Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
887731b0fae5c313d2344e3756099212_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
887731b0fae5c313d2344e3756099212_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
887731b0fae5c313d2344e3756099212_JaffaCakes118.html
-
Size
6KB
-
MD5
887731b0fae5c313d2344e3756099212
-
SHA1
1020cefb0eb7647a849a9531a955da3ea42ea472
-
SHA256
33366f874c5df575de2a7f86e46a2d9c2eb6ffbc687b07ddb1a6b28a59d82ed0
-
SHA512
2bbf48a8be279db704c903c1af36be50678ace83d2deaaab5e600b068747e45a5e20c672d833e615a603d3fa3056d34aedd7e8691f863736ce91bdc5cea2c5bc
-
SSDEEP
96:uzVs+ux7u8LLY1k9o84d12ef7CSTU/ZcEZ7ru7f:csz7u8AYS/ab76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429501697" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003ddc10ea2f9c204eadfdcd864106f274f07ba45b2c3aaaba896ecff617167428000000000e8000000002000020000000da334efa97e459d1992e087a01f00f3e028e27032ae152590baecbaf360529af20000000f25bab0830c41120ef48295aba3a6487769f060e138e47117e804346f871021040000000c69c57b5ad2f8685c68e145e16287b6c60c78c8d63ad33ba0acc661df97151fd9edfc4be05f0ed8afafc087c3b2ecf4204e02302a0889730a454b2e3a1e00117 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000048a9d025f2721839f7d62bef72d09016ed9d9de33f9350a4d525b74cc30f1690000000000e8000000002000020000000aa42a0dba2fd296ce2f457e26c64f49395067052a21ebebd0d616cc7226bfacc90000000463e1a8b84f2311c59584e7f65912729a3e84fc6b608c4f344ec27934b4db956da2ef2de18ae6c0ee0f1c63d8ad11ce3d831caa5a9c7a31bf40723dae3c804dfe4123a404995d754aa95092750a43a3046be578dbcb8fad4c5fda5da68296168f057761a76830f03b72d7e20bc1e674d4ed2dbd281b00d9eefdb9e3299efaf053476ea19fad00852a7c7cf2ba48da6524000000034c8e1823c7e4c1f530fd6f3eac25ccc059ec88e47092e75bb9892a0b57470b81714e86801e4d19270df08d2abdee6d029e63a6465d211e483bd84a19737dd20 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B07E8F1-5781-11EF-BDF4-FEF21B3B37D6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08667208eebda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2976 2852 iexplore.exe 30 PID 2852 wrote to memory of 2976 2852 iexplore.exe 30 PID 2852 wrote to memory of 2976 2852 iexplore.exe 30 PID 2852 wrote to memory of 2976 2852 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\887731b0fae5c313d2344e3756099212_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2daeee0dbe3cb54118129ae09e0b74b
SHA1f58926159a27bbedde0d470665ba784f6812c835
SHA2567e72a9f71fdd1287573edb032d2a47076f7615811b046f00fa223600314b3bfa
SHA512901b05921ad0769a6fc9a5875cf248d2a32fb2134084c05d51e48b583107ee63cacd02bbc011977f49c038b4fc2f5485981e60bedbce55cf91e7335abb702603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520efdfaf7326f2cfbdb51dbc70777132
SHA1d6c22175cb7aaeb1f991a41941715a0ea98c757d
SHA256c1e66c38a81317425cd1d92276f81ca4a70cefe8f1ce075d98ae4fa7361389bf
SHA5126be5deffa88d26a541d7c3283be3b4029d8a4ec78e77d024d88680f7e74661d04cd6c72de724ca2784b8df4503aaeaa2b63960eda761c5743c03fade21781adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f4cbc60437d366ff47ff6f76d424567
SHA161246721776847d1513460fd7badce33b1856af9
SHA2567c8fe2c1eab655a49a6a98286179ee5bf1b89fb9058f4d7ae3a9a9dfc012f841
SHA512382457c02a222107e1bd8432618af0e8f12d03f6a095c0c20f0625d0393db83384daf6fde030b705f2c496b794ac5f8c5164fbde4e3d43a4f37171453f85571f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a8008d981f842933a73965ad88640fb
SHA1666743c9c719b9e79b38a320d433ed81454660e1
SHA256fa614d7ee1f5be66d8bc303b9a4048d97f3a96e4093ef24df52119c8e1e6282c
SHA5122fa8289d57a9dfee099bba990d94075a6211edd7de585cbcb449c5dfc3d203de03ba3d6d0d513dc2dfadf7b39411c06e86d01afe7e2f391a2f4ce18964d9c790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5eb9e2c08b8c195cf9572ccb821dc09
SHA135ea8a42cdc9d44e83d5409088554ee6bcc20ab6
SHA2569359dd5b250a629d4c693f1674897e364b9efc2202cfec2c3eaaf718c52c7aa1
SHA512bd601e3b0f7e895339aca6f77404698a0d62e747d88e31266499997a15fa9d43c2311789772e84cd9583207efd4b180157c0a61ef616b9349839f1b0f9ea1603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b12718934034e9bb3d858db9014ca06
SHA1128004c91b8dfb44a903f1bcf5cdf468b8af982a
SHA2563e507f5e1f67f3b53b3b026bb9794afb279e44779d1a3cabff8acec2b0f53af0
