Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 23:27
Static task
static1
Behavioral task
behavioral1
Sample
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
-
Size
2KB
-
MD5
822692e5cb959054233cc42a4c7a2cee
-
SHA1
1016ac21d3d7e35baa647d00c916815f4e0f59a2
-
SHA256
e915d87ffd8dbd867f9ac84fab000083f08291d5279d064d852d0d434c40e957
-
SHA512
8b4c8b129114f960a28f5770dfc000babe55e3ebf2a41213a43135b9f079ad4dd4b078ef07d210a06c57d39913d4435a39d2f79eed4a8934b5232d8994ba6258
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{932C2091-505D-11EF-B6C3-72D3501DAA0F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000004f13d0d57f0b255043b939d39de6f2ac93cc180ae03bb6aac0dd10f8dd72d968000000000e800000000200002000000031ffc9887c49ffdac955152d1fe447739c0f5f5636c6db6417006d645021962220000000838971a2d01972b951a4cece055dfdf99e4173844f7836d95a4fd04297353c3e40000000bda77ab22fd38961d3df486207bfd62527427af660d64592afe7a27919bb7324bf1c897ee957735fd746b6b287942aab73d1aa81598de5a46dc99c36c53d97c7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a043ac676ae4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000035a99d800d7f568b6a2c916701e0b0b28de7f6051dfb35ce13c51cbe5994db25000000000e8000000002000020000000295297065615c2505dcc046879d6abf2d13d0c635c88d759641ad011e1fdf15a90000000cd96492fdd86202cb7199eac3858b48a72625ca16183d99e664b824f97e282dd50886d915d0ef19086bb81fb57bc87e19143b4258a0925a12176e05131057a8676e22dae8b112cfbec5e304138a36e32fa32cbf3a945c1f04526d7b90b1cdd73ff346e39d919a747a053b6768c4dc060e9c21f5ae3871c4c7dd4438d2879c6b98a87d6ee48805c086ef1aa1177f12d2740000000ca8aff565cd1364ead83c738cea6f214dd79dc268f3eb28fc2176db07ae9818088afc99e86177cb2f1e0c23f82bb51bf2f890a66d802b25185f804ea43062300 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428716697" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31 PID 3056 wrote to memory of 2336 3056 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554404702a7469fdef478417af1e12aed
SHA1ab980a73354d6028745a8f01871f0f8da71073d4
SHA25673d8cc2290bacf8df80367685bce93f6c07b914212eb9d05de0a19c4df502b92
SHA51207a073a8ce16d60894663889c1270406ea9670fe90a5fb1a6dd41b72eb344491b621dd9badd64947861b09b9f207ef861653dab964eb8c540678bd12425d019b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574299c2704170a095c649338663ff1e9
SHA1752f49b9801050d1bcb70c84e6ccefcaded5fc3b
SHA256e219297f8ebfe4176f03f587e09ee8c9ad9385b61e8484ee471c39949273403c
SHA5122f656ba56aba628765cde963672d211567ef592a0925ecd9f74037b77d87c9ed2af86cf8e659d1d013036743fb2a35cb231c98ef65196c4be52d5d50b8a6be2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181f82af2d54ce76367211f9218be1d9
SHA157fb0e9e3a260014b1442bacf8eb70c0836b51cd
SHA256149bda4a4a0b48151c32d4ce63c52df8c865d26467df87bb24b781feedf56430
SHA5123b3694089926526388ff31b04b7183e30f4f2fae53b324a903f9b02aec9537eb00e1ba6168ec2f9fbc9fcd3736ba1867d900b60d30bdec4d96d831d45f8f3e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5644370715033430029ca58445cf5e7af
SHA1fcf44a49438fd97452d263a24718ab6d5e1e4c49
SHA2566388de5d21cdd431ba70dd873d1fbd6543384d05a506393687e65ef6167f596d
SHA5129d75e5a85cb40ca3869ccef9f120e7779eb8ce8a23b70746d8e8deb50e43935bcc178ff999c8772f8fa2d883fed74f3d0bcdc42f08840fad16c5c514219085c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a0fe409d18d71ea1dbeac14993c57b4
SHA1e2d5a3e914620b5a723d29d94ee3c9142aaf236c
SHA2566fd1903858938738611d08176c759cecc7b68e7cd24690d05d4de9c79e3886a2
SHA512247137961098e324f0a003d7b1f1f609a5c01534271a7fbb5a4d5e36cf49e2dc4b8f1eaf48985b30530eaa828ba41febdca68bed916fd4c75fbe550946c7584d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1de63dcf886cd912a917612d32bb07f
SHA16814bf5710bb1912c4bc2edbd560ba53f109cdf9
SHA256582794260aa298c8131faf9f7a5baf916cd10070ac84670608b5f3e266bbbdff
SHA5125bb65684e1be952c7183e696eb75d7b01d3ecf46be8358fee574091144b9879c40b4960b0170bcf7708d771549750dc2af55523dae556e0cf37a5d844417265f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d23bf1ea1b90aacaea41b8a701b70b6d
SHA1553ef6ac38cf0a6481c51010bdeb2e6cd9add429
SHA256fc65aa3111394d8ea73735857c2c4fbda70219106d489fab2dff4e1332798370
