Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
75c7d85915230763d20108c5b3ff6906_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
75c7d85915230763d20108c5b3ff6906_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
75c7d85915230763d20108c5b3ff6906_JaffaCakes118.html
-
Size
9KB
-
MD5
75c7d85915230763d20108c5b3ff6906
-
SHA1
04361360986a3817baba35d6927af46f79b7968c
-
SHA256
9374f4099a644c5873f96cfe80fcea3b2fa6bb354451ca3364eeed0e4ec319d5
-
SHA512
2a3ab96f4e981ce6c343c8e8f53cf5df0f77a41743e5267788d4aa835cab6c501a90481b8dff9a9cf5becbcb1c9ba41822059bc9cea51f2593d0ac093951d791
-
SSDEEP
192:SILnCPEZZdzosaQfqbpB/Vyqj/EPi80Tx6H5cvnk4GZzW6b2HC:SILnCPEZZdzo+Yk709w5wkHWy
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E5E06F1-4BF9-11EF-9CBD-4625F4E6DDF6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009697276b471379721a2619d6b6a400151c9fa8933cf0f61309650157b314a7c6000000000e800000000200002000000055fde0c5e2ea9756c6df1510fb60cc8706065179875b0c705208d8c7d3b4559090000000f03ec3cce9dad596703d924ce7dd07db146aff4c1da2cb47ecfd100961f0eed20cb807e97ae05c2c928302f65f15c14e789acb62ccf41622740fe50984fa6e534e3ebf2d8efd6e5e211a0fe00354e4896300b5e96491cb593feb6eab28e0bf1453642955cb58f818d00904051194692270b1090ace0949e44a07d36858189e64f5a3d511cc644f1e87334bab180ed81a40000000cfa19e50e19c79fd5452987648b01551322ca92d8d7691632e61e933a57ffec8e4f20780ba29afbb0e4da3b5bf3f82d33f64e09f776c637f7804e42f2e6af6d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428233909" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e48f5506e0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008a4b5242969b87c243edb9f94db043a5d8225d6edb9cd376384f67750bd3f397000000000e8000000002000020000000f54148ad4ca5c0c82ab29a54ed4894ef20c246b7b4c91902c647c73e1120bb1420000000b1db5ef571d1d3f3f2bd68fac5c6af4a019856a7513046c0effb5d32805577a7400000003070c9364d9a127e54269417e12ea7c62bfdcc4d78a7bef919ac10824d5d5a94110a88ebaf0cee869194c0acb16a99b55a1c1d0239268adf183fcbc88e4520e2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2712 iexplore.exe 2712 iexplore.exe 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE 1412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2712 wrote to memory of 1412 2712 iexplore.exe 30 PID 2712 wrote to memory of 1412 2712 iexplore.exe 30 PID 2712 wrote to memory of 1412 2712 iexplore.exe 30 PID 2712 wrote to memory of 1412 2712 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75c7d85915230763d20108c5b3ff6906_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c258a90a27620ffc6f96d8eec540272
SHA1229ea54096a0cbb203d1c9a2df8cd5c59958a847
SHA25648dd10131dc18bf192154a50726fade13d65fea4e561c512ef601cfe77e7297c
SHA512ebcd770e4aef75546730329c03de52a65e5210338c1762cd01620fa5565d8c0d8c70581d015178feac79572a9f871c0d8757b755a7bbf729b760421dc7b3fba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1fdedc0fc6dac2ce116fcff16fd4ed2
SHA17de6ba8c43dc85237193fce4bcc6afaebd0daceb
SHA256fdbe13909d40b3572a13e120568fdd2b732b4596bde87a3272dfdda8645b9366
SHA51212afe56c9bf366a1dd04406bc59c7168c2cd68756b2a0e3abee6735ab2e8af21e5fae86932cf7d8775207ad6ec26305d568d29eaca0ff12f2954ce0825823d82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bea578e6a01c5f31b4025d16f34993cc
SHA18c4d21555b35f8ac291874b63b78d4304af15a20
SHA2561b03cd0280ec73b42db01887c3ce74c011bd8331be5a262f8c6d4fe37213043e
SHA5129530d3472cb045083f3d9347269745408765ede6559583597964a55ce24258be6d14545710bd325a37ba68a8cbbda229dfc29c611ba125768eb5209d0241d37c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c051ad53e45d40b906f251c7ea12dd90
SHA18400f0453168ddbaaf4005f6b049fbf99d6b63ec
SHA2568ed5449def8b54ab855512f91f51f479b46d5a7f85f5786d498c52d8c8858d56
SHA512aaa6428d744484ba7bd441bf6bf03ae62fd3bffefd9013612578202ec72c28d861b59b9334f98c95ccc6cdb6e2fe4458f666453800dc69f97efec91950a687e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b49580a5a11e41431f29cde257a3f24
SHA15cb03ad89472085a5a29066803a31c2f762886ce
SHA2565f75aaabcb49c7ea620566dcd0d73b70e3748f7b2341c647a3bb36250c9734ff
SHA51239b0f62a1ca0ef1e3d1438f0832cb7c66008ecf6bd5d6d630ba4c5add9299a70d5da19d4f9276ba92314da71385c7f1b6763c058a3dd751e845a1ec90b768f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c3cfe19f49cf0af35a71a83b36dd60c
SHA1e8066b15e9aed5dd2fbd908f671a028b1580a361