SHA5127ba5085f975e6fa4fb0edfe9ef6e8f385077eb6206ced6cc05d7f20db79abc27748ca28d027386b2d03d2cf0af79172ad52888256990d3f8b0b1bd25e7228135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c86af3bfa980f391de495c282fae8504
SHA1d918d1a3feebffba7785c01bbbffe62cf177ebd7
SHA25691a81b64837d90248ef406b77155c14b69ac5ee0fe2aefdb2278781d8d8f2d1e
SHA51242061780e2a364ae9b41d923910e8c211f819120f91918a6dc14117bcf23aed3bb241de58798ea81a028ba8bb9859c300fe002dde760254573c434d31b190541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d43a52926f450d538ce76ba76065b933
SHA1fad2ed6c01b27b7f0e1ec8c1e8d5f9ac4e453ab5
SHA256dc4f646b016d44bffb1cb446c1184232c9ca9609ad7552002a519e1e34e4ca3c
SHA5121a5cceb42ac43b3acb9a383ebaef3df7b8bda9d508ebc0f54d13a8088de03168b51e3a2e2682c87aab3b89f1321f1594573c8b0c5f35a6e5452f1062dfa29696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5190e63dda5fa9c3be2c122cc81024ec4
SHA102c419cb870acd521ce377c76031ac9f1cc4c002
SHA25672adbb7b80ba8de0d4b6b8bafd35e1406b46ea0c9dd81b1268e9e012ee05eeca
SHA512114961df4df4feffc586fee504476e3447eadc735e912139a723afe6e78aeadb4e873d27100f5e4fb533edda54128c4b1b484bb111797cb2ed5e4afad9608309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d919ce6949acb93c909fa4fec8037bb
SHA1a292c85bcabc3383dcd2fe93e40ef0f6c21ffbae
SHA25695ea420b0debd2dd5e43c19b05b4b03a2bb3efdf3f68a9aa791ba35f556cb1af
SHA5127b3a7fb9af4159d98d2a09553d78a00daa7c450caaf2ee26c44dd38ba021fc2a58feaae76caea0acc1cd3bb317db49abc229f533a25bb10bc03bef152337b37a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0eda5b604048365969af8f3d24f1668
SHA10bca2ff7dc05d6fdb02f772e71be42a69bca8eaa
SHA2567ef96af73df179271e7bb3a6e31ffb0ecf7286d47aac980ac822c51a8c624680
SHA51254156f5d59686d19ffb72126f0152a2193040c47634120b0ef2d010ccc6465c712c8ff27ff78689b9ab313b78f98304cb27764eaa6788bcdd521a75bd6dfdfce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa35af0fb8ed21e22cb55d1cf28c1d3c
SHA1a950d544ec8bd01d1f52cd65a63d3334b4096d85
SHA256c4568f267fe54be3571845e3e35d232d1637aa33240db5ee55430a9eeec98fc2
SHA512a15cf10051853fafe827360a81e112ce4f9a35484d468542e1ad3711c7f8b791fe6efff5c19fcd9d8d273d6b5fbe026dbdfbcbedd53258aa2e3a4efeb8842c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa2f13fe6c0ddd7ff9e24c444955ba89
SHA179f0a9d94128d8510e31b6e2dc493480a6ad0226
SHA256ef7e5411f54d9bbf69eb3c4dc6e5fb5f33f0b4f502acbdd39579e48dbf1c74b3
SHA512a6377f70da7654a3d7ea91d875abcd493511de06ef35d1ea49d880971b4eed618024115fec638ba530009de463d913e128f9cad574f8c66ba1826a186704c6a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564ae42fe05923195a48899f1d8d03a0f
SHA11b7358afde59c92882086462361c94ed38f95d5a
SHA256606d9ded6853e85af2d6f110e7a9340e4a43e79f280349460f928ea7722f7ef6
SHA5121f683b3dbe62b3fa769a52254d8df7e36d6f0dc435cfe74bc07af86aea4cb3b9c32bc0456906e5b8bcb57420f109a793707a679edb71932a98b83675b9d9ff7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ef55a83d96c2976d653c892f0aaaec7
SHA1878d7c269fdd5d1ed84f5785e9a940bb7b68c90c
SHA25672dc009d0dfef8e7a04beef54af57b6af1555fdda9683dd035ad147a22ca0a93
SHA512c3af1a87eb56e547cd574bf7b9da1bccb0a35888f2f240d7bf4c92f716599c39590e07f88863bc434d313953533ce243b6552a0c4d1dc22cca513873897fc96a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5532ab939c19e5bf6024b663764a70977
SHA12b6853959859ed23e10e577a66e0f6a98e46e72d
SHA2565327d3a8f2abdd5c4bb30afef030089a7c96a2282559d407bbd76390eeb1924f
SHA51261269979882aa9f8822272b084d7535688f48a6044f8c9ee9b8101e1e41cfb4b67a6f219a827be0519f7247a525f7ad69b07e8012ed2b70a5cae3299c3d9a3ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576b6d2c6dbe5d28984d6306e232149e7
SHA19646537a371827bb1335c56e2b49af15711e0ea0
SHA25623573546699844ee7a96257ffeee32a586218297f528be7a3870d234462104de
SHA5122449c8652cde70242f15f0ba9bc30ab6144d08ba33939517008216534a7706253b82112076cb5a84c4af880fe6597b0f32b81841205d9e63204917bf15b5e09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5388f44c871c995095b91771abf5b542c
SHA1ee19d7c1bfdea27cedb2ea29b8f3e6b71c68aed0
SHA25627666385030c9457036eb499583262ddaf9976fc11bbfac704e0a23c690b0fb4
SHA512bb2a8b208a75bdd7c816b7b4453aad68c0525fd2e7e9ed6690873768720ec1f3d0d4d028a5baa41e4be717f3754eda5fab2d4add54591994db8a90f4dafedd51
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b