4
SHA1b32d7927565bd6a76afcf9734e8243fbd8c19d85
SHA25652e6da62e14f3252f018ef2a522a5cefda8fa08e57d06c85c0a1b48c2fc58bfd
SHA512138eac2bc3d9ca8ecb51143acd08d2fd326cb7ba8490a5a225884628a0606346f921900bd7abdb540e1e63acf07e17116fdd040f2f19615ccac24b40f6d57b62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567dbc5bba5d5b5932db4ff69a917eb2b
SHA1372ed9c139d417d21ab10c259d98e9459efd6ebc
SHA256d5c19aac3ff035f037a34155ded2c63570d74931e3927590e91749bdbab5018b
SHA512fae4aeb5b46b7fb0e57a1dbf217e265be0f80ae91e0e420f2ce482c391f4fac36ee33408bcba5b8e4fd826040a81217c0b1bba799b5aa737a252fa56d376d87f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eb654fa0d1d19bfd1da785a13e38d7a
SHA126b0bdcd55f3244474b343bee69f2288824c1f3b
SHA2563db65069a54c57b6f3521bb5ec3c8229252e2003a16aa11e08ed1264859fe0f8
SHA5122a5ec12c6ff91b0fb169632f5ed486652c9f8514d6592d9005a8aae2e25ceddeef87df979f5f74f8fedcfda92a7e57a9562c9b0a5235a7426cfd62c3c1feb07b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb8f592472cff365695e4c7a2d055fb2
SHA1745a8a371c0380234d00945df0b68549bd6a6a17
SHA256d8456de57ca028d5cbf7377248cdce29af2aef86bd60cf045b8a1b3ca1619bf0
SHA512f5bd0c73c4f7ed2f0ea218d93a77219ea418b6457a89a3734a403be4a47660298c393799ce820e74238bd06f3089987e581ad760f8ff603d37a37955e13085c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590f3a3f5a44698eeaf238f286c983464
SHA10592675faa6492c292e9984b69883fd2642bf5b4
SHA2569f094404b280a8c964340eb52b2201e8f1f8b9361a0b29713092ec29b33b41c0
SHA512ed7ff36f32d6012f834b787ecabd3386e11777b58bb3b393fa20abe649afe860cbc3c2f385a4521765f9723b8c5a2ea8cfc2dacc6d19d38e8e835235e210ead9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5876d52ffb84c48386dcd363203159e01
SHA16e3dfd5fd5005c5915279c938a9721abe31174d9
SHA25610f3bea19a0c6e0aa2baeae6c213c0aea5000e0a09dd7729a7d6167fa6d45c51
SHA5127e4e5f3a70671b279d14eca3aafef3bf3e1301ff0a3a55bdd28268d4f606a6c15c1a7e191e62e8a6915d63c954d4fe2dcce894b7fc0f2d57aaf93502c5b4887f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514dd5963c5aaff17d418ee53b8ef68f7
SHA1004d336559c5f0d455d0786547022afbeaece5b8
SHA256d3663727f33d2eefa8cc5291146203688e0beab721b537127e60f016d4a26f66
SHA512363c09ae2a4f30feba31c83acc2a937ba598b6c4b6932af837381024ffd022fee1e08c7057d6fbf6418e8f9c1359b53fbdae38b11b075da467a9d02e11b7025d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514231043433844ec7dc32a8f80c84d33
SHA1b734f943ab2241e464c5c14ce2b5c93f88678680
SHA2568ce7ea54997fced5755dfd8ce9816424ee8439fa08813394ea2632a6843e4bb2
SHA5120e5f6779f4516de97658c63d125c47a6ade55a1c85ddd517463ef59ef0e06aa4deb0a622ea74ec1e6fc0103403d7de50fe832c0f9efa0ec417a6751d9c7acd6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb739bb2c1a5e55eabeee601cb0f5ed0
SHA13873155a38779d9b5e1a0f7766e94590c69c9208
SHA2562ceceea668f6c4460ccff1dee3efe53a6a9c94258ac2cecccd2507f57795b75d
SHA5121c7cbc1a88a59eea0a27ba11bd0673dd386ddb55fbdf09aa414a880a34bdc0e865ba31a471d947f284a7e6fe164185e18a6a4a6c34843f1dd660ac8c82151d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ef41ef5d6d13120d453a6a3cf297a11
SHA103f0251d3869806775460f94ce91afa9898e4d68
SHA256d012b75d29cdc0f9b4acf0116f14a3425e5bf450134d3aee214747631b6288ec
SHA512f0b6023d3e689d5ddc89bfff42be4198d0a3da1d3d03357f9da729769929e09a4b59da312c9a7d484b10c61765bc0c24c3bfb7f6274445d053f74326490b1e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb5fe7707698bf99f663dd8a4f9d5a61
SHA165c8ff78f2c005a713579125d24c41307f299cca
SHA25649fb71a2fbec5d50c6f588e6ba37aa0c750b8f69fee608ba083081f21218dc8e
SHA5128c094ca15fa1510f2d107965c358b2ab53ad32edcf7fcba979dec6d08cb5b8e167c212f35f8dcd2bf778747ed524b6b7ba956b0e3a2f68dad4be4abb62720c93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f96017d9a1505ff54c316eb9ec5c003f
SHA121ee8e35b646559f9ed08b25cd00b0740246a3d3
SHA2561145c987c7388477fc38ec2a68e4efade3831cc7e8a63ff49393f263d05fa83e
SHA512abdaeb4142b9d36fe9fe21119b6c42dfd5aa461735757d4f6f0e580a17976bd1408962073d6fecc0a39d0441c0c6ac55f7dc1b92ee732c7102b8b8aff4ec847d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5185fcd8a4e1acd04131b2389b55025f9
SHA127a13056a91c106c6d22163e0364eabfc14940e8
SHA2566ee2695a70620abdc93680a22136df7cc0c1479a39d60ad3b4619e10f254b310
SHA512b722c3bcac0768179df7f2bec1aa87da095f4c5a7187fea56e0261e67bf3ce19af575320b67788ff88ba4b05685356920da5362bec8fc1bf0a8e57c46502fe92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509d06be1e7a01cfd5a5a09ada47a7c02
SHA15374df23e82097815368669167ccae7596a876bd
SHA2569b4b10b70eafc226dcf846d38123130e12d96f0fe2d7033a52e14acefbab00d2
SHA5124dcebdf5054ec50e406d6c04f334f6041bef48e8d6665dfcce2e501b5dcea5b0099ddd78f7aa950081cfb09b660f432b60637f32800dd1b2e0b1cf0fd264a61c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b