Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
86d55f8a686e668e40cf34eb57a5b632_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
86d55f8a686e668e40cf34eb57a5b632_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
86d55f8a686e668e40cf34eb57a5b632_JaffaCakes118.html
-
Size
13KB
-
MD5
86d55f8a686e668e40cf34eb57a5b632
-
SHA1
aba8473d8b92c58c3279f2ef431fe39be969c976
-
SHA256
8f4938f507f7d8d4ba7dd111b6e5978804024f02a2c13d4ab1a659f233029aac
-
SHA512
9bdcf3fa74397317290782fa02950205fbcb041197e24e002f7e93edf121823d228094f023512f465f29b447eb4a87bc6c2b1ce118270b9295efcdf68bbd46be
-
SSDEEP
384:pUXs8jyGndereXGsaVBRdKS/vIWs97K4XkBCtDX+yeuT:ms8jy6IreXGsaVBRdKS/vakBCtwm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000d05b6901ed1ac9ed3c97c022f6b3c778f13a6e49229b211ca0d11bab51781aad000000000e80000000020000200000004a39e3cae840bc66632ac09d9765d4b8571f0fb1850ea4a0fe20fd5ce60df3cf20000000d0dad49ba0481999d33b2309dfdaa3b308bd3187cc900a5f97828c039a1aaecd40000000c47cfa373327603fd2a1fa33e03e722ea8f04b054ac113e80345ddcd3db00fc4e25be8c437e77137501a85b9e6933758b7dcb9c8515bf426f444ecac51216394 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c0ae8a2cd561a3370ccd4e7c6b7df4ce29d92d0fc6cde045e3f87b479424011d000000000e80000000020000200000006a115bc1ba93833178676178e6a61e9880508349179b080daec66cae122589b6900000004bcace08446fb9992eb7f0e9e5beb71872e4bf4827ba0e4e93265be1773c3516940ed10e6e22b8666c513e812f2121d7674798d0ff1eb37dc1852f77d32a92c4af88dd151083daeeb5fa7d6ef5b7eb77c21d5a4e30d1c3cb23a5aa126fd844e52c739eea01d8a930d0c8718f69e5dba4936b69206b583fac6a6de353fac105100c16fd3cb437c9d37e2450550f8aea01400000008ad65e189574875ec969fd27b21834d01ddf7f510584d0e58f68a21f17a611abb88b22394861cb29da37d52d87942eaccc44e31db6bfa94f75f633ddbb309598 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF1B4901-5736-11EF-8650-76B5B9884319} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b027a9c343ebda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429469760" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86d55f8a686e668e40cf34eb57a5b632_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50447633e0cb7ceade3a444a1bbfbd840
SHA110952dcd562fb2636f3d66581e6b48358f2270b8
SHA25622a93c5c6fd8a2e6181078538f2932b54ed7377fe46c66d0377b73fd47db66c7
SHA512f9a62f3b8138cc3ce327f7fa34a208b926396d89a5a64125932d7e813e2c3becac4cb225b579a5f6fdaad3fdaa895f7cc60308ec5cbf0b8bce14af92236e693b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5935bbd4a51e3ef7b0c9d6adf5f24ce
SHA13ea16b71ae429f1c43732ff47f984f1630536524
SHA2562cf1ab71f66126452dc4d3c8e343274b55bc0d4eac6bca160f4bf84ac403c694
SHA512d123c025f4cf312f2e290b3f9085432401e5ce6de2a7b781316d14f9e8c9146157967401cec4c64a82a1f7a792e0bebb8b49ed6f0fcbd78de6246cddcd9cb505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5633c3c12359f5420171f8f24f51f79df
SHA1d41ec6fdc4df2c4858b216127ddea76ca200316f
SHA2564eaba2f724e1af5b2681d6f087706ee7f7d2a370e6f7022276aba57ed7d7d01a
SHA51244861eb0f6105569b30d6bb0119016e3a028a9c3173ab7f18a975a05a15bfa123ac9a33f01a6ee9678c7e1564515693427b1f5456c128d9ec3347cca39e9da28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5505794b403d5587a36ca16aba3471ff9
SHA178a300bcc321fc38f7435cd27871f6e3dc4fadd3
SHA2569003df69b6f33f7e78d6ea458b11f8b05b390a87cbbfe524fbd5482658c1308d
SHA512c72124f43fa1dee21369a4b5632dca624a7e75ff64db4806d415bed307b4910d5d1a9b977f25ad0b0d5b1e155e257a74c2ce46927339edc128c61be495b42296
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed15691a66539c571085039d749328ae
SHA129b4a71d89bc4bdde9fd3bbca4fe36d1100c6557
SHA25651a24544c9978b54fb0fd0811d4ed5d1d62d858d32178e1f140b4004cd283af4
SHA5127f8d5460d2ba95b50ba8dd302c8bad4a179d21fc3d7b293e38cbde009a873b095a8b7ea44ec6940c79e996cd69827f66299b8d60f1681abd2d7718c27227e313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565f600ad98d43a215f992570e1201e65
SHA1119edbdb20e33dc15f3d1417fdb2544e190e1c52
SHA256a948785fcd18b7140e2575a91b27435b9b51cacf79833e662dee4ea69daa624a
SHA51227fc5e9b658171ca9bde24d964daaca03cc126b12e4d23dbbed051307a3dd573f8e66e41f882f688527714dc8be8be5d8f51e7186069bb89a48187e3b79d5498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e6d53ecb7c4146eb2e47d7c7eaab9be
