Analysis
-
max time kernel
5s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
03e729a50c66be08b6274ba22fea4f9f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
03e729a50c66be08b6274ba22fea4f9f_JaffaCakes118.html
Resource
win10v2004-20240729-en
General
-
Target
03e729a50c66be08b6274ba22fea4f9f_JaffaCakes118.html
-
Size
90KB
-
MD5
03e729a50c66be08b6274ba22fea4f9f
-
SHA1
1f230509c33d19fc0de9d34c7a2c725db38a227a
-
SHA256
7e582b3ca3bd53bb2fa9fb966ea197fef98ff0215cd5f9760798191fb1c5ca1c
-
SHA512
41bbf15d4acb5e7ee491066c376d3b20e5e157ab6efd6f54d9094751585e1e31eb66be1e3707d043caefae4b18bb1a3714ae127b0ecf21f565ad77a84fb4b947
-
SSDEEP
1536:MnFpBWRW1p/o9v8zAxWzXxfUHCiImowlMASLefB1U6gopyetHsKqCOt4TykB9rbr:MnFpBWRV8cxSXLmowlMAS6fB1U6gopyi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27A84891-4E7C-11EF-8D34-5A77BF4D32F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2824 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2824 iexplore.exe 2824 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2716 2824 iexplore.exe 30 PID 2824 wrote to memory of 2716 2824 iexplore.exe 30 PID 2824 wrote to memory of 2716 2824 iexplore.exe 30 PID 2824 wrote to memory of 2716 2824 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03e729a50c66be08b6274ba22fea4f9f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5211af25cb125e7036de3e2e41384675c
SHA1e7bd6926b7685076f4b515c5aeba59960c0f5d9a
SHA25693fe3a467f5a28f54467c1fc29117718b04795092fb26ea4611409cdfb2176ed
SHA5123c35eef2137a720da7c0ab74fb43a9797eef8a6cac412eb441144dee895d62f18bfcc3a700fe6a4814a8f575890c551e294d49108cac11944197c5fd1f01700e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_139940C9B5DB989CC3655EB2326736AC
Filesize472B
MD52d2f8b94da7f01d75d4f9bf36c11c90e
SHA174abd5554a9b3e080a4b5ed588659d89c4bdc64b
SHA256ec82e9e4503275804aa9733a7f124d161917b3c40f49f1df85a11c7ed5a0be35
SHA512dfe2c7e8e0a1050bc912a0fc5397fef9093bb259fa19b01cffe922127a166bd9081af4d72a7c9921bb10bf9ace2391ce8aa95fd870d1b2d09aa1b0caf30660d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3956a82862028aa6e03c6bead448157
SHA13525a81e281c71aacffdda8ca840e93b533e6733
SHA256a838ff9740278e328a5e56ace3b512eb4b8746fa6f7968df89398ccbfcfd45ab
SHA512864ace9ebb185949f140d3f72232abbf2f47a3cc2a175c0119c821364f8a9045d296328ec3e21fa0419ae37cc1e3762dd3f889d7d69b617dff017e541241170e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e881f47115a142b779a238d95b3396d
SHA1885483a730c10b104065aff3dad15a83556c1016
SHA256e0ff5f424422b8146f2a028b7b63d70f6e2ca690870833efd2af60997b85290f
SHA512c94d4cf1e0fd804149fcb034b2f89a0c6af14dbed8ebf16ffe933238b159bcf02793afb9cd269aa8980aa4c9e21d97477bc6a5a07ee5eae6b4953afc3d57b34e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c482d2761192833f1c0428e0dc5bcfac
SHA141f6687dd00cf9a000403f91e825966164b9fdf0
SHA2569c623340d81d4772f0f018862c8130e22ee165f71452723918b3bc479c9041e7