SHA25608f7815e146e98d9db7b350fca7aada09b3736692086bba20d70119130d2e8fa
SHA512d265491d8b7ace0861fca2036df384882b850f61df6496a8ef1bbf56dda94df06f43850d645fae941e42bf12775e6ec45adacb02876359eaeed1fc24d1c4fd0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a43992edf0286c7d3b4b0985264291e
SHA1c8e6c8b02b1eb03d938f3327f9f04a66a5acc83d
SHA256fd3434eb1fd94d890df82d255af0e07ebf46a8437bfc87eb0cef79198d61db48
SHA512c8edf5d0ee5c5fc326bc38a463aedd4692cf52860b5f9fab31974c0c94ee5e99a06c04bb25d30fa27c1ad0f1d396642573ade0a8f62844a3ffccd636c4b91422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a83f75a89599b9c975d4d40d5a19cc0
SHA167ee97a01da808bf06b3be6337c4007271a7b031
SHA2569ab23491c667d893de43e138615c200d55a1ad489068ffcc6ca9ab808e8861e7
SHA512c5e757afeb04f9fa7862ac9ce4116263c35102b091d3d3d769560f227b7f28adc96e9248f754840c3f5895adef76d872c420f8ad5a214383bef73b6e1adf9dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a9739b56652bcdbd1687fc75fb9ef92
SHA196106746e3e69d88e13d4c77af3aff5c048ba34a
SHA25680ac50d66711a99ae30315481b592393b966d2345c0c8eb305e3f937f0d2a23d
SHA512119777c05a90b73f6999a032d85e5ca170f4274509e73fe8aa010924b337838b3fea485a4c5f1359b82fa58351b8eaf32df503bb167ec4efff32da785e231699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5101c7d939cb4385d150bc02e2287c088
SHA11027089706b364dd580e23b52221d55afabe5b98
SHA256ac2a93eed753d3231dcf115874ae0cf4ff6697013f85eb64981c6934ab1df9c9
SHA5125222d59c9d94fc150d11f46c86087c7149f72aead28907eb7541b41ce265210a14cbce98d3470983b5a8ddd50757bb5c3b26dd3e162946e402960b1008c599f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf594493094f7b926e232b5520e165f1
SHA1a1ac76ea313190457cbae8d9a62c5a521381e17d
SHA256e7a0659f58bd7c15b155367e4d125d8bb94db86417d4b339d842d5a9c93abe87
SHA512492a325bf890d2580325539391d9ec6a5441e13018f80b7d1ba531e0dffa5a18d42f079d486714bf3d3ad50887fb44c33ac4561dfbf414d2c58a186157b20487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5869ab1aa18e8ac69b3e9a9874527bf
SHA1a677dd1d62f127e14aee9d4a1c3248e81c8f6791
SHA25648a07f13e88f9ded2e5efbb3442ceb655cbaeb97adae54839ed54af953678c0e
SHA5129041aa5584048f3110e0b4865d5a350b8f83b9ea1aaf5ffb65507d373a6b399c56f74fe1316ca8957f39ee3ef8def7a11bfd2598d9a2b49211fe5bf64cd9a229
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd7f7bc8899e8e84aeedba6395197c6c
SHA13316c32d1211bd17107cd4956585e179ec5be4f1
SHA25660523ad89d2c3f3972f5defe01bc32387b343d310b321c0cea9276d36a15f726
SHA512a1fa59f654b170090c1bc5251a409878af26317e1e381f8c8838068e745044a1bd2c016cb952ce91a04de8c887862701b2b8ecabc3ae1b01a8d1d1976211042e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5505370a6303336d2785f1cd718d2a8b7
SHA1e05b80f9df82feda56867b4990e81f2b948e6689
SHA25661934cc9045e36c2efd4c74a99c536a5cad2fb03d4c96429b3829ca9e4753fa7
SHA5124e5ab51e3e735b6d40526b4a85df69d0dc424928aa2d8b79cf5133cceddbd0867175bbd8012a64bb3eeeb2042638e7164b2fa742ef0f4c9ffb0f60a52ed626de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510149c217e5e4acdd0638c07dbff6aff
SHA188bc94679b9a4e3a288793a968daa75bfa42712a
SHA256c5ea51ab4e7a02455cc1d232e5dba699f692e1cd8b05791f3c2d1e276e27ec87
SHA512cfb389d67f56faa2a6d7ed797066e9b7dd3fd8f22285e711cc483e2bd92cb9af424766f23cb9629c6e1510839e29dca27b12d374fbd6af8274111ce11456c97c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54140069696a2a032f9d124ac76e11f1e
SHA156ecef4b01d13ce6597797ec6083cc67f9882e43
SHA2561ab0927a90735110b1c3fc82bd9293d64dd9ab7f9575fbf6dc7c42ca98895469
SHA51260f26245bd81554738cc8962e3654ac6fc34f5d600420df2ae14db47f0d12f9d400a5305b7b691566b0e21aeada481ddb520714268ed234f1d56eac2f0f86575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574ffa584a0a63989264cfd36cb51e5fd
SHA180e2e888cff6938171e6fcc06894f9eb29d784b8
SHA2568866668ca7090e7cce5424517b404e36ed3c6028905598906186c38ed3c9ca9f
SHA512850b673d485abf56dd1b6ff5b4c8fe144e6a0fe1ad8a9f7a23f237499da1be4664a2cdf140836b4822fb8102bc11db58f516ba9a4370e786fb6cc47b844fbcb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb35c1a3bf81be131cf5a8b7ef960ce1
SHA1c91b53a265914f897e1c944d3756679d7c2bb064
SHA256ee3217b9c4987b362b8c348b50e9e790a2c9084337826a6d768681adbafd87f5
SHA512b6b65766afad58e0235cd38a4e650a188bd5123b0bce5518a86aa9a7273ea1415fe5bf89fdc8bac676450c05282e152699acfa93485853b747c6360764e3f137
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b