Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
-
Size
833B
-
MD5
87e5898764cb4f0409421b032af228fb
-
SHA1
7353dce2b05c0c49896255d019265633af4fc8e7
-
SHA256
34978cd52fbfe0947e967a9851b74ec4b743252649f65fa61297cbfdede002f6
-
SHA512
db5edde83b5103a31aa91c1cdff74e82fe542b97a3f79a072e4052d8c45c4e7055bc93e253ddafbbe6403d84e977245fab7337b946f35e73bd9e8bf80504b4e6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99E31EB1-5766-11EF-B8DF-E649859EC46C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000053d457663a8f6a92b20277a648c813b44247e2906177c70f4ecf060a2b24b42c000000000e8000000002000020000000e27a28afcf354b61f7731940aa6b4c4c6edc413613d99f87cb3c8e745cafe14d2000000094028a16fb34a74980547bbd9022fabd6a99610709f5e443a43391f9ea9d04004000000042b43f757bbe7ff84c4e350a75b8adbd25f05d77743983dee742c26a80b547730c383bd76d604af20bcc9ad0ca59f793efbe74dbd59a72434c762bb95c1e7cef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429490234" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40780b6f73ebda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008fcfec0915c84cab4aa5dfa91555234add0e49eb80b7c53786016017fe514a85000000000e80000000020000200000004f0552ec7d7be4de955b0e020408cec32fb430fd6f793bcf3bee24fd6793a03290000000b3e7d68bac085c435c7ca52519835c86f012215a4263e69538ff3bbf41b64bc018065117e91822fa88fdfef2d6812b56e65f09d5372574ef8ef2e59b86a54b2a838747e24476653478cafd637eb66d14b7fd969931318e474abc1b9228ebfb4d054d648e3cbbc59f8b2e72d1a56ca15f550aff8754635866866e29b97e701b87799e21090115119790c70f84a3de435340000000d21a648b03e8cec8d716e5f57561ab696dc414bdbba6b44cb46d4317ec9130a888b0cc7fe23376b12c6d68d0cc8ccb0294ce7871643d4661b46bf5af8570b26d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1944 iexplore.exe 1944 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2016 1944 iexplore.exe 29 PID 1944 wrote to memory of 2016 1944 iexplore.exe 29 PID 1944 wrote to memory of 2016 1944 iexplore.exe 29 PID 1944 wrote to memory of 2016 1944 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87e5898764cb4f0409421b032af228fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5796b7d57fb0eff1ba6c888e7cb324b26
SHA1ba4247452ba58bceab4fa4f3546e9f6fc193feaa
SHA256cdbc1f03735013e9de025f7b5c5873ceace8629068299b6d95ce5aaed4a7147e
SHA51254421596fb7d180827118b4cf3fb96014c99999c87db668efc85ea67e7488ebc53e8468b32d2a6b5861d12fdc1870ce9d4b4f1fba885f7f631bbc4d970e34980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56551405b115bb874d06ad8ee66903083
SHA1bcbd044046bd45fc16203fb5c88b7c10a951c5b1
SHA25682d68cf34cd6b9b678abc94d7fa9ce49fdc13b56a35a2fd929dbcb5d25dbf4b9
SHA51226402d0f5d48ded205f71c212ae913910546081c7f49d0666fdf0367755aaace041c0ca71178fc399fba2c34504a7d34f3e452c4d09f8ec4507f2f0fc1669058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7ac4b3efe502b6e51cbdea565966579
SHA19fd7ba8fae5722c1d0f508411d286ee4972df394
SHA256f9d067e0285930b96a814f38c09b4704fc2f54674638de970982f69e22c44c56
SHA5121bd961778ecf056da34c0a4401e53b7a42d5a35a912724c698eb409de9ed410bbaa26321cfbc6259de1657867d97f9a16eb61c75498d462f16cbb58aa703d1a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a40b6545fc1bef6b09ccc4840cbc4e59
SHA16231961444361ec4477f1e844d8da016c80e8ec9
SHA256e80baf2ab97ae9816b20d68d450a578b696ed918e77b547939893689b4e374a4
SHA512495cd4de5995373ed85fc46608b2b33d688363fd789665a03f51a61a8d70f66f47893069ba483911a471db18315a87c16fd453ed3eab5ef3136d764e37b9e4b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bb0f45334a890ce321484b8060ee708
SHA1c370e83cc4e61e140372705999ab12fdcb95a570
SHA25687a24140a48a2f6881a7ce9d438de86dab2630179550f13f64e16ffb6c2a10b0
SHA512f84c8736b0e83b87772b8b933bf297a9de1dd74ccfd4aa781f937f404db3dcbd21b0178b7053b7cd24ff70e898ba0cd7f18b8b906dc0d618c498b8fb1c82628b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2c5f9f5d44a407aa0d557ecf9b356e9
SHA1b235cac9ff3099b4b6d21755b98722a9a73861a2
SHA2566f2bd9d34ef5f53320db1ac8ab08f2ab78695213e1372b93e27bf67acd66bc89
SHA51261df56999c8a7d908d72f63ba5a214bdfd6f76af71c7731d3c70858e2345591c4806cb3e8f4ef4c5a9c2f6bd8d9833aea191f352aaadc20503c49c21e6b43c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c30d5438040842c01d2b9d6c071ee0e
SHA14f8ed15af147898f280888af464e1aad2bf55aa8
SHA256cf5e8fa495b643124332f53571e422e38724ffef5e1202708fc71c8c3517e502