SHA1925fe09783e7b048f3a65ff59f17cee5aea7aac1
SHA25610978a32c22da223f5a249854a1d0c49068b856a614f5658dc744415b5ff74fa
SHA512a1d09e68c716ea8e363313db683f0fbdd88b124a587f66765f6372b310d76d68450582037c132a3c788662bc446ece442de27a27519e56348e0c20cf843fcc6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c3ea7cc294e82c19da9f1d2e470a9e7
SHA1dea76d87757f09b8383c1c8d999234b85db71009
SHA25614744cb1d30309e5750e7aab26292e815c2a1e24ea940ec049aa532282848c52
SHA512cf240add536d1884c05a24b09d73876c84770f9131b9c984d3c8a307b6ec90a6374225bc7342fa7a7fc96568fa4330ee83e73d84e1785d26bb2a25397cf0cacf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531d78cef258a7ba8380a65b429a88445
SHA1f82d771eb864d7f6ca1b95efbe901df31fcef210
SHA2565b18590bfec8f665a392dcd73b3b2c3b9a9d990fdd94fa1ab1de4b0e0e011932
SHA512e2a1cb875f475f8e6cdd26ba310439d2ea4203a53ea7174cd1951a7dcf1ec3ca46df81c42f23edcb14c66d80a4ea4da29df1c0772b1858024c3fd5985ae9bbc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507e47fa9faa2603df4eb48cefb4297ea
SHA1aaf005e74c23602f524fadfa99e052d89192a1db
SHA256ea9595d4c04399ebd3133f36cd38a18b4f69ce1afd6ab7f117169e4c4c681597
SHA5129d5c70b503c6a22648bf019ccdf257b47df15f3872ab54e29697a15a64d2d5145ae9914e3afd70e399cf3d6af6c8ecf945805cd559763a96a17da868d75fd30d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5889e6c206d8d95d1ab5534a07ce12df9
SHA13191ae8af4a442dd22e9e24307666972caa7a602
SHA2564e6bfd684ee6290fd8b2cca7bfd3b245197dfbe75053eacd8a74062c1a39d6d5
SHA512857063bc9a76177601a6461bb842bfd287ed1e6dd410735646f84deb41797ccc626e040f902cd7c65141c24998083222442edb2b252753d0ce9de29c04219b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bf957d6ec785ec2d1b5fc8aca39d24a
SHA184b8a6575d753c039675737f13510eeb07a0029f
SHA256bab8ff9850fcc1dce2935a2d6bc4a88c60cb7fecae86b5cca9c26336c4120d3b
SHA51276246fca3512aa27f86e573bd0e219b98a1bfda7ca16e43fb591f53f95010623512b474954c403451a836200cf76991888b66548c68342ff281f6fc28b34e973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545a14ac35562ccbf3f4f024ce8355b66
SHA14d2b0a2e54ed8ff2d5551249dffca583c76bb304
SHA2566f6914e5b3b46a9f7f22f04197fbe5c82b68d574e961ed53bd73e6b7914d1cda
SHA5127e4752b83b4b3ab9a08e7d67b7d76931b3a4062ea0b508c2746975b86cc94bea78e1e9fbd108abbf9bc5495be7d8771ca09e3d2ca0cec9fbd8ca8f55cab9c106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5896b68f166f2b460987eb948349c28bb
SHA1a51431711fc7b3676df12f63bc1f269d4b7b3dc3
SHA2566887a4e29e85a12a28b697a66ec8d6ef67563581bc6b3834599293cdb2ac1fd0
SHA512724c2bb329be3676ffb65452640bd9fa1cf73dc2ea10b6048222c0cd31c323513d95fcb8bc132fed819ea3aeef0a405ff78eec22e88680eaa47e9e445ba21dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580aae9bc1cd0303c44f1914d3840db90
SHA11ed4205ed8288ce3a5139b8cb45a3b30ee53f7ca
SHA25610fe2e94fba712fe3f7ffe4d145fd8c3e71d2d16ead6cf99b1f15381540f9c26
SHA5128e65ff442d73657e50850e28aadc243cd01bbd0d680322654c14636fd1d9b0349b1e78a12db679ee62cfde8b94008fcbd4c72e74d7dcee4f7bd9cc48309d07fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53170b81c54c00ded8e5641d7e92cc5b2
SHA1f74a92d387b8db7277401aaa8a8911ff0cc43dcf
SHA256fb52feea07cfc9689f332d28845d76b16bb6d41bee2183ef87341e509083b5a8
SHA5126d8df8c826eeca111f52d0355111fe77998d68a68648fe126ff6a7d6213eebcaffc181bd1cf66020723ede974c563b78fc034d30ba8a1139d11440a4ef44f2bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5188b32715386d0cd725a8f6a085b6891
SHA14e525a75fc4ca5a27dee0d50e2e97014fa30d414
SHA256345c9c4c903e2e8c2a373beb279e7c2c73ef67f8a5266c39a6db67b5aabfc6fd
SHA51299fdd33653306597b25d13b52048acc002c2d09628125fdab6cc0ab7fc83fa2317bc644d60a1f9570bc74459cce2ffcc73725ffd6bdba67a43962dda3b230d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527eaa1818abbec2b40d5fd62d97cf1f1
SHA1b84e5948148857fc1ea1dcc5f950b620bd0b5b6b
SHA2567c52fa1855ebc0aa121b95e6959197768ee56d2e98eee394f77499b80a97d485
SHA5128ce235cef046d63dd7ab059ac9a68b169d59bc960f22f9e8a90bd7c9d006cf1216a95929ce3a53a4bc3bf4f5b3f641a56ce7fb18f48c69af6af91ab77dc94a12
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b