SHA5123405684df663243d2b6d2427a7a18d9cc20e3b45299dfef3aa0b6d153ec5a12c191cff51d26bd02617d1fd4b91aba28cd87ca8fb75511d27e759acff58bab692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7779999dc3b44c1c64a49eef8ceb4b
SHA1e83bcd611550db76d93c815299706cf652e0e0a8
SHA256b35a12af8c7e24c8264920afce9635eb730a8997990b43071807b98fe2f15abf
SHA512f1ee788ea25438d8fc47733acf0dab9ce57653b23d4e9c2f23d066a5456b4cb0f066bca58e08f847d25ac98897aa90520dbd303f78453091ce7fdf4fed34e85b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508334899bb575312e53c10daed63abd3
SHA197c685234e050b328e6336c812e160f1c504888d
SHA25654647718594001d24d7becd6ee23170dff27c74d1da9fe3908570b019e7f5492
SHA512b7f0c99ac754d529b84d6cb70702ec38eae0c80127bcb37da720edc47e9cc64cb4292760fc5630ba80f6e81cd0b3c08a9c26ebcac1c0f777c22c031a0e6d5039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee86d53decb16fbed330062578def06b
SHA1e8e55cf4eb3b9fc92d254dd33114c2b58993e39a
SHA25695c12ee0265cdee6e1e83f65ce7615fe04ee4c97182e4b369d4f0a2d1dcbab77
SHA5125aedffca86a3af15c6f331db8dd9e09b5104d5f297d59636bc1fd4c4d4c4a999b3b7340737a5fbb791173a1539c8b05dc3aca9c6c2e53d6f869e4783e4fb4595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2a84e74cdaacaf6702ba24d2f6579d1
SHA19fd749d692ac58d92ba7cedda960525d10e58c51
SHA256b5f801b5c425c879266f0dc5b7d8f8304ad7e8b67204727e3d2ec49c745c1825
SHA512504c9a1fc6d77d30fddcceed8f61926b56fc935755dc3ffe99abcfc08541bdb0e489256206c821001872c7aae532c2af4a8580067e70951fd4a504e04a850b59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52be2f57339211e17715b595058e28635
SHA12ca4e6f123d9f6635e4e8c8d29df9e3dcf2319a1
SHA25696ca30800b5aedd148a5929ba486768c786246c888b59d45dfdf45a5128b7274
SHA5121651c9816cffca378e44f36efbee9e7ee8b67b5a4ff4c92977f9c19bc4e722bc584703329f4ac906349779fea46ff8df772d8a7d98d0ffd0d72351b157d1d9ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e8d5892f662da4caf9b2f4df9b54f09
SHA12f1b8ab09c40887a00941df137991e2b834ec5cc
SHA256a9e401e89006983f42aaff6d63858cc79969d50da43879090a41499c8a62203f
SHA51288b147824b1c1f8c734093c41a7163937191c4e28b677ebb8dba1f1dc30d69ebe8bad20006928a81876f806f25d89c43544acaa7b331599a46b889e22b989c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f70eb3fdbb8aa37f94490a5927d90a5
SHA1935463bc379a30eb48a50cf4d9754175b63c676d
SHA2565876e0c3e92409f36dcc41f98501e58b5d24da37c52cdd91eb8784d3892217ba
SHA512e481295c289a5f1025b8788751c5ea4ca491ae1dd36ecddd582f1b66756343abfeede526959ef6c7e2e00816877bbed2fe344e45179a6fc1c268c07e39517af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2d66f0d407b885ac8b4576123c9bcca
SHA11218e7703d79ca0872a126842da28629e2e2e38a
SHA256e4e2b735776c40e73b7333a65bc579e8fe2e2f6f4981c9f7ed68448882dd154f
SHA512d0de6d843785040cb0c1c3f7ca60a5f4dc3101fbe76976466ddd02abf00629ef24dfe0e49564ebc4913cee759b723ca1ec69ab38f7134b3393d2e3dbc9b336ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573aca199893572fb94b4b4da6a4dd810
SHA17ead2d27db7f80cddbac7468f8cd46ffed0ed7ff
