Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html
-
Size
28KB
-
MD5
74455cf8ec3f9731c31bf7da77c55720
-
SHA1
21627c64feef93c40185f1ba4e7e3bb68ea1e15e
-
SHA256
2b8586eeb2cfa577b1bdf772809e5f9ccb569f75a71d13cac959b878e92d4089
-
SHA512
c9db9cd68eaa3e473d835427ebb494dfa58945365ccb6c10b4a5056ffdf0e8b1aa728e89e72024f7a7d7baf9206c0eb50a3f6ca31b4ba8b9114d4f0ee28b4b17
-
SSDEEP
192:uwD8b5n6lMunQjxn5Q/snQieHNnnnQOkEntEenQTbnNnQ9e/Tm63fbK0JQl7MBnb:iQ/7a1vbKRSb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EDBD351-4B5F-11EF-AC6D-CE9644F3BBBD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428167606" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2500 iexplore.exe 2500 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30 PID 2500 wrote to memory of 2392 2500 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5356aa00f59704f7a0f04014abecf6ab7
SHA12646a3d7bf93b3238780ff4fab06f02e823c7e05
SHA25688692f740ad1e1d0bf0a2df8c2ef73ae50c152cf171fc4e09e63e4b6811d9be2
SHA512c4628aa4ca31c2e19e2b2f10d7c5823513875883376de6852fbe77fca7d0575ed66b744db85766901412025e6aa90d38e715fbf858dbd68292f296632616a637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d88465f0c0f10e79044ba55fa7a2a2a6
SHA19426f6807cb9c7bbcc6dac7fdff7ec8f5290ef8a
SHA2565c5331329299e883e41df81d17296ac2c37ae15ec885ea3705cf62f0f9ef388c
SHA512721b98be61d128baa89b8235b08d3dc628050f2aba25bbf1a4a586ad79fc7ad084824419c6306d284aae3c8f1955fb81fad478481d909e08cc51f2f4fcb82d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e1afc4d2dd5b7b60b61a1f31a7fde90
SHA11a32bc182d80018b6ec5a691807d81ce2abe91e9
SHA2566ba600308d27c1c515b2a534470c40045e2ba9375c31d5a12e6095aee8dc7888
SHA51236dde9ecb76efd8faec58d05f868305f5ccf954642fa2ec6e18597c31a4f6b218306e4ffb53591c311351210da3a3c0c42520b71b095231a07f481f0a4b1c637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f654353b320894777bde20dcd58cd7e
SHA1a6ea90b01c83363c8995ebbc3a3c314d66bd9a81
SHA256c0c29d592f0a236ad9f4ba749d737acd70fb62fff5cdc23440dded22706c1f1e
SHA5128f6a92bff0be62bcb6eb1f2c8ca2b3a136ac9831e9c3a6cc351655429062c468befb471c8a4088ee30b7ad663b588d6e70817b6961e84c0b790a1a96026497c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e529a8701eceb2f74461c594efc4016
SHA1512963d3177ae086d7b8719afd41b0788ee5683e
SHA256e68dab7bd7a4b7468277ca0bbadd958e0e2a1558c88781e999cb9e318c3e33ee
SHA512e9449d80bccc709e9aec32aef6fd08541e642a14dbe3041925eafccf3074f7b2ca4c88e41f41d86787048e5af89c4ef77452d2fcd504087f9abe54f54680d8d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1c768c8f8fa91d5b15f666dfcac2d85
SHA18b374116ec33130931c6e3996ca049a4fe09ed16
SHA256a3da147b8b0333f7c9f1db124d7109827435b5c2cdd25ac6d69848ca145ccc7d
SHA512e2418a77d4e5b0ff7f37311697c1e1a1f3739663074d9b822a2b2d22d42c08f77645e3e15e5bd578389ed423288ec7287d9642ac5d9eb7244da3f047b382cbc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554f220a677ba2708016643ba73c75518
SHA191b32212840a2dfb076d2f286aa1ddacf920acce
SHA256a4f21b13c03078244594621280cbd5b60f4e4fa5fb409d5f8d874a5b0df5a42f
SHA5120d2d565ae696fa6d98db548bac189ecb4b36506ea0f69b6886907b5b2a4bd384c99908f1afe2890233404fc8c414b580b00e9b7d3b83019b339f76e99096d16e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9d307026beff3ce700b04046429adec
SHA1bbf1f0e48c25484b736c878054e069fececa75b9
SHA2563602abf8a926657af40b0f04db7265be239b069b8556f7d941e1f8e26a31c919
SHA512cca1ffc99fe91a036f180f7807d74113f83b06cc661761c3a7e0745ac6e14ce7401d6b24889234582e18b0a15842349cdf9e889360d3ffdfc6c8ca42aca6eb8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563a3f0508d3b98c69a580af22cd0cea6
SHA1f52e724a916aaf18643695bf517f1a2698f8597e
SHA256c6fd124e2b4b681d71f136da09eb52e15d1f8fc0a6421efb181e58b440af5cb1
SHA5129c46c64e4234949090d97aad2e9581a7a97131be9419f4d92d63fd6cacc576930ea8f0c42d071136bd12b7a3c5acfd7ad16cdf7038353da1176ed36124fc37a9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b