Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
853068fcfd9b2d6c0ee34e1c2ca41b1b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
853068fcfd9b2d6c0ee34e1c2ca41b1b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
853068fcfd9b2d6c0ee34e1c2ca41b1b_JaffaCakes118.html
-
Size
11KB
-
MD5
853068fcfd9b2d6c0ee34e1c2ca41b1b
-
SHA1
0b52206d020b1828f46c44c78d1e60ec5c7a0a0f
-
SHA256
c154fa606eca873a1e9f231768aa2ad61ae1735fe0446d5dac8eb03b16abc377
-
SHA512
c7aa5fbbf4ca9a21b3c9a34a9718d9c4e26725d96dcd19e919427746022448127d74fd6a2ff72864cc84ce123fa530a3c00f07167996d91977e374e8ae503358
-
SSDEEP
192:2VrlIsr032L8k/w1wvqLkZDBNknwdrPlT01amvLuBuLbdU8d:srlIcu2d/guDBNknwdrPlT0amzguLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429434995" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000d26474d8ecdd2a84efdbcbf65fe3396067e1ccd5f60d5ada201ac8f4d8e1a6f000000000e80000000020000200000001deada1ca8ac23dda1724040361cb9a4e78c3fb377ae48cc0f9fd986a4fb8eff20000000b076fdc483d6fef3de43e4f396527f2022ecbf292dc9dd53849eddd329478e5f40000000402e2e9e0b73d28fd119537e11cbc2224699d605d2195e63a9f5bb7dd71950174fbb87ec88f832f2199b2172b219645c869fe1e32b28766ba4911b28a5470e12 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD801581-56E5-11EF-BB9C-566676D6F1CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0434501f3eada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000005152e776e7b56566d04364a4d83eca3ca149db9ee222e08d8cf7cc803db3ce9f000000000e80000000020000200000004763d59a3333f24ae9763ad9f9d024fd5d15b56d26b0911b2dddadefa1eae2f59000000039b3a8608c58813c4d46485366ca3afd6c2b03d44b8ee2cb7b8dccbf6f0dc7179f84269e65471aae10ea85c9a86f3053a2a2099114e81842e7aff887a77b6d5b67910df112d0dedcd71ddfa9cff6e48b1d4fe8750d8a29ebbc77e747a4c28cec0b1fb98faa2a7622876c63551236ff47228220e07338151194f07d36f5a3457ff6fdd6b9baef2ac3984cbe471ce4639240000000d4d1a7b3111a05850fbc292a83b6ff9863fb34e3cc7bd2c6736932b98a62517ce45d1842e446c052d92ecf1e10e60f5051cf6d02a5852c720434a06bf8059b6a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2900 iexplore.exe 2900 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2404 2900 iexplore.exe 30 PID 2900 wrote to memory of 2404 2900 iexplore.exe 30 PID 2900 wrote to memory of 2404 2900 iexplore.exe 30 PID 2900 wrote to memory of 2404 2900 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\853068fcfd9b2d6c0ee34e1c2ca41b1b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cbefb87156ead06582ed3531917abe4d
SHA1798b733dd48c5ae786872eb1ed83706edaf48cc2
SHA256c510b42ed8044c6324ad6f9eb6ed0fa39ed137022c8bd113214e640cd4db4aaf
SHA51212f4e3ace52255878375bc2af02019e1d6d83d2d214d7976f3820cdb779895cb15ca2c96e4b8640288acee9113c7308830e64a2dad7c53814244f1b0dc8659cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ebbc2cc67e2c67a99b2e7d48ea1ca17c
SHA16dde556587b7731ee0ce20e98b0e6d0fc895c604
SHA25636fa0eb7aa6fa6b3bd22852bc4e4197d02d6ed9ce7c996100c99dc8834ba88ce
SHA512fcd7ab501a24da06cfe1f414706a7652e7db6e153f00ce9e6e44935b4bfad754c7c5f485be9138d2506e9255a6f73c7231f2a8d5e8d7c1e348d9b0a8e9c93a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aff4e2b64c966d50b5f3318a121efad3
SHA112b3f494b5877d44986b006e75dbd69cd91d0389
SHA25607e759324392d297b0cc80cd3897caddef2714ea64f264a03a958b4cbe3b2450
SHA51279fb898c2bc83e41ee2addc2f0e8d99e5ce2c2a657be14b1716e1387ef7d3cadca5b6028ee04331d5d7b64a3eeb7c0639a430aaeb03dd8cb08c0941b4a1fcbb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d7ddad9ab914a8b9f36216ee4d2412a
SHA1b8d2159283fae84b6aa24e143c796feb6b35847d
SHA256307f16776dd17e7748b41d6ef751e6cbac3354ea96127b211a42e040799dcb82
SHA512b77d25a556b2f645b085017419e89f39b1357472ead5e91d057c5f5b8b633c6c847cfd6978744469f24188d39a6e0af2a7d57c4a057665bf6c1317b8aaa649c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55e368d092565a11cda5275834073f871
SHA1bb0290c33e73a7f2276b1bd6d31f2e26e1ce12f6
SHA256c844c6e901c94d3a53254b590f8b22a29d6fd0ea67bd01680c7901269284ec92
SHA512a41045943901b5037f327ab66921efb2f5a8dcfe54d84dd0eaeff290af87c7ac879957661e87910bf4b276b426d3565cfde8e408b99ef0b112c7bebce6e93a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57c93ee209a9dc376e3e6690824bd3101