SHA5122fef9c4c52b4101cd50e081f68a185082265aad6219bc93e909a3bdece991a94eb2de49d4922053310511a2a3a8518e7289b3d5bb432af7138ccca317d8fa148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be7c345ace06478a53f53fa3738493ae
SHA1d96257909d3717b457757eec81af5ff78ee956a6
SHA256cf5ebd8e0dc0f4b63fa9a45c9ea23c20e2e25b9c5fbf37ae9da82975b7d77c35
SHA512da346d3a6926ecaf2b35fb81cb74c14f0924b30bb238eddd4cff5837a06571053cc42f08cada3690e8a5d64eb1168b636fd578c292774f9714dffe4940b6e6d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd01011f6c8a3b7b9c7391b4b8535ec6
SHA191e7d9bbe2f1d7c9efcbc66d2bfec85c003bd30e
SHA256c17e194608374fbbac41744ed2702f0b14f5e1ab8761fc56a56867aa31a57ae5
SHA512c800a9f22e035d43c6699681883ca82db8a97156368f0284f58a6a59f944ef6c3bb60d2df3e5a702b6a73d6f7f90cd1af5103afd5076a54b35254348a0e6bcbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c014305f8a11429c081a58317f9853dd
SHA12bfe5f7ad47d1a2e3cb627a5adcc4c8c5998d8e1
SHA25621cab3921a0d21e5a86f6642f2e722cef42af58725f573b3bbbe6dc3a548b020
SHA512551b5a56a6760b09711b3b4252067d2b65a48df99cc3cd271391851aeb6d3e3a58440e760639d9935ae22f9f49971a3a6b2241ae7d28eb07b26d03879974fe08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb52ed5c39de16f348ea72fdc5dee05f
SHA16909d289549bfbcf64b1829fdd8744711c54aa95
SHA25632a6bb47dbdf9c54ea06cbf1807f98e986cf1f6c2b72646fe1c0fecd3d5998e7
SHA512b3a5381b2d7c9e3ee1777c46e6b24353cc4872df00d13c6fa199be51684ede20ee9b48a29206c8c42315206336aa2c1b56ead8fadfc9042c759f10c747c55c5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc17c95f6c4e18bc499fbb17e2970200
SHA109fa58b6a9bbbfe1bbc006a1445b2fcd971c810a
SHA256f2d26053d1ff06f916a16417940e1b97b845148cb01f30c46e756711affeb5cf
SHA5120c0f5d84fe14fc3073b04f3e5e1aa90a58fa3430aa321f5fc2d63dc780882c1d1149f7d4b22ae256eaf331c8f7d81b6d217f5e1f10c25b2ed30c26e9f731d11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54375245fb7c26e25c0da723e53183d86
SHA160ea2c33cb9ed14dcc6a3b2447ed350c839f4a95
SHA2561753aff841e716f72e78e408a72bafab3c88da16c46927fc7051fc6afef7d3cf
SHA512a145aed1f794c0e128f1c14837889a1a71f6e10aa8e300a551e72c6de30983441dfa188b56e0949cd89b6ab7de41b6f314222d9e7f3e1107050303c82f8c4918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e64dce48d3c30f971406e8f4cbf9597
SHA16b3fb4ab22fa56903877e53629cc545430dc8aa9
SHA2565d07fcd2b88835bd5220f3d2d512e0f070d9a25a79627823e566d9e67f13b05d
SHA512af677e21fb257f4369ae3157c80c138e8d645fb8fd1a97b277372233a8e960ccf91c64dc211105227c9daf6fe27587078755aa1eccfb40fef6afdf26e62923c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb1cfd28b014030fff80b902b149016b
SHA11b4db1e453ac1c1b31d85855d1656db44908e577
SHA256e4556790db1bf23468c79815a4c7521ae7d4e0cbc796da6d21d0357d4c5743b0
SHA51221dbb9ce03ea5f55c0407d9bee6365a808ed9b40fd44608eac6c45350d9256c4a13b17ef6f42070fd70e9fd76355a6e4affa9aee2302ba6a59bac223b0d13adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe4a7f203b9e729097ef933f2b52e8b3
SHA122e3c47fee3a401de62e050d41cf115a80f10570
SHA256bf1437861a1c0e11a483e639f631dbab557993cf848b925611f1091be0844982
SHA5120d1df3a730c5322f32d7041c692f5d7e69a98755195a6a5d362142fa39d6a8c6650fec1008e218ca68695390c682bd230ec626cb4a10f153de762d186bc40830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c362eb7b13e5515a6f9fb74e81a267
SHA124d2c2b2e5ac314c6c1dddbd61e80c3cf5237988
SHA2566d46123baf3afa961e2997276a470f9590911f4de14cf9c3107e8beeb24dfc7a
SHA5125d0df13851964b95ccabd75d80e94838fd2525ea3f8abe5e9012e3a2a09dc0349a7aea6e91b78d617cc573efe0e1f0efbebd05b1148e8763767e54239817eefb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b34be4a95edccf742bdca5efa0745c2
SHA11733f9273f622afd31a95823fba7e98b21ab2983
SHA2569f7bae696d3564ba3d887eabe2825cb91c5860c09a8fe511cd34895cd20720dc
SHA5125d21da9b2b7473915291b5a63cf29cc2d295e00c8423291448e50ca82f2978ba56381bb308699ecd9698f0fe3162c2da7a3cfea3fc77d6458b40c970c6678633
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f1cf02f805ccec90e6e26bded538ae9
SHA1e9c98f21b59268da9983a259f622930d954f41f5
SHA2565743a6c5502aa97bc3e021d7c950b6d02be314dae281343868b1170470e76ed0
SHA51234c39adb82db1ca1b68e48bf0796cafe14c17ab65ad6118cf08ecc77540a0a25d272d57cb04a946c8acd51022d4be02f21ea8e01fcb0088565630bd01315e4b9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b