SHA256c3db9900a4bbece717089a8ca53bd7311122fc2992b81912423f38be03f8d5c0
SHA5127f41f52226900024ededcfacc9e2135cbe8b21abe044ad3e63813bf83175d92a72c08c436f1f5b24a9a6158817d6a6f0cb2d6d263c39d56154cfe2d86dd1d4aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584470fcf6113a095f0ee9da0e7b3d72f
SHA133539b4b4ecbf314fc9b3e67f2b4a1fcace650dd
SHA256a27624ce496e4fb878e6d8c926da5b3c008eb5ba7dd5e0f9a746872a9c22abcb
SHA512f41eb78099fb29e3781fe2737fe699480cd430a7f2f1446201f1fdc231e16ea496c65ee4121d357adcba5171f585b1cda4f367ad0fd956c56ab1f001722c7d65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5768061b17d47ed038c6b17c4fb3c63b4
SHA19769f8285f60733e681dec8a32838a3eb191bd90
SHA2566a067ed19908ee076f183b9e73407713b29309b37c113aea5d09cdc124c20b20
SHA512859ef8e011ded0f087a15a0f88392d5539c39a51bac59d5bff89ae8f2776b4a495c82a9d36e69e2b1e92dfd29836306c7541c99ce9dcde75561e90c4520a17fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5944096405f2f83b3eecdb568808994d6
SHA1ebfb14f48b90484ebfdb6f0475472eb756811324
SHA25696f3c1de2387abaf666d45bcf0937c913890d24ed32892e24dcaf30f4fceda3a
SHA512760b7c3d41f5cfb286297cce63d0153c13903f435cab62e26a0baf5b1a944992af569a5f2affde14f2fa9858e0a845dc49c607a890b05f37d40953b213066a27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c3ae3b5ce5ac5f618dd6feb4d1bd897
SHA1b1dac75d91e8476c4219cb457549efd5db9a3af2
SHA256bdda6c72bf0f7cbff0616f53c6b947c83f524e08dd1f0ce0913b0cff003132ff
SHA512636a29b7c09ab47935b4c4bdef2bad4a51cbafea281ad3f3c6969f1e5746b4eb68ce0e4327352a9957220d9e0109c6a5e704a6af0ebf3d0fba964146edaddbb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570e38004710a43ad654f828752f33ecd
SHA1ed324673091facf38fde8f3be031d79d8d32052f
SHA256c7dca81a8b047a12d47a74881bc756811592c30e0a2f35183dd6a8afc647117f
SHA512a40959f2c33439566ab5b25330e840597d37a16f2b2f52b9dac5ddcc7ffddb110431c051eb223abd8972fe3f94dd964d1aab2c4001dc58522d8784889fcdf7f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4e9aff20e6ecca2d7324dab0e6b6c09
SHA18b2cb5072bcc203e0690cb6cf320994c40fad413
SHA256e521efbb9b65481be946be29e696c4a00065bc533b8978ab79c874dc8f645a60
SHA512b5b38d0428672ca390f77e80179fccc222ae97258ef43823011bed87b1f6965e662beac4671cabd484c69bda516efbaaa18fffec695661bc9529952629416f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc43b9e18d14458e3c3a922dbb6395dd
SHA155f6e3945360e5d6e4384dff17ab8957cd1ff48e
SHA256a093bb98149ad38425f4ab4eb50c3fa8369611d6497450777d48cb35f16b43c2
SHA5122db81c1229172e4d7d25796537fa032d11d4d58f40f0a0ac1ff1ab627a8bb1f3e85da25eb80fe3c863e8a6f4ad065035e1d540fa9bddc1c4016bfad6b89fd84a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573517b2b5fe52b31d29dc2a00f8f94dd
SHA14f2b993f41e42092b0234f31158cf4711a971f8f
SHA2560ffc3844d0457ff71b59b45e170a4efaf193c9f887baf44ec36194a3f2769ef6
SHA512235e78a87e53193141478cd357f0ea339ec28978bc048b6c37520b76abb362c1604bafff4b7b57938bb7df99dcad8ca9ba32031f3d4eeb8cce892969a7103efc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b