SHA16b63eca824699b4b8596d34e44f1038daae33809
SHA2566b72e32cb31a9d0d205b3d71ea0da0137785238d478808518e3ba57a3f90ea8e
SHA51252820b4ea8681595be182d7f6996f125571c9d33575756fb743936727b9041896012a9c282137a41d81df52dacfa29a8c098af522e60b05d37c58aeda176baba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5426576b70458713216ff06edda380684
SHA1617a9a36a94d839100ade30cd09778575ef7123e
SHA256e5b2254e8c68175a1c66798e70a9237751fe934c979ff744d21b94830c6fed30
SHA512a0005efc0c73d6051f8b9633b4d70e05a1386fac5033d80291966a6c5972c00d0582483035db7051f4e135a3e618bfda0f083dff1fba4ba0712667d6d950fbd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5336fa920333a3692f3b657cb70cbbbe5
SHA19f6c7c923e0de1277295b8ea2165cdc7ed7e6c5a
SHA2565045a1ad3939053f245e5aa677e3d141bdad36fbd5ff8544c3dbbf6ac9e6a1f7
SHA51278b4adeee7f003fb42603b7244009cda399c125a6e71ca26df2f36267dfe6c0f205cfa6727e54d015f795250e14987cb1fbaab841b5805b70806ddd5d3fc679d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ddf911b816e9316e350fede9f1a95b7
SHA1cf268cc2385fb5d012d460bcbbcf736e58994361
SHA25622d0d149b05794a8b5a81e063aaa8eb94b7c6ac992ebcee2dba2b9edb8c5c29d
SHA512cff668f7c7b4117f0dfd864523c944f87679a1b130b990a369939b8f65c13cce2a712718d0c6fadebe02a64c6ac96746fd85ce805d6b1fe60e86e8d6cc77d1ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD593d7f2d4a60c88a30e317208c91cbd6c
SHA1a243bc594bef2252e68b1669fe48557b0d85a0ab
SHA256b49a4110043e9abd03f487a739e9e21e0b93a40fd128b983772bede880f65793
SHA5123718fed0c235e9e62dd77273fe6ab7eec8b43d31581a8d0842ccd47e42cac455452f73ace5592a80de9231f21fefc575fd0575e71cc94a22c0192ffeedceba5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ca2d426ad7f88f97b14262a20f7a683f
SHA1ec6ef37fe1abeca1674d1f94eb6cf81f6b58e1c6
SHA256c6f23ca01ab895db0b9c1e24875939050e209e71509a7dc7afe59c45637f359f
SHA512e35a62a556f45068df49e6c167defd597eebe0c15465637d383ab47dac704e5fca6e8e9d5303c21bba168b781db81f6bfce138ae86e9ebed39fffafb55126446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5286d8e4645ec0218698816ad86819bb3
SHA155c3e67db5adc761c2e3e74bc8451b4ffef63831
SHA256af97bf9eda5184409a53d10e45967c022064b3bc0e36c85e93ed9f4b3cecf0c8
SHA512910b0adbfa145649218aaa5ec73d10894bcccae260a6efda8d1bfdeccf7a42023b4d003e023aa23f2f21662fa002fd23bb3eb79c1e118d19b6329a67dc87ea83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50866b67e85e72a19ce1ed5b2634ae550
SHA14042ae602dc4929cea077eebf7e0848f27320d22
SHA2561192072aab4b4e4d4fbd12b7d9fa76c4af7ee55391d99bfb94d5620467a7055c
SHA512820dcdf9cc3b87242f162cd6011188d70d2ce0ae4ef24af70c9e34cb5e65c92f0dbc0571c0a2b59071019838b534d4e7a95b1602185eedec9050320e0238a611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59a72976aff01d96bdf23b780b8c7231c
SHA10b035de6108955f2212913e61ac8d9f8e56fe3fc
SHA25696fdd130d3d05dda4fd7739d23eb3bec9b4c1674a755d88c8328bca7222218a2
SHA512b2ecc93e7848f9b2fb303c4587bb496d35054580986c9da374ace131849201eb0f620b51161d2d60aedf89317ab1c245599465d96441b8044d435078d5b6ced3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5959fb42e1650f5f6fe15128cc7b9c287
SHA1050687f3764977654edea9007560ae134861762f
SHA256bd64e2503a6b81d0876267e016ef5aecd0f24a784a31986f86c6bd4526748f79
SHA51259f72ac844796f6f038351e7bfe106bcf4bae3b3df0a9895e09f5babe738d85d690f3794a03658b7652dc27d070b5e19609838c408ab21a872a07bfa824654f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD595daab482b725cf78a105e32fec55c48
SHA18000144066a94a83199313e101eb5081723e70b2
SHA2566a570b4d10de17d7b336ef9cc358e56a530763a1893fccacdbd0e4bf977dc427
SHA5120aff94605472fc1cb7938629c6520c50f94c4cae60b33e7979448a90de1e378bc847beef070c9451d7e6bc68e537e4b45eca9dee5670e66d37d4981e679a31d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5725e5744c6d350e4ab1ec0e573e893e0
SHA15d33e3cf31bc280db760d1c4a887f248af253051
SHA2563e2eb93c9892437d34e152ee1e308d7ca5a0b5dfb9fb315417316dd6f365836f
SHA512f348ffe817300c668f1ccf4f193083b0ce7613fd4cce2490e7596f55a9d5cb83e9b52a76f5aca883e05757d7637bd1524a1c1945a14ee9fa6c6d356631c3e1d3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b