SHA51243e4c200a11c24f355e9b77259d164c4e044784111a9028e9648cf21dac0d0071cc61d96d059e0ab982e8f03fa9489800198d25575a6b9e2770a2ec6f3077063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c97968da2407d385335a54406232a753
SHA159c6efc70020a3831867e3ce5f2d5b0220cf68ed
SHA256ac9863feddbca299249d0b7388bd8608a0baad95a168108fd313047fdfc3de50
SHA512903144109b69c6d3c6512e10c7b624ba660bc1e20926bfed089b8f941533ac4dc41e6b7aec42a313c49fe594f4606d2ca6c4450d61e20a50f4428880a80416e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a93d83c4ff69f7af268fcf1694b46d
SHA16fc0d49fb8e83fb0b8c976159bfaf7646db7db85
SHA256cc18ef889945142c63e00a6f7353d642baf6aa6cdc5d27742335bc7bc520af45
SHA5123e11d16d644e36d001ff8f205ead534cde999f987fa174c893daf2587765579d51ee2d1027431bc23143f74b16dd5131a2fe7278d7f82cb22233110d2d2a0e8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af77be5c940aa3e8daa04505e7b7494f
SHA11673281f47a022be079c46f42e64deae547392a3
SHA2567ab9c3bc10acab33b0a483a4a69612b343085ffcf9cd5ad7917b23e63d549f5a
SHA512a566b326d11f94aeab04aea3c1aaf2611dbd927e37e5781dc9dce51c578ebabc5aadbbf326763aeb8e25c199a98cecc1a38ba63bfd0d80100660dcdb96367f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e7364ed40183ecf58ef82bf6ee904c3
SHA1a0685dc8592828e4ce61420208887a2835df6444
SHA256dad8b0dce1290e2fa0c3aa6b6edf42852570ec828f6901016bdf475e03810a1f
SHA512271f47298af139784f2fa7e3cf1a5c179626610f968003d516160059c7654716bf262188cd7d6fb19c5b56bb319c9a2439b274784036a05765b57f50f7ef4e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580ad227aa7089f2dd23dd77878e794c7
SHA11a7ce0bef0955356c38f183c8f065215d8b34142
SHA256f4b054747b9946a3dfc1e3ab90a8c84a79344adfc116b831efcfe10d87707d79
SHA5123d25ec80079ba6cde769991d7735e5921c247775d8f9a82cfae6f8748076d2781e56f6ccb16acde218ca83ab3a93094a223492bdd1f4ba9a98fb00cb89731f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512bf5787fae993358e044fecaa8ee169
SHA1adb8b962e56cc91d18286c554150db7166443b51
SHA2561e7bb7a674103920e390c2ab9ce5b0945ddac535f98cea4ba32b7b70acf0bd2a
SHA512cf0b65c4ff0abf13998e82041e47089e2736ff266ffd6eaa1234482403fa82782378eee2dd70c4c4002fceb659aedd4a27b3ddbbd90c4cfd9ab0f673cb4d769e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c39f024287d8b7678735fba6b6001e6
SHA123a8945f4c7849c23d412389d3e766aab9b96a33
SHA25695c89c0e83f0226df1b67a9f3441509510692a43c2fe791700c8ed7e64fb0666
SHA51241a3ad32bd6258c786bc7f9f98920e5b55c064cb635b382887af9c1757419a924c299bec8500f9493b9c6d7bbb539a16faf2d257af6ae88a77051c44d76ca836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca9faaa81533153834d474e05b0d2480
SHA151415868628e500b2929a069d4ca946bbf491bd4
SHA256f6ac0977539f02d4300c9faf438ebc4f389012785a90188890c839d7412e86b2
SHA512cb8bbfeef8f46405b1735b8fa01e858d3892680cc6e18d5a8e72144205be78881e522f336086c5e04286aa1570e893ce31e0516d829dcccf1e44e8586ff12597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b554c9a6b1adfeabac2a5f1c19c9bc67
SHA14836d1bd9396c43115035715d7b39b1ca665a77b
SHA2562636ecdd2a34ae27e6f15f24b5f9aa789fbf0406e24fcd0f0272fcb6201992bc
SHA512952071332a000d68addc678f10652472303e13a2fc8022002bf5fae6f9a10cb9d6ca3718781921a437d78e4f345c233639aaec840972f7a42691aea5c6604c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b11152f6558b61f3daee739825e17d0
SHA1ce4514825e1acc00f3b1d04c13aa5364ded11d80
SHA2569a070be427948bdbd345c378394c391829f2fdf2882b0bef54a83dfc61db8155
SHA512956fd9a3e1d8c4ea30c14c5d7525b2444a89bed7a790e8f65eac76246ebd1ceaf3236d90b96fe90db45056e16c5d0bc0466ec742234b0f8e43f4c65926acf79b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5414938d87229cfd4a2fdd0ca73567914
SHA1a614ec6ed286b36be3307d0c2c75760589f89a7c
SHA2565bb368c8b1c44901ce12b2a13ba894df930dde03f696de4e8383ccc47f3d7048
SHA5121bc018f9d0760aa6844067e8523bda4afde9ef0d62534a9df79993a7018a0bf166aa86495851318b419b9c48b6b562bb27a9d4f8c21ab475fe24b61216b3a7f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5733bcb1f21e5a242bc9f4fc491e2dc07
SHA17d61e76a052e7f5d1d5c8773fdd31f39d1177a21
SHA25630e395965b440287680f572872ef900bb94afd66205d7dcff1a0ce39174d4b3e
SHA51254b1a4a93a7e293a58646ad1035c8a663763d619be8bd5e5f295f252f99d19db4011e12cd8539c9bffdc0a80cd278db9d0c309e2a0ea9226f1963b50270ef